Towards Reasonable Budget Allocation in Untargeted Graph Structure Attacks via Gradient Debias
Authors: Zihan Liu
Yun Luo
Lirong Wu
Zicheng Liu
Stan Z. Li
Venue: NeurIPS 2022 Accept (2022)
Keywords: graph adversarial attack
graph structure attack
attack loss design

Abstract: It has become cognitive inertia to employ cross-entropy loss function in classification related tasks. In the untargeted attacks on graph structure, the gradients derived from the attack objective are the attacker's basis for evaluating a perturbation scheme. Previous methods use negative cross-entropy loss as the attack objective in attacking node-level classification models. However, the suitability of the cross-entropy function for constructing the untargeted attack objective has yet been discussed in previous works. This paper argues about the previous unreasonable attack objective from the perspective of budget allocation. We demonstrate theoretically and empirically that negative cross-entropy tends to produce more significant gradients from nodes with lower confidence in the labeled classes, even if the predicted classes of these nodes have been misled. To free up these inefficient attack budgets, we propose a simple attack model for untargeted attacks on graph structure based on a novel attack objective which generates unweighted gradients on graph structures that are not affected by the node confidence. By conducting experiments in gray-box poisoning attack scenarios, we demonstrate that a reasonable budget allocation can significantly improve the effectiveness of gradient-based edge perturbations without any extra hyper-parameter.

Towards Reasonable Budget Allocation in Untargeted Graph Structure Attacks via Gradient Debias
Zihan Liu 1.2, Yun Luo 1.2, Lirong Wu 1.2, Zicheng Liu 1.2, and Stan Z. 1f AI Division, School of Engineering, Westlake University, Hangzhou, 310030 2 College of Computer Science and Technology. Zhejiang University, Hangzhou. 310058 (liuzihan, luoyun, wulirong, wwwrrronn,iiiieiii wwwuiichengn, stan, .2. li..ll.l.essseeeeeeeeeeeeeeeemle @westallke edu. cn
Abstract
It has become cognitive inertia to employ cross-entropy loss function in classifi- cation related tasks. In the untargeted attacks graph structure, the gradients derived from the attack objective are the attacker's basis for evaluating a pertur- bation scheme. Previous methods use negative cross-entropy loss as the attack objective in attacking node-level classification models. However, the suitability of the cross-entropy function for constructing the untargeted attack objective has yet been discussed in previous works. This paper argues about the previous unreason- able attack objective from the perspective of budget allocation. We demonstrate theoretically and empirically that negative cross-entropy tends to produce more significant gradients from nodes with lower confidence in the labeled classes, even if the predicted classes of these nodes have been misled. To free up these incfficient attack budgets, we propose simple attack model for untargeted attacks on graph structure based on novel attack objective which generates unweighted gradients on graph structures that are not affected by the node confidence. By conducting experiments in gray-box poisoning attack scenarios, we demonstrate that reason- able budget allocation can signíficantly improve the effectiveness gradient-based edge perturbations without any extra hyper-parameter.
1 Introduction
Graph-structured data are widely used in real-world domains such as social networks [31], traffic networks [21] and recommendation systems [26]. As graphs have attracted considerable attention in fundamental researches and various applications [24, 25, 32, 13], the robustness of graph neural networks (GNNs) rapidly gaining research attention [29]. As a major approach to robustness research, researchers have investigated various attack scenarios [19, 28, 33, 34J. The attack scenarios are classified into white-box, gray-box and black-box attacks mainly based on the information available to the attacker [27]. Unlike white-box and black-box attacks, in gray-box attacks, the graph and training labels are visible, while the network architecture of the victim model invisible. gray-box attacker typically transfers the attack trained surrogate model (i.c., alternative GNN) to the victim model [9, 33, 34]. Therefore, gray-box attacks are an ideal scenario to study the transferability of attacks.
This paper investigates the impact of attacker's graph edge perturbation on the robustness GNNs in the case of poisoning attacks. Poisoning attacks study the impact of the attacked data on the model training, which is also the case that may be encountered in attacks where the attacker has contaminated the data before the model training. Among the proposed gray-box untargeted attack methods, gradicnt-basee attackers have been shown to have superior attack performance and have
"Correpponding author: Stan Z. Li.
36th Conference on Neural Information Processing Systems (NeurIPS 2022).

---

Step 0
Step
Step
p 0.7
p 0.2
p 0.05
Negative Cross-Entropy Loss
0.9
p - 0.6
0.6
Ideal
p 0.2
Nodes
Deleted Edges
Edges
Added Edges
1.0
Prediction Confidence
p 0.2
Figure 1: A schematic showing the allocation of the budget during an attack when the attack loss is the negative cross-entropy loss (i.e. Latk Lce).
become one of the mainstream attack strategies [9, 34). Attackers are built on constructing surrogate model, designing an attack objective function, and obtaining the gradient distribution of the adjacent matrix by backpropagation. Thereafter, the attacker selects the edges to perturbed based on the saliency of their gradients relative to their connectivity states. We refer to the gradient distribution generated by a single node on the graph structure as the partial gradient matrix of that node. The derivation of this partial gradient matrix typically involves the mapping function of the surrogate model as well as the attack objective.
The key issue of attacks on graph structure is the structural gradients, which (along with the attribute gradients) are generated by the nodes' attack objective. The attack objective is designed as a negative cross-entropy loss in previous works [9, 34). We define 'node confidence' specifically as the confidence node in the prediction of the pseudo-label class obtained from the unperturbed graph. generated by the loss of nodes with the message passing between
Note that the structural gradients nodes. We argue that there is a strong correlation between structural gradients and nodes' confidence, and empirically prove this conjecture (demonstrated in Section 5.3). When the attack objective is negative cross-cntropy loss, the partial gradient matrix from a low-confidence node has a relatively large L2 norm. Thus, low confidence nodes contribute more significant gradients to the edges; in other words, an edge is more likely to be perturbed because low-confidence node contributes a high gradient it. This phenomenon is defined as the gradient bias with respect to the node confidence.
Figure I illustrates the impact of this phenomenon an example of a binary classification task. During the process from the initial step to the 1st step, the allacker reduces the confidence of a node from 0.7 to 0.2 by removing an edge, while the confidence of another node connected by this edge is reduced to 0.6. Considering that the node with confidence of 0.2 has produced a false prediction, it is optimal for the attacker to subsequently attack the node with a confidence of 0.6. However, since the cross-entropy loss of the node with confidence 0.2 produces large gradient, the attacker is likely to continue attacking the edges of the node based on the importance of the gradient. The reason for this phenomenon is that the cross-entropy function is logarithm-based function. It generates higher gradients for low confidence nodes in the classification task, thus favoring the model to fit these nodes. When the attack objective is associated with the cross-entropy function, generates more significant gradicnts on low confidence nodes. Since the structural gradient originates from the aggregation of node features, the effect of node confidence reflected in the structural gradients as well.
In this paper, we demonstrate theoretically and empirically that the previous attack objective (i.e., negative cross-entropy loss) traps the attacker in a vicious cycle of inefficient budget consumption. The iterative perturbations cause the confidence level of the low confidence nodes to become lower, and the more significant gradients generated by these nodes result in them being allocated more attack budgets. To address this design flaw, this paper proposes an improved attack objective, known as gradient debias, which generates unweighted gradients on the graph structure independent of node confidence. Our approach introduces an additional weight to eliminate the bias due to the confidence- related weight on partial gradient matrices. We implement our proposed attack objective to simple GNN surrogate model with a basic perturbation strategy to construct our attack model with Gradient Debias (GraD). To validate the effectiveness of GraD on untargeted attacks on graph structure, we
2

---

test our approach multiple datasets as well as victim models and compare its performance with state-of-the-arr baselines. The contribution of this paper can be summarized as follows:
We demonstrate that the attack objective in previous works lead to a tendency for low-confidence nodes to contribute more significant gradients on the graph structure. This traps the attacker in a vicious cycle of constantly attacking low confidence nodes.
We propose improved attack objective, known gradient debias, which solves the problem of low confidence nodes dominating the attacker's 's decision.
We propose a novel attack model, GraD, which assembles our proposed attack objective and a simple surrogate model well basic perturbation strategy.
We verify the effectiveness of GraD by comparing ours' attack performance with various basclines on untargeted gray-box poisoning attacks.
2 Related Works
Background Adversarial attacks in deep learning have received interests in various fields [30, 6, 10, 8]. The domain of adversarial attack on graph is classified terms of scenarios of attack tasks. Attacks on graph networks contain two types of attack objectives: targeted and untargeted attacks [27]. Targeted attacks [33] disrupt the network by attacking the neighbors and edges of the target node for a given budget, while untargeted attacks try to influence the predictions of as many nodes as possible [14, 28, 34J. Depending on the knowledge of the attacker, attacks are classified as white- box [23, 28], gray-box [18, 33, 34] and black-box attacks [3, 15]. White-box attacks can obtain all the information about the victim models; gray-box attacks can obtain samples for training the victim models; black-box attacks
query the predictions of the victim models [27]. The attacker performs a poisoning attack [18, 34] if the victim model is retrained after the original data is contaminated; otherwise, it performs
evasion attack [23, 28). In terms of the attack techniques, attacks be classified as: modifying node attributes [14, 23], edge perturbation [9, 28, 34), and node injection [18, 19]. Each attack technique has limited budget, such as the matrix norm variation on attributes or the changes in the adjacent matrix.
Untargeted poisoning attack The researches closely related to this paper devoted to the study of edge perturbation based untargeted attack methods. Zinger et al. [34] proposed the attack model Meta-Self, which modifies the graph structure or node features by the meta-gradient of trained surrogate model in a gray-box setting, which is the first gradient-based attack model. Subsequently, papers [2, 9, 14, 28, 11] have also proposed new attack strategies and improvements using the gradient information provided by the surrogate model in the node features and graph structure. These works mainly use an attack objective function to obtain the gradient on the adjacency matrix by backpropagation. The form of the proposed allack objective function has been a negative cross-entropy loss. Liu al. [12] discuss the design of the surrogate model, and the attack losses involved in graph adversarial attacks are discussed in [4]. In existing white- and gray-box attacks for classification, the form of cross-entropy is an essential component of the attack loss [28, 23, 34]. Our proposed confidence-oriente attack loss overturns this mindset, which has been justified in this paper.
Preliminaries
3.1 Notations
For the node classification task, given a graph G with node attributes X and a subset of node labels Y, GNNs are expected to predict the class of unlabelled nodes. Let G' = (V, E, X) represents an attribute graph, where V {u1, U2 , is the set of N nodes, E C V V is the set of edges. Each sample is represented as a node v; associated with its attribute I; E Rd and label y, E R* where & is the number of classes. We denote the adjacency of the nodes as a binary adjacent matrix A {0, 1) N where A,, 1 if (i,j) C E. In addition, the surrogate model is denoted by fe. while the prediction of fe for node V; is denoted by the probability distribution P... We use C to represent the loss (objective) function. The perturbed graph is indicated as G = (A', X') to distinguish the perturbed graph from the original graph. The attack on graph is limited by budget
A.
3

---

grod
Loss Function
Losstry) Losstrs) :
Back- Propagation
Train
Avg
Surrogate Model
GG)
Loustre
12
grad
G
V
Calculate
Perturb
Sclect
V
0
grad
Adjacent Matrix
G
Figure 2: Illustration of the process by which the attack model generates one perturbation.
3.2 Gradient-based Attack on Graph Structure
In scenarios where the attacker performs untargeted attacks graph structure, the attacker is restricted by attack imperceptibility. The lu norm of the difference in the perturbed graph with respect to the original graph is bounded by the perturbation budget A. For undirected graph, A is expressed as:
|| lo s 24.
(1)
A is generally no more than 5% of the number of edges in the original graph. In an untargeted attack scenario, the attacker aims reduce the test performance of the poisoned victim model.
Gradient-based attackers have become mainstream approaches of edge perturbations on the graph structure [9, 28, 34]. Unlike the gradient-based attacks widely used in computer vision [29], for graph data, the discretization of the graph structure dictates that the gradient matrix cannot be directly added to the adjacency matrix. The gradient the graph structure A is considered reference for selecting edge candidates that are more likely to be ideal for perturbations. It can be derived by the following equations:
0+ = argmin Lee (Jo(G),))
(2)
0
grad
V AaCus (G)):
(3)
where Latk the attack loss function and so- the properly trained surrogate model. In existing methods, the attack loss is expressed as
Lotk [o
(4)
where V a subnet of nodes that involved in calculating the attack loss. The subset V consists of two forms: Vi and V* self. where Viaann contains labeled nodes and Vieif uses pseudo-label labels generated by the surrogatc model so it can contain unlabelled nodes. For the edge between nodes and vy. if A,
1 and Agrad < O, if A,, 0 and Agrad >> 0, then flipping edge F,j is considered as a perturbation that has the potential to negatively affect the victim model. The process of perturbing the graph using the gradient information can be represented as:
A =
= ΦVV ACes ()),))),A 1),
(5)
where & denotes the strategy for choosing the edge to be attacked. The factors that influence the perturbation include the attack loss Latk as well the strategy and the surrogate model fa..
In the work [34], the authors do an ablation study on the node sets Vitain and V Their results show that constructing the attack loss using Viey leads to superior performance. This is due to the fact that node classification tasks are generally supervseee and therefore the labeled nodes are too sparse respect to the whole graph. However, we find a fatal problem during the exploration of the attack loss. The cross-entropy is function related to the prediction confidence the node on the

---

labeled class P., (yn (G)). That is, the gradient from the cross-entropy function is also correlated with the confidence. The result of this correlation is that the gradient generated by the different nodes will contain a magnitude. In the next section, we will discuss the reason why this magnitude appears and whether it is reasonable the process of attack.
Methodology
4.1 The Pipeline of Attack Model
We first present the overview of our attack model in Figure 2, which illustrates the entire flow of an attacker perturbing an edge of graph.
The first step is to retrain surrogate model fo- (G,) with the perturbation graph G² in the way of Eq- (2). We use the surrogate model with same network architecture as [34], which is a linear 2-layer graph convolutional network (GCN) [7]: fo fG(G) = softmaxx XW), where D-1/2(A 1) is the normalized adjacent matrix and W is a learnable weight matrix.
In the second step, we use the pseudo-label to construct the attack loss of the node. The pscudo-laber y is calculated from the prediction of the surrogate model fo- (G) trained with the original graph G. Note that we set the attacker's ss surrogate model to be consistent with the model used to generate
pseudo-labels avoid inconsistent predictions due different structures of GNNs. The attack loss Latk of node vú is related to the confidence P., (v/lfo- (G)) and the pseudo-label y,, the details of which will be discussed in Section 4.2.
In the third step, the attack loss of cach node is backpropagated to producc partial gradient matrix Agrad according to Eq. (3). A partial gradient matrix Agraa denotes the structural gradient generated from a single node v;- For a GCN that aggregates h times, a node will generate gradient values on all edges between that node and its h-hop neighbors. The overall gradient information Aorad passed to the attack strategy @ is the average of all the partial gradient matrices, which can be represented as:
Agrad
Σ Agrad)
(6)
where N* denotes the number of nodes in the node subset V which chosen as the set unlabelled nodes in our implementation. The attack strategy is a basic edge perturbation selection method based on the saliency of gradients, which is represented as follows:
Agrad
if Agred
0 & As,j
Agrad_
Agrad
if A
0 & A
0 elsc
where Agrad in Eq. (7) removes candidates with inconsistent gradient signs and edge states. Then the attacker flips the edge e'. argmax Agrad, with maximum gradient saliency as the t-th perturbation, which forms the perturbed graph G/+1 that runs into the next loop.
4.2 Budget Allocation with Gradient Debias
After explaining the attack pipcline, we cxplain why low confidence nodes dominate the attack because of the previous attack objective, i.c., negative cross-entropy loss -Lee. We first merge the formulation Eq. (3) and Eq. (6):
V
A grad Σ v A
(8)
The gradient on the graph structure A gred comes from the contribution of each node in V*, The widely used formulation for attack objective is the negative cross-entropy loss, shown in Eq. (4). The cross entropy loss Los can be expressed as:
Loe(fo- (G), v\) = Σ ye log Po, (vulfo-) - llog P., (v.l.oo))
(9)
5

---

where the Lar is function of the prediction confidence of the node on the labeled class v(- According to the chain rule, the gradient on the adjacent matrix derived from attack loss is:
daatk ap., (v.lfo)
V Cuts = dP., (vAlfo)
(10)
0A
where term PP. ( 1/8A can produce matrix of gradient distributions influenced by the mapping function of surrogate model, and term 0Lax (v(lS=)) acts weight to it. Next, we expand this expression for this weight:
@aack
-fce
= Pr, Pu,(u/loo))
(11)
PP., (1, oP., (v()oo))
From the Eq. (11), observe that the magnitude of partial gradient matrix is weighted by the reciprocal of node confidence P., (v(lfo-)
When the attack loss is coosseettropy-baset nodes with low confidence generate gradients with larger magnitude than those that nodes with high confidence generate. For example, for node with a confidence of 0.1, the derivative of its attack loss with respect to confidence is 10, which four times larger than that of node with confidence of 0.4. Since the selection of perturbations depends on the significance of gradients, nodes with low confidence are more likely to contribute more significant gradients in their partial gradient matrices. This causes low confidence node become more vulnerable when its confidence is reduced.
Note that the budget A should be allocated through the entire graph. It is ineffective to allocate budget to a node whose confidence is low enough in the labeled class. The previous attack loss results in lendency; that is, nodes with lower confidence are more likely to influence the judgment of the attacker. Therefore, with the increase low confidence nodes during the attack process, it becomes more difficult for the attacker allocate the budget to other nodes, resulting in budget waste.
To address the above problem, we propose a simple but effective attack objective known as gradient debias. Since the attack objective based on cross-entropy is what weights the partial gradient matrices, a solution is to apply an additional weight Xp, to balance the former weight. We propose our gradient debias attack objective, of which the expression is:
Xp. Po. (x)
(12)
Latk (f = Ap. log Po, (v)lfo-).
(13)
where Ap, is a detached term that is numerically equal to the prediction confidence. Considering Eq. (10) and (11), our attack objective regularize each partial gradient matrices Agrad in the overall gradient matrix Agrad, Since the effect of Xp, essentially cancels out the effect of aL a (v/ fo-))) in Eq. (10), Eq. (13) can be rewrited to simple form:
V Latk--gd aP., fo/
(14)
0A
Latk gd = Pa, (./1fo-))
(15)
Compared with Cark. gd has simpler formula, which can be understood as globally reducing the conlidence of the nodes. Based on the gradient debias, the importance of all nodes during the attack is equal for the attacker. In the previous Cusk. there low confidence node affecting the gradient of this edge (i.e., node e vy or their (h- hhp neighbors). then the contribution of this node to the gradient of edge A,,, will be significant. It explains why the previous approach is more likely to waste the attack budget on low confidence nodes. In our proposed Latt gd, the gradients generated by each node are equally superimposed on edges. That is, the gradient on edge A grod reflects the expected confidence decrease of perturbing this edge, regardless of the confidence of the nodes. During the perturbation, Lalk-yd yd prevents the attacker from falling into the vicious circle of repeatedly making low confidence nodes even lower and gives the attacker more reliable gradient information leading to a more reasonable budget allocation.
6

---

Table 1: Experimental results of 'weak transfer' scenarios, where the victim models are GCNs. "Clean' denotes the result for an unperturbed graph. The best results from each experiment are bold. The Gain row indicates the improvement our method relative to the second-best method.
Cora
Cora-ML
Citeseer
Polblogs
Peri Rate
3%
5%
3%
Clean
81.740.3
84.0--04
69.91-0.4
95,4:10.4
Randon
81.7.10.3
81.2:0033
0.5
82.810.4
69.0.0.33
67.810.
85.1::0.6
84.0.1099
DICE
81.2.4.0.3
80.9.::55
83.5.0.5
82.51004
69.34..22
69.0404
9..22.222
79.2.:0.7
EpoArk
79 79.7
77.0+06
82.1=033
813+0.4
67.3+005
66.3=044
83.1=111
82 62.33
Meta-TTrii
79.5+:0.4
7..4+0.2
81.7=0.3
79.0+0.33
67.0++0.4
65.5+004
87.7=00.3
83.5++00.7
Meta-Salf
77.9:10.4
7..8:104
79.5=003
76.2+-0.3
65.0:10.33
60.4:10.44
7944:0.5
75.8:10..5
GraD(ours)
75.2:10.44
7.44.0.
77.9-0.1
75.0
61.2-10.77
5..8:10.9
74.4::0.3
69.5-10.4
Gain
+2.7
+4.4
+1.2
+3.8
+6.3
5 Experiments
In this section, we conduct experiments to verify the effectiveness of our proposed attack model, GraD 1 We describe the experimental scenarios, including the datasets, baselines, and the experiment setup. The practical lests of the computational efficiency of GraD and other allack models are provided in Appendix A.2.
5.1 Experimental Scenarios
Datasets We adopt datasets of Citeseer [17], Cora [16), Cora-ML [16], and Polblogs [1] to evaluate our approach, which are detailed in Appendix A.1. Following the setup in [34], datasets are split to 10% labeled nodes and 90% of unlabeled nodes. The ground-truth labels of unlabeled nodes are invisible to both the attacker and the surrogale and only used to evaluate the performance of the adversarial attacks. For the integrity of the experiments, we also provide a comparison on the largest connected component (LCC) datasets in Appendix A.3.
Baselines This paper takes Random, DICE [22], (34an,, Meta-Self [34], EpoAtk[9] white-box attack model in the original paper transferred to gray-box attack) as baselines, all of which attack GNNs by modifying graph structure. All baselines are open source, which makes them easy to replicate. The implementation of baselines is detailed as follows.
Experimental Setup We conduct experiments in untargeted gray-box poisoning attack scenarios. The gray-box attack scenarios are further split into weak transfer and strong transfer. In a weak transfer scenario, the victim model is also GCN [7] as the surrogate model but has different network structures. In a strong transfer scenario, the victim model has different principles from the surrogate, which is a GAT [20] or a GraphSage [5]. Different GNNs tend differ from graph representations, challenging the attack transferability. To ensure absolute fairness in the test scenarios, we save the perturbation graphs generated by all attack models and test them on unified victim models. Each experiment is repeated ten times with different initialization, and we take the mean and variance as a result. We compare the attack performance of each method al perturbation rales of 3% and 5%. The results of the experiment are expressed in terms of classification accuracy.
5.2 Performance of Attack Model
Experiments are designed to compare our proposed GraD with several baselines, and the experimental results are presented in this section. We category the experiments into weak transfer scenarios and strong transfer scenarios based on the differences between the surrogate and victim models. In gray- box attack, experimental scenarios are designed to verify the transferability of the attack methods. In a weak transfer scenario, both the victim model and the surrogate model are GCNs. Although they differ in the design of activation functions and network layers, their similar representation learning principles make the attack in this scenario relatively simple. In a strong transfer scenario. the victim model is GAT representation learning, making attacks in this scenario more difficult. The attacking budget A is set at 3%, and 5% of edges in the original graph in the weak transfer scenarios, while it set at 5% in the strong transfer scenarios. The control group 'Clean' represents the classification accuracy of the victim model trained with the original graphs under the same training process.
GraphSage, unlike the surrogate model. They different in principle from
http:://gihuu..com//aaan

---

Table Experimental results of 'strong transfer' scenarios, where GAT' and GraphSage act as victim models. The experiments are all performed at perturbation rate of 5%.
Cora
Cora-ML
Cieseer
Polblogs
Victim GAT
GraphSage
GAT
GraphSage
GAT
GraphSage
GAT
GraphSage
Clean 81.
80.8=0.4
8..3+1..
8199:00.6
68.24006
69.8
9..0
90.5
Random
80.3:006
80.7=0.6
80.740.6
80.6:10.8
66.040.7
68.74:0.7
81.710.3
78.1=1.1
DICF
79.6
80.0=00.4
80.9+00.5
80.7:4-0.9
66.5410.77
69.14:0.8
81.8+0.2
76.1=1.9
EpoAtk
49:
78.9=088
79.4+00.6
80.24:077
66.94:066
68.8:-0.55
85.6+0.7
69.4=188
Meta-Train
78.5+00.6
76.1=1.0
77.2+0077
77.7+188
66.5+:0..6
67.9+-0.9
86.0=0.88
71.2=4.0
Meta-Self
0..5
7..9
74.2:10.5
76.3.1166
60.3.10.8
60.8:10.6
814116
6..1
GraD(ours) 7..1
70.6
72.9:10.6
74.6:110
60.11:0.8
58.8.12.2
7.88
66.0=0.4
Gain
+3.4
44.3
+1.3
+1.7
+0.2
+2.0
+11.0
.1.9
5.2.1 Weak Transfer Scenarios
Table shows the experimental results when the network structures of the victim model and the surrogate model are GCNs. Our proposed GraD uses a linear GCN network similar to [34], while EpoAtk [9] is nonlinear GCN network with different structure. In this scenario, the representation learning process of the surrogate model and the victim model is similar, so the transfer of the attack is less difficult. From the table 1 we can that GraD is superior the existing state-of-the-an baselines in all untargeted poisoning attack experiments and considerably outperforms other work in most scenarios. In terms of overall attack performance, GraD is far better than the other attack models, followed in order by Meta-Self, Meta- Train, and EpoAtk, while Random and DICE, which are based on randomness, are the worst of all baselines. GraD outperforms the second-best method on the Cora dataset by 2.7% and 4.4%. On Cora-ML, GraD performs better than the second- method by 1.6% and 1. 1.2%. On Citeseer, GraD obtains better results than the second-best method by 3.8% and 4.6%. On Polblogs, GraD outperforms the second- best method by 5.0% and 6.3%. Our method was on average 4.48% higher than the second-best method Meta-Self, with the best results being 1.2% to 8.0% higher than the second-best. From the results shown in Table 1, the performance of GraD exceeds that other state-of-the-art baselines, which proves that our proposed attack model substantially improves the performance of the attacker. We experimentally validate our discussion of design flaws on attack loss function in prior work and the effectiveness of our proposed gradient dc-wcighting.
5.2.2 Strong Transfer Scenarios
Table 2 shows the experimental results for the case where the structures of the victim model and the surrogate model are different. The surrogatc model is GCN model, while the victim model is a GAT or a GraphSage. Results show the performance of GraD and basclines perturbation rates of 5%. Comparing the results in Table 2 with that in Table 1, although both scenarios belong to the gray-box setting, the attack method yields more significant deviation when the structure of the victim model differs from the surrogate. On Cora, Cora-ML, and Citeseer, there is consistency between the effects of each attack method in the strong transfer scenarios and those in the weak transfer scenarios. For the scenarios where the victim models are GATs, our method improves 3.4%, 1.3%, and 0.2% compared to the second-best method on Cora, Cora-ML, and Citeseer, respectively. For the scenario where the victim model is GraphSage, our method compared to the second-best method improves by 4.3%, 1.7%, and 2.0% on the three datascts. The performance of cach method on Polblogs varies. When the victim model is GAT, our method outperforms the second best method, DICE, by 11% while DICE outperforms other gradient- based baselines. However, when the victim
the random-basee model is Sagp the effect of GraD is 1.9% lower than the best model. This result shows that the variability of the network structure is what makes the transfer of attacks more difficult. Overall, GraD still substantially improves attackers' performance in strong transfer scenarios, demonstrating the effectiveness of our approach.
5.3 Correlation between Nodes' Confidence and Structural Gradients
An important assumption supporting our theory is that the confidence degree of nodes is strongly correlated with the gradient of the edge. To verify our statement that lower confidence nodes produce relatively significant gradients, we do the statistics shown in Figure 3. It compares the previous attack objective -Lee with Latk gd on Citeseer and Cora. In the figure, the x-axis of each point the
8

---

Citeseer
Cora
Citeseer
Cora
99
CEE
100
Lakel
Lakgg
50-
00
0.2
0.5
055
35
0.0
0.2
94
0.6
08
1.0
0.3
0.2
114
68
10
0.5
10.2
005
1M
Confidence
Confidence
Confiddnne
Confidence
Figure 3: Scatterplol of the nodes' confidence with the Eg norm of their partial gradient matrices.
Metn-Self
140
Cireserr
Iroquetes
MI
Prnquence
40
8.
60
Cora
Polbiogs treeuebe
30
Conficence
Confdonce
Confidrace
Figure 4: Confidence distribution of perturbed graphs from GraD and Meta-Self on unified GCN model. The x-axis is the interval of the confidence level, and the y-axis is the frequency of the node confidences distributed in the interval.
confidence of the node on the pseudo-labed class, and the y-axis is the l norm of its partial gradient matrix (i.e., the global salience of the gradient generated by that node via the attack loss).
The previous attack objective produces significant gradients for low confidence nodes. The attack is more susceptible to low confidence nodes, which limits budgetary planning to a local scope. The gradient bias of low confidence nodes is eliminated in proposed Latk-odt gd The gradient is naturally larger on node at a middle confidence level than at a low or high confidence level. This is because the node deviates from the centroid of any class in the hidden space. Nodes at the middle confidence level become low confidence nodes when attacked, while low confidence nodes are not vulnerable. It ensures that the vulnerable nodes continuously change and achieves global budget allocation.
5.4 Confidence Distribution Analysis
To demonstrate that approach solves the problem we state, visualize the distribution of the surrogate model's prediction confidence, as shown in Figure 4. The confidence level of a node is the output possibility (obtained from the clean graph) for its pseudo-label class. We compare the confidence distributions between the perturbed graphs generated by GraD and Meta-Self. 'Clean' represents the confidence distribution of the GNN model trained with the unperturbed graph. The GNN model for each graph is set up as a GCN with unified network architecture.
In Cora, Cora-ML, and Citeseer, most nodes have confidence levels greater than 0.9 in clean graph, mainly distributed at the high confidence level. The nodes in the Polblogs are mainly distributed at a confidence level of about 0.7. For the perturbed graphs generated by Meta-Self, the number of nodes with high and low confidence significantly more than other nodes, especially in Cora, Citeseer, and Polblogs. It validates our elaboration that the previous attack objective leads the attacker into repeatedly attacking low confidence nodes. Comparing GraD with Meta-Self, graphs perturbed by GraD have fewer nodes being distributed in the high confidence level. Moreover, the graphs from GraD have fewer nodes on the low confidence level than that of Meta-Self. The results show that GraD attacks more high-confidence nodes and generates fewer low-confidence nodes than Meta-Self. The results illustrates that GraD allocates the attack budget on low confidence nodes to high confidence nodes that have not yet been attacked.

---

6 Conclusion
This paper focuses on the budget allocation problem for untargeted gray-box edge perturbations. We first argue that the loss function used by other methods will lead to an unreasonable budget allocation during the perturbation process. The gradient of the attack loss function based on cross- entropy is related to the confidence of the node on the pseudo-label, which Icads to the problem that nodes with lower confidence are more likely to be allocated budgets. Considering that a node is successfully attacked after its confidence is below threshold, it should not be allocated more budget than other nodes from a budget allocation perspective. To this end, we propose GraD, an attack model using gradient de-weighting attack objective. Our method proposes simple but effective attack objective to balance the harmful tendency caused by confidence when the gradient generated through backpropagation. In the experimental section, we validate the effectiveness of our proposed method by experimenting with different settings of the untargeted poisoning gray-box attack. The results demonstrate that GraD significantly improves the attacker's attack success rate, which proves the reliability of our discussion on the shortcoming of the previous attack objective and the effectiveness of our approach.
Acknowledgement
This work is supported in part by Ministry of Science and Technology of the People 's Republic of China (No. 2021YFA130160) and National Natural Science Foundation of China (No. U21A20427).
References
[1] Lada A Adamic and Natalie Glance. The political blogosphere and the 2004 us election: divided they blog. In Proceedings of the 3rd international workshop on Link discovery, pages 36-43, 2005.
[2] Heng Chang, Yu Rong, Tingyang Xu, Wenbing Huang, Honglei Zhang, Peng Cui, Wenwu Zhu, and Junzhou Huang. A restricted black-box adversarial framework towards attacking graph embedding models. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 34, pages 3389-3396, 2020.
[3] Hanjun Dai, Hui Li, Tian Tian, Xin Huang, Lin Wang, Jun Zhu, and Le Song. Adversarial attack on graph structured data. In International conference on machine learning, pages 1115 1124. PMLR, 2018
[4] Simon Geisler, Tobias Schmidt, Hakan Sirin, Daniel Zügner, Aleksandar Bojchevski, and Stephan Günnemann. Robustness of graph neural networks at scale. Advances in Neural Information Processing Systems, 34, 2021.
[5] Will Hamilton, Zhitao Ying, and Jure Leskovec. Inductive representation learning on large graphs. Advances in neural information processing systems, 30, 2017.
[6] Jen-tse Huang, Jianping Zhang, Wenxuan Wang, Pinjia He, Yuxin Su, and Michael R. Lyu. Aeon: method for automatic evaluation of nip test cases. In Proceedings of the 31st ACM SIGSOFT International Symposium on Software Testing and Analysis, ISSTA 2022, page 202-214, New York, NY, USA, 2022. Association for Computing Machinery.
[7] Thomas N. Kipf and Max Welling. sume-suuer classification with graph convolutional networks. In 5th International Conference Learning Representations, ICLR 2017, Toulon, France, April 24-26, 2017, Conference Track Proceedings, 2017.
[8] Linyang Li, Ruotian Ma, Qipeng Guo, Xiangyang Xue, and Xipeng Qiu. Bert-attack: Adversar- ial attack against bert using bert. In Proceedings the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 3193-6202. 2020.
[9] Xixun Lin, Chuan Zhou, Hong Yang, Jia Wu, Haibo Wang, Yanan Cao, and Bin Wang, Ex- ploratory adversarial attacks on graph neural networks. In 2020 IEEE International Conference on Data Mining (ICDM), pages 1136-114 1141. IEEE, 2020.
10

---

[10] Yen-Chen Lin, Zhang- Wei Hong, Yuan- Liao, Meng-Li Shih, Ming- Yu Liu, and Min Sun. Tactics of adversarial attack on deep reinforcement learning agents. In Proceedings of the 26th International Joint Conference on Artificial Intelligence, pages 3756-3762, 2017.
[11] Zihan Liu, Yun Luo, Lirong Wu, Siyuan Li, Zicheng Liu, and Stan Z Li. Are gradients graph structure reliable in gray-box attacks? arXiv preprint arXiv:2208 05514, 2022.
[12] Zihan Liu, Yun Luo, Zelin Zang, and Stan Z Li. Surrogate representation learning with isometric mapping for gray-box graph adversarial attacks. In Proceedings of the Fifteenth ACM International Conference on Web Scarch and Data Mining, pages 591-598, 2022.
[13] Yun Luo, Zihan Liu, Yuefeng Shi, Stan Z Li, and Yue Zhang. Exploiting sentiment and common sense for zero-shot stance detection. arXiv preprint arXiv:2208.0877) 2022.
[14] Jiaqi Ma, Shuangrui Ding, and Qiaozhu Mei. Towards more practical adversarial attacks on graph neural networks. Advances in neural information processing systems, 2020.
[15] Yao Ma, Suhang Wang, Tyler Derr, Lingfei Wu, and Jiliang Tang. Attacking graph convolutional networks via rewiring. arXiv preprint arXiv: 120.vv1196600777.. 2019.
[16] Andrew Kachites McCallum, Kamal Nigam, Jason Rennie, and Kristie Seymore. Automating the construction of internet portals with machine learning. Information Retrieval, 3(2):177-163, 2000.
[17] Prithviraj Sen, Galilco Namata, Mustafa Bilgic, Lise Getoor, Brian Galligher, and Tina Eliassi- Rad. Collective classification in network data. Al magazine, 29(3):93-93, 2008.
[18] Yiwei Sun, Suhang Wang, Xianfeng Tang. Tsung Yu Hsieh, and Vasant Honavar. Node injection attacks on graphs via reinforcement learning, arXiv preprint 1909 06543, 2019.
[19] Yiwei Sun, Suhang Wang, Xianfeng Tang, Tsung- Yu Hsieh, and Vasant Honavar. Adversarial attacks on graph neural networks via node injections: A hierarchical reinforcement learning approach. Proceedings of The Web Conference 2020, pages 673-683, 2020.
[20] Petar Velickovic, Guillem Cucurull, Arantxa Casanova, Adriana Romero, Pietro Lio, and Yoshua Bengio. Graph attention networks. stat. 1050:20, 2017.
[21] Xiaoyang Wang, Yao Ma, Yiqi Wang, Wei Jin, Xin Wang, Jiliang Tang, Caiyan Jia, and Jian Yu. Traffic flow prediction via spatial temporal graph neural network. In Proceedings of The Web Conference 2020, pages 1082-1099 1092, 2020.
[22] Marcin Waniek, Tomasz P Michalak, Michael J Wooldridge, and Talal Rahwan. Hiding individuals and communities in a social network. Nature Human Behaviour, (12):139-147, 2018.
[23] Huijun Wu, Chen Wang, Yuriy Tyshetskiy, Andrew Docherty, Kai Lu, and Liming Zhu. Ad- versarial examples graph data: Deep insights into attack and defense. In International Joint Conference on Artificial Intelligence, 2019.
[24] Lirong Wu, Haitao Lin, Zhangyang Gao, Cheng Tan, Stan Li, et al. Graphmixup: Improving class-imbalanced node classification on graphs by self-supervised context prediction. arXiv preprint arXiv:2106. 11133, 2021.
[25] Lirong Wu, Haitao Lin, Cheng Tan, Zhangyang Gao, and Stan Z Li. Self-supervised learning on graphs: Contrastive, generative, or predictive. IEEB Transactions on Knowledge and Data Engineering, 2021.
[26] Shu Wu, Yuyuan Tang, Yanqiao Zhu, Liang Wang, Xing Xie, and Tieniu Tan. Session-based recommendation with graph neural networks. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 33, pages 346-353, 2019.
[27] Han Xu, Yao Ma, Hao-Chen Liu, Debayan Deb, Hui Liu, Ji-Liang Tang, and Anil K Jain. Adversarial attacks and defenses in images, graphs and text: A review. International Journal of Automation and Computing, 17(2):151-178, 2020.
11

---

[28) Kaidi Xu, Hongge Chen, Sijia Liu, Pin Yu Chen, Tsui Wei Weng, Mingyi Hong, and Xue Lin. Topology attack and defense for graph neural networks: An optimization perspective. In 28th International Joint Conference on Artificial Intelligence, IJCAI 2019, pages 3961-3967, 2019.
[29] Xiaoyong Yuan, Pan Hc, Qile Zhu, and Xiaolin Li. Adversarial examples: Attacks and defenses for deep learning. IEEE transactions on neural networks and learning systems, 30(9))2805- 2824, 2019.
[30] Jianping Zhang, Weibin Wu, Jen-tse Huang, Yizhan Huang, Wenxuan Wang, Yuxin Su, and Michael R Lyu. Improving adversarial transfcrability via ncuron attribution-based attacks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 14993-15002, 2022.
[31] Ting Zhong. Tianliang Wang, Jiahao Wang, Jin Wu, and Fan Zhou. Multiple-aspect attentional graph neural networks for online social network user localization. IEEE Access, 8:95223-95234, 2020.
[32] Jie Zhou, Ganqu Cui, Shengding Hu, Zhengyan Zhang, Cheng Yang, Zhiyuan Liu, Lifeng Wang, Changcheng Li, and Maosong Sun. Graph neural networks: A review of methods and applications. AI Open, 1:57-81, 2020.
[33] Daniel Zügner, Amir Akbarnejad, and Stephan Günnemann. Adversarial attacks on neural networks for graph data. In Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery Data Mining, pages 2847 2856, 2018.
[34] Daniel Zügger and Stephan Günnemann. Adversarial attacks on graph neural networks via meta learning. In 7th International Conference Learning Representations, ICLR New Orleans, LA, USA, May 6-9, 2019. OpenReview.net, 2019.
New
12


Reviews:
[{"review_id": "bDH2W8aZ_W", "reviewer": "Reviewer_2pFy", "summary": "- The authors tackle the problem of the attack objective (the form of cross-entropy function) in the untargeted attacks on node-level classification models. \n- They show that nodes with low confidence significantly affect the gradient.\n- To alleviate this problem of inefficient attack budgets, they propose a novel attack objective whose corresponding gradient is not affected by the confidence of nodes. \n- They conduct experiments on gray-box poisoning attack and shows that the proposed attack method GraD (based on the proposed gradient-debias attack objective) can significantly improve the attack performance.", "questions": "- I hope that the explanation of the purpose of the poisoning attack is simply added to the introduction or related works.\n- Why are there no line numbers in your submission?\n- I want to know more scenarios to apply GraD other than gray-box / white-box attack on GCN-based node classification models if exist. \n- If I understood correctly, we can apply GraD to white-box attack too. Can you show some white-box attack results of GraD and white-box baseline methods? \n- One can replace the attack objective of GraD to the original negative cross-entropy loss and compare it with GraD as an ablation study. Is there already a baseline corresponding to it in the table 1, 2? If not, I want to see this result.\n\nPOST REBUTTAL COMMENTS: The authors answer the questions. My concerns have been addressed. They can apply their method also in the white-box attack setting. They add broader impacts and fix some minor issues in the paper. I adjust my score from 6 to 7.", "limitations": "This paper handle the adversarial attack which can be used by malicious adversaries. That said, I wish that the authors include ethics or broader-impact statement in the paper or appendix.", "rating": 7, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "# Strengths\n- The authors states an interesting problem in the cross-entropy based attack objective. (Figure 1 was very helpful to understand the concept!)\n- The authors explain the proposed problem using a simple mathematics. Also, they mathematically explain their proposed attack objective can solve the problem.\n- They conduct fair comparison on various datasets and achieve the state-of-the-art attack performance.\n\n# Weaknesses\n- The usage of the method seems limited to gray-box / white-box attack on GCN-based node classification models. \n- Ablation studies seem insufficient.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "b7_BTEvZh7M", "reviewer": "Reviewer_9RmM", "summary": "This paper studies the problem conducting untargeted poisoning attacks against graph neural networks by pertaining edges of the original graph. The authors identified the problem of attack loss design, which mostly uses the same loss function (i.e., negative cross entropy) for model training, and pointed out that, with the wrong loss function, attack budget is wasted on causing misclassification for nodes that are already misclassified. Then a debasing solution is proposed by multiplying the gradients with their confidence scores and the obtained simple attack strategy outperforms the existing baselines significantly. ", "questions": "I do not list this as a question that will change my decision, but I am curious to know, if there are any other ways (e.g., designing new attack loss) to perform the edge perturbation instead of renormalizing the gradient.", "limitations": "N/A", "rating": 5, "confidence": 3, "soundness": 2, "presentation": 4, "contribution": 2, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "I like the idea of the paper as it challenges some of the common beliefs in the attack design against graph neural networks, which is novel and signficant. The presentation of the paper is also very clear and easy to follow. Overall, the strength of the paper significantly outweighs the weakness. However, I have the following concerns:\n1) the work by Ma et al., [9] (reference in the paper) and one missing work linked below [1] might deserve more discussion, as they are more related to the key problem identified in the paper: the downside of choosing a wrong type of attack loss.\n[1] Ma et al., \"Adversarial Attack on Graph Neural Networks as An Influence Maximization Problem\", WSDM 2022.  \n2) the identified problem and fixable solution given in the paper is only demonstrated for the case of cross-entropy loss, and so the conclusion is not very generic.\n\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "Imfyr8NILL8", "reviewer": "Reviewer_CLc8", "summary": "This paper studies the graph modification attack in a untargeted poisoning setting by editing the edges, and reveals that using the negative cross entropy as the attack loss will cause unreasonable budget allocation issue. Thus, the paper proposes a new attack objective by plugging the confidence to reduce the influence of the negative cross entropy. The authors conduct some experiments to validate their findings.", "questions": "Starting from an interesting observation of the budget allocation in the untargeted poisoning graph modification attack, the authors reveal that using negative cross entropy loss can affect the gradients signals passed to the adversary hence the adversary keeps allocating budgets to attack the low confidence nodes. However, there are several concerns raised when I read the paper.\n\n1. The scope of the studied attack might be too limited. In fact, graph adversarial attacks can have both poisoning and evasion, targeted and untargeted, modification and injection attacks [1,2,3]. Especially, [3,4] point out that the poisoning attack can have severe issues due to the ill-defined imperceptibility. More justification and discussions are required for the reasons about why adopting the setting in the paper. Otherwise, the limited setting used and discussed in this paper weakens the significance and novelty of the paper, given that the main contribution of this work is to propose a new adversarial objective for graph adversarial attacks. \n\n2. Important experiments seem to be missed in the paper. Since the proposed objective can improve the budget allocation of the graph adversarial attack, the authors only conduct two experiments with 2 specific allowed budgets, which is significantly less than existing literatures [1,2,3,4,5,6,7], providing weak support to the effectiveness of the proposed objective.\n\n3. It would be more interesting if the authors could discuss and evaluate the budget allocation during the targeted attack to the large scale graphs [8,9] which tends to be appealing in practice, as we often do not have sufficient budgets to attack all of the test nodes in a large scale graph while many of node classification applications focus on the large scale graphs. In the literature, the graph injection attack can serve a good proxy [4].\n\n4. The scope of the experiments is also limited. The authors only test with GCN, GAT, GraphSage, while neglecting many defense methods [6,7], as well as methods such as Nettack that can also be leveraged to attack and see the survey [1,2,3] for more details. Some representative datasets such as Pubmed are missed.\n\n5. In experimental setup, ``Each experiment is repeated ten times with a fixed random seed’’, what is the point to fixing the random seeds and repeat the experiments? How do they produce different results if the random seeds are fixed?\n\n6. The writing is hard to follow. There are too many undefined mathematical symbols and typos. Here are some of them (not sure why authors cancel the line numbers, making the reviewers hard to point out the specific locations of their concerns):\n    - In 3.1, ``while the prediction of f θ is denoted by the probability distribution P_vi’’\n    - In Eq. 4, what is z_i?\n    - After Eq. 4, `` where V ∗ is a subnet of nodes’’\n    - In Sec. 4, is it the linearized GNN, SGC or GCN?\n    - In Sec. 4, y_i is undefined.\n    - In Eq. 6, what is A^grad? What is A^grad with subscript v_i? Does it mean taking some entry in A^grad?\n    - After Fig. 4, ``We consider this to be since the node deviates from the centroid of any class.’’\n\n\n\n\nReferences:\n\n[1] Wei Jin, Yaxin Li, Han Xu, Yiqi Wang, Shuiwang Ji, Charu Aggarwal, Jiliang Tang. Adversarial Attacks and Defenses on Graphs: A Review, A Tool and Empirical Studies. SIGKDD Explorations 2020.\n\n[2] Lichao Sun, Yingtong Dou, Carl Yang, Ji Wang, Philip S. Yu. Adversarial Attack and Defense on Graph Data: A Survey. arXiv 2020.\n\n[3] Qinkai Zheng, Xu Zou, Yuxiao Dong, Yukuo Cen, Da Yin, Jiarong Xu, Yang Yang, Jie Tang. Graph Robustness Benchmark: Benchmarking the Adversarial Robustness of Graph Machine Learning. NeurIPS 2021 Datasets and Benchmark Track.\n\n[4] Yongqiang Chen, Han Yang, Yonggang Zhang, Kaili Ma, Tongliang Liu, Bo Han, James Cheng. Understanding and Improving Graph Injection Attack by Promoting Unnoticeability. ICLR 2022.\n\n[5] Shuchang Tao, Qi Cao, Huawei Shen, Junjie Huang, Yunfan Wu, Xueqi Cheng. Single Node Injection Attack against Graph Neural Networks. CIKM 2021.\n\n[6] Xiang Zhang, Marinka Zitnik. GNNGuard: Defending Graph Neural Networks against Adversarial Attacks. NeurIPS 2020.\n\n[7] Wei Jin, Yao Ma, Xiaorui Liu, Xianfeng Tang, Suhang Wang, Jiliang Tang. Graph Structure Learning for Robust Graph Neural Networks. KDD 2020.\n\n[8] Simon Geisler, Tobias Schmidt, Hakan Şirin, Daniel Zügner, Aleksandar Bojchevski, Stephan Günnemann. Robustness of Graph Neural Networks at Scale. NeurIPS 2021.\n\n[9] Enyan Dai, Tianxiang Zhao, Huaisheng Zhu, Junjie Xu, Zhimeng Guo, Hui Liu, Jiliang Tang, Suhang Wang. A Comprehensive Survey on Trustworthy Graph Neural Networks: Privacy, Robustness, Fairness, and Explainability. arXiv 2022.\n", "limitations": "The authors did not provide such a discussion.", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "*Originality & Significance*: Studies around graph adversarial attack and defense are of great importance to the community. However, given the limited scope of the focus in this paper, the significance might be weakened. See the Questions below for more details.\n\n*Quality*: The authors conduct certain theoretical and empirical analysis to validate their claims. However, the experiments might not be sufficient to fully support the effectiveness of the proposed method. See the Questions below for more details.\n\n*Clarity*: The paper is well-organized yet not easy to follow. There are too many undefined mathematical symbols and typos.\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}]

Author rebuttal:

Decision: Accept