Adversarial Attacks on Neural Networks for Graph Data

By Daniel Zügner, Amir Akbarnejad, Stephan Günnemann. 2018

1,271 citations recorded by the source corpus.

Deep learning models for graphs have achieved strong performance for the task of node classification. Despite their proliferation, currently there is no study of their robustness to adversarial attacks. Yet, in domains where they are likely to be used, e.g. the web, adversaries are common. Can deep learning models for graphs be easily fooled? In this work, we introduce the first study of adversarial attacks on attributed graphs, specifically focusing on models exploiting ideas of graph convolutions. In addition to attacks at test time, we tackle the more challenging class of poisoning/causative attacks, which focus on the training phase of a machine learning model.We generate adversarial perturbations targeting the node's features and the graph structure, thus, taking the dependencies between instances in account. Moreover, we ensure that the perturbations remain unnoticeable by preserving important data characteristics. To cope with the underlying discrete domain we propose an efficient algorithm Nettack exploiting incremental computations. Our experimental study shows that accuracy of node classification significantly drops even when performing only few perturbations. Even more, our attacks are transferable: the learned attacks generalize to other state-of-the-art node classification models and unsupervised approaches, and likewise are successful even when only limited knowledge about the graph is given.

Subfields: Artificial Intelligence, Graph Learning, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Graph Learning

In Safety, Robustness & Interpretability

Citations in the corpus

Attacking Graph-based Classification via Manipulating the Graph Structure (2019, methodology): “We note that a recent attack called Nettack [77] for GCN essentially assumes the equal cost.”
Failing Loudly: An Empirical Study of Methods for Detecting Dataset Shift (2018, background): “Seemingly subtle changes in the data distribution can destroy the performance of otherwise state-of-the-art classifiers, a phenomenon exemplified by adversarial examples [51, 57].”
Pitfalls of Graph Neural Network Evaluation (2018, background): “Taking further into account that the predictions of GNNs can greatly change under small data perturbations [Zügner et al., 2018] clearly confirms the need for evaluation strategies based on multiple splits.”
A Comprehensive Survey on Graph Neural Networks (2019, background): “…GNNs to a variety of problems such as program veriﬁcation [17], program reasoning [166], social inﬂuence prediction [167], adversarial attacks prevention [168], electrical health records modeling [169], [170], brain networks [171], event detection [172], and combinatorial optimization [173].”
Generalizable Adversarial Attacks with Latent Variable Perturbation Modelling (2019, methodology): “…while constrained optimization-based attack strategies are easily applicable to continuous input domains (i.e., images), adapting them to new modalities, such as discrete textual data [ 13; 7; 8 ] or graph-structured data that is non-i.i.d. [ 6; 28 ] , represents a signiﬁcant challenge [ 25; 23 ] .”
Data Poisoning Attack against Unsupervised Node Embedding Methods (2018, background): “Existing work (Dai et al., 2018; Zugner et al., 2018) on adversarial attacks on graph are limited to graph neural networks (Kipf & Welling, 2017), a supervised learning method.”
Subgraph Federated Learning with Missing Neighbor Generation (2021, background): “However, as GNNs leverage the homophily of nodes in both node features and link structures to conduct the inference, they are vulnerable to the perturbation on graphs [13, 14, 15].”
Data Poisoning Attacks on Federated Machine Learning (2020, background): “Furthermore, poisoning attack is investigated on many machine learning models, including autoregressive models [1], matrix factorization based collaborative ﬁltering [13] and neural networks for graph data [22].”
Graph Information Bottleneck (2020, positive): “Recent literature shows that representations learned by GNNs are far from robust and can be easily attacked by malicious manipulation on either features or structure [15,16].”
Graph Random Neural Networks for Semi-Supervised Learning on Graphs (2020, background): “Second, GNNs are often not robust to graph attacks [48, 45], due to the deterministic propagation adopted in most of them.”
Adversarial Examples on Graph Data: Deep Insights into Attack and Defense (2019, methodology): “[Z¨ugner et al. , 2018] uses a simpliﬁed surrogate model to achieve the attacks on GCN models for the same reason.”
A Review on Generative Adversarial Networks: Algorithms, Theory, and Applications (2020, background): “This is a very hot research topic recently [112], [113].”
You Only Propagate Once: Accelerating Adversarial Training via Maximal Principle (2019, background): “However, recent works show that deep networks are often sensitive to adversarial perturbations [26,33,45], i.”
GNNGuard: Defending Graph Neural Networks against Adversarial Attacks (2020, methodology): “r r r We compare our model to baselines under three kinds of adversarial attacks: direct targeted attack (Nettack-Di [8]), influence targeted attack (NettackIn [8]), and non-targeted attack (Mettack [26]).”
Adversarial Attacks on Node Embeddings via Graph Poisoning (2018, methodology): “While adversarial attacks for graph models have been proposed recently (Zügner et al., 2018; Dai et al., 2018a; Zügner & Günnemann, 2019), they are all limited to the semisupervised learning setting.”
Adversarial Attack on Graph Structured Data (2018, background): “Z¨ugner et al. (2018) studied the problem of adversarial attack over graphs in parallel to our work, although with very different methods. combinatorial optimization : Modifying the discrete structure to fool the target classiﬁer can be treated as a combinatorial optimization problem.”