Adversarial Attacks on Graph Classification via Bayesian Optimisation
arXiv:2111.02842
Abstract
Graph neural networks, a popular class of models effective in a wide range of graph-based learning tasks, have been shown to be vulnerable to adversarial attacks. While the majority of the literature focuses on such vulnerability in node-level classification tasks, little effort has been dedicated to analysing adversarial attacks on graph-level classification, an important problem with numerous real-life applications such as biochemistry and social network analysis. The few existing methods often require unrealistic setups, such as access to internal information of the victim models, or an impractically-large number of queries. We present a novel Bayesian optimisation-based attack method for graph classification models. Our method is black-box, query-efficient and parsimonious with respect to the perturbation applied. We empirically validate the effectiveness and flexibility of the proposed method on a wide range of graph classification tasks involving varying graph properties, constraints and modes of attack. Finally, we analyse common interpretable patterns behind the adversarial samples produced, which may shed further light on the adversarial robustness of graph classification models.
NeurIPS 2021. 11 pages, 8 figures, 2 tables (24 pages, 17 figures, 8 tables including references and appendices)
References in corpus (19)
- Adversarial Attacks on Neural Networks for Graph Data
- Deep Graph Library: A Graph-Centric, Highly-Performant Package for Graph Neural Networks
- Discriminative Embeddings of Latent Variable Models for Structured Data
- TUDataset: A collection of benchmark datasets for learning with graphs
- Adversarial Attack and Defense on Graph Data: A Survey
- Benchmarking Graph Neural Networks
- Adversarial Attacks on Node Embeddings via Graph Poisoning
- Adversarial Examples on Graph Data: Deep Insights into Attack and Defense
- Wasserstein Weisfeiler-Lehman Graph Kernels
- Attacking Graph Convolutional Networks via Rewiring
- Adversarial Attacks and Defenses on Graphs: A Review, A Tool and Empirical Studies
- Black-box Adversarial Attacks with Bayesian Optimization
- Adversarial Attack on Hierarchical Graph Pooling Neural Networks
- Interpretable Neural Architecture Search via Bayesian Optimisation with Weisfeiler-Lehman Kernels
- Explainability-based Backdoor Attacks Against Graph Neural Networks
- Query-limited Black-box Attacks to Classifiers
- GraphAttacker: A General Multi-Task GraphAttack Framework
- CorrAttack: Black-box Adversarial Attack with Structured Search
- BO-DBA: Query-Efficient Decision-Based Adversarial Attacks via Bayesian Optimization