Robust Graph Convolutional Networks Against Adversarial Attacks

Zhu, Dingyuan; Zhang, Ziwei; Cui, Peng; Zhu, Wenwu

doi:10.1145/3292500.3330851

Cited by 308 publications

(244 citation statements)

References 13 publications

Supporting

Mentioning

220

Contrasting

Order By: Relevance

“…Specifically, an attacker can slightly perturb the graph structure and/or node features to mislead the predictions made by GNNs. Some empirical defenses [38,39,41] were proposed to defend against such attacks. However, these methods do not have certified robustness guarantees.…”

Section: Related Workmentioning

confidence: 99%

Certified Robustness of Community Detection against Adversarial Structural Perturbation via Randomized Smoothing

Jia

Wang

Cao

et al. 2020

Proceedings of the Web Conference 2020

View full text Add to dashboard Cite

Community detection plays a key role in understanding graph structure. However, several recent studies showed that community detection is vulnerable to adversarial structural perturbation. In particular, via adding or removing a small number of carefully selected edges in a graph, an attacker can manipulate the detected communities. However, to the best of our knowledge, there are no studies on certifying robustness of community detection against such adversarial structural perturbation. In this work, we aim to bridge this gap. Specifically, we develop the first certified robustness guarantee of community detection against adversarial structural perturbation. Given an arbitrary community detection method, we build a new smoothed community detection method via randomly perturbing the graph structure. We theoretically show that the smoothed community detection method provably groups a given arbitrary set of nodes into the same community (or different communities) when the number of edges added/removed by an attacker is bounded. Moreover, we show that our certified robustness is tight. We also empirically evaluate our method on multiple real-world graphs with ground truth communities.

show abstract

Section: Related Workmentioning

confidence: 99%

Certified Robustness of Community Detection against Adversarial Structural Perturbation via Randomized Smoothing

Jia

Wang

Cao

et al. 2020

Proceedings of the Web Conference 2020

View full text Add to dashboard Cite

show abstract

“…For example, Wu et al [35] utilize the Jaccard similarity of features to prune perturbed graphs with the assumption that connected nodes should have high feature similarity. RGCN in [39] adopts Gaussian distributions as the node representations in each convolutional layer to absorb the e ects of adversarial changes in the variances of the Gaussian distributions. e basic idea of aforementioned robust GNNs against poisoning a ack is to alleviate the negative e ects of the perturbed edges.…”

Section: Adversarial Attack and Defense On Graphsmentioning

confidence: 99%

“…Jaccard similarity is used sparse features and Cosine similarity is adopted for dense features. • RGCN [39]: RGCN aims to defend against adversarial edges with Gaussian distributions as the latent node representation in hidden layers to absorb the negative e ects of adversarial edges. • VPN [17]: Di erent from GCN, parameters of VPN are trained on a family of powered graphs of G. e family of powered graphs increases the spatial eld of normal graph convolution, thus improves the robustness.…”

Section: Baselinesmentioning

confidence: 99%

“…For example, Wu et al [35] utilize Jaccard similarity of features to prune perturbed graphs with the assumption that connected nodes have high feature similarity. RGCN in [39] introduce Gaussian constrains on model parameters to absorb the e ects of adversarial changes. e aforementioned models only rely on the poisoned graph for training, leading to sub-optimal solutions.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Transferring Robustness for Graph Neural Network Against Poisoning Attacks

Tang

Sun

et al. 2020

Proceedings of the 13th International Conference on Web Search and Data Mining

155

View full text Add to dashboard Cite

Graph neural networks (GNNs) are widely used in many applications. However, their robustness against adversarial a acks are criticized. Prior studies shows that using unnoticeable modi cations on graph topology or nodal features can signi cantly reduce the performances of GNNs. It is very challenging to design robust graph neural networks against poisoning a ack and several e orts have been taken. Existing work aims at reducing the negative impact from adversarial edges only with the poisoned graph, which is sub-optimal since they fail to discriminate adversarial edges from normal ones. On the other hand, clean graphs from similar domains as the target poisoned graph are usually available in real world. By perturbing these clean graphs, we create supervised knowledge to train the ability to detect adversarial edges so that the robustness of GNNs is elevated. However, such potential for clean graphs is neglected by existing work. To this end, we investigate a novel problem of improving the robustness of GNNs against poisoning a acks by exploring clean graphs. Speci cally, we propose PA-GNN, which relies on a penalized aggregation mechanism that directly restrict the negative impact of adversarial edges by assigning them lower a ention coe cients. To optimize PA-GNN for a poisoned graph, we design a meta-optimization algorithm that trains PA-GNN to penalize perturbations using clean graphs and their adversarial counterparts, and transfers such ability to improve the robustness of PA-GNN on the poisoned graph. Experimental results on four real-world datasets demonstrate the robustness of PA-GNN against poisoning a acks on graphs. ACM Reference format:

show abstract

“…Multiple CDAs are available to analyze the network structure but, a little work has been done to conceal the community information of the nodes in the network. 10,[31][32][33][34] Researchers found the motivation behind the hiding of information and discussed various deception mechanisms in the social network. Caspi and Gorsky 35 performed a web-based survey on the motivation and emotions for Israeli users' online deception.…”

Section: Introductionmentioning

confidence: 99%

Intelligent deception techniques against adversarial attack on the industrial system

Kumari¹,

Yadav²,

Namasudra

et al. 2021

Int J Intell Syst

View full text Add to dashboard Cite

Community detection algorithms (CDAs) are aiming to group nodes based on their connections and play an essential role in the complex system analysis. However, for privacy reasons, we may want to prevent communities or a group of nodes in the complex industrial network from being discovered in some instances, leading to the topics on community deception. In this paper, we introduce and formalize two intelligent community deception methods to conceal the nodes from various CDAs. We used node‐based matrices, persistence and safeness scores, to formalize the optimization problems to confound the CDAs. The persistence score is used to destabilize the constant communities in the network while the safeness score is used to assess the level of hiding of a node from CDAs. The objective functions aim to minimize the persistence score and maximize the safeness score of the nodes in the network. From the simulation results, it can be analyzed that the proposed strategies are intelligently concealing the community information in the complex industrial system.

show abstract

Robust Graph Convolutional Networks Against Adversarial Attacks

Cited by 308 publications

References 13 publications

Certified Robustness of Community Detection against Adversarial Structural Perturbation via Randomized Smoothing

Certified Robustness of Community Detection against Adversarial Structural Perturbation via Randomized Smoothing

Transferring Robustness for Graph Neural Network Against Poisoning Attacks

Intelligent deception techniques against adversarial attack on the industrial system

Contact Info

Product

Resources

About