Derivative-free optimization adversarial attacks for graph convolutional networks

Abstract

In recent years, graph convolutional networks (GCNs) have emerged rapidly due to their excellent performance in graph data processing. However, recent researches show that GCNs are vulnerable to adversarial attacks. An attacker can maliciously modify edges or nodes of the graph to mislead the model’s classification of the target nodes, or even cause a degradation of the model’s overall classification performance. In this paper, we first propose a black-box adversarial attack framework based on derivative-free optimization (DFO) to generate graph adversarial examples without using gradient and apply advanced DFO algorithms conveniently. Second, we implement a direct attack algorithm (DFDA) using the Nevergrad library based on the framework. Additionally, we overcome the problem of large search space by redesigning the perturbation vector using constraint size. Finally, we conducted a series of experiments on different datasets and parameters. The results show that DFDA outperforms Nettack in most cases, and it can achieve an average attack success rate of more than 95% on the Cora dataset when perturbing at most eight edges. This demonstrates that our framework can fully exploit the potential of DFO methods in node classification adversarial attacks.

Trustworthy Graph Neural Networks: Aspects, Methods and Trends

“…In black-box attack scenarios, however, the gradients are unknown to attackers. There are several approaches [52], [101], [89] designed for solving the optimisation problem without using gradients, such as reinforcement learning [89] and genetic algorithms [52]. Specifically, attackers utilising reinforcement learning algorithms can define graph perturbations as executing actions, then design rewards based on their attack goals [52].…”

“…These approaches may require additional effort to determine the gradients (e.g., the time cost for the Topology attack using a surrogate model can be six to ten times that of a simple gradient-based approach [104]). Meanwhile, non-gradient methods are also widely employed in many studies [52], [101]. Most of these methods do not require knowledge of gradients, which makes them more practical when dealing with situations in which an attacker has limited knowledge.…”

Generalization of Neural Combinatorial Solvers Through the Lens of Adversarial Robustness

“…its inputs (see § D). For nondifferentiable models, one can use derivative-free optimization (Yang & Long, 2021).…”

“…Fortunately, most neural combinatorial solvers rely on GNNs and therefore this does not impose an issue. However, even if assessing a non-differentiable model one could revert to derivative-free optimization (Yang & Long, 2021).…”

“…Nevertheless, this could be done with derivative-free optimization (Yang & Long, 2021) or a scalable variant of of L 0 -PGD called projected randomized block coordinate descent (Geisler et al, 2021).…”