Adversarial Attacks on Graph Neural Networks via Node Injections: A Hierarchical Reinforcement Learning Approach

Abstract

Graph Neural Networks have achieved immense success for node classification with its power to explore the topological structure in graph data across many domains including social media, Ecommerce, and FinTech. However, recent studies show that GNNs are vulnerable to attacks aimed at adversely impacting their performance, e.g., on the node classification task. Existing studies of adversarial attacks on GNN focus primarily on manipulating the connectivity between existing nodes, a task that requires greater effort on the part of the attacker in real-world applications. In contrast, it is much more expedient on the part of the attacker to inject adversarial nodes, e.g., fake profiles with forged links, into existing graphs so as to reduce the performance of the GNN in classifying existing nodes.Hence, we consider a novel form of node injection poisoning attacks on graph data. We model the key steps of a node injection attack, e.g., establishing links between the injected adversarial nodes and other nodes, choosing the label of an injected node, etc. by a Markov Decision Process. We propose a novel reinforcement learning method for Node Injection Poisoning Attacks (NIPA), to sequentially modify the labels and links of the injected nodes, without changing the connectivity between existing nodes. Specifically, we introduce a hierarchical Q-learning network to manipulate the labels of the adversarial nodes and their links with other nodes in the graph, and design an appropriate reward function to guide the reinforcement learning agent to reduce the node classification performance of GNN.The results of our experiments show that NIPA is consistently more effective than the baseline node injection attack methods for poisoning graph data used to train GNN on several benchmark data sets. We further show that the graphs poisoned by NIPA are statistically similar to the original (clean) graphs, thus enabling the attacks to evade detection.

Investigating and Mitigating Degree-Related Biases in Graph Convoltuional Networks

“…Graph data are ubiquitous in real-world. Recently, graph convolutional neural networks (GCNNs) have achieved state-of-the-art performance for many graph mining tasks [10,15,34], and many efforts have been taken [13,25,26,33,35,36]. In general, these GCNNs could be divided into two categorizes: spectral based GCNNs and spatial-based GCNNs.…”

Attacking Graph-Based Classification without Changing Existing Connections

“…In [39], aiming at GCNs, Wang et al used a greedy algorithm to add fake nodes into a graph to conduct fake node attacks. Another recent work [30] proposed node injection attacks to poison the training graph used by GNNs, in order to reduce classification accuracy of GNNs on the unlabeled nodes. To achieve that, they used a deep hierarchical reinforcement learning based method to launch these attacks.…”

“…In [39], the authors considered an attack on graph convolutional networks (GCNs) by adding fake nodes to the graph. Targeting GNNs, [30] formulated the fake node injection problem as a Markov decision process and utilized Q-learning algorithm to address this problem. However, they did not explore such an attack (adding new nodes) on collective classification methods.…”

TDGIA: Effective Injection Attacks on Graph Neural Networks

“…In view of the gap, very recent efforts [17,19], including the KDD-CUP 2020 competition 1 , have been devoted to adversarial attacks on GNNs under the setting of graph injection attack (GIA). Specifically, the GIA task in KDD-CUP 2020 is formulated as follows:…”

“…Table 1 summarizes the differences. First, NIPA [17] and AFGSM [19] are developed under the poison setting, which requires the re-training of the defense models for each attack. Differently, TDGIA follows KDD-CUP 2020 to use the evasion attack setting, where different attacks are evaluated based on the same set of models and weights.…”