Adversarial Attack Framework on Graph Embedding Models with Limited Knowledge

Abstract

With the success of the graph embedding model in both academic and industry areas, the robustness of graph embedding against adversarial attack inevitably becomes a crucial problem in graph learning. Existing works usually perform the attack in a white-box fashion: they need to access the predictions/labels to construct their adversarial loss. However, the inaccessibility of predictions/labels makes the white-box attack impractical to a real graph learning system. This paper promotes current frameworks in a more general and flexible sense -- we demand to attack various kinds of graph embedding models with black-box driven. We investigate the theoretical connections between graph signal processing and graph embedding models and formulate the graph embedding model as a general graph signal process with a corresponding graph filter. Therefore, we design a generalized adversarial attacker: GF-Attack. Without accessing any labels and model predictions, GF-Attack can perform the attack directly on the graph filter in a black-box fashion. We further prove that GF-Attack can perform an effective attack without knowing the number of layers of graph embedding models. To validate the generalization of GF-Attack, we construct the attacker on four popular graph embedding models. Extensive experiments validate the effectiveness of GF-Attack on several benchmark datasets.

arXiv commentJournal extension of GF-Attack, accepted by TKDE

References in corpus (29)

• DeepWalk: Online Learning of Social Representations
• LINE: Large-scale Information Network Embedding
• The Emerging Field of Signal Processing on Graphs: Extending High-Dimensional Data Analysis to Networks and Other Irregular Domains
• Graph Embedding Techniques, Applications, and Performance: A Survey
• Simplifying Graph Convolutional Networks
• struc2vec: Learning Node Representations from Structural Identity
• Adversarial Attacks on Neural Networks for Graph Data
• Network Embedding as Matrix Factorization: Unifying DeepWalk, LINE, PTE, and node2vec
• Spatial Temporal Graph Convolutional Networks for Skeleton-Based Action Recognition
• Motifs in Temporal Networks
• The Space of Transferable Adversarial Examples
• Self-Supervised Graph Transformer on Large-Scale Molecular Data
• How Powerful are Graph Neural Networks?
• Adversarial Attacks on Graph Neural Networks via Meta Learning
• Adversarial Attack and Defense on Graph Data: A Survey
• Adaptive Sampling Towards Fast Graph Representation Learning
• Adversarial Attacks on Node Embeddings via Graph Poisoning
• GNNGuard: Defending Graph Neural Networks against Adversarial Attacks
• Adversarial Examples on Graph Data: Deep Insights into Attack and Defense
• Graph Information Bottleneck
• Adversarial Attack on Community Detection by Hiding Individuals
• Implicit Graph Neural Networks
• DeepCas: an End-to-end Predictor of Information Cascades
• Multi-View Graph Neural Networks for Molecular Property Prediction
• Variational Inference for Graph Convolutional Networks in the Absence of Graph Data and Adversarial Settings
• Cross-Entropy Loss and Low-Rank Features Have Responsibility for Adversarial Examples
• Comprehend DeepWalk as Matrix Factorization
• AutoGL: A Library for Automated Graph Learning
• Spectral Graph Attention Network with Fast Eigen-approximation

Cited by in corpus (4)

• Towards Lightweight Graph Neural Network Search with Curriculum Graph Sparsification
• DREAM: Domain-agnostic Reverse Engineering Attributes of Black-box Model
• Adversarial attacks to image classification systems using evolutionary algorithms
• Separated Contrastive Learning for Matching in Cross-domain Recommendation with Curriculum Scheduling