Adversarial Attacks and Defenses on Graphs

Jin, Wei; Li, Yaxing; Xu, Han; Wang, Yiqi; Ji, Shuiwang; Aggarwal, Charų C.; Tang, Jiliang

doi:10.1145/3447556.3447566

Cited by 117 publications

(69 citation statements)

References 38 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…There has been increasing research interest in adversarial attacks on GNNs recently. Detailed expositions of existing literature are made available in a couple of survey papers [12,23]. Given the heterogeneous nature of diverse graph structured data, there are numerous adversarial attack setups for GNN models.…”

Section: Related Workmentioning

confidence: 99%

“…Given the heterogeneous nature of diverse graph structured data, there are numerous adversarial attack setups for GNN models. Following the taxonomy provided by Jin et al [12], the adversarial attack setup can be categorized based on (but not limited to) the machine learning task, the goal of the attack, the phase of the attack, the form of the attack, and the model knowledge that attacker has access to. First, there are two common types of tasks, node-level classification [5,6,27,34] and graph-level classification [5,25].…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Adversarial Attack on Graph Neural Networks as An Influence Maximization Problem

Deng

Mei

2022

Proceedings of the Fifteenth ACM International Conference on Web Search and Data Mining

View full text Add to dashboard Cite

Graph neural networks (GNNs) have attracted increasing interests. With broad deployments of GNNs in real-world applications, there is an urgent need for understanding the robustness of GNNs under adversarial attacks, especially in realistic setups. In this work, we study the problem of attacking GNNs in a restricted and realistic setup, by perturbing the features of a small set of nodes, with no access to model parameters and model predictions. Our formal analysis draws a connection between this type of attacks and an influence maximization problem on the graph. This connection not only enhances our understanding on the problem of adversarial attack on GNNs, but also allows us to propose a group of effective and practical attack strategies. Our experiments verify that the proposed attack strategies significantly degrade the performance of three popular GNN models and outperform baseline adversarial attack strategies 1 . CCS CONCEPTS• Computing methodologies → Machine learning; • Security and privacy;

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Adversarial Attack on Graph Neural Networks as An Influence Maximization Problem

Deng

Mei

2022

Proceedings of the Fifteenth ACM International Conference on Web Search and Data Mining

View full text Add to dashboard Cite

show abstract

“…In this work, we assume that the parameters of the model are fixed before and after perturbation. In the adversarial learning literature, an attack that modifies the input to cause large changes in the output whilst the model parameters are fixed is known as an evasion attack [11]. Robust models in the context of our work are those that are robust to evasion attacks with respect to the graph structure.…”

Section: Stability Of Polynomial Filtersmentioning

confidence: 99%

“…Like their Euclidean counterparts, GCNNs are susceptible to adversarial attacks [9,10,11]. An adversarial attack is a small but targeted perturbation of the input which causes large changes in the output [12].…”

Section: Introductionmentioning

confidence: 99%

On The Stability of Graph Convolutional Neural Networks Under Edge Rewiring

Kenlay

Thano

Dong

2021

ICASSP 2021 - 2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)

View full text Add to dashboard Cite

Graph neural networks are experiencing a surge of popularity within the machine learning community due to their ability to adapt to non-Euclidean domains and instil inductive biases. Despite this, their stability, i.e., their robustness to small perturbations in the input, is not yet well understood. Although there exists some results showing the stability of graph neural networks, most take the form of an upper bound on the magnitude of change due to a perturbation in the graph topology. However, the change in the graph topology captured in existing bounds tend not to be expressed in terms of structural properties, limiting our understanding of the model robustness properties. In this work, we develop an interpretable upper bound elucidating that graph neural networks are stable to rewiring between high degree nodes. This bound and further research in bounds of similar type provide further understanding of the stability properties of graph neural networks.

show abstract

“…(1) Neural-network encoders f comp : X comp → R Ncomp×D , f prot : X prot → R Nprot×D that separately extract embeddings H comp , H prot for the compound X comp and protein X prot where D is hidden dimension. Graph neural network (GNN, [14,15,16,17,18,19]) is adopted for compound 2D chemical graphs and hierarchical recurrent neural network (HRNN, [20]) is chosen for protein 1D amino-acid sequences.…”

Section: Pipeline Overviewmentioning

confidence: 99%

Cross-Modality Protein Embedding for Compound-Protein Affinity and Contact Prediction

You

Shen

2020

Preprint

View full text Add to dashboard Cite

Compound-protein pairs dominate FDA-approved drug-target pairs and the prediction of compound-protein affinity and contact (CPAC) could help accelerate drug discovery. In this study we consider proteins as multi-modal data including 1D amino-acid sequences and (sequence-predicted) 2D residue-pair contact maps. We empirically evaluate the embeddings of the two single modalities in their accuracy and generalizability of CPAC prediction (i.e. structure-free interpretable compound-protein affinity prediction). And we rationalize their performances in both challenges of embedding individual modalities and learning generalizable embedding-label relationship. We further propose two models involving cross-modality protein embedding and establish that the one with cross interaction (thus capturing correlations among modalities) outperforms SOTAs and our single modality models in affinity, contact, and binding-site predictions for proteins never seen in the training set.

show abstract

Adversarial Attacks and Defenses on Graphs

Abstract: Deep neural networks (DNNs) have achieved significant performance in various tasks. However, recent studies have shown that DNNs can be easily fooled by small perturbation on the input, called adversarial attacks.

Cited by 117 publications

References 38 publications

Adversarial Attack on Graph Neural Networks as An Influence Maximization Problem

Adversarial Attack on Graph Neural Networks as An Influence Maximization Problem

On The Stability of Graph Convolutional Neural Networks Under Edge Rewiring

Cross-Modality Protein Embedding for Compound-Protein Affinity and Contact Prediction

Contact Info

Product

Resources

About