Transferring Robustness for Graph Neural Network Against Poisoning Attacks

Abstract

Graph neural networks (GNNs) are widely used in many applications. However, their robustness against adversarial attacks is criticized. Prior studies show that using unnoticeable modifications on graph topology or nodal features can significantly reduce the performances of GNNs. It is very challenging to design robust graph neural networks against poisoning attack and several efforts have been taken. Existing work aims at reducing the negative impact from adversarial edges only with the poisoned graph, which is sub-optimal since they fail to discriminate adversarial edges from normal ones. On the other hand, clean graphs from similar domains as the target poisoned graph are usually available in the real world. By perturbing these clean graphs, we create supervised knowledge to train the ability to detect adversarial edges so that the robustness of GNNs is elevated. However, such potential for clean graphs is neglected by existing work. To this end, we investigate a novel problem of improving the robustness of GNNs against poisoning attacks by exploring clean graphs. Specifically, we propose PA-GNN, which relies on a penalized aggregation mechanism that directly restrict the negative impact of adversarial edges by assigning them lower attention coefficients. To optimize PA-GNN for a poisoned graph, we design a meta-optimization algorithm that trains PA-GNN to penalize perturbations using clean graphs and their adversarial counterparts, and transfers such ability to improve the robustness of PA-GNN on the poisoned graph. Experimental results on four real-world datasets demonstrate the robustness of PA-GNN against poisoning attacks on graphs. Code and data are available here: https://github.com/tangxianfeng/PA-GNN.

Accepted by WSDM 2020. Code and data: https://github.com/tangxianfeng/PA-GNN

References in corpus (29)

• Explaining and Harnessing Adversarial Examples
• Semi-Supervised Classification with Graph Convolutional Networks
• Model-Agnostic Meta-Learning for Fast Adaptation of Deep Networks
• Inductive Representation Learning on Large Graphs
• Spectral Networks and Locally Connected Networks on Graphs
• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Convolutional Neural Networks on Graphs with Fast Localized Spectral Filtering
• Deep Convolutional Networks on Graph-Structured Data
• Simplifying Graph Convolutional Networks
• Learning Convolutional Neural Networks for Graphs
• Adversarial Attacks on Graph Neural Networks via Meta Learning
• GaAN: Gated Attention Networks for Learning on Large and Spatiotemporal Graphs
• Adversarial Attacks on Node Embeddings via Graph Poisoning
• Fast Gradient Attack on Network Embedding
• Hierarchically Structured Meta-learning
• Certifiable Robustness and Robust Training for Graph Convolutional Networks
• Adversarial Examples on Graph Data: Deep Insights into Attack and Defense
• Query-Efficient Hard-label Black-box Attack:An Optimization-based Approach
• Learning to Learn: Meta-Critic Networks for Sample Efficient Learning
• Adaptive Graph Convolutional Neural Networks
• Topology Attack and Defense for Graph Neural Networks: An Optimization Perspective
• Attacking Graph Convolutional Networks via Rewiring
• Graph Neural Networks for Social Recommendation
• Node Injection Attacks on Graphs via Reinforcement Learning
• Graph Neural Networks with Generated Parameters for Relation Extraction
• Regional Homogeneity: Towards Learning Transferable Universal Adversarial Perturbations Against Defenses
• Learning Transferable Adversarial Examples via Ghost Networks
• Graph Few-shot Learning via Knowledge Transfer
• Feature Interaction-aware Graph Neural Networks

Cited by in corpus (35)

• A Comprehensive Survey on Deep Graph Representation Learning
• Adversarial Attack and Defense on Graph Data: A Survey
• threaTrace: Detecting and Tracing Host-based Threats in Node Level Through Provenance Graph Learning
• GNNGuard: Defending Graph Neural Networks against Adversarial Attacks
• Trustworthy Graph Neural Networks: Aspects, Methods and Trends
• Investigating and Mitigating Degree-Related Biases in Graph Convolutional Networks
• A Comprehensive Survey on Trustworthy Graph Neural Networks: Privacy, Robustness, Fairness, and Explainability
• Condensing Graphs via One-Step Gradient Matching
• A Survey of Adversarial Learning on Graphs
• Graph Structure Learning for Robust Graph Neural Networks
• DECOR: Degree-Corrected Social Graph Refinement for Fake News Detection
• Adversarial Attacks and Defenses on Graphs: A Review, A Tool and Empirical Studies
• Knowing your FATE: Friendship, Action and Temporal Explanations for User Engagement Prediction on Social Apps
• NetFense: Adversarial Defenses against Privacy Attacks on Neural Networks for Graph Data
• Regional Homogeneity: Towards Learning Transferable Universal Adversarial Perturbations Against Defenses
• NRGNN: Learning a Label Noise-Resistant Graph Neural Network on Sparsely and Noisily Labeled Graphs
• Learning Transferable Adversarial Examples via Ghost Networks
• Say No to the Discrimination: Learning Fair Graph Neural Networks with Limited Sensitive Attribute Information
• Robust Node Classification on Graphs: Jointly from Bayesian Label Transition and Topology-based Label Propagation
• Adversarial Immunization for Certifiable Robustness on Graphs
• Learning Robust Representation through Graph Adversarial Contrastive Learning
• Few-shot Network Anomaly Detection via Cross-network Meta-learning
• GraphAttacker: A General Multi-Task GraphAttack Framework
• Graph Few-shot Learning via Knowledge Transfer
• Understanding Structural Vulnerability in Graph Convolutional Networks
• Certified Robustness of Graph Neural Networks against Adversarial Structural Perturbation
• Financial Crime & Fraud Detection Using Graph Computing: Application Considerations & Outlook
• Spatially Focused Attack against Spatiotemporal Graph Neural Networks
• I-GCN: Robust Graph Convolutional Network via Influence Mechanism
• Graph Computing for Financial Crime and Fraud Detection: Trends, Challenges and Outlook
• An Empirical Study of DNNs Robustification Inefficacy in Protecting Visual Recommenders
• Towards Self-Explainable Graph Neural Network
• Graph Feature Gating Networks
• Understanding Adversarial Examples Through Deep Neural Network's Response Surface and Uncertainty Regions
• AN-GCN: An Anonymous Graph Convolutional Network Defense Against Edge-Perturbing Attack