Topology Attack and Defense for Graph Neural Networks: An Optimization Perspective

Xu, Kaidi; Chen, Hongge; Liu, Sijia; Chen, Pin-Yu; Weng, Tsui-Wei; Mei, Hong; Lin, Xue

doi:10.48550/arxiv.1906.04214

Cited by 47 publications

(91 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Some works try to model the attack as an optimization problem. PGD and MinMax [27] optimize the negative crossentropy loss using the gradient. Nettack [40] iteratively selects augmentations by calculating the score/loss of each possible augmentation and chooses the one that maximizes the loss.…”

Section: Related Work 21 Graph Adversarial Attackmentioning

confidence: 99%

“…We compare CLGA with five baseline untargeted poisoning attacks, including PGD [27], DICE [26], MinMax [27], Metattack [41], and the unsupervised node embedding attack proposed by Bojchevski et al [2]. Among these baselines, only Bojchevski et al [2] is unsupervised and does not need labels, which is the same as our method.…”

Section: Baselinesmentioning

confidence: 99%

“…It generates different views of the original graph using stochastic augmentations and adopts a special contrastive loss to learn embeddings by comparing these views, which also makes graph contrastive learning models more robust to adversarial attacks compared with other graph representation methods [30]. However, such conclusions are obtained using existing graph adversarial attacks, which are mostly supervised attacks [9,27,40,41], i.e. they need labels to conduct the attack as shown in Fig.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Unsupervised Graph Poisoning Attack via Contrastive Loss Back-propagation

Zhang,

Chen,

Sun

et al. 2022

Preprint

View full text Add to dashboard Cite

Graph contrastive learning is the state-of-the-art unsupervised graph representation learning framework and has shown comparable performance with supervised approaches. However, evaluating whether the graph contrastive learning is robust to adversarial attacks is still an open problem because most existing graph adversarial attacks are supervised models, which means they heavily rely on labels and can only be used to evaluate the graph contrastive learning in a specific scenario. For unsupervised graph representation methods such as graph contrastive learning, it is difficult to acquire labels in real-world scenarios, making traditional supervised graph attack methods difficult to be applied to test their robustness. In this paper, we propose a novel unsupervised gradient-based adversarial attack that does not rely on labels for graph contrastive learning. We compute the gradients of the adjacency matrices of the two views and flip the edges with gradient ascent to maximize the contrastive loss. In this way, we can fully use multiple views generated by the graph contrastive learning models and pick the most informative edges without knowing their labels, and therefore can promisingly support our model adapted to more kinds of downstream tasks. Extensive experiments show that our attack outperforms unsupervised baseline attacks and has comparable performance with supervised attacks in multiple downstream tasks including node classification and link prediction. We further show that our attack can be transferred to other graph representation models as well. CCS CONCEPTS• Information systems → Data mining.

show abstract

Section: Related Work 21 Graph Adversarial Attackmentioning

confidence: 99%

Section: Baselinesmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Unsupervised Graph Poisoning Attack via Contrastive Loss Back-propagation

Zhang,

Chen,

Sun

et al. 2022

Preprint

View full text Add to dashboard Cite

show abstract

“…In the field of graph adversarial learning, researchers have proposed various settings for attacks. According to the information available to the attackers, attacks can be divided into white-box (attackers can obtain all the information of the victim model) [21,25,28], gray-box (the parameters of the victim and the test labels are invisible) [12,32,33], and black-box attacks (labels are invisible but attackers can do black-box queries to the prediction) [4,14], respectively. At which phase, i.e., model training and model testing, an adversarial attack happens, determines whether the attack is a poisoning attack or an evasion attack.…”

Section: Introductionmentioning

confidence: 99%

“…Among the proposed gray-box untargeted attack methods, the gradient-based attackers [12,13,28,33] have been proved to have enhanced attacking performance and become one of the mainstream attack strategies. Gradient-based attackers rely on a pre-trained GNN classifier, known as a surrogate model, to obtain gradients at node features and graph structure, based on which to generate perturbations.…”

Section: Introductionmentioning

confidence: 99%

Surrogate Representation Learning with Isometric Mapping for Gray-box Graph Adversarial Attacks

Liu,

Luo,

Zang

et al. 2021

Preprint

View full text Add to dashboard Cite

Gray-box graph attacks aim at disrupting the performance of the victim model by using inconspicuous attacks with limited knowledge of the victim model. The parameters of the victim model and the labels of the test nodes are invisible to the attacker. To obtain the gradient on the node attributes or graph structure, the attacker constructs an imaginary surrogate model trained under supervision. However, there is a lack of discussion on the training of surrogate models and the robustness of provided gradient information. The general node classification model loses the topology of the nodes on the graph, which is, in fact, an exploitable prior for the attacker. This paper investigates the effect of representation learning of surrogate models on the transferability of gray-box graph adversarial attacks. To reserve the topology in the surrogate embedding, we propose Surrogate Representation Learning with Isometric Mapping (SR-LIM). By using Isometric mapping method, our proposed SRLIM can constrain the topological structure of nodes from the input layer to the embedding space, that is, to maintain the similarity of nodes in the propagation process. Experiments prove the effectiveness of our approach through the improvement in the performance of the adversarial attacks generated by the gradient-based attacker in untargeted poisoning gray-box setups. CCS CONCEPTS• Computing methodologies → Supervised learning by classification.

show abstract

Resisting Graph Adversarial Attack via Cooperative Homophilous Augmentation

Zhu

Zhou

et al. 2023

Lecture Notes in Computer Science

View full text Add to dashboard Cite

As the study of graph neural networks becomes more intensive and comprehensive, their robustness and security have received great research interest. The existing global attack methods treat all nodes in the graph as their attack targets. Although existing methods have achieved excellent results, there is still considerable space for improvement. The key problem is that the current approaches rigidly follow the definition of global attacks. They ignore an important issue, i.e., different nodes have different robustness and are not equally resilient to attacks. From a global attacker's view, we should arrange the attack budget wisely, rather than wasting them on highly robust nodes. To this end, we propose a totally new method named partial graph attack (PGA), which selects the vulnerable nodes as attack targets. First, to select the vulnerable items, we propose a hierarchical target selection policy, which allows attackers to only focus on easy-to-attack nodes. Then, we propose a cost-effective anchor-picking policy to pick the most promising anchors for adding or removing edges, and a more aggressive iterative greedy-based attack method to perform more efficient attacks. Extensive experimental results demonstrate that PGA can achieve significant improvements in both attack effect and attack efficiency compared to other existing graph global attack methods.

show abstract

Topology Attack and Defense for Graph Neural Networks: An Optimization Perspective

Cited by 47 publications

References 11 publications

Unsupervised Graph Poisoning Attack via Contrastive Loss Back-propagation

Unsupervised Graph Poisoning Attack via Contrastive Loss Back-propagation

Surrogate Representation Learning with Isometric Mapping for Gray-box Graph Adversarial Attacks

Resisting Graph Adversarial Attack via Cooperative Homophilous Augmentation

Contact Info

Product

Resources

About