ATTACK GRAPH CONVOLUTIONAL NETWORKS BY ADDING FAKE NODES

1 INTRODUCTION . Graphs play a very important role in many real world applications , such as social networks ( Facebook and Twitter ) , biological networks ( protein-protein interaction networks and gene interaction networks ) , as well as attribute graphs ( PubMed and Arxiv ) ( Grover & Leskovec , 2016 ; Ying et al. , 2018 ; Rhee et al. , 2017 ) . Node classification is one of the most important tasks on graphs—given a graph with labels associated with a subset of nodes , predict the labels for rest of the nodes . For this node classification task , deep learning models on graphs , such as Graph Convoltional Networks ( GCNs ) , have achieved state of the art performance ( Kipf & Welling , 2016 ) . Moreover , GCNs have wide applications in cyber security , where they can learn a close-to-correct node labeling semiautonomously . This reduces the load on security experts and helps to manage networks that add or remove nodes dynamically , such as , WiFi networks in universities and web services in companies . The wide applicability of GCNs motivates recent studies about their robustness . Zügner et al . ( 2018 ) Dai et al . ( 2018 ) developed algorithms to attack GCNs , showing that by altering a small amount of edges and features , the classification accuracy of GCNs can be reduced to chance-level . However , changing edges or features associated with existing nodes is impractical in many cases . For example , in social network applications , an attacker has to login to the users ’ accounts to change existing connections and features , and gaining login accesses is almost impossible . In comparison , adding fake nodes that correspond to fake accounts or users , can be much easier in practice . But the key question is can we interfere the classification results of existing nodes by adding fake nodes to the network ? We answer this question affirmative by introducing novel algorithms to design fake nodes that successfully reduce GCN ’ s performance on existing nodes . To design the adjacency and feature matrices associated with fake nodes , we have to address two challenges . First , the edges and features are usually discrete 0/1 variables . Although there have been many algorithms proposed for attacking image classifiers , such as FGSM , C & W and PGD attacks ( Goodfellow et al. , 2014 ; Carlini & Wagner , 2017 ; Madry et al. , 2017 ) , they all assume continuous input space and can not be directly applied to problems with discrete input space . Second , it ’ s not easy to make the fake nodes “ looked ” like the real ones ? For example , if we add a fake node that connects to all existing nodes , the system can easily detect and disable such fake node . In this paper , we propose two algorithms , Greedy attack and Greedy-GAN attack , to address these two challenges . Our contributions can be summarized below : • To the best of our knowledge , this is the first paper studying how to add fake nodes to attack GCNs . We do not need to manipulate existing nodes ’ adjacency and feature matrices . • We propose a Greedy attack algorithm to address the discrete input space problem in designing fake nodes ’ adjacency and feature matrices . • We introduce a discriminator to classify fake nodes from real nodes , and propose a GreedyGAN algorithm to simultaneous optimize the discriminator and the attacker . Despite a lower successful rate , this approach can make fake nodes harder to detect . • We conduct experiments on several real datasets . For non-targeted attack , we get accuracy down to 0.10 for the Cora dataset , and 0.14 for the Citeseer dataset . For targeted attack on whole datasets , Greedy attack have up to 99 % success rate on Cora and 90 % on Citeseer . For targeted attack on a single node , it could reach 94 % success rate on Cora and 0.80 % success rate on Citeseer . 2 RELATED WORK . Adversarial Attacks Adversarial examples for computer vision tasks have been studied extensively . Goodfellow et al . ( 2014 ) discovered that deep neural networks are vulnerable to adversarial attacks—a carefully designed small perturbation can easily fool a neural network . Several algorithms have been proposed to generate adversarial examples for image classification tasks , including FGSM ( Goodfellow et al. , 2014 ) , IFGSM ( Kurakin et al. , 2016 ) , C & W attack ( Carlini & Wagner , 2017 ) and PGD attack ( Madry et al. , 2017 ) . In the black-box setting , it has also been reported that an attack algorithm can have high success rate using finite difference techniques ( Chen et al. , 2017b ) , and several algorithms are recently proposed to reduce query numbers ( Ilyas et al. , 2018 ; Suya et al. , 2017 ) . Transfer attack Papernot et al . ( 2016a ) and ensemble attack Tramèr et al . ( 2017 ) can also be applied to black-box setting , with lower successful rate but less number of queries . Besides attacking image classification , CNN related attacks have also been explored . A typical usage is attacking semantic segmentation and object detection ( Metzen et al. , 2017 ; Arnab et al. , 2017 ; Xie et al. , 2017 ; Lu et al. , 2017 ; Eykholt et al. , 2017 ) . Image captioning ( Chen et al. , 2017a ) and visual QA ( Xu et al. , 2017 ) could also be attacked . Most of the above-mentioned work are focusing on problems with continuous input space ( such as images ) . When the input space is discrete , attacks become discrete optimization problems and are much harder to solve . This happens in most natural language processing ( NLP ) applications . For text classification problem , Fast Gradient Sign Method ( FGSM ) is firstly applied by ( Papernot et al. , 2016b ) . Deleting important words ( Li et al. , 2016 ) , replacing or inserting words with typos and synonyms ( Samanta & Mehta , 2017 ; Liang et al. , 2017 ) . For black box setting , Gao et al . ( 2018 ) develops score functions to find out the works to modify . Jia & Liang ( 2017 ) adds misleading sentences to fool the reading comprehension system . Zhao et al . ( 2017 ) use GAN to generate natural adversarial examples . Ebrahimi et al . ( 2017 ) and Cheng et al . ( 2018 ) attacks machine translation system Seq2Seq by changing words in text . Graph Convolutional Neural Networks ( GCN ) . Classification of graph nodes has become an important problem in cyber security applications and recommender systems . Graph convolutional networks ( GCNs ) solve the problem in an end-to-end manner and can avoid the ” optimize twice ” problem of previous graph embedding methods . The main idea of GCNs is to aggregate associated information from a node and its neighbors using some aggregation functions . They train the aggregation steps and the final prediction layer end-to-end to achieve better performance than traditional approaches . There are several variations of GCNs proposed recently ( Kipf & Welling , 2016 ; Pham et al. , 2016 ; Defferrard et al. , 2016 ; Hamilton et al. , 2017 ; Chen et al. , 2018 ; Ying et al. , 2018 ) , and we will focus on the commonly used structure proposed in ( Kipf & Welling , 2016 ) . There have been several work on attacking GCNs . Recently , Zügner et al . ( 2018 ) published an attack on GCNs by changing current nodes ’ links and features . They present a FGSM-like method and optimize a surrogate model named Nettack to choose the edges and features that should be manipulated . Dai et al . ( 2018 ) showed that by only manipulating graph structure , the Graph Neural Networks are quite vulnerable to the attacks of challenging few edges . They proposed reinforcement learning-based attack method to attack . They also employed a gradient ascent method to change the graph structures in the white-box setting . Both of these two papers perform non-targeted attacks only . Instead of altering edges or features of existing nodes , we develop novel algorithms to add fake nodes to interfere the performance of GCNs . This has not been done in previous work . Furthermore , we test our algorithm in both targeted and non-targeted attacks in the experiments . 3 PRELIMINARY . GCN is a semi-supervised learning method to classify nodes in attribute graphs . Given an adjacency matrix A ∈ Rn×n , feature matrix X ∈ Rn×d , and a subset of labeled nodes , the goal is to predict the labels of all the nodes in the graph . There are several variations of GCNs , but we consider one of the most common approaches introduced in ( Kipf & Welling , 2016 ) . Starting from H0 = X , GCN uses the following rule to iteratively aggregate features from neighborhoods : H ( l+1 ) = σ ( D̃− 1 2 ÃD̃− 1 2H ( l ) W ( l ) ) ( 1 ) where Ã = A+ IN is the adjacency matrix of the undirected graph with added self connections , IN is the identity matrix , D̃ is a diagonal matrix with D̃i , i = ∑ j Ãij , and σ is the activation function . We set σ ( x ) = ReLU ( x ) = max ( 0 , x ) , which is the most common choice in practice . For a GCN with L layers , after getting the top-layer feature HL , a fully connected layer with soft-max loss is used for classification . A commonly used application is to apply two-layer GCN for semi-supervised learning node classification on graph ( Kipf & Welling , 2016 ) . The model could be simplified as : Z = f ( X , A ) = softmax ( Âσ ( ÂXW ( 0 ) ) W ( 1 ) ) , ( 2 ) where Â = D̃− 1 2 ÃD̃− 1 2 . Another choice for forming Â is to normalize the adjacency matrix by rows , leading to Â = ˜D−1Ã . We will experience with both choices in the experimental results . For simplicity , we will assume our target network is structured as equation 2 , but in general our algorithm can be used to attack GCNs with more layers . 4 ATTACK ALGORITHMS . In this section , we will describe our “ fake nodes ” attack on GCNs . We will describe both a nontargeted attack , which tries to lower the accuracy of all the existing nodes uniformly , and a targeted attack , which attempts to force the GCN to give a desired label to nodes . Instead of manipulating the feature and adjacency matrices of existing nodes , we insert m fake nodes with corresponding fake features into the graph . After that , the adjacency matrix is A′ = [ A BT B C ] and the feature matrix becomes : X ′ = [ X Xfake ] . Note that A is the original adjacency matrix and X is the original feature matrix . Starting fromB = 0 , C = I , our goal is to designB , C , Xfake to achieve the desired objective ( e.g. , lower the classification accuracy on existing nodes ) .

Summary: The authors propose a new adversarial technique to add “fake” nodes to fool a GCN-based classifier. The basic approach relies on a greedy heuristic to add edge/node features, and the authors also present a GAN-based approach, which allows the model to add “fake” nodes that are not easily distinguishable from regular nodes. The primary motivation behind the idea of adding “fake” is that it is unrealistic to change the features/edges of existing nodes. Experimental results show that adding a large number (20% in most cases) of fake nodes can significantly degrade accuracy of a GCN, and results show that the GAN-based approach is somewhat effective at making the “fake” nodes less distinguishable.  In terms of strengths, the GAN-based approach is well-motivated and it appears that the authors were thorough in their experiments on Cora/Citseer (e.g., with a number of ablation/sensitivity studies).