Certified Robustness of Community Detection against Adversarial Structural Perturbation via Randomized Smoothing

Abstract

Community detection plays a key role in understanding graph structure. However, several recent studies showed that community detection is vulnerable to adversarial structural perturbation. In particular, via adding or removing a small number of carefully selected edges in a graph, an attacker can manipulate the detected communities. However, to the best of our knowledge, there are no studies on certifying robustness of community detection against such adversarial structural perturbation. In this work, we aim to bridge this gap. Specifically, we develop the first certified robustness guarantee of community detection against adversarial structural perturbation. Given an arbitrary community detection method, we build a new smoothed community detection method via randomly perturbing the graph structure. We theoretically show that the smoothed community detection method provably groups a given arbitrary set of nodes into the same community (or different communities) when the number of edges added/removed by an attacker is bounded. Moreover, we show that our certified robustness is tight. We also empirically evaluate our method on multiple real-world graphs with ground truth communities.

Backdoor Attacks to Graph Neural Networks

“…Randomized smoothing: Randomized smoothing [4,10,19,24,25,27,28,32] is state-of-the-art technique to build provably robust machine learning. Compared with other certified defense mechanisms, randomized smoothing has two key advantages: 1) scalable to large neural networks, and 2) applicable to arbitrary classifiers.…”

“…Cohen et al [10] derived the first tight certified robustness guarantee for randomized smoothing with Gaussian noise by Neyman-Pearson Lemma [36]. Jia et al [19] generalized the tight certified robustness guarantee to general toppredictions for randomized smoothing with Gaussian noise. Jia et al [20] leveraged randomized smoothing to certify robustness of community detection against structural perturbations.…”

“…Jia et al [19] generalized the tight certified robustness guarantee to general toppredictions for randomized smoothing with Gaussian noise. Jia et al [20] leveraged randomized smoothing to certify robustness of community detection against structural perturbations. All these randomized smoothing methods add additive noise to a testing example.…”

FoggySight: A Scheme for Facial Lookup Privacy

“…There has been research on providing a variety of defenses to adversarial examples. Some of it has shown qualified empirical success [40], some has provided certification guarantees about very specific adversaries [65] and some has even focused on top-k classification [32]. However, the adversarial examples research literature has also found that robust performance (on adversarial examples) often comes at the cost of clean performance (on regular test set examples) [30].…”

On the Security of Randomized Defenses Against Adversarial Samples

“…This solution trades scalability with clean-data accuracy, which drops significantly as the allowed adversarial perturbation increases. In a similar vein, recent works prove the certified robustness of randomized smoothing, a pre-processing technique similar to Randomized Squeezing and Region-Based Classification which adds Gaussian noise to the classifier's input (instead of uniform noise) [9,22].…”