# Link-Wise Attack Observer for Switching Message Passing

- ID: 1555
- Canonical URL: https://synthcore.org/idea/1555/link-wise-attack-observer-for-switching-message-passing
- API JSON: https://synthcore.org/api/idea/1555.json
- API Markdown: https://synthcore.org/api/idea/1555.md
- Verification status: mech_ok_no_baseline
- Source: [arXiv:2607.28794](https://arxiv.org/abs/2607.28794)
- Category: dynamics
- Solves: stability, accuracy
- ML areas: graph-nn, transformer, moe-routing, training-dynamics
- Math tags: control-theory, dynamical-systems, linear-algebra, graph-theory
- Ratings: usefulness 8/10; difficulty 6/10; novelty 8/10

## Idea description

Add a low-dimensional dynamical observer to every graph-NN or mixture-of-experts communication link and estimate additive message corruption before aggregation. The observer is switched together with the network mode, such as changing adjacency, expert assignment, attention mask, or operating regime; the corrected message is the received message minus the estimated attack. This should remain effective against attacks with arbitrarily large amplitude if their temporal rate is bounded and the clean message dynamics are observable over a finite switching window.

## Mathematical statement

Let $x(t)$ denote a clean latent message or node state and let $z(t)$ denote an auxiliary attack state. For switching mode $r(t)\in\{1,\ldots,R\}$, define the augmented state $\chi=[z^\top,x^\top,\hat a^\top]^\top$ with dynamics $\dot\chi=\mathcal A_{r(t)}\chi+\mathcal B_{r(t)}u+D\nu$, where $u$ is the clean upstream message, $\nu$ is a bounded attack-driving input, and the received observation is $y=\mathcal C_{r(t)}\chi$. The required finite-window observability condition is $W_o(t,T_o)=\int_t^{t+T_o}\Phi_{\mathcal A}(s,t)^\top\mathcal C_{r(s)}^\top\mathcal C_{r(s)}\Phi_{\mathcal A}(s,t)\,ds\succeq\beta_o I$ for every time $t$, with $T_o>0$, $\beta_o>0$, and $\Phi_{\mathcal A}$ the homogeneous switched transition matrix. In discrete neural-network time, use $\hat\chi_{k+1}=A_{r_k}\hat\chi_k+B_{r_k}u_k+L_{r_k}(y_k-C_{r_k}\hat\chi_k)$ and corrected message $\tilde y_k=y_k-H\hat\chi_k$, where $H$ selects the attack estimate. If the attack follows $a_{k+1}=a_k+d_k$ with $\|d_k\|\leq\bar d$ and the switched observer error matrices $F_r=A_r-L_rC_r$ are uniformly exponentially stable, then the asymptotic residual obeys $\limsup_{k\to\infty}\|a_k-\hat a_k\|\leq c_L\bar d$, where $c_L$ depends on observer gains and mode switching but not on the attack amplitude.

## Key formulas

- $$\dot{\chi}=\mathcal A_{\rho(t)}\chi+\mathcal B_{\rho(t)}\bar{x}^{*}+D\nu,\qquad y^{z*}=\mathcal C_{\rho(t)}\chi.$$
- $$W_o(t,T_o)=\int_t^{t+T_o}\Phi_{\mathcal A}(s,t)^{\top}\mathcal C_{\rho(s)}^{\top}\mathcal C_{\rho(s)}\Phi_{\mathcal A}(s,t)\,ds\succeq\beta_o I.$$
- $$\hat\chi_{k+1}=A_{r_k}\hat\chi_k+B_{r_k}u_k+L_{r_k}(y_k-C_{r_k}\hat\chi_k),\qquad \tilde y_k=y_k-H\hat\chi_k.$$
- $$\limsup_{k\to\infty}\|a_k-\hat a_k\|\leq c_L\bar d,\qquad a_{k+1}=a_k+d_k,\quad \|d_k\|\leq\bar d.$$

## Implementation notes

1. Exact integration point: use a residual graph neural network, message-passing GNN, attention edge, or MoE router in which each incoming edge produces a vector message $m_{ij,k}$. Let the received message be $y_{ij,k}=m_{ij,k}+a_{ij,k}$, where $a_{ij,k}$ is an injected corruption. Maintain a separate observer state $\hat\chi_{ij,k}$ for every edge; the clean aggregation consumes $\tilde m_{ij,k}=y_{ij,k}-H\hat\chi_{ij,k}$ rather than $y_{ij,k}$. 2. Pseudocode: select mode $r_k$ from the current adjacency or router state; compute the upstream prediction $u_{ij,k}=f_\theta(h_i,h_j)$; form innovation $e_{ij,k}=y_{ij,k}-C_{r_k}\hat\chi_{ij,k}$; update $\hat\chi_{ij,k+1}=A_{r_k}\hat\chi_{ij,k}+B_{r_k}u_{ij,k}+L_{r_k}e_{ij,k}$; subtract $H\hat\chi_{ij,k}$; aggregate corrected messages and backpropagate normally. Use diagonal or learned gains $L_r$ initially, then enforce observer contraction by spectral normalization so $\|A_r-L_rC_r\|_2\leq q<1$ for every mode, or solve a common quadratic Lyapunov inequality $F_r^\top PF_r-P\preceq-\epsilon I$ with $F_r=A_r-L_rC_r$, $P\succ0$, and $\epsilon>0$. 3. Computed versus estimated: $A_r,B_r,C_r,H$ are design matrices; estimate the observability Gramian from random mode sequences using the minimum finite-window singular value; estimate $\bar d$ from the maximum first difference of the injected signal or set it by an attack budget; estimate $c_L$ from observer impulse-response simulations. 4. First cheap experiment: use a two-layer message-passing GNN on Cora or a synthetic stochastic block graph, with two adjacency or router modes switched every 5--20 steps. Inject edge-wise attacks $a_{ij,k}=A\sin(\omega k)$ and ramps with amplitudes $A\in\{1,10,100,1000\}$ while keeping $|a_{k+1}-a_k|\leq\bar d$. Compare vanilla aggregation, clipping, robust median aggregation, and the observer. Measure node accuracy, corrected-message error, and the smallest empirical Gramian singular value. The quantitative prediction is amplitude-independent residual scaling: after transients, residual error should be approximately linear in $\bar d$ and nearly unchanged as $A$ increases by 1000 times. Rejection should fail sharply when the minimum finite-window Gramian singular value approaches zero or when the dominant spectral radius of some $A_r-L_rC_r$ reaches one.

## Verification

- Status: mech_ok_no_baseline
- Mechanism evidence: yes
- Mechanism confirmed: yes
- Practical verdict: harms
- Verdict: Built a link-wise switched scalar attack observer and verified the mechanism numerically. The contraction prediction matched exactly across gains, residual scaled linearly with the bounded attack-rate budget, and the alternating-mode stability boundary occurred at the predicted two-step multiplier of 1.0, with divergence beyond it. Large attack offsets from 0 to 100,000 produced essentially identical residuals, while the tiny aggregation demo reduced RMSE from 1204.28 to 0.438 (2749x), although this is not evidence of end-to-end GNN accuracy improvement.

### Mechanism check

- Verdict: Built a link-wise switched scalar attack observer and verified the mechanism numerically. The contraction prediction matched exactly across gains, residual scaled linearly with the bounded attack-rate budget, and the alternating-mode stability boundary occurred at the predicted two-step multiplier of 1.0, with divergence beyond it. Large attack offsets from 0 to 100,000 produced essentially identical residuals, while the tiny aggregation demo reduced RMSE from 1204.28 to 0.438 (2749x), although this is not evidence of end-to-end GNN accuracy improvement.
- Confidence: 9/10
- Limitations: This is a NumPy toy experiment, not a trained multi-layer GNN, Cora/SBM benchmark, or GPU test. The upstream clean message u is assumed known to the observer, attacks are additive and edge-wise, observability is demonstrated only for a scalar C=1 system, and clipping/median baselines plus computational overhead were not tested.

### Practical benchmark

- Paired seeds: 8
- Baseline mean: 0
- Idea mean: 0
- p-value: 0.0081
- Paired wins: 0/8
- Benchmark verdict: idea worse (significant)

## Artifacts

- [bench_report.json](https://synthcore.org/code/393/bench_report.json)
- [observer_experiment.py](https://synthcore.org/code/393/observer_experiment.py)
- [report.md](https://synthcore.org/code/393/report.md)
- [report_bench_2026-08-31T110429.md](https://synthcore.org/code/393/report_bench_2026-08-31T110429.md)
- [results.json](https://synthcore.org/code/393/results.json)
- [stage2_observer_bench.py](https://synthcore.org/code/393/stage2_observer_bench.py)
- [Download all files as ZIP](https://synthcore.org/download/393)

## Disclaimer

AI-generated research hypothesis, automatically tested. Not peer-reviewed.