Link-Wise Attack Observer for Switching Message Passing

1. Exact integration point: use a residual graph neural network, message-passing GNN, attention edge, or MoE router in which each incoming edge produces a vector message $m_{ij,k}$. Let the received message be $y_{ij,k}=m_{ij,k}+a_{ij,k}$, where $a_{ij,k}$ is an injected corruption. Maintain a separate observer state $\hat\chi_{ij,k}$ for every edge; the clean aggregation consumes $\tilde m_{ij,k}=y_{ij,k}-H\hat\chi_{ij,k}$ rather than $y_{ij,k}$. 2. Pseudocode: select mode $r_k$ from the current adjacency or router state; compute the upstream prediction $u_{ij,k}=f_\theta(h_i,h_j)$; form innovation $e_{ij,k}=y_{ij,k}-C_{r_k}\hat\chi_{ij,k}$; update $\hat\chi_{ij,k+1}=A_{r_k}\hat\chi_{ij,k}+B_{r_k}u_{ij,k}+L_{r_k}e_{ij,k}$; subtract $H\hat\chi_{ij,k}$; aggregate corrected messages and backpropagate normally. Use diagonal or learned gains $L_r$ initially, then enforce observer contraction by spectral normalization so $\|A_r-L_rC_r\|_2\leq q<1$ for every mode, or solve a common quadratic Lyapunov inequality $F_r^\top PF_r-P\preceq-\epsilon I$ with $F_r=A_r-L_rC_r$, $P\succ0$, and $\epsilon>0$. 3. Computed versus estimated: $A_r,B_r,C_r,H$ are design matrices; estimate the observability Gramian from random mode sequences using the minimum finite-window singular value; estimate $\bar d$ from the maximum first difference of the injected signal or set it by an attack budget; estimate $c_L$ from observer impulse-response simulations. 4. First cheap experiment: use a two-layer message-passing GNN on Cora or a synthetic stochastic block graph, with two adjacency or router modes switched every 5--20 steps. Inject edge-wise attacks $a_{ij,k}=A\sin(\omega k)$ and ramps with amplitudes $A\in\{1,10,100,1000\}$ while keeping $|a_{k+1}-a_k|\leq\bar d$. Compare vanilla aggregation, clipping, robust median aggregation, and the observer. Measure node accuracy, corrected-message error, and the smallest empirical Gramian singular value. The quantitative prediction is amplitude-independent residual scaling: after transients, residual error should be approximately linear in $\bar d$ and nearly unchanged as $A$ increases by 1000 times. Rejection should fail sharply when the minimum finite-window Gramian singular value approaches zero or when the dominant spectral radius of some $A_r-L_rC_r$ reaches one.