Certifiable Robustness and Robust Training for Graph Convolutional Networks

Abstract

Recent works show that Graph Neural Networks (GNNs) are highly non-robust with respect to adversarial attacks on both the graph structure and the node attributes, making their outcomes unreliable. We propose the first method for certifiable (non-)robustness of graph convolutional networks with respect to perturbations of the node attributes. We consider the case of binary node attributes (e.g. bag-of-words) and perturbations that are L_0-bounded. If a node has been certified with our method, it is guaranteed to be robust under any possible perturbation given the attack model. Likewise, we can certify non-robustness. Finally, we propose a robust semi-supervised training procedure that treats the labeled and unlabeled nodes jointly. As shown in our experimental evaluation, our method significantly improves the robustness of the GNN with only minimal effect on the predictive accuracy.

Published as a Conference Paper at ACM SIGKDD 2019

References in corpus (1)

• Adversarial Attacks on Neural Networks for Graph Data

Cited by in corpus (17)

• Adversarial Attack and Defense on Graph Data: A Survey
• Stability Properties of Graph Neural Networks
• Transferring Robustness for Graph Neural Network Against Poisoning Attacks
• Graph Neural Networks: Taxonomy, Advances and Trends
• Graph Convolutional Networks for Graphs Containing Missing Features
• Trustworthy Graph Neural Networks: Aspects, Methods and Trends
• Quantifying Privacy Leakage in Graph Embedding
• A Comprehensive Survey on Trustworthy Graph Neural Networks: Privacy, Robustness, Fairness, and Explainability
• Single Node Injection Attack against Graph Neural Networks
• A Kernel of Truth: Determining Rumor Veracity on Twitter by Diffusion Pattern Alone
• Robust Mid-Pass Filtering Graph Convolutional Networks
• How does Heterophily Impact the Robustness of Graph Neural Networks? Theoretical Connections and Practical Implications
• A Survey on Verification and Validation, Testing and Evaluations of Neurosymbolic Artificial Intelligence
• Single-Node Attacks for Fooling Graph Neural Networks
• Adversarially Regularized Graph Attention Networks for Inductive Learning on Partially Labeled Graphs
• Adversarial Immunization for Certifiable Robustness on Graphs
• Certifying Robustness of Graph Convolutional Networks for Node Perturbation with Polyhedra Abstract Interpretation