Black-box Adversarial Attack and Defense on Graph Neural Networks

Abstract

Graph neural networks (GNNs) have achieved great success on various graph tasks. However, recent studies have revealed that GNNs are vulnerable to adversarial attacks, including topology modifications and feature perturbations. Regardless of the fruitful progress, existing attackers require node labels and GNN parameters to optimize a bi-level problem, or cannot cover both topology modifications and feature perturbations, which are not practical, efficient, or effective. In this paper, we propose a black-box attacker PEEGA, which is restricted to access node features and graph topology for practicability. Specifically, we propose to measure the negative impact of various adversarial attacks from the perspective of node representations, thereby we formulate a single-level problem that can be efficiently solved. Furthermore, we observe that existing attackers tend to blur the context of nodes through adding edges between nodes with different labels. As a result, GNNs are unable to recognize nodes. Based on this observation, we propose a GNN defender GNAT, which incorporates three augmented graphs, i.e., a topology graph, a feature graph, and an ego graph, to make the context of nodes more distinguishable. Extensive experiments on three real-world datasets demonstrate the effectiveness and efficiency of our proposed attacker, despite the fact that we do not access node labels and GNN parameters. Moreover, the effectiveness and efficiency of our proposed defender are also validated by substantial experiments.

Uplift Modeling for Target User Attacks on Recommender Systems

“…First, heuristic attackers intuitively increase the co-occurrence of some selected items and the target item 𝑖 in 𝑫 𝑓 via some heuristic rules, enhancing the popularity of item 𝑖 [31]. However, such methods cannot directly optimize the attack objectives, leading to poor attack performance [19,30,32]. Besides, to maximize the attack objectives, gradient-based methods directly optimize the interactions of fake users [19,30,32] while neural attackers optimize neural networks to generate fake user interactions [26,34,35,51].…”

“…However, such methods cannot directly optimize the attack objectives, leading to poor attack performance [19,30,32]. Besides, to maximize the attack objectives, gradient-based methods directly optimize the interactions of fake users [19,30,32] while neural attackers optimize neural networks to generate fake user interactions [26,34,35,51]. Their optimization process typically utilizes the recommendations of the victim model or a surrogate model for gradient descent [44,63].…”

Adversarial Machine Learning: A Systematic Survey of Backdoor Attack, Weight Attack and Adversarial Example

“…Bandit [86] extended this gradient estimation by embedding both the spatial prior (neighboring pixels have similar gradients) and the temporal prior (the gradients between consecutive iterations are similar) to obtain more consistent gradients. N Attack [112] extended the NES attack by restricting the vectors sampled from the Gaussian distribution into the feasible space (i.e., the allowed search space of adversarial perturbation). The AdvFlow method [134] further extended N Attack by replacing the Gaussian distribution by a complex distribution which is captured by the normalizing flow model [175] pre-trained on benign data, such that the generated adversarial sample is more close to the benign sample.…”

Resisting Graph Adversarial Attack via Cooperative Homophilous Augmentation

“…2) Preprocessing Filter: In the case where the attack budgets are constrained and fixed, to maximize the damage to the overall performance of the graph model, it is reasonable to focus on the nodes that can be correctly classified by the graph model [21]. Therefore, it is desirable to first find out items already classified correctly.…”