AN-GCN: An Anonymous Graph Convolutional Network Defense Against Edge-Perturbing Attack

Abstract

Recent studies have revealed the vulnerability of graph convolutional networks (GCNs) to edge-perturbing attacks, such as maliciously inserting or deleting graph edges. However, a theoretical proof of such vulnerability remains a big challenge, and effective defense schemes are still open issues. In this paper, we first generalize the formulation of edge-perturbing attacks and strictly prove the vulnerability of GCNs to such attacks in node classification tasks. Following this, an anonymous graph convolutional network, named AN-GCN, is proposed to counter against edge-perturbing attacks. Specifically, we present a node localization theorem to demonstrate how the GCN locates nodes during its training phase. In addition, we design a staggered Gaussian noise based node position generator, and devise a spectral graph convolution based discriminator in detecting the generated node positions. Further, we give the optimization of the above generator and discriminator. AN-GCN can classify nodes without taking their position as input. It is demonstrated that the AN-GCN is secure against edge-perturbing attacks in node classification tasks, as AN-GCN classifies nodes without the edge information and thus makes it impossible for attackers to perturb edges anymore. Extensive evaluations demonstrated the effectiveness of the general edge-perturbing attack model in manipulating the classification results of the target nodes. More importantly, the proposed AN-GCN can achieve 82.7% in node classification accuracy without the edge-reading permission, which outperforms the state-of-the-art GCN.

arXiv comment15 pages, 11 figures

References in corpus (23)

• The Emerging Field of Signal Processing on Graphs: Extending High-Dimensional Data Analysis to Networks and Other Irregular Domains
• Adversarial Attacks on Neural Networks for Graph Data
• Adversarial Attacks on Graph Neural Networks via Meta Learning
• Adversarial Attack and Defense on Graph Data: A Survey
• PairNorm: Tackling Oversmoothing in GNNs
• Adaptive Sampling Towards Fast Graph Representation Learning
• Poisoning Attacks to Graph-Based Recommender Systems
• Transferring Robustness for Graph Neural Network Against Poisoning Attacks
• Fake News Detection on Social Media using Geometric Deep Learning
• Adversarial Attacks on Node Embeddings via Graph Poisoning
• Robust Local Features for Improving the Generalization of Adversarial Training
• Certifiable Robustness to Graph Perturbations
• Adversarial Explanations for Understanding Image Classification Decisions and Improved Neural Network Robustness
• Batch Virtual Adversarial Training for Graph Convolutional Networks
• Mimic and Fool: A Task Agnostic Adversarial Attack
• Analytical solution of linear ordinary differential equations by differential transfer matrix method
• Hierarchical Propagation Networks for Fake News Detection: Investigation and Exploitation
• A Unified Framework for Data Poisoning Attack to Graph-based Semi-supervised Learning
• Adversarial Defense Framework for Graph Neural Network
• SFE-GACN: A Novel Unknown Attack Detection Method Using Intra Categories Generation in Embedding Space
• Time-aware Gradient Attack on Dynamic Network Link Prediction
• Learning continuous-time PDEs from sparse data with graph neural networks
• Ordinary Differential Equation and Complex Matrix Exponential for Multi-resolution Image Registration