Paper: Long-distance Targeted Poisoning Attacks on Graph Neural Networks (ICLR-2024)

Reviewer comment (Experiments):
The definition of "long distance" and the specific distance of the injected malicious nodes remain unclear in the current version of the paper.

Author response:
**[Q.1.]** *The definition of "long distance" and the specific distance of the injected malicious nodes remain unclear in the current version of the paper.* \
**[A.1.]** We define long distance as following, for any attack point $v_a$, the shortest path length from $v_a$ to the target node $v_t$ should be larger than the number of layers used by the victim GNN model. In our experiments, we set $k=3$. We will emphasize the definition more clearly in revision.

Reviewer comment (Experiments):
Have you taken into account the influence of robust methods during the poisoning process? If so, what are the results regarding the method's effectiveness when attackers lack knowledge of defense mechanisms, which is more practical in real-world scenarios?

Author response:
**[Q.2.]** *Have you taken into account the influence of robust methods during the poisoning process? If so, what are the results regarding the method's effectiveness when attackers lack knowledge of defense mechanisms.* \
**[A.2.]** In the experiments reported in the paper, MetaLDT’s inner training loops and MimicLDT’s surrogate models account for what GNN defenses are used. In the table below, we include results in a setting where MimicLDT’s surrogate model does not account for GNN defenses, and we instead use vanilla GCN as the surrogate model. 
|  | Surrogate | GCN | GraphSAGE | GAT | GNNGuard | SoftMedianGDC | JaccardGCN | SVDGCN | ProGNN |
| ----- | ----- | -----| ----- | ----- | ----- | ----- |----- |  ----- |  ----- |
| Cora | Aware the defense | 0.67 | 0.63 | 0.60 | 0.70 | 0.55 | 0.66 | 0.74 | 0.59 |
|    | Vanilla GCN | 0.67 | 0.63 | 0.59 | 0.68 | 0.29 | 0.65 | 0.35 | 0.53 |
| arXiv | Aware the defense | 0.74 | 0.73 | 0.70 | 0.64 | 0.59 | 0.63 | 0.62 | 0.58 |
|    | Vanilla GCN | 0.74 | 0.72 | 0.67 | 0.64 | 0.42 | 0.61 | 0.49 | 0.55 |

We observe that for some defenses (e.g., SAGE, GNNGuard), not knowing about the defenses has little or no impact on poison success rate, but for others (e.g., SVDGCN and SoftMedian) the effects are more noticeable.  Table 9 in the paper’s appendix evaluates MetaLDT under a similar scenario, i.e., in a case where its inner-training loop does not account for defenses, and leads to similar conclusions.

Reviewer comment (Experiments):
The rationale behind why MimicLDT is more efficient is not clearly articulated. Further elaboration on this aspect would be beneficial. Is it possible to discuss the trade-off between efficiency and effectiveness, such as exploring adjustments to hyperparameters to strike a balance between MimicLDT and MetaLDT?

Author response:
**[Q.3.]** *The rationale behind why MimicLDT is more efficient is not clearly articulated. Further elaboration on this aspect would be beneficial. Is it possible to discuss the trade-off between efficiency and effectiveness, such as exploring adjustments to hyperparameters to strike a balance between MimicLDT and MetaLDT?* \
**[A.3.]** MimicLDT uses certain design heuristics to restrict the optimization to a much smaller search space than MetaLDT, and is thus more efficient. In particular, MimicLDT does not optimize for which attack points to use nor the graph structure among injected nodes. Furthermore, MimicLDT uses a surrogate optimization goal (trying to use injected nodes to cause an attack point and the target to collide in the embedding space) to determine injected node features. This is in contrast to MetaLDT whose optimization considers the entire space of attack node choices and injected node/graph structures and uses meta-learning (which requires very expensive inner training) to achieve direct end-to-end optimization of the label flipping probability.

In terms of the trade-off between MetaLDT and MimicLDT, we note that MetaLDT always has significantly higher computational cost than MimicLDT in order to achieve any decent poisoning rate, e.g., in Figure 5 of the Appendix, we show that, for Cora and GCN, MetaLDT requires a minimum of 8 inner training rounds and 9670.46s to reach the same poison success rate that MimicLDT can reach in about 43.17 seconds. On the other hand, MetaLDT’s larger search space means that it can often achieve higher poison success rates than MimicLDT can if time is not a concern.

Reviewer comment (Novelty):
The authors claim that most of the existing attacks on GNNs modify the target node’s k-hop neighborhood, but this is not accurate. For instance, most of the cited poisoning attacks focus on global structure attack, where the entire graph structure can be modified.

Author response:
Although existing poisoning attacks can modify any part of the entire graph structure, the results of their optimization end up exclusively changing the target’s k-hop neighborhood.  Furthermore, existing attacks based on meta learning can not scale to large graphs and thus are not practical.

Reviewer comment (Experiments):
The threat model assumes that the attacker has access to the training data (including the original graph G, node features, labels, and also knows the training procedure), which is a rather strong assumption. There exist (restricted) black-box attacks to GNNs, while the authors do not compare and discuss with them.

Author response:
To the best of our knowledge, no existing black-box GNN attacks can be applied to our setting, i.e., long-distance node-injection targeted poisoning. While we do not discount the possibility that potential black box attacks for this setting could be developed, doing so would require significant further research. We will add a discussion about black box attacks to a revised version of our paper.

Reviewer comment (Evaluation):
The motivation of considering nodes that are outside the top-k neighbors of the target victim is unclear. The authors argued in the appendix that, using some graph explanation tools, the attached nodes can be retried relatively well in some settings. However, the authors made an implicit assumption that such a tool can be directly treated as a detection method, without distinguishing the differences between the influential nodes for the target victim and other nodes. Can we use some threshold to filter out suspicious looking influence nodes for the node under examination? Will this filtering step can be evaded by some adaptive attacks so that short-distance attacks can still survive without sacrificing the effective much?

Author response:
You made a good point that attackers could try to strengthen their attacks if they knew that GNN explanation tools are being used to detect short distance attacks. In addition to being less conspicuous, we think the bigger advantage of a long distance attack like MimicLDT is that it allows the attacker to choose from a much larger population of potential attack points. In particular, any node whose label is the same as the target poison label can function as an attack point, and there are many more of those at further distance away from the target node.

Reviewer comment (Novelty):
From the technical perspective, I did not find a significant (inherent) difference from the previously proposed Meta-Attack, as the major the differences are on optimizing a different loss function to encode the targeted attack objective and also to avoid making connections with nodes of top-k neighbors of the target victim during optimization.

Author response:
Our main contribution is the practical long distance poisoning attack MimicLDT, whose design heuristics are derived from our observations of MetaLDT’s behavior.  Compared to existing attacks, MimicLDT can scale to much larger graphs and is easier for the attacker to launch because it is flexible with which attack points to use.  We design and evaluate MetaLDT to motivate the heuristics of MimicLDT and to quantify how much MimicLDT gives up in terms of poison effectiveness to its design heuristics.

We also want to clarify that the differences between MetaLDT and Meta-Attack extend beyond changes to the loss function, and require changing the optimization procedure. Specifically, MetaLDT (a) requires the optimization procedure to alternate between optimizing the adjacency matrix and optimizing node features; (b) uses a gradient descent based feature optimizer, rather than one based on meta-scores, thus allowing us to change the feature of all injected nodes in a single feature-optimization iteration (rather than requiring changes to a single node at a time). These changes to the optimization procedure are crucial to making MetaAttack work in our setting.

Reviewer comment (Reproducibility):
What is the value of $k$ to determine if an attack is short-distance or long distance.

Author response:
$k$ is the number of GNN layers used by the victim model. A long distance attack is one in which injected nodes are further away from the target node than the number of GNN layers.

Reviewer comment (Experiments):
The comparison with short-distance attacks is valuable. However, the compared baselines lack more recent node injection attack methods.

Author response:
We evaluated the efficacy of AFGSM (Wang et al., DMKD’20)[1], a well cited recent node-injection poisoning attack. We used the author’s implementation, but modified it to perform targeted label-flipping poisoning instead of misclassifying the target to be any arbitrary class. The table below shows the Cora results of direct attacks (injected nodes can be direct neighbors of the target node) as well as indirect attacks (injected nodes cannot be direct neighbors but can be k-hop neighbors). The experiments use the same setting as that in our paper (Sec 6, Table 1).  
|  |  | GCN | GraphSAGE | GAT | GNNGuard | SoftMedianGDC | JaccardGCN | SVDGCN | ProGNN |
| ----- | ----- | -----| ----- | ----- | ----- | ----- |----- |  ----- |  ----- |
| Cora | Direct | 0.52 | 0.42 | 0.43 | 0.50 | 0.39 | 0.49 | 0.43 | 0.46 |
|    | Indirect | 0.37 | 0.24 | 0.31 | 0.33 | 0.25 | 0.32 | 0.23 | 0.34 |

We can see that both the direct and indirect-attacks of AFGSM have a poison success rate ranging from 23–52%, which is lower than what we achieved (55-74% for MimicLDT, 53-96% for MetaLDT). We will add this comparison to a revised version of the paper.

We would also like to note that most recent injection attacks, including, TDGIA(Zou et al., KDD’21), GIA-HAO (Chen et al., ICLR’22), CANA(Tao et al., 2023), G2A2C(Ju et al., AAAI’23), are test-time evasion attacks, so we cannot directly compare against them.

[1] Jihong Wang, Minnan Luo, Fnu Suya, Jundong Li, Zijiang Yang, and Qinghua Zheng. 2020. Scalable attack on graph data by injecting vicious nodes. Data Min. Knowl. Discov. 34, 5 (Sep 2020), 1363–1389. https://doi.org/10.1007/s10618-020-00696-7

Reviewer comment (Experiments):
Some claims lack further empirical or theoretical support. For example, the authors claim that 'there are many more potential attack points beyond the target’s K-hop neighborhood’. It would be better if authors could offer detailed support data analysis.

Author response:
Please refer to our answer to Q.2.

Reviewer comment (Writing):
Some minor errors:  
designe-> design  
heuristicsc)Finally -> heuristics. c) Finally

Author response:
Thank you for pointing out the typos. We will fix these.

Reviewer comment (Experiments):
Whether the proposed method be generalized to unknown victim models?

Author response:
Our proposed attack assumes knowledge of the victim model. We do not believe it can be generalized to unknown victim models in theory. However, empirically, the situation is a bit more complex: we ran experiments where the attacker who uses a GCN as the surrogate model either did not know what model was being used (e.g. GAT) or was unaware of what defenses were in use, and measured the efficacy of MimicLDT. We show results in the table below (the rows corresponding to “vanilla GCN”):
|  | Surrogate | GCN | GraphSAGE | GAT | GNNGuard | SoftMedianGDC | JaccardGCN | SVDGCN | ProGNN |
| ----- | ----- | -----| ----- | ----- | ----- | ----- |----- |  ----- |  ----- |
| Cora | Aware the defense | 0.67 | 0.63 | 0.60 | 0.70 | 0.55 | 0.66 | 0.74 | 0.59 |
|    | Vanilla GCN | 0.67 | 0.63 | 0.59 | 0.68 | 0.29 | 0.65 | 0.35 | 0.53 |
| arXiv | Aware the defense | 0.74 | 0.73 | 0.70 | 0.64 | 0.59 | 0.63 | 0.62 | 0.58 |
|    | Vanilla GCN | 0.74 | 0.72 | 0.67 | 0.64 | 0.42 | 0.61 | 0.49 | 0.55 |

Our results show that in many cases (e.g. GAT) using a vanilla GCN based surrogate model can poison as successfully as using a surrogate based on the correct victim model. However, we also see a significant drop in poison success rate in other cases (e.g., SoftMedian, SVDGCN).

Reviewer comment (Evaluation):
Is there any data analysis supporting the claim that 'there are many more potential attack points beyond the target’s K-hop neighborhood’?

Author response:
We evaluated this empirically for the Cora dataset. Figure 1 of [supplementary material](https://drive.google.com/file/d/1l11Ko6MdRqI0-ok3dN_BDi2pTxumK6CY/view?usp=sharing) shows the distribution of the distance of potential attack points from a target.  We can see that about 95% of the attack points are more than 3-hops away (thus qualifying as long-distance attacks). In Figures 2 and 3, we show the attack points picked by MimicLDT across various datasets and MetaLDT across various models in our experiments are between 4 and 19 hops away.