Topology Attack and Defense for Graph Neural Networks: An Optimization Perspective

Abstract

Graph neural networks (GNNs) which apply the deep neural networks to graph data have achieved significant performance for the task of semi-supervised node classification. However, only few work has addressed the adversarial robustness of GNNs. In this paper, we first present a novel gradient-based attack method that facilitates the difficulty of tackling discrete graph data. When comparing to current adversarial attacks on GNNs, the results show that by only perturbing a small number of edge perturbations, including addition and deletion, our optimization-based attack can lead to a noticeable decrease in classification performance. Moreover, leveraging our gradient-based attack, we propose the first optimization-based adversarial training for GNNs. Our method yields higher robustness against both different gradient based and greedy attack methods without sacrificing classification accuracy on original graph.

arXiv commentAccepted by IJCAI 2019, the 28th International Joint Conference on Artificial Intelligence

References in corpus (11)

• Semi-Supervised Classification with Graph Convolutional Networks
• Towards Deep Learning Models Resistant to Adversarial Attacks
• Adversarial Attacks on Neural Networks for Graph Data
• Adversarial Attacks on Graph Neural Networks via Meta Learning
• Sensor Selection for Estimation with Correlated Measurement Noise
• Adversarial Attacks on Node Embeddings via Graph Poisoning
• Adversarial Attack on Graph Structured Data
• Structured Adversarial Attack: Towards General Implementation and Better Interpretability
• Sparsity-Aware Sensor Collaboration for Linear Coherent Estimation
• Interpreting Adversarial Examples by Activation Promotion and Suppression
• Robust Optimization over Multiple Domains

Cited by in corpus (27)

• Stability Properties of Graph Neural Networks
• Transferring Robustness for Graph Neural Network Against Poisoning Attacks
• GNNGuard: Defending Graph Neural Networks against Adversarial Attacks
• DeepRobust: A PyTorch Library for Adversarial Attacks and Defenses
• A Survey of Adversarial Learning on Graphs
• Adversarial T-shirt! Evading Person Detectors in A Physical World
• Adversarial Attacks and Defenses on Graphs: A Review, A Tool and Empirical Studies
• Robust Counterfactual Explanations on Graph Neural Networks
• Reliable Graph Neural Networks via Robust Aggregation
• Adversarial Attack on Hierarchical Graph Pooling Neural Networks
• Surrogate Representation Learning with Isometric Mapping for Gray-box Graph Adversarial Attacks
• Towards More Practical Adversarial Attacks on Graph Neural Networks
• On the Design of Black-box Adversarial Examples by Leveraging Gradient-free Optimization and Operator Splitting Method
• Understanding and Improvement of Adversarial Training for Network Embedding from an Optimization Perspective
• Decentralized Inference with Graph Neural Networks in Wireless Communication Systems
• Adversarial Diffusion Attacks on Graph-based Traffic Prediction Models
• Jointly Attacking Graph Neural Network and its Explanations
• A Restricted Black-box Adversarial Framework Towards Attacking Graph Embedding Models
• Uncertainty-aware Attention Graph Neural Network for Defending Adversarial Attacks
• Robustness of Graph Neural Networks at Scale
• Interpretable Stability Bounds for Spectral Graph Filters
• A Hard Label Black-box Adversarial Attack Against Graph Neural Networks
• Towards Query-Efficient Black-Box Adversary with Zeroth-Order Natural Gradient Descent
• Generating Adversarial Computer Programs using Optimized Obfuscations
• Scalable Adversarial Attack on Graph Neural Networks with Alternating Direction Method of Multipliers
• CoG: a Two-View Co-training Framework for Defending Adversarial Attacks on Graph
• On Generalization of Graph Autoencoders with Adversarial Training