Adversarial Attacks on Node Embeddings

1 INTRODUCTION . Unsupervised node embedding ( network representation learning ) approaches are becoming increasingly popular and achieve state-of-the-art performance on many network learning tasks ( Cai et al. , 2017 ) . The goal is to embed each node in a low-dimensional feature space such that the graph ’ s structure is captured . The learned embeddings are subsequently used for downstream tasks such as link prediction , node classification , community detection , and visualization . Among the variety of proposed approaches , techniques based on random walks ( RWs ) ( Perozzi et al . ; Grover & Leskovec ) are highly successful since they incorporate higher-order relational information . Given the increasing popularity of these method , there is a strong need for an analysis of their robustness . In particular , we aim to study the existence and effects of adversarial perturbations . A large body of research shows that traditional ( deep ) learning methods can easily be fooled/attacked : even slight deliberate data perturbations can lead to wrong results ( Goodfellow et al. , 2014 ; Mei & Zhu , 2015 ; Carlini & Wagner , 2017 ; Liang et al. , 2017 ; Cisse et al. , 2017 ; Lin et al. , 2017 ; Chen et al. , 2017a ) . So far , however , the question of adversarial perturbations for node embeddings has not been addressed . This is highly critical , since especially in domains where graph embeddings are used ( e.g . the web ) adversaries are common and false data is easy to inject : e.g . spammers might create fake followers on social media or fraudsters might manipulate friendship relations in social networks . Can node embedding approaches be easily fooled ? The answer to this question is not immediately obvious . On one hand , the relational ( non-i.i.d . ) nature of the data might improve robustness since the embeddings are computed for all nodes jointly rather than for individual nodes in isolation . On the other hand , the propagation of information might also lead to cascading effects , where perturbations in one part of the graph might affect many other nodes in another part of the graph . Compared to the existing works on adversarial attacks our work significantly differs in various aspects . First , by operating on plain graph data , we do not perturb the features of individual instances but rather their interaction/dependency structure . Manipulating the structure ( the graph ) is a highly realistic scenario . For example , one can easily add or remove fake friendship relations on a social network , or write fake reviews to influence graph-based recommendation engines . Second , the node embedding works are typically trained in an unsupervised and transductive fashion . This means that we can not rely on a single end-task that our attack might exploit to find appropriate perturbations , and we have to handle a challenging poisoning attack where the model is learned after the attack . That is , the model can not be assumed to be static as in most other adversarial attack works . Lastly , since graphs are discrete classical gradient-based approaches ( Li et al . ; Mei & Zhu , 2015 ) for finding adversarial perturbations that were designed for continuous data are not well suited . Particularly for RW-based methods , the gradient computation is not directly possible since they are based on a non-differentiable sampling procedure . How to design efficient algorithms that are able to find adversarial perturbations in such a challenging – discrete and combinatorial – graph domain ? We propose a principled strategy for adversarial attacks on unsupervised node embeddings . Exploiting results from eigenvalue perturbation theory ( Stewart , 1990 ) we are able to efficiently solve a challenging bi-level optimization problem associated with the poisoning attack . We assume an attacker with full knowledge about the data and the model , thus , ensuring reliable vulnerability analysis in the worst case . Nonetheless , our experiments on transferability demonstrate that our strategy generalizes – attacks learned based on one model successfully fool other models as well . Overall , we shed light on an important problem that has not been studied so far . We show that node embeddings are sensitive to adversarial attacks . Relatively few changes are needed to significantly damage the quality of the embeddings even in the scenario where the attacker is restricted . Furthermore , our work highlights that more work is needed to make node embeddings robust to adversarial perturbations and thus readily applicable in production systems . 2 RELATED WORK . We focus on adversarial attacks on unsupervised node embedding approaches based on random walks ( RWs ) , and further show how one can easily apply a similar analysis to attack other node embeddings based on factorization . For a recent extensive survey , also of other non-RW based approaches , we refer to Cai et al . ( 2017 ) . Moreover , while many ( semi- ) supervised learning methods ( Kipf & Welling , 2016 ; Defferrard et al . ) have been introduced , we focus on unsupervised methods since they are often used in practice due to their flexibility in solving various downstream tasks . Adversarial attacks . Attacking machine learning models has a long history , with seminal works on SVMs and logistic regression ( Biggio et al. , 2012 ; Mei & Zhu , 2015 ) . Deep neural networks were also shown to be highly sensitive to small adversarial perturbations to the input ( Szegedy et al. , 2013 ; Goodfellow et al. , 2014 ) . While most works focus on image classification , recent works have shown the existence of adversarial examples also in other domains ( Liang et al. , 2017 ; Grosse et al. ) . Different taxonomies exist characterizing the attacks/adversaries based on their goals , knowledge , and capabilities ( Biggio et al . ; Papernot et al . ; Muñoz-González et al. , 2017 ) . The two dominant attacks types are poisoning attacks that target the training data ( the model is trained after the attack ) and evasion attacks that target the test data/application phase ( the learned model is assumed fixed ) . Compared to evasion attacks , poisoning attacks are far less studied ( Koh & Liang , 2017 ; MuñozGonzález et al. , 2017 ; Li et al . ; Mei & Zhu , 2015 ; Chen et al. , 2017a ) since they require solving a challenging bi-level optimization problem . Attacks on semi-supervised graph models . The robustness of semi-supervised graph classification methods to adversarial attacks has recently been analyzed ( Zügner et al. , 2018 ; Dai et al. , 2018a ) . The first work , introduced by Zügner et al . ( 2018 ) , linearizes a graph convolutional network ( GCN ) ( Kipf & Welling , 2016 ) to derive a closed-form expression for the change in class probabilities for a given edge/feature perturbation . They calculate a score for each possible edge flip based on the classification margin and greedily pick the top edge flips with highest scores . Later , Dai et al . ( 2018a ) proposed a reinforcement ( Q- ) learning formulation where they decompose the selection of relevant edge flips into selecting the two end-points . Both approaches focus on targeted attacks ( misclassify a given node ) for the semi-supervised graph classification task . In contrast , our work focuses on general attacks ( decrease the overall quality ) on unsupervised node embeddings . Manipulating graphs . In the context of graph clustering , Chen et al . ( 2017b ) measure the changes in the result when injecting noise to a bi-partite graph of DNS queries , but do not focus on automatically generating attacks . There is an extensive literature on works that optimize the graph structure to manipulate e.g . information spread in a network ( Chen et al . ; Khalil et al . ) , user opinions ( Amelkin & Singh , 2017 ; Chaoji et al . ) , shortest paths ( Phillips ; Israeli & Wood ) , page rank scores and other metrics ( Avrachenkov & Litvak ; Chan et al. ) . Remotely related are poisoning attacks on multi-task relationship learning ( Zhao et al. , 2018 ) . While they exploit the relations between different tasks , they still deal with the classical scenario of i.i.d . instances within each task . Robustness and adversarial training . The robustification of machine learning models has also been studied – known as adversarial machine learning or robust machine learning . Such approaches are out of scope for this paper and we do not discuss them . The goal of adversarial training ( e.g . via GANs ( Dai et al. , 2018b ) ) is to improve the embeddings , while our goal is to damage the embeddings produced by existing models by perturbing the graph structure . 3 ATTACKING NODE EMBEDDINGS . Here we explore poisoning attacks on the graph structure – the attacker is capable of adding or removing ( flipping ) edges in the original graph within a given budget . We focus mainly on approaches based on random walks and extend the analysis to spectral approaches ( Sec . 6.2 in the appendix ) . 3.1 BACKGROUND AND PRELIMINARIES . Let G = ( V , E ) be an undirected unweighted graph where V is the set of nodes , E is the set of edges , and A ∈ { 0 , 1 } |V |×|V | is the adjacency matrix . The goal of network representation learning is to find a low-dimensional embedding zv ∈ RK for each node with K |V | . This dense lowdimensional representation should preserve information about the network structure – nodes similar in the original network should be close in the embedding space . DeepWalk ( Perozzi et al . ) and node2vec ( Grover & Leskovec ) learn an embedding based on RWs by extending and adapting the skip-gram architecture ( Mikolov et al. , 2013 ) for learning word embeddings . They sample finite ( biased ) RWs and use the co-occurrence of node-context pairs in a given window in each RW as a measure of similarity . To learn zv they maximize the probability of observing v ’ s neighborhood . 3.2 ATTACK MODEL . We denote with Â the adjacency matrix of the graph obtained after the attacker has modified certain entries in A . We assume the attacker has a given , fixed budget and is only capable of modifying f entries , i.e . ||Â − A||0 = 2f ( we have 2f since G is undirected ) . The goal of the attacker is to damage the quality of the learned embeddings , which in turn harms subsequent learning tasks such as node classification or link prediction that use the embeddings as features . We consider both a general attack that aims to degrade the embeddings of the network as a whole , as well as a targeted attack that aims to damage the embedding regarding a specific target or specific task . The quality of the embeddings is measured by the lossL ( A , Z ) of the model under attack , with lower loss corresponding to higher quality , where Z ∈ RN×K is the matrix containing the embeddings of all nodes . Thus , the goal of the attacker is to maximize the loss . We can formalize this as the following bi-level optimization problem : Â∗ = arg max Â∈ { 0,1 } N×N L ( Â , Z∗ ) Z∗ = min Z L ( Â , Z ) subj . to ||Â−A||0 = 2f , Â = ÂT ( 1 ) Here , Z∗ is always the ’ optimal ’ embedding resulting from the ( to be optimized ) graph Â , i.e . it minimizes the loss , while the attacker tries to maximize the loss . Solving such a problem is highly challenging given its discrete and combinatorial nature , thus we derive efficient approximations .

Summary: The authors present a novel adversarial attack on node embedding method based on random walks. They focus on perturbing the structure of the network. Because the bi-level optimization problem can be highly challenging, they refer to factorize a random walk matrix which is proved equivalent to DeepWalk. The experimental results show that their approach can effectively mislead the node embedding from multi-classification.