Adversarial Attacks on Link Prediction Algorithms Based on Graph Neural Networks

Lin, Wan‐Yu; Ji, Shengxiang; Li, Baochun

doi:10.1145/3320269.3384750

Cited by 26 publications

(14 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…However, it would also be interesting to compare ALPINE with CNE against other types of link prediction methods to gain more insights. For example, a comparison of our work with a state-of-the-art link prediction approach (e.g., SEAL [45] according to [46,47]) could be used to show whether the differentiation between the unknown and the unlinked status together with active learning would improve the link prediction accuracy in general. Note that this type of comparison can be biased as we had three types of link statuses, while other link prediction methods usually have only two.…”

Section: Discussionmentioning

confidence: 99%

ALPINE: Active Link Prediction Using Network Embedding

et al. 2021

View full text Add to dashboard Cite

Many real-world problems can be formalized as predicting links in a partially observed network. Examples include Facebook friendship suggestions, the prediction of protein–protein interactions, and the identification of hidden relationships in a crime network. Several link prediction algorithms, notably those recently introduced using network embedding, are capable of doing this by just relying on the observed part of the network. Often, whether two nodes are linked can be queried, albeit at a substantial cost (e.g., by questionnaires, wet lab experiments, or undercover work). Such additional information can improve the link prediction accuracy, but owing to the cost, the queries must be made with due consideration. Thus, we argue that an active learning approach is of great potential interest and developed ALPINE (Active Link Prediction usIng Network Embedding), a framework that identifies the most useful link status by estimating the improvement in link prediction accuracy to be gained by querying it. We proposed several query strategies for use in combination with ALPINE, inspired by the optimal experimental design and active learning literature. Experimental results on real data not only showed that ALPINE was scalable and boosted link prediction accuracy with far fewer queries, but also shed light on the relative merits of the strategies, providing actionable guidance for practitioners.

show abstract

Section: Discussionmentioning

confidence: 99%

ALPINE: Active Link Prediction Using Network Embedding

et al. 2021

View full text Add to dashboard Cite

show abstract

“…To analyze the robustness of GNNs, various attack methods under different settings have been proposed to determine the vulnerabilities of graph embedding methods and help develop the corresponding defense methods. The attacks on the graph focus more on the main tasks such as classification [4,13,28], community detection [2,9], and link prediction [6,11]. Graph neural networks have been proven to be vulnerable and susceptible to attacks by Zinger et al [32] in 2018, who propose the earliest graph adversarial attack method Nettack for targeted node classification tasks.…”

Section: Related Workmentioning

confidence: 99%

Surrogate Representation Learning with Isometric Mapping for Gray-box Graph Adversarial Attacks

Liu,

Luo,

Zang

et al. 2021

Preprint

View full text Add to dashboard Cite

Gray-box graph attacks aim at disrupting the performance of the victim model by using inconspicuous attacks with limited knowledge of the victim model. The parameters of the victim model and the labels of the test nodes are invisible to the attacker. To obtain the gradient on the node attributes or graph structure, the attacker constructs an imaginary surrogate model trained under supervision. However, there is a lack of discussion on the training of surrogate models and the robustness of provided gradient information. The general node classification model loses the topology of the nodes on the graph, which is, in fact, an exploitable prior for the attacker. This paper investigates the effect of representation learning of surrogate models on the transferability of gray-box graph adversarial attacks. To reserve the topology in the surrogate embedding, we propose Surrogate Representation Learning with Isometric Mapping (SR-LIM). By using Isometric mapping method, our proposed SRLIM can constrain the topological structure of nodes from the input layer to the embedding space, that is, to maintain the similarity of nodes in the propagation process. Experiments prove the effectiveness of our approach through the improvement in the performance of the adversarial attacks generated by the gradient-based attacker in untargeted poisoning gray-box setups. CCS CONCEPTS• Computing methodologies → Supervised learning by classification.

show abstract

“…Existing studies have shown that GNNs are vulnerable to adversarial attacks [5,6,33,46,48,61], which deceive a GNN to produce wrong labels for specific target graphs (in graph classification tasks) or target nodes (in node classification tasks). According to the stages when these attacks occur, they can be classified into training-time poisoning attacks [30,46,53,63,64] and testing time adversarial attacks [7,9,27,32,43,48]. In this paper, we focus on testing time adversarial attacks against classification attacks.…”

Section: Related Workmentioning

confidence: 99%

“…While GNNs significantly boost the performance of graph data processing, existing studies show that GNNs are vulnerable to adversarial attacks [13,27,41,43,43,52,63]. However, almost all the existing attacks focus on attacking GNNs for node classification, leaving attacks against GNNs for graph classification largely unexplored, though graph classification has been widely applied [1,31,43,49].…”

Section: Introductionmentioning

confidence: 99%

A Hard Label Black-box Adversarial Attack Against Graph Neural Networks

Mu¹,

Wang²,

Li³

et al. 2021

Preprint

View full text Add to dashboard Cite

Graph Neural Networks (GNNs) have achieved state-of-the-art performance in various graph structure related tasks such as node classification and graph classification. However, GNNs are vulnerable to adversarial attacks. Existing works mainly focus on attacking GNNs for node classification; nevertheless, the attacks against GNNs for graph classification have not been well explored.In this work, we conduct a systematic study on adversarial attacks against GNNs for graph classification via perturbing the graph structure. In particular, we focus on the most challenging attack, i.e., hard label black-box attack, where an attacker has no knowledge about the target GNN model and can only obtain predicted labels through querying the target model. To achieve this goal, we formulate our attack as an optimization problem, whose objective is to minimize the number of edges to be perturbed in a graph while maintaining the high attack success rate. The original optimization problem is intractable to solve, and we relax the optimization problem to be a tractable one, which is solved with theoretical convergence guarantee. We also design a coarse-grained searching algorithm and a query-efficient gradient computation algorithm to decrease the number of queries to the target GNN model. Our experimental results on three real-world datasets demonstrate that our attack can effectively attack representative GNNs for graph classification with less queries and perturbations. We also evaluate the effectiveness of our attack under two defenses: one is well-designed adversarial graph detector and the other is that the target GNN model itself is equipped with a defense to prevent adversarial graph generation. Our experimental results show that such defenses are not effective enough, which highlights more advanced defenses. CCS CONCEPTS• Security and privacy; • Computing methodologies → Machine learning;

show abstract

Adversarial Attacks on Link Prediction Algorithms Based on Graph Neural Networks

Cited by 26 publications

References 25 publications

ALPINE: Active Link Prediction Using Network Embedding

ALPINE: Active Link Prediction Using Network Embedding

Surrogate Representation Learning with Isometric Mapping for Gray-box Graph Adversarial Attacks

A Hard Label Black-box Adversarial Attack Against Graph Neural Networks

Contact Info

Product

Resources

About