Adversarial Examples for Graph Data: Deep Insights into Attack and Defense

Abstract

Graph deep learning models, such as graph convolutional networks (GCN) achieve remarkable performance for tasks on graph data. Similar to other types of deep models, graph deep learning models often suffer from adversarial attacks. However, compared with non-graph data, the discrete features, graph connections and different definitions of imperceptible perturbations bring unique challenges and opportunities for the adversarial attacks and defenses for graph data. In this paper, we propose both attack and defense techniques. For attack, we show that the discreteness problem could easily be resolved by introducing integrated gradients which could accurately reflect the effect of perturbing certain features or edges while still benefiting from the parallel computations. For defense, we observe that the adversarially manipulated graph for the targeted attack differs from normal graphs statistically. Based on this observation, we propose a defense approach which inspects the graph and recovers the potential adversarial perturbation. Our experiments on a number of datasets show the effectiveness of the proposed methods.

Towards Revealing Parallel Adversarial Attack on Politician Socialnet of Graph Structure

“…On the other hand, proposing a perturbation filtering mechanism to reduce the size of multinode candidate perturbations set is also an effective way. In addition, our method does not consider the constraints of attributed graphs [33], such as attribution-based node similarity constraint [34] and attribution cooccurrence constraint [17]. Parallel multinode adversarial attack on attributed graph and Heterogeneous Information Network (HIN) [35] still needs further exploration.…”

Deep Insights into Graph Adversarial Learning: An Empirical Study Perspective

“…In a follow-up study, Zügner et al [29] study the discreteness of graph data, and solve the bilevel problem of poisoning attacks using meta gradients. Wu et al [22] introduce integrated gradients that could guide the attack of perturbing certain features or edges while still benefiting from the parallel computations. Additionally, several heuristic methods are also proposed to poison the GNNs [1,8,16], revealing the vulnerability of GNNs in different graph analysis tasks.…”

“…In addition, it is an intuitive way to preprocess the input data and thus reducing the effects of adversarial examples. Wu et al [22] inspect the input graph and recover the potential adversarial examples with Jaccard Similarity. Entezari et al [9] demonstrate that attackers only affect the high-rank singular components of the graph, and further propose a low-rank approximation method to reduce the adversarial effects.…”

Finding Achilles' Heel

“…Due to limited space, for a comprehensive literature survey of adversarial attacks, please refer to a recent study [2]. There are some notable papers [4,26,46,58,59] after the survey published in 2018, but we did not notice any adversarial attack paper on action recognition applications. One of the reasons is that adversarial attack on video level classifiers is more complicated due to the availability of multiple modes of information.…”