Can Adversarial Network Attack be Defended?

Abstract

Machine learning has been successfully applied to complex network analysis in various areas, and graph neural networks (GNNs) based methods outperform others. Recently, adversarial attack on networks has attracted special attention since carefully crafted adversarial networks with slight perturbations on clean network may invalid lots of network applications, such as node classification, link prediction, and community detection etc. Such attacks are easily constructed with serious security threat to various analyze methods, including traditional methods and deep models. To the best of our knowledge, it is the first time that defense method against network adversarial attack is discussed. In this paper, we are interested in the possibility of defense against adversarial attack on network, and propose defense strategies for GNNs against attacks. First, we propose novel adversarial training strategies to improve GNNs' defensibility against attacks. Then, we analytically investigate the robustness properties for GNNs granted by the use of smooth defense, and propose two special smooth defense strategies: smoothing distillation and smoothing cross-entropy loss function. Both of them are capable of smoothing gradient of GNNs, and consequently reduce the amplitude of adversarial gradients, which benefits gradient masking from attackers. The comprehensive experiments show that our proposed strategies have great defensibility against different adversarial attacks on four real-world networks in different network analyze tasks.

On Generalization of Graph Autoencoders with Adversarial Training

“…Jin and Zhang [8] introduce latent adversarial training for GCN, which train GCN based on the adversarial perturbed output of the first layer. Besides, several studies explored adversarial training based on adversarial perturbed edges for graph data [31,1,28]. Among these works,part of studies pay attention to achieving model's robustness while ignoring the effect of generalization [31,8,1,28,2] and the others simply utilize perturbations on nodal attributes while not explore the effect of perturbation on edges [3,22,5].…”

GraphAttacker: A General Multi-Task GraphAttack Framework

“…Besides adversarial training, Chen et al [8] trained a distillation GCN model by using the output confidence of the initial GCN as a soft label. Based on graph purification defense, [15] performed low-rank approximation on the graph to reduce the impact of NETTACK.…”

“…In various online data, de-anonymization attacks [22], [23] expose users' private information, which leads to the issues of privacy leakage. Therefore, the attacks [4], [6], [9], [12], [57], [60], [63] and possible defenses [8], [13], [15], [16], [29], [41], [45], [62] research on GNNs has become the hot spot.…”

A Survey of Adversarial Learning on Graphs

“…Other adversarial-based models are fed with adversarial samples during the training process, which helps the model learn to adjust to adversarial samples and thus reduces the negative impacts of those potential attack samples. [73], [54], [23] are the scenarios of the former one, while [10], [67], [21] and [26] are the scenarios of the latter one.…”

“…In particular, we first introduced some common metrics for both defense and attack, and then introduce some metrics provided in their respective work in three categories: effectiveness, efficiency, and imperceptibility. For instance, the Attack Success Rate (ASR) [9] and the Average Defense Rate (ADR) [10] are proposed to measure the effectiveness of attack and defense, respectively.…”