Adversarial Examples on Graph Data: Deep Insights into Attack and Defense

Abstract

Graph deep learning models, such as graph convolutional networks (GCN) achieve remarkable performance for tasks on graph data. Similar to other types of deep models, graph deep learning models often suffer from adversarial attacks. However, compared with non-graph data, the discrete features, graph connections and different definitions of imperceptible perturbations bring unique challenges and opportunities for the adversarial attacks and defenses for graph data. In this paper, we propose both attack and defense techniques. For attack, we show that the discreteness problem could easily be resolved by introducing integrated gradients which could accurately reflect the effect of perturbing certain features or edges while still benefiting from the parallel computations. For defense, we observe that the adversarially manipulated graph for the targeted attack differs from normal graphs statistically. Based on this observation, we propose a defense approach which inspects the graph and recovers the potential adversarial perturbations. Our experiments on a number of datasets show the effectiveness of the proposed methods.

to appear in IJCAI'19

References in corpus (9)

• Axiomatic Attribution for Deep Networks
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Deep Convolutional Networks on Graph-Structured Data
• Simplifying Graph Convolutional Networks
• Deep k-Nearest Neighbors: Towards Confident, Interpretable and Robust Deep Learning
• An unexpected unity among methods for interpreting model predictions
• Attack Graph Convolutional Networks by Adding Fake Nodes
• Defending against Adversarial Images using Basis Functions Transformations
• Graph Based Convolutional Neural Network

Cited by in corpus (41)

• Adversarial Attack and Defense on Graph Data: A Survey
• Transferring Robustness for Graph Neural Network Against Poisoning Attacks
• GNNGuard: Defending Graph Neural Networks against Adversarial Attacks
• Graph Information Bottleneck
• DeepRobust: A PyTorch Library for Adversarial Attacks and Defenses
• When Does Self-Supervision Help Graph Convolutional Networks?
• Node-Level Membership Inference Attacks Against Graph Neural Networks
• Graph Structure Learning for Robust Graph Neural Networks
• Adversarial Attacks and Defenses on Graphs: A Review, A Tool and Empirical Studies
• Stealing Links from Graph Neural Networks
• Tensor Graph Convolutional Networks for Multi-relational and Robust Learning
• Node Injection Attacks on Graphs via Reinforcement Learning
• Adversarial Attack Framework on Graph Embedding Models with Limited Knowledge
• How does Heterophily Impact the Robustness of Graph Neural Networks? Theoretical Connections and Practical Implications
• Reliable Graph Neural Networks via Robust Aggregation
• GraphDefense: Towards Robust Graph Convolutional Networks
• Adversarial Attack on Hierarchical Graph Pooling Neural Networks
• DefenseVGAE: Defending against Adversarial Attacks on Graph Data via a Variational Graph Autoencoder
• Structack: Structure-based Adversarial Attacks on Graph Neural Networks
• USER: Unsupervised Structural Entropy-based Robust Graph Neural Network
• Surrogate Representation Learning with Isometric Mapping for Gray-box Graph Adversarial Attacks
• Graph Neural Networks Inspired by Classical Iterative Algorithms
• Node Similarity Preserving Graph Convolutional Networks
• Towards Security Threats of Deep Learning Systems: A Survey
• Edge Dithering for Robust Adaptive Graph Convolutional Networks
• Learning to Deceive Knowledge Graph Augmented Models via Targeted Perturbation
• Certified Robustness of Community Detection against Adversarial Structural Perturbation via Randomized Smoothing
• Adversarial Attacks on Graph Classification via Bayesian Optimisation
• Jointly Attacking Graph Neural Network and its Explanations
• GraphAttacker: A General Multi-Task GraphAttack Framework
• Black-box Gradient Attack on Graph Neural Networks: Deeper Insights in Graph-based Attack and Defense
• Robustness of Graph Neural Networks at Scale
• Certified Robustness of Graph Neural Networks against Adversarial Structural Perturbation
• Understanding Structural Vulnerability in Graph Convolutional Networks
• GraphMI: Extracting Private Graph Data from Graph Neural Networks
• A Hard Label Black-box Adversarial Attack Against Graph Neural Networks
• I-GCN: Robust Graph Convolutional Network via Influence Mechanism
• Topological Effects on Attacks Against Vertex Classification
• DeepInsight: Interpretability Assisting Detection of Adversarial Samples on Graphs
• Spatio-Temporal Sparsification for General Robust Graph Convolution Networks
• Certified Robustness of Graph Classification against Topology Attack with Randomized Smoothing