Adversarial Attack and Defense on Graph Data: A Survey

Abstract

Deep neural networks (DNNs) have been widely applied to various applications, including image classification, text generation, audio recognition, and graph data analysis. However, recent studies have shown that DNNs are vulnerable to adversarial attacks. Though there are several works about adversarial attack and defense strategies on domains such as images and natural language processing, it is still difficult to directly transfer the learned knowledge to graph data due to its representation structure. Given the importance of graph analysis, an increasing number of studies over the past few years have attempted to analyze the robustness of machine learning models on graph data. Nevertheless, existing research considering adversarial behaviors on graph data often focuses on specific types of attacks with certain assumptions. In addition, each work proposes its own mathematical formulation, which makes the comparison among different methods difficult. Therefore, this review is intended to provide an overall landscape of more than 100 papers on adversarial attack and defense strategies for graph data, and establish a unified formulation encompassing most graph adversarial learning models. Moreover, we also compare different graph attacks and defenses along with their contributions and limitations, as well as summarize the evaluation metrics, datasets and future trends. We hope this survey can help fill the gap in the literature and facilitate further development of this promising new field.

Published on IEEE TKDE. For more open-source and up-to-date information, please check our Github repository: https://github.com/YingtongDou/graph-adversarial-learning-literature

References in corpus (72)

• Emergence of scaling in random networks
• Community structure in social and biological networks
• A Survey on Deep Learning in Medical Image Analysis
• DeepWalk: Online Learning of Social Representations
• Explaining and Harnessing Adversarial Examples
• Semi-Supervised Classification with Graph Convolutional Networks
• Model-Agnostic Meta-Learning for Fast Adaptation of Deep Networks
• Intriguing properties of neural networks
• Cooperative Game Theory Approaches for Network Partitioning
• Inductive Representation Learning on Large Graphs
• End to End Learning for Self-Driving Cars
• Towards Deep Learning Models Resistant to Adversarial Attacks
• Simplifying Graph Convolutional Networks
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Adversarial Attacks on Neural Networks for Graph Data
• Evasion Attacks against Machine Learning at Test Time
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Adversarial Attacks on Graph Neural Networks via Meta Learning
• Revisiting Semi-Supervised Learning with Graph Embeddings
• Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models
• Spatially Transformed Adversarial Examples
• Spam Review Detection with Graph Convolutional Networks
• Poisoning Attacks to Graph-Based Recommender Systems
• Hiding Individuals and Communities in a Social Network
• HyperGCN: A New Method of Training Graph Convolutional Networks on Hypergraphs
• Transferring Robustness for Graph Neural Network Against Poisoning Attacks
• NetGAN: Generating Graphs via Random Walks
• Adversarial Attacks on Node Embeddings via Graph Poisoning
• Adversarial Attack on Graph Structured Data
• Fast Gradient Attack on Network Embedding
• GNNGuard: Defending Graph Neural Networks against Adversarial Attacks
• Anti-Money Laundering in Bitcoin: Experimenting with Graph Convolutional Networks for Financial Forensics
• Certifiable Robustness and Robust Training for Graph Convolutional Networks
• Adversarial Examples on Graph Data: Deep Insights into Attack and Defense
• TDGIA:Effective Injection Attacks on Graph Neural Networks
• Adversarial Attack on Community Detection by Hiding Individuals
• Exploring the Space of Black-box Attacks on Deep Neural Networks
• Single Node Injection Attack against Graph Neural Networks
• Attacking Graph Convolutional Networks via Rewiring
• A Survey of Adversarial Learning on Graphs
• Attack Graph Convolutional Networks by Adding Fake Nodes
• Certifiable Robustness to Graph Perturbations
• Practical Attacks Against Graph-based Clustering
• Batch Virtual Adversarial Training for Graph Convolutional Networks
• Data Poisoning Attack against Unsupervised Node Embedding Methods
• Indirect Adversarial Attacks via Poisoning Neighbors for Graph Convolutional Networks
• Stealing Links from Graph Neural Networks
• Attacking Similarity-Based Link Prediction in Social Networks
• Tensor Graph Convolutional Networks for Multi-relational and Robust Learning
• Link Prediction Adversarial Attack
• GraphSAC: Detecting anomalies in large-scale graphs
• GraphDefense: Towards Robust Graph Convolutional Networks
• Adversarial Attack on Hierarchical Graph Pooling Neural Networks
• Adversarial Defense Framework for Graph Neural Network
• Can Adversarial Network Attack be Defended?
• DefenseVGAE: Defending against Adversarial Attacks on Graph Data via a Variational Graph Autoencoder
• Poisoning Knowledge Graph Embeddings via Relation Inference Patterns
• Time-aware Gradient Attack on Dynamic Network Link Prediction
• Attack Tolerance of Link Prediction Algorithms: How to Hide Your Relations in a Social Network
• Edge Dithering for Robust Adaptive Graph Convolutional Networks
• Learning to Deceive Knowledge Graph Augmented Models via Targeted Perturbation
• Information Obfuscation of Graph Neural Networks
• A Robust Hierarchical Graph Convolutional Network Model for Collaborative Filtering
• Adversarial Attacks on Graph Classification via Bayesian Optimisation
• Network disruption: maximizing disagreement and polarization in social networks
• Data Poisoning Attack against Knowledge Graph Embedding
• Multiscale Evolutionary Perturbation Attack on Community Detection
• Unsupervised Euclidean Distance Attack on Network Embedding
• Generalizable Adversarial Attacks with Latent Variable Perturbation Modelling
• Unsupervised Adversarially-Robust Representation Learning on Graphs
• Investigating Robustness and Interpretability of Link Prediction via Adversarial Modifications
• Adversarial Attacks to Scale-Free Networks: Testing the Robustness of Physical Criteria

Cited by in corpus (41)

• Graph Neural Networks: A Review of Methods and Applications
• Enhancing Graph Neural Network-based Fraud Detectors against Camouflaged Fraudsters
• threaTrace: Detecting and Tracing Host-based Threats in Node Level Through Provenance Graph Learning
• Iterative Deep Graph Learning for Graph Neural Networks: Better and Robust Node Embeddings
• Stability Properties of Graph Neural Networks
• HyperGCN: A New Method of Training Graph Convolutional Networks on Hypergraphs
• Deep Learning on Graphs: A Survey
• Graph Neural Networks: Taxonomy, Advances and Trends
• Automated Machine Learning on Graphs: A Survey
• Single Node Injection Attack against Graph Neural Networks
• A Survey of Adversarial Learning on Graphs
• SE-GSL: A General and Effective Graph Structure Learning Framework through Structural Entropy Optimization
• Node-Level Membership Inference Attacks Against Graph Neural Networks
• Adversarial Attacks and Defenses on Graphs: A Review, A Tool and Empirical Studies
• Unbiased Graph Embedding with Biased Graph Observations
• Adversarial Attack Framework on Graph Embedding Models with Limited Knowledge
• Adversarial Attack on Hierarchical Graph Pooling Neural Networks
• Reinforced Neighborhood Selection Guided Multi-Relational Graph Neural Networks
• Can Large Language Models Improve the Adversarial Robustness of Graph Neural Networks?
• Specification Overfitting in Artificial Intelligence
• Adversarial Machine Learning in Wireless Communications using RF Data: A Review
• Robust Node Classification on Graphs: Jointly from Bayesian Label Transition and Topology-based Label Propagation
• Secure Deep Graph Generation with Link Differential Privacy
• Adversarial Attacks on Graph Classification via Bayesian Optimisation
• Black-box Gradient Attack on Graph Neural Networks: Deeper Insights in Graph-based Attack and Defense
• BASAR:Black-box Attack on Skeletal Action Recognition
• A Restricted Black-box Adversarial Framework Towards Attacking Graph Embedding Models
• Generalizable Adversarial Attacks with Latent Variable Perturbation Modelling
• Semantic-preserving Reinforcement Learning Attack Against Graph Neural Networks for Malware Detection
• Differentiable Language Model Adversarial Attacks on Categorical Sequence Classifiers
• Node Copying: A Random Graph Model for Effective Graph Sampling
• Interpretable Stability Bounds for Spectral Graph Filters
• Graph Convolutional Neural Networks Sensitivity under Probabilistic Error Model
• Robust Spammer Detection by Nash Reinforcement Learning
• Node Feature Kernels Increase Graph Convolutional Network Robustness
• Community detection robustness of graph neural networks
• Spatio-Temporal Sparsification for General Robust Graph Convolution Networks
• AN-GCN: An Anonymous Graph Convolutional Network Defense Against Edge-Perturbing Attack
• Operator Autoencoders: Learning Physical Operations on Encoded Molecular Graphs
• Adversarial Attacks on Deep Models for Financial Transaction Records
• Dual GNNs: Graph Neural Network Learning with Limited Supervision