Near-Black-Box Adversarial Attacks on Graph Neural Networks as An Influence Maximization Problem

1 INTRODUCTION . There has been a surge of research interest recently in graph neural networks ( GNNs ) ( Wu et al. , 2020 ) , a family of deep learning models on graphs , as they have achieved superior performance on various tasks such as traffic forecasting ( Yu et al. , 2017 ) , social network analysis ( Li et al. , 2017 ) , and recommender systems ( Ying et al. , 2018 ; Fan et al. , 2019 ) . Given the successful applications of GNNs in online Web services , there are increasing concerns regarding the robustness of GNNs under adversarial attacks , especially in realistic scenarios . In addition , the research about adversarial attacks on GNNs in turns helps us better understand the intrinsic properties of existing GNN models . Indeed , there have been a line of research investigating various adversarial attack scenarios for GNNs ( Zügner et al. , 2018 ; Zügner & Günnemann , 2019 ; Dai et al. , 2018 ; Bojchevski & Günnemann , 2018 ; Ma et al. , 2020 ) , and many of them have been shown to be , unfortunately , vulnerable in these scenarios . In particular , Ma et al . ( 2020 ) examine an extremely restricted nearblack-box attack scenario where the attacker has access to neither model parameters nor model predictions , yet they demonstrate that a greedy adversarial attack strategy can significantly degrade GNN performance due to the natural inductive biases of GNN binding to the graph structure . This scenario is motivated by real-world GNN applications on social networks , where attackers are only able to manipulate a limited number of user accounts , and they have no access to the GNN model parameters or predictions for the majority of users . In this work , we study adversarial attacks on GNNs under the aforementioned near-black-box scenario . Specifically , an attack in this scenario is decomposed into two steps : 1 ) select a small set of nodes to be perturbed ; 2 ) alter the node features according to domain knowledge up to a pernode budget . The focus of the study lies on the node selection step , so as in Ma et al . ( 2020 ) . The existing attack strategies , although empirically effective , are largely based on heuristics ( Ma et al. , 2020 ) . We instead formulate the adversarial attack as an optimization problem to maximize the mis-classification rate over the selected set of nodes , and we carry out formal analysis regarding this optimization problem . The proposed optimization problem is combinatorial and seems hard to solve in its original form . In addition , the mis-classification rate objective involves model parameters which are unknown in the near-black-box setup . We mitigate these difficulties by rewriting the problem and connecting it with influence maximization on a special linear threshold model related to the original graph structure . Inspired by this connection , we show that , under certain distribu- tional assumptions about the GNN , the expected mis-classification rate is submodular with respect to the selected set of nodes to perturb . The expected mis-classification rate is independent of the model parameters and can be efficiently optimized by a greedy algorithm thanks to its submodularity . Therefore , by specifying concrete distributions , we are able to derive a group of near-black-box attack strategies maximizing the expected mis-classification rate . The connection with influence maximization also provides us nice interpretations regarding the problem of adversarial attack on GNNs . To empirically verify the effectiveness of the theory , we implement two near-black-box adversarial attack strategies and test them on three popular GNN models , Graph Convoluntioal Network ( GCN ) ( Kipf & Welling , 2016 ) , Graph Attention Network ( GAT ) ( Veličković et al. , 2018 ) , and Jumping Knowledge Network ( JKNet ) ( Xu et al. , 2018 ) with common benchmark datasets . Both attack strategies significantly outperform baseline attack strategies in terms of decreasing model accuracy . Finally , we summarize the contributions of our study as follows . 1 . We formulate the problem of adversarial attack on GNNs as an optimization problem to maximize the mis-classification rate . 2 . We draw a novel connection between the problem of adversarial attacks on GNNs and influence maximization based on a linear threshold model . This connection helps us develop effective and efficient near-black-box adversarial attack strategies and provides interpretations regarding the adversarial attack problem . 3 . We implement two variants of the proposed near-black-box attack strategies and empirically demonstrate their effectiveness . 2 RELATED WORK . There has been increasing research interest in adversarial attacks on GNNs recently . Detailed expositions of existing literature are made available in a couple of survey papers ( Jin et al. , 2020 ; Sun et al. , 2018 ) . Given the heterogeneous nature of diverse graph structured data , there are numerous adversarial attack setups for GNN models . Following the taxonomy provided by Jin et al . ( 2020 ) , the adversarial attack setup can be categorized based on ( but not limited to ) the machine learning task , the goal of the attack , the phase of the attack , the form of the attack , and the model knowledge that attacker has access to . First , there are two common types of tasks , node-level classification ( Zügner et al. , 2018 ; Dai et al. , 2018 ; Wu et al. , 2019 ; Entezari et al. , 2020 ) and graph-level classification ( Tang et al. , 2020 ; Dai et al. , 2018 ) . The goal of the attack can be changing the predictions of a small and specific set of nodes ( targeted attack ) ( Zügner et al. , 2018 ; Dai et al. , 2018 ) or degrading the overall GNN performance ( untargeted attack ) ( Zügner & Günnemann , 2019 ; Sun et al. , 2019 ) . The attack can happen at the model training phases ( poisoning attack ) ( Zügner & Günnemann , 2019 ; Sun et al. , 2019 ) or after training completes ( evasion attack ) ( Dai et al. , 2018 ; Chang et al. , 2020 ) . The form of the attack could be perturbing the node features ( Zügner et al. , 2018 ; Ma et al. , 2020 ) or altering the graph topology ( Dai et al. , 2018 ; Sun et al. , 2019 ) . Finally , depending on the knowledge ( e.g . model parameters , model predictions , features , and labels , etc . ) the attacker has access to , the attacks can be roughly categorized into white-box attacks ( Xu et al. , 2019 ) , grey-box attacks ( Zügner et al. , 2018 ; Sun et al. , 2019 ) , black-box attacks ( Dai et al. , 2018 ; Chang et al. , 2020 ) or near-black-box ( Ma et al. , 2020 ) . However , it is worth noting that the borders of these three categories are blurry in literature . The setup of interest in this paper can be categorized as node-level , untargeted , evasional , and nearblack-box attacks by perturbing the node features . While each setup configuration might find its suitable application scenarios , we believe that near-black-box setups are particularly important as they are associated with many realistic scenarios . Among the existing studies on node-level blackbox attacks , most of them ( Bojchevski & Günnemann , 2018 ; Chang et al. , 2020 ; Dai et al. , 2018 ) still allow access to model predictions or some internal representations such as node embeddings . In this paper , we follow the most strict near-black-box setup ( Ma et al. , 2020 ) to our knowledge , which prohibits any probing of the model . Compared to Ma et al . ( 2020 ) , we develop attack strategies by directly analyzing the problem of maximizing mis-classification rate , rather than relying on heuristics . We remark that there are also plenty of existing works investigating adversarial attacks on non-GNN models ( Wang & Gong , 2019 ; Zhang et al. , 2019 ) , which we consider less relevant to this work , and refer the readers to the survey papers ( Jin et al. , 2020 ; Sun et al. , 2018 ) for more details . 3 PRELIMINARIES . 3.1 NOTATIONS . We start by introducing notations that will be used across this paper . Suppose we have an attributed graph G = ( V , E , X , y ) , where V = { 1 , 2 , · · · , N } is the set of N nodes , E ⊆ V × V is the set of edges , X ∈ RN×D is the node feature matrix withD-dimensional features , and y ∈ { 1 , 2 , · · · , K } N is the node label vector withK classes . We also denote a random walk transition matrix on the graph asM ∈ RN×N . For any 1 ≤ i , j ≤ N , Mij = 1/|Ni| if ( i , j ) ∈ E or i = j , andMij = 0 otherwise . To ease the notation , for any matrix A ∈ RD1×D2 in this paper , we refer Aj to the transpose of the j-th row of the matrix , i.e. , Aj ∈ RD2 . We consider a GNN model f : RN×D → RN×K that maps from the node feature matrix X to the output logits of all nodes ( denoted as H , f ( X ) ∈ RN×K ) . Let Ni = { j ∈ V | ( i , j ) ∈ E } ∪ { i } be the set of neighbors of node i , including itself . We assume the GNN f has L layers , with the l-th layer ( 0 < l < L ) at node i taking the form H ( l ) i = ReLU ( ∑ j∈Ni αijW ( l ) H ( l−1 ) j ) . W ( l ) is the learnable weight matrix , ReLU ( · ) is an element-wise ReLU activation function , and different GNNs have different normalization terms αij . We also define H ( 0 ) = X and H = H ( L ) =∑ j∈Ni αijW ( L ) H ( L−1 ) j . Later in Section 4 , we carry out our analysis on a GCN model with αij = 1/|Ni| ( Hamilton et al. , 2017 ) . 3.2 THE NEAR-BLACK-BOX ADVERSARIAL ATTACK SETUP . Next we briefly introduce the near-black-box adversarial attack setup proposed by Ma et al . ( 2020 ) . The goal of the attack is to perturb the node features of a few carefully selected nodes such that the model performance is maximally degraded . The attack is decomposed into two steps . In the first step , the attacker selects a set of nodes S ⊆ V to be perturbed , under two constraints |S| ≤ r and |Ni| ≤ m , ∀i ∈ S for some 0 < r N and 0 < m maxi |Ni| . These two constraints prevent the attacker from manipulating a lot of nodes or very important nodes as measured by the node degree , which makes the setup more realistic . In the second step , the attacker is allowed to add a small constant perturbation ∈ RD to each node in S , i.e. , let the perturbed feature be X ′i , Xi + for i ∈ S. The perturbation vector is constructed based on the domain knowledge about the task but without access to the GNN model . For example , if the GNN model facilitates a recommender system for social media , an attacker may hack a handful of carefully selected users and manipulate their demographic features , posts , or browsing trajectories to get more users exposed to certain political content the attacker desires . In practice , the perturbation vector can be tailored for different nodes given personalized knowledge about each node . But following Ma et al . ( 2020 ) , we consider the worst case where no personalization is available .

Summary: Paper summary: The paper studies the problem of attacking GNNs in a restricted black-box setup, i.e., by perturbing the features of a small set of nodes, with no access to model parameters and model predictions. The authors draw a connection between the restricted attack problem and the influence maximization problem, and then propose several approximation techniques to solve the reformulated attack problem. Experimental results on attacking three GNN models demonstrate the effectiveness of the proposed attack.