Perturbations targeting the graph structure have proven to be extremely
effective in reducing the performance of graph neural networks (GNNs), and
traditional defenses such as adversarial training do not seem to be able to
improve robustness. This work is motivated by the observation t