Attack Graph Convolutional Networks by Adding Fake Nodes

Abstract

In this paper, we study the robustness of graph convolutional networks (GCNs). Previous work have shown that GCNs are vulnerable to adversarial perturbation on adjacency or feature matrices of existing nodes; however, such attacks are usually unrealistic in real applications. For instance, in social network applications, the attacker will need to hack into either the client or server to change existing links or features. In this paper, we propose a new type of "fake node attacks" to attack GCNs by adding malicious fake nodes. This is much more realistic than previous attacks; in social network applications, the attacker only needs to register a set of fake accounts and link to existing ones. To conduct fake node attacks, a greedy algorithm is proposed to generate edges of malicious nodes and their corresponding features aiming to minimize the classification accuracy on the target nodes. In addition, we introduce a discriminator to classify malicious nodes from real nodes, and propose a Greedy-GAN attack to simultaneously update the discriminator and the attacker, to make malicious nodes indistinguishable from the real ones. Our non-targeted attack decreases the accuracy of GCN down to 0.03, and our targeted attack reaches a success rate of 78% on a group of 100 nodes, and 90% on average for attacking a single target node.

References in corpus (13)

• Ensemble Adversarial Training: Attacks and Defenses
• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Towards Deep Learning Models Resistant to Adversarial Attacks
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Understanding Neural Networks through Representation Erasure
• Generating Natural Adversarial Examples
• Deep Text Classification Can be Fooled
• Towards Crafting Text Adversarial Samples
• Adversarial Examples that Fool Detectors
• Query-Efficient Hard-label Black-box Attack:An Optimization-based Approach
• Seq2Sick: Evaluating the Robustness of Sequence-to-Sequence Models with Adversarial Examples
• Note on Attacking Object Detectors with Adversarial Stickers
• Query-limited Black-box Attacks to Classifiers

Cited by in corpus (17)

• Adversarial Attack and Defense on Graph Data: A Survey
• Adversarial Examples on Graph Data: Deep Insights into Attack and Defense
• Attacking Graph Convolutional Networks via Rewiring
• A Survey of Adversarial Learning on Graphs
• Projective Ranking-based GNN Evasion Attacks
• Node Injection for Class-specific Network Poisoning
• Cluster Attack: Query-based Adversarial Attacks on Graphs with Graph-Dependent Priors
• Surrogate Representation Learning with Isometric Mapping for Gray-box Graph Adversarial Attacks
• Time-aware Gradient Attack on Dynamic Network Link Prediction
• Robust Node Classification on Graphs: Jointly from Bayesian Label Transition and Topology-based Label Propagation
• WebGraph: Capturing Advertising and Tracking Information Flows for Robust Blocking
• GraphAttacker: A General Multi-Task GraphAttack Framework
• Unsupervised Euclidean Distance Attack on Network Embedding
• A Targeted Universal Attack on Graph Convolutional Network
• Semantic-preserving Reinforcement Learning Attack Against Graph Neural Networks for Malware Detection
• A Hard Label Black-box Adversarial Attack Against Graph Neural Networks
• Auditing the Sensitivity of Graph-based Ranking with Visual Analytics