Adversarial Attacks on Graph Neural Networks via Meta Learning

By Daniel Zügner, Stephan Günnemann. 2019

659 citations recorded by the source corpus.

Deep learning models for graphs have advanced the state of the art on many tasks. Despite their recent success, little is known about their robustness. We investigate training time attacks on graph neural networks for node classification that perturb the discrete graph structure. Our core principle is to use meta-gradients to solve the bilevel problem underlying training-time attacks, essentially treating the graph as a hyperparameter to optimize. Our experiments show that small graph perturbations consistently lead to a strong decrease in performance for graph convolutional networks, and even transfer to unsupervised embeddings. Remarkably, the perturbations created by our algorithm can misguide the graph neural networks such that they perform worse than a simple baseline that ignores all relational information. Our attacks do not assume any knowledge about or access to the target classifiers.

Subfields: Artificial Intelligence

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

Citations in the corpus

Attacking Graph-based Classification via Manipulating the Graph Structure (2019, background): “Several work [8, 16, 57, 77, 78] proposed attacks to graph neural network methods via inserting fake edges to the graph or deleting existing edges.”
Adversarial Attacks on Neural Networks for Graph Data (2018, background): “Can deep learning models for graphs be easily fooled? In this extended abstract we summarize the key findings and contributions of our work [Zügner and Günnemann, 2019a], in which we introduce the first study of adversarial attacks on attributed graphs, specifically focusing on models exploiting ide”
Node Similarity Preserving Graph Convolutional Networks (2020, methodology): “We adopt metattack [45] as the attack method.”
Adversarial Attack and Defense on Graph Data: A Survey (2018, methodology): “Citation Network Node/Link Citeseer [87] 3,327 4,732 3,703 6 [145], [28], [23], [106], [92], [8], [147], [12], [129], [120], [125], [17], [127], [40], [140], [89], [22], [144], [105] , [57], [148], [9], [52], [53], [107], [36], [134], [96], [20], [54], [29], [56], [31], [76], [77], [146], [59], [49]”
Topology Attack and Defense for Graph Neural Networks: An Optimization Perspective (2019, methodology): “We compare our four attack methods (CE-PGD, CW-PGD, CE-min-max, CW-min-max) with DICE (‘delete edges internally, connect externally’) [ Waniek et al. , 2018 ] , Meta-Self attack [ Z¨ugner and G¨unnemann, 2019 ] and greedy attack, a variant of Meta-Self attack without weight re-training for GCN.”
Query-efficient Meta Attack to Deep Neural Networks (2019, methodology): “Zgner & Gnnemann (2019) try to attack the structure of a graph model in the training process to decrease the model generalization performance.”
Bilevel Optimization: Convergence Analysis and Enhanced Design (2020, methodology): “Bilevel optimization in meta-learning : Bilevel optimization framework has been successfully applied to meta-learning recently (Snell et al., 2017; Franceschi et al., 2018; Rajeswaran et al., 2019; Z¨ugner & G¨unnemann, 2019; Ji et al., 2020a;b).”
Advances in adversarial attacks and defenses in computer vision: A survey (2021, background): “For instance, attacks specifically devised for GCNs are studied in [188] and [193].”
Adversarial Attacks on Node Embeddings via Graph Poisoning (2018, methodology): “Z¨ugner & G¨unnemann (2019) develop a general attack on the training procedure of GCN using meta-gradients.”
Deep Learning on Graphs: A Survey (2018, neutral): “[129] Targeted attacks of graph structures O(M) No Zugner and Gunnemann [130] Non-targeted attacks of graph structures O(N2) No”
Graph Structure Learning for Robust Graph Neural Networks (2020, methodology): “Specifically, we apply the state-of-the-art graph poisoning attack, metattack [39], to perturb the graph data and visualize the graph properties before and after mettack.”
Robust Graph Convolutional Networks Against Adversarial Attacks (2019, background): “In targeted attacks [7, 37], the attacker focus on misclassifying some target nodes while in non-targeted attacks [38], the attacker aims to reduce the overall model performance.”
Subgraph Federated Learning with Missing Neighbor Generation (2021, background): “However, as GNNs leverage the homophily of nodes in both node features and link structures to conduct the inference, they are vulnerable to the perturbation on graphs [4, 40, 41].”
Graph Random Neural Networks for Semi-Supervised Learning on Graphs (2020, methodology): “Under Metattack, the gap between GRAND and GCN/GAT also enlarges with the increase of the perturbation rate.”
Certifiable Robustness and Robust Training for Graph Convolutional Networks (2019, background): “Only recently, however, researchers have started to investigate adversarial attacks on graph neural networks [4, 21, 22] and node embeddings [1].”
Adversarial Attacks and Defenses in Images, Graphs and Text: A Review (2019, background): “Dai’s RL Method : RL-S2V Different from Zugner’s greedy method, the work (Dai et al., 2018) introduced a Reinforcement Learning method to attack the graph neural networks.”
GNNGuard: Defending Graph Neural Networks against Adversarial Attacks (2020, methodology): “r r r We compare our model to baselines under three kinds of adversarial attacks: direct targeted attack (Nettack-Di [8]), influence targeted attack (NettackIn [8]), and non-targeted attack (Mettack [26]).”