Topology Attack and Defense for Graph Neural Networks: An Optimization Perspective

By Kaidi Xu, Hongge Chen, Sijia Liu, Pin-Yu Chen, Tsui-Wei Weng, Mingyi Hong, Xue Lin. International Joint Conference on Artificial Intelligence, 2019

538 citations recorded by the source corpus.

Graph neural networks (GNNs) which apply the deep neural networks to graph data have achieved significant performance for the task of semi-supervised node classification. However, only few work has addressed the adversarial robustness of GNNs. In this paper, we first present a novel gradient-based attack method that facilitates the difficulty of tackling discrete graph data. When comparing to current adversarial attacks on GNNs, the results show that by only perturbing a small number of edge perturbations, including addition and deletion, our optimization-based attack can lead to a noticeable decrease in classification performance. Moreover, leveraging our gradient-based attack, we propose the first optimization-based adversarial training for GNNs. Our method yields higher robustness against both different gradient based and greedy attack methods without sacrifice classification accuracy on original graph.

Subfields: Artificial Intelligence, Electrical and Electronic Engineering

View Paper: https://www.semanticscholar.org/paper/341880efaef452f631a4a5cd61bef5dae47741d7

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

1. Huan Zhang
2. Jiliang Tang
3. Philip S. Yu
4. Pin-Yu Chen
5. Hongge Chen
6. Bo Li
7. Marinka Zitnik
8. Lichao Sun

In Electrical and Electronic Engineering

1. Huan Zhang
2. Bo Li
3. Philip S. Yu
4. Kaisheng Ma
5. Marinka Zitnik
6. Lichao Sun

Citations in the corpus

• Adversarial Attacks and Defenses in Images, Graphs and Text: A Review (2019, background): “Many of them are inspired by the popular defense methodology in image classification, using adversarial training to protect GNN models[104, 105], which provides moderate robustness.”
• GNNGuard: Defending Graph Neural Networks against Adversarial Attacks (2020, background): “- r The attacker aims to degrade overall GNN classification performance [26, 39].”
• Adversarial T-Shirt! Evading Person Detectors in a Physical World (2019, background): “The vulnerability of deep neural networks (DNNs) against adversarial attacks (namely, perturbed inputs deceiving DNNs) has been found in applications spanning from image classification to speech recognition [33,21,34,37,6,32,2].”
• Adversarial Robustness vs. Model Compression, or Both? (2019, background): “, structure and weight parameters) [7, 8, 50, 44]; or black-box accesses where the adversary can only make queries and observe outputs [9, 22].”
• Adversarial Attack and Defense on Graph Data: A Survey (2018, methodology): “Attack Model GNN [8], [12], [17], [21], [23], [28], [73], [92], [93], [103], [106], [125], [145], [147] [20], [36], [42], [49], [67], [96], [97], [104], [120], [122], [134], [141], [146] Non-GNN [2], [18], [19], [24], [27], [33], [43], [50], [108], [109], [128], [129], [136], [143] [26], [34], [39] ”