Original: A DVERSARIAL A TTACKS ON G RAPH N EURAL N ETWORKS VIA M ETA L EARNING
Revised: A DVERSARIAL A TTACKS ON G RAPH N EURAL N ETWORKS VIA M ETA L EARNING

Original: Anonymous authors

Original: Paper under double-blind review

Original: A BSTRACT
Revised: A BSTRACT

Original: Deep learning models for graphs have advanced the state of the art on many tasks.
Revised: Deep learning models for graphs have advanced the state of the art on many tasks.

Original: Despite their recent success, little is known about their robustness.
Revised: Despite their recent success little is known about their robustness.

Original: We investigate training time attacks on graph neural networks for node classiﬁcation that perturb the discrete graph structure.
Revised: We investigate training time attacks on graph neural networks for node classiﬁcation that perturb the discrete graph structure.

Original: Our core principle is to use meta-gradients to solve the bilevel problem underlying training-time attacks, essentially treating the graph as a hyperparameter to optimize.
Revised: Our core principle is to use meta-gradients to solve the bilevel problem underlying training-time attacks, essentially treating the graph as a hyperparameter to optimize.

Original: Our experiments show that small graph perturbations consistently lead to a strong decrease in performance for graph convolutional networks, and even transfer to unsupervised embeddings.
Revised: Our experiments show that small graph perturbations consistently lead to a strong decrease in performance for graph convolutional networks, and even transfer to unsupervised embeddings.

Original: Remarkably, the perturbations created by our algorithm  misguide the graph neural networks such that they perform worse than a simple baseline that ignores all relational information.
Revised: Remarkably, the perturbations created by our algorithm can misguide the graph neural networks such that they perform worse than a simple baseline that ignores all relational information.

Original: Our attacks do not assume any knowledge about or access to the target classiﬁers.
Revised: Our attacks do not assume any knowledge about or access to the target classiﬁers.

Original:  I NTRODUCTION
Revised:  I NTRODUCTION

Original: Graphs are a powerful representation that can model diverse data from virtually any domain, such as biology (protein interaction networks), chemistry (molecules), or social networks (Facebook).
Revised: Graphs are a powerful representation that can model diverse data from virtually any domain, such as biology (protein interaction networks), chemistry (molecules), or social networks (Facebook).

Original: Not surprisingly, machine learning on graph data has a longstanding history, with tasks ranging from node classiﬁcation, over community detection, to generative modeling.
Revised: Not surprisingly, machine learning on graph data has a longstanding history, with tasks ranging from node classiﬁcation, over community detection, to generative modeling.

Original: In this paper, we study node classiﬁcation, which is an instance of semi-supervised classiﬁcation: given a single (attributed) network and a subset of nodes whose class labels are known (e.g., the topic of a paper in a citation graph), the goal is to infer the classes of the unlabeled nodes.
Revised: In this paper, we study node classiﬁcation, which is an instance of semi-supervised classiﬁcation: given a single (attributed) network and a subset of nodes whose class labels are known (e.g., the topic of a paper in a citation graph), the goal is to infer the classes of the unlabeled nodes.

Original: While there exist many classical approaches to node classiﬁcation (London & Getoor, 2014; Chapelle et al., 2006), recently deep learning on graphs has gained much attention (Monti et al., 2017;  Battaglia et al., 2018; Perozzi et al., 2014; Bojchevski et al., 2018).
Revised: While there exist many classical approaches to node classiﬁcation (London & Getoor, 2014; Chapelle et al., 2006), recently deep learning on graphs has gained much attention (Monti et al., 2017; Bojchevski & G ¨ unnemann, 2018a; Battaglia et al., 2018; Perozzi et al., 2014; Bojchevski et al., 2018; Klicpera et al., 2019).

Original: Speciﬁcally, graph convolutional approaches (Kipf & Welling, 2017; Pham et al., 2017) have improved the state of the art in node classiﬁcation.
Revised: Speciﬁcally, graph convolutional approaches (Kipf & Welling, 2017; Pham et al., 2017) have improved the state of the art in node classiﬁcation.

Original: However, recent works have also shown that such approaches are vulnerable to adversarial attacks both at test time ( evasion ) as well as training time ( poisoning attacks) (Z ¨ ugner et al., 2018; Dai et al., 2018).
Revised: However, recent works have also shown that such approaches are vulnerable to adversarial attacks both at test time ( evasion ) as well as training time ( poisoning attacks) (Z¨ugner et al., 2018; Dai et al., 2018).

Original: A core strength of models using graph convolution – exploiting the information in a node’s neighborhood to improve classiﬁcation – is also a major vulnerability: because of these propagation effects, an attacker can change a single node’s prediction without even changing any of its attributes or edges.
Revised: A core strength of models using graph convolution – exploiting the information in a node’s neighborhood to improve classiﬁcation – is also a major vulnerability: because of these propagation effects, an attacker can change a single node’s prediction without even changing any of its attributes or edges.

Original: This is because the foundational assumption that all samples are independent of each other does not hold for node classiﬁcation.
Revised: This is because the foundational assumption that all samples are independent of each other does not hold for node classiﬁcation.

Original: Network effects such as homophily (London & Getoor, 2014) support the classiﬁcation, while on the other hand they enable indirect adversarial attacks.
Revised: Network effects such as homophily (London & Getoor, 2014) support the classiﬁcation, while on the other hand they enable indirect adversarial attacks.

Original: So far, all existing attacks on node classiﬁcation models are targeted , that is, aim to provoke misclassiﬁcation of a speciﬁc single node, e.g. a person in a social network.
Revised: So far, all existing attacks on node classiﬁcation models are targeted , that is, aim to provoke misclassiﬁcation of a speciﬁc single node, e.g. a person in a social network.

Original: In this work, we propose the ﬁrst algorithm for poisoning attacks that is able to compromise the global node classiﬁcation performance of a model.
Revised: In this work, we propose the ﬁrst algorithm for poisoning attacks that is able to compromise the global node classiﬁcation performance of a model.

Original: We show that even under restrictive attack settings and without access to the target classiﬁer, our attacks can render it near-useless for use in production (i.e., on test data).
Revised: We show that even under restrictive attack settings and without access to the target classiﬁer, our attacks can render it near-useless for use in production (i.e., on test data).

Original: Our approach is based on the principle of meta learning, which has traditionally been used for hyperparameter optimization (Bengio, 2000), or, more recently, few-shot learning (Finn et al., 2017).
Revised: Our approach is based on the principle of meta learning, which has traditionally been used for hyperparameter optimization (Bengio, 2000), or, more recently, few-shot learning (Finn et al., 2017).

Original: In essence, we turn the gradient-based optimization procedure of deep learning models upside down and treat the input data – the graph at hand – as a hyperparameter to learn.
Revised: In essence, we turn the gradient-based optimization procedure of deep learning models upside down and treat the input data – the graph at hand – as a hyperparameter to learn.

Original: Remarkably, our attacks do not need access to a model’s gradients – not even knowledge about its architecture – to drastically reduce its performance after training on the poisoned graph.

Original:  R ELATED W ORK
Revised:  R ELATED W ORK

Original: Adversarial attacks on machine learning models have been studied both in the machine learning and security community and for many different model types (Mei & Zhu, 2015).
Revised: Adversarial attacks on machine learning models have been studied both in the machine learning and security community and for many different model types (Mei & Zhu, 2015).

Original: It is important to distinguish attacks from outliers; while the latter naturally occur in graphs (Bojchevski & G¨unnemann, 2018), adversarial examples are deliberately created with the goal to mislead machine learning models and often designed to be unnoticeable.
Revised: It is important to distinguish attacks from outliers; while the latter naturally occur in graphs (Bojchevski & G¨unnemann, 2018), adversarial examples are deliberately created with the goal to mislead machine learning models and often designed to be unnoticeable.

Original: Deep neural networks are highly sensitive to these small adversarial perturbations to the data (Szegedy et al., 2014; Goodfellow et al., 2015).
Revised: Deep neural networks are highly sensitive to these small adversarial perturbations to the data (Szegedy et al., 2014; Goodfellow et al., 2015).

Original: The vast majority of attacks and defenses assume the data instances to be independent and continuous.
Revised: The vast majority of attacks and defenses assume the data instances to be independent and continuous.

Original: This assumption clearly does not hold for node classiﬁcation and many other tasks on graphs.
Revised: This assumption clearly does not hold for node classiﬁcation and many other tasks on graphs.

Original: Works on adversarial attacks for graph learning tasks are generally sparse.
Revised: Works on adversarial attacks for graph learning tasks are generally sparse.

Original: Chen et al.
Revised: Chen et al.

Original: (2017) have measured the changes in the resulting graph clustering when injecting noise to a bi-partite graph that represent DNS queries.
Revised: (2017) have measured the changes in the resulting graph clustering when injecting noise to a bi-partite graph that represent DNS queries.

Original: However, their focus is not on generating attacks in a principled way.
Revised: However, their focus is not on generating attacks in a principled way.

Original: Torkamani & Lowd (2013) consider adversarial noise in the node features in order to improve robustness of collective classiﬁcation via associative Markov networks.
Revised: Torkamani & Lowd (2013) consider adversarial noise in the node features in order to improve robustness of collective classiﬁcation via associative Markov networks.

Original: Only recently researchers have started to study adversarial attacks on deep learning for graphs.
Revised: Only recently researchers have started to study adversarial attacks on deep learning for graphs.

Original: Dai et al.
Revised: Dai et al.

Original: (2018) consider test-time (i.e., evasion) attacks on graph classiﬁcation (i.e., classiﬁcation of graphs themselves) and node classiﬁcation.
Revised: (2018) consider test-time (i.e., evasion) attacks on graph classiﬁcation (i.e., classiﬁcation of graphs themselves) and node classiﬁcation.

Original: However, they do not consider poisoning (i.e., trainingtime) attacks or evaluate transferability of their attacks, and restrict the attacks to edge deletions only.
Revised: However, they do not consider poisoning (i.e., trainingtime) attacks or evaluate transferability of their attacks, and restrict the attacks to edge deletions only.

Original: Moreover, they focus on targeted attacks, i.e. attacks designed to change the prediction of a single node.
Revised: Moreover, they focus on targeted attacks, i.e. attacks designed to change the prediction of a single node.

Original: Z¨ugner et al.
Revised: Z¨ugner et al.

Original: (2018) consider both test-time and training-time attacks on node classiﬁcation models.
Revised: (2018) consider both test-time and training-time attacks on node classiﬁcation models.

Original: They circumvent explicitly tackling the bilevel optimization problem underlying poisoning attacks by performing their attacks based on a (static) surrogate model and evaluating their impact by training a classiﬁer on the data modiﬁed by their algorithm.
Revised: They circumvent explicitly tackling the bilevel optimization problem underlying poisoning attacks by performing their attacks based on a (static) surrogate model and evaluating their impact by training a classiﬁer on the data modiﬁed by their algorithm.

Original: In contrast to Dai et al.
Revised: In contrast to Dai et al.

Original: (2018), their attacks can both insert and remove edges, as well as modify node attributes in the form of binary vectors.
Revised: (2018), their attacks can both insert and remove edges, as well as modify node attributes in the form of binary vectors.

Original: Again, their algorithm is suited only to targeted attacks on single nodes; the problem of training-time attacks on the overall performance of node classiﬁcation models remains unexplored.
Revised: Again, their algorithm is suited only to targeted attacks on single nodes; the problem of training-time attacks on the overall performance of node classiﬁcation models remains unexplored.

Original: Bojchevski & G ¨ unnemann (2018) propose poisoning attacks on a different task: unsupervised node representation learning (or node embeddings).
Revised: Bojchevski & G ¨ unnemann (2018b) propose poisoning attacks on a different task: unsupervised node representation learning (or node embeddings).

Original: They exploit perturbation theory to maximize the loss obtained after training DeepWalk.
Revised: They exploit perturbation theory to maximize the loss obtained after training DeepWalk.

Original: In this work, we focus on semi-supervised learning.
Revised: In this work, we focus on semi-supervised learning.

Original: Meta-learning (Thrun & Pratt, 1998; Naik & Mammone, 1992), or learning to learn , is the task of optimizing the learning algorithm itself; e.g., by optimizing the hyperparameters Bengio (2000), learning to update the parameters of a neural network (Schmidhuber, 1992; Bengio et al., 1992), or the activation function of a model (Agostinelli et al., 2014).
Revised: Meta-learning (Thrun & Pratt, 1998; Naik & Mammone, 1992), or learning to learn , is the task of optimizing the learning algorithm itself; e.g., by optimizing the hyperparameters Bengio (2000), learning to update the parameters of a neural network (Schmidhuber, 1992; Bengio et al., 1992), or the activation function of a model (Agostinelli et al., 2014).

Original: Gradient-based hyperparameter optimization works by differentiating the training phase of a model to obtain the gradients w.r.t.
Revised: Gradient-based hyperparameter optimization works by differentiating the training phase of a model to obtain the gradients w.r.t.

Original: the hyperparameters to optimize.
Revised: the hyperparameters to optimize.

Original: The key idea of this work is to use meta-learning for the opposite: modifying the training data to worsen the performance after training (i.e., training-time or poisoning attacks).
Revised: The key idea of this work is to use meta-learning for the opposite: modifying the training data to worsen the performance after training (i.e., training-time or poisoning attacks).

Original: Mu ˜ noz-Gonz ´
Revised: Mu ˜ noz-Gonz ´

Original: alez
Revised: alez

Original: et al.
Revised: et al.

Original: (2017) demonstrate that meta learning can indeed be used to create training-time attacks on simple, linear classiﬁcation models.
Revised: (2017) demonstrate that meta learning can indeed be used to create training-time attacks on simple, linear classiﬁcation models.

Original: On continuous data, they report little success when attacking deep neural networks, and on discrete datasets, they do not consider deep learning models or problems with more than two classes.
Revised: On continuous data, they report little success when attacking deep neural networks, and on discrete datasets, they do not consider deep learning models or problems with more than two classes.

Original: Like most works on adversarial attacks, they assume the data instances to be independent.
Revised: Like most works on adversarial attacks, they assume the data instances to be independent.

Original: In this work, for the ﬁrst time, we propose an algorithm for global attacks on (deep) node classiﬁcation models at training time.
Revised: In this work, for the ﬁrst time, we propose an algorithm for global attacks on (deep) node classiﬁcation models at training time.

Original: In contrast to Z¨ugner et al.
Revised: In contrast to Z¨ugner et al.

Original: (2018), we explicitly tackle the bilevel optimization problem of poisoning attacks using meta learning.
Revised: (2018), we explicitly tackle the bilevel optimization problem of poisoning attacks using meta learning.

Original:  P ROBLEM F ORMULATION
Revised:  P ROBLEM F ORMULATION

Original: We consider the task of (semi-supervised) node classiﬁcation.
Revised: We consider the task of (semi-supervised) node classiﬁcation.

Original: Given a singlelarge (attributed) graph and a set of labeled nodes, the goal is to infer the class labels of the unlabeled nodes.
Revised: Given a single (attributed) graph and a set of labeled nodes, the goal is to infer the class labels of the unlabeled nodes.

Original: Formally, let G =
Revised: Formally, let G =

Original: ( A, X ) be an attributed graph with adjacency matrix A ∈ { 0 , 1 } N × N and node attribute matrix X ∈ R N × D , where N is the number of nodes and D the dimension of the node feature vectors.
Revised: ( A, X ) be an attributed graph with adjacency matrix A ∈ { 0 , 1 } N × N and node attribute matrix X ∈ R N × D , where N is the number of nodes and D the dimension of the node feature vectors.

Original: W.l.o.g.
Revised: W.l.o.g.

Original: , we assume the node IDs to be V = { 1 , . . .
Revised: , we assume the node IDs to be V = { 1 , . . .

Original: , N } .
Revised: , N } .

Original: Given the set of labeled nodes V L ⊆ V , where nodes are assigned exactly one class in C = { c 1 , c 2 , ..., c K } , the goal is to learn a function f θ , which maps each node v ∈ V to exactly one of the K classes in C (or in a probabilistic formulation: to the K-simplex).
Revised: Given the set of labeled nodes V L ⊆ V , where nodes are assigned exactly one class in C = { c 1 , c 2 , ..., c K } , the goal is to learn a function f θ , which maps each node v ∈ V to exactly one of the K classes in C (or in a probabilistic formulation: to the K-simplex).

Original: Note that this is an instance of transductive learning, since all test samples (i.e., the unlabeled nodes) as well as their attributes and edges (but not their class labels!) are known and used during training (Chapelle et al., 2006).
Revised: Note that this is an instance of transductive learning, since all test samples (i.e., the unlabeled nodes) as well as their attributes and edges (but not their class labels!) are known and used during training (Chapelle et al., 2006).

Original: The parameters θ of the function f θ are generally learned by minimizing a loss function L train (e.g. cross-entropy) on the labeled training nodes:
Revised: The parameters θ of the function f θ are generally learned by minimizing a loss function L train (e.g. cross-entropy) on the labeled training nodes:

Original: [Equation]
Revised: [Equation]

Original: where we overload the notation of f θ to indicate that we feed in the whole graph G .
Revised: where we overload the notation of f θ to indicate that we feed in the whole graph G .

Original: 3. A TTACK M ODEL
Revised: 3. A TTACK M ODEL

Original: Adversarial attacks are small deliberate perturbations of data samples in order to achieve the outcome desired by the attacker when applied to the machine learning model at hand.
Revised: Adversarial attacks are small deliberate perturbations of data samples in order to achieve the outcome desired by the attacker when applied to the machine learning model at hand.

Original: The attacker is constrained in the knowledge they have about the data and the model they attack, as well as the adversarial perturbations they can perform.
Revised: The attacker is constrained in the knowledge they have about the data and the model they attack, as well as the adversarial perturbations they can perform.

Original: Attacker’s goal.
Revised: Attacker’s goal.

Original: In our work, the attacker’s goal is to increase the misclassiﬁcation rate (i.e., one minus the accuracy) of a node classiﬁcation algorithm achieved after training on the data (i.e., graph) modiﬁed by our algorithm.
Revised: In our work, the attacker’s goal is to increase the misclassiﬁcation rate (i.e., one minus the accuracy) of a node classiﬁcation algorithm achieved after training on the data (i.e., graph) modiﬁed by our algorithm.

Original: In contrast to Z ¨ ugner et al.
Revised: In contrast to Z ¨ ugner et al.

Original: and Dai et al.
Revised: and Dai et al.

Original: (2018), our algorithm is designed for global attacks reducing the overall classiﬁcation performance of a model.
Revised: (2018), our algorithm is designed for global attacks reducing the overall classiﬁcation performance of a model.

Original: That is, the goal is to have the test samples classiﬁed as any class different from the true class.
Revised: That is, the goal is to have the test samples classiﬁed as any class different from the true class.

Original: Attacker’s knowledge.
Revised: Attacker’s knowledge.

Original: The attacker can have different levels of knowledge about the training data, i.e. the graph G , the target machine learning model M , and the trained model parameters θ .
Revised: The attacker can have different levels of knowledge about the training data, i.e. the graph G , the target machine learning model M , and the trained model parameters θ .

Original: In our work, we focus on limited-knowledge attacks where the attacker has no knowledge about the classiﬁcation model and its trained weights, but the same knowledge about the data as the classiﬁer.
Revised: In our work, we focus on limited-knowledge attacks where the attacker has no knowledge about the classiﬁcation model and its trained weights, but the same knowledge about the data as the classiﬁer.

Original: In other words, the attacker can observe all nodes’ attributes, the graph structure, as well as the labels of the subset V L and uses a surrogate model to modify the data.
Revised: In other words, the attacker can observe all nodes’ attributes, the graph structure, as well as the labels of the subset V L and uses a surrogate model to modify the data.

Original: Besides assuming knowledge about the full data, we also perform experiments where only a subset of the data is given.
Revised: Besides assuming knowledge about the full data, we also perform experiments where only a subset of the data is given.

Original: Afterwards, this modiﬁed data is used to train deep neural networks to degrade their performance.
Revised: Afterwards, this modiﬁed data is used to train deep neural networks to degrade their performance.

Original: Attacker’s capability.
Revised: Attacker’s capability.

Original: In order to be effective and remain undiscovered, adversarial attacks should be unnoticeable .
Revised: In order to be effective and remain undiscovered, adversarial attacks should be unnoticeable .

Original: To account for this, we largely follow Z ¨ ugner et al.
Revised: To account for this, we largely follow Z ¨ ugner et al.

Original: (2018)’s attacker capabilities.
Revised: (2018)’s attacker capabilities.

Original: First, we impose a budget constraint ∆ on the attacks, i.e. limit the number of changes (cid:107)
Revised: First, we impose a budget constraint ∆ on the attacks, i.e. limit the number of changes (cid:107)

Original: A − ˆ A (cid:107) 0 ≤ ∆ (here we have 2∆ since we assume the graph to be symmeytric).
Revised: A − ˆ A (cid:107) 0 ≤ ∆ (here we have 2∆ since we assume the graph to be symmetric).

Original: Furthermore, we make sure that no node becomes disconnected (i.e. a singleton) during the attack.
Revised: Furthermore, we make sure that no node becomes disconnected (i.e. a singleton) during the attack.

Original: One of the most fundamental properties of a graph is its degree distribution.
Revised: One of the most fundamental properties of a graph is its degree distribution.

Original: Any signiﬁcant changes to it are very likely to be noticed; to prevent such large changes to the degree distribution, we employ Z¨ugner et al.
Revised: Any signiﬁcant changes to it are very likely to be noticed; to prevent such large changes to the degree distribution, we employ Z¨ugner et al.

Original: (2018)’s unnoticeability constraint on the degree distribution.
Revised: (2018)’s unnoticeability constraint on the degree distribution.

Original: Essentially, it ensures that the graph’s degree distribution can only marginally be modiﬁed by the attacker.
Revised: Essentially, it ensures that the graph’s degree distribution can only marginally be modiﬁed by the attacker.

Original: The authors also derive an efﬁcient way to check for violations of the constraint so that it adds only minimal computational overhead to the attacks.
Revised: The authors also derive an efﬁcient way to check for violations of the constraint so that it adds only minimal computational overhead to the attacks.

Original: While in this work we focus on changing the graph structure only, our algorithm can easily be modiﬁed to change the node features as well.
Revised: While in this work we focus on changing the graph structure only, our algorithm can easily be modiﬁed to change the node features as well.

Original: We summarize all these constraints and denote the space of admissible perturbations on the data as Φ( G ) , where G is the graph at hand.
Revised: We summarize all these constraints and denote the set of admissible perturbations on the data as Φ( G ) , where G is the graph at hand.

Original: 3. O VERALL G OAL
Revised: 3. O VERALL G OAL

Original: Poisoning attacks can  mathematically formulated as a bilevel optimization problem:
Revised: Poisoning attacks can be mathematically formulated as a bilevel optimization problem:

Original: [Equation]
Revised: [Equation]

Original: L atk is the loss function the attacker aims to optimize.
Revised: L atk is the loss function the attacker aims to optimize.

Original: In our case of global and unspeciﬁc (regarding the type of misclassiﬁcation) attacks, the attacker tries to decrease the generalization performance of the model on the unlabeled nodes .
Revised: In our case of global and unspeciﬁc (regarding the type of misclassiﬁcation) attacks, the attacker tries to decrease the generalization performance of the model on the unlabeled nodes .

Original: Since the test data’s labels are not available, we cannot directly optimize this loss.
Revised: Since the test data’s labels are not available, we cannot directly optimize this loss.

Original: One way to approach this is to maximize the loss on the labeled (training) nodes
Revised: One way to approach this is to maximize the loss on the labeled (training) nodes

Original: L train , arguing that if a model has a high training error, it is very likely to also generalize poorly (the opposite is not true; when overﬁtting on the training data, a high generalization loss can correspond to a low training loss).
Revised: L train , arguing that if a model has a high training error, it is very likely to also generalize poorly (the opposite is not true; when overﬁtting on the training data, a high generalization loss can correspond to a low training loss).

Original: Thus, our ﬁrst attack option is to choose L atk =
Revised: Thus, our ﬁrst attack option is to choose L atk =

Original: −L train .
Revised: −L train .

Original: Recall that semi-supervised node classiﬁcation is an instance of transductive learning: all data samples (i.e., nodes) and their attributes are known at training time (but not all labels!).
Revised: Recall that semi-supervised node classiﬁcation is an instance of transductive learning: all data samples (i.e., nodes) and their attributes are known at training time (but not all labels!).

Original: We can use this insight to obtain a second variant of L atk .
Revised: We can use this insight to obtain a second variant of L atk .

Original: The attacker can learn a model on the labeled data to estimate the labels ˆ C U of the unlabeled nodes V U = V\V L .
Revised: The attacker can learn a model on the labeled data to estimate the labels ˆ C U of the unlabeled nodes V U = V\V L .

Original: The attacker can now use selflearning and use these predicted labels and compute the loss of a model on the unlabeled nodes, i.e. L self =
Revised: The attacker can now perform selflearning, i.e. use these predicted labels and compute the loss of a model on the unlabeled nodes, yielding our second option L atk = −L self where L self =

Original: L ( V U , ˆ C U ), yielding our second option L atk = −L self .
Revised: L ( V U , ˆ C U ) .

Original: Note that, at all times, only the labels of the labeled nodes are used for training; L self is only used to estimate the generalization loss after training.
Revised: Note that, at all times, only the labels of the labeled nodes are used for training; L self is only used to estimate the generalization loss after training.

Original: In our experimental evaluation, we compare both versions ofthe attack loss L atk outlined above.
Revised: In our experimental evaluation, we compare both versions of L atk outlined above.

Original: Importantly, notice the bilevel nature of the problem formulation in Eq.
Revised: Importantly, notice the bilevel nature of the problem formulation in Eq.

Original: (2): the attacker aims to maximize the classiﬁcation loss achieved after optimizing the model parameters on the modiﬁed (poisoned) graph ˆ G .
Revised: (2): the attacker aims to maximize the classiﬁcation loss achieved after optimizing the model parameters on the modiﬁed (poisoned) graph ˆ G .

Original: Optimizing such a bilevel problem is highly challenging by itself.
Revised: Optimizing such a bilevel problem is highly challenging by itself.

Original: Even worse, in our graph setting the data and the action space of the attacker are discrete : the graph structure is
Revised: Even worse, in our graph setting the data and the action space of the attacker are discrete : the graph structure is

Original: A = { 0 , 1 } N × N , and the possible actions are edge insertions and deletions.
Revised: A = { 0 , 1 } N × N , and the possible actions are edge insertions and deletions.

Original: This makes the problem even more difﬁcult in two ways.
Revised: This makes the problem even more difﬁcult in two ways.

Original: First, the action space is vast; given a budget of ∆ perturbations, the number of possible attacks is, ignoring symmetry, (cid:0) N 2 ∆ (cid:1) and thus in O ( N 2∆ ) ; exhaustive search is clearly infeasible.
Revised: First, the action space is vast; given a budget of ∆ perturbations, the number of possible attacks is, ignoring symmetry, (cid:0) N 2 ∆ (cid:1) and thus in O ( N 2∆ ) ; exhaustive search is clearly infeasible.

Original: Second, a discrete data domain means that we cannot use gradient-based methods such as gradient descent to make small (real-valued) updates on the data to optimize a loss.
Revised: Second, a discrete data domain means that we cannot use gradient-based methods such as gradient descent to make small (real-valued) updates on the data to optimize a loss.

Original:  G RAPH S TRUCTURE P OISONING VIA M ETA -L EARNING 4. P OISONING VIA M ETA - GRADIENTS
Revised:  G RAPH S TRUCTURE P OISONING VIA M ETA -L EARNING 4. P OISONING VIA M ETA - GRADIENTS

Original: In this work, we tackle the bilevel problem described in Eq.
Revised: In this work, we tackle the bilevel problem described in Eq.

Original: (2) using meta-gradients, which have traditionally been used in meta-learning.
Revised: (2) using meta-gradients, which have traditionally been used in meta-learning.

Original: The ﬁeld of meta-learning (or learning to learn) tries to make the process of learning machine learning models more time and/or data efﬁcient, e.g. by ﬁnding suitable hyperparameter conﬁgurations (Bengio, 2000) or initial weights that enable rapid adaptation to new tasks or domains in few-shot learning (Finn et al., 2017).
Revised: The ﬁeld of meta-learning (or learning to learn) tries to make the process of learning machine learning models more time and/or data efﬁcient, e.g. by ﬁnding suitable hyperparameter conﬁgurations (Bengio, 2000) or initial weights that enable rapid adaptation to new tasks or domains in few-shot learning (Finn et al., 2017).

Original: Meta-gradients (e.g., gradients w.r.t.
Revised: Meta-gradients (e.g., gradients w.r.t.

Original: hyperparameters) are obtained by backpropagating through the learning phase of a differentiable model (typically a neural network).
Revised: hyperparameters) are obtained by backpropagating through the learning phase of a differentiable model (typically a neural network).

Original: The core idea behind our adversarial attack algorithm is to treat the graph structure matrix as a hyperparameter and compute the gradient of the attacker’s loss after training with respect to it:
Revised: The core idea behind our adversarial attack algorithm is to treat the graph structure matrix as a hyperparameter and compute the gradient of the attacker’s loss after training with respect to it:

Original: [Equation]
Revised: [Equation]

Original: where opt( · ) is a differentiable optimization procedure (e.g. gradient descent and its stochastic variants) and L train the training loss.
Revised: where opt( · ) is a differentiable optimization procedure (e.g. gradient descent and its stochastic variants) and L train the training loss.

Original: Notice the similarity of the meta-gradient to the bi-level formulation in Eq.
Revised: Notice the similarity of the meta-gradient to the bi-level formulation in Eq.

Original: (2); the meta-gradient indicates how the attacker loss L atk after training will change for small perturbations on the data, which is exactly what a poisoning attacker needs to know.
Revised: (2); the meta-gradient indicates how the attacker loss L atk after training will change for small perturbations on the data, which is exactly what a poisoning attacker needs to know.

Original: As an illustration, consider an example where we instantiate opt with vanilla gradient descent with learning rate α starting from some intial parameters θ
Revised: As an illustration, consider an example where we instantiate opt with vanilla gradient descent with learning rate α starting from some intial parameters θ

Original: [Equation]
Revised: [Equation]

Original: The attacker’s loss after training for T steps is L atk ( f θ T ( G )) .
Revised: The attacker’s loss after training for T steps is L atk ( f θ T ( G )) .

Original: The meta-gradient can be expressed by unrolling the training procedure:
Revised: The meta-gradient can be expressed by unrolling the training procedure:

Original: [Equation]
Revised: [Equation]

Original:  Note that the parameters θ t itself depend on the graph G (see Eq. 4); they are not ﬁxed .
Revised: ] , where ( [Equation] Note that the parameters θ t itself depend on the graph G (see Eq. 4); they are not ﬁxed .

Original: Thus, the derivative w.r.t.
Revised: Thus, the derivative w.r.t.

Original: the graph has to be taken into account, chaining back until θ 0 .
Revised: the graph has to be taken into account, chaining back until θ 0 .

Original: Given this, the attacker can use the meta-gradient to perform a meta update M on the data to minimize L atk :
Revised: Given this, the attacker can use the meta-gradient to perform a meta update M on the data to minimize L atk :

Original: [Equation]
Revised: [Equation]

Original: The ﬁnal poisoned data G (∆) is obtained after performing ∆ meta updates.
Revised: The ﬁnal poisoned data G (∆) is obtained after performing ∆ meta updates.

Original: A straightforward way to instantiate M is (meta) gradient descent with some step size β : M ( G ) =G [Equation] L
Revised: A straightforward way to instantiate M is (meta) gradient descent with some step size β : M ( G ) =

Original: [Equation]

Original: f

Original: [Equation] T [Equation] G ))) .
Revised: G − β ∇ G L atk ( f θ T ( G ))) .

Original: It has to be noted that such a gradient-based update rule is neither possible nor well-suited for problems with discrete data (such as graphs).
Revised: It has to be noted that such a gradient-based update rule is neither possible nor well-suited for problems with discrete data (such as graphs).

Original: Due to the discreteness, the gradients are not deﬁned.
Revised: Due to the discreteness, the gradients are not deﬁned.

Original: Thus, in our approach we simply relax the data’s discreteness condition.
Revised: Thus, in our approach we simply relax the data’s discreteness condition.

Original: However, we still perform discrete updates (actions) since the above simple gradient update would lead to dense (and continuous) adjacency matrices; not desired and not efﬁcient to handle.
Revised: However, we still perform discrete updates (actions) since the above simple gradient update would lead to dense (and continuous) adjacency matrices; not desired and not efﬁcient to handle.

Original: Thus, in the following section, we propose a greedy approach to preserve the data’s sparsity and discreteness.
Revised: Thus, in the following section, we propose a greedy approach to preserve the data’s sparsity and discreteness.

Original: 4. G REEDY P OISONING A TTACKS VIA M ETA G RADIENTS
Revised: 4. G REEDY P OISONING A TTACKS VIA M ETA G RADIENTS

Original: We assume that the attacker does not have access to the target classiﬁer’s parameters, outputs, or even knowledge about its architecture; the attacker thus uses a surrogate model to perform the poisoning attacks.
Revised: We assume that the attacker does not have access to the target classiﬁer’s parameters, outputs, or even knowledge about its architecture; the attacker thus uses a surrogate model to perform the poisoning attacks.

Original: Afterwards the poisoned data is used to train deep learning models for node classiﬁcation (e.g. a GCN) to evaluate the performance degradation due to the attack.
Revised: Afterwards the poisoned data is used to train deep learning models for node classiﬁcation (e.g. a GCN) to evaluate the performance degradation due to the attack.

Original: We use the same surrogate model as Z¨ugner et al.
Revised: We use the same surrogate model as Z¨ugner et al.

Original: (2018), which is a linearized two-layer graph convolutional network:
Revised: (2018), which is a linearized two-layer graph convolutional network:

Original: [Equation]
Revised: [Equation]

Original: where ˆ A
Revised: where ˆ A

Original: = D − 1 / 2 ˜ AD − 1 / 2 , ˜
Revised: = D − 1 / 2 ˜ AD − 1 / 2 , ˜

Original: A =
Revised: A =

Original: A + I , A is the adjacency matrix, X are the node features, D the diagonal matrix of the node degrees, and θ = { W } the set of learnable parameters.
Revised: A + I , A is the adjacency matrix, X are the node features, D the diagonal matrix of the node degrees, and θ = { W } the set of learnable parameters.

Original: In contrast to
Revised: In contrast to

Original: Z¨ugner et al.
Revised: Z¨ugner et al.

Original: we do not linearize the output (softmax) layer.
Revised: we do not linearize the output (softmax) layer.

Original: Note that we only perform changes to the graph structure A , hence we treat the node attributes X as a constant during our attacks.
Revised: Note that we only perform changes to the graph structure A , hence we treat the node attributes X as a constant during our attacks.

Original: For clarity, we replace G with A in the meta gradient formulation.
Revised: For clarity, we replace G with A in the meta gradient formulation.

Original: We deﬁne a score function S : V × V
Revised: We deﬁne a score function S : V × V

Original: → R that assigns each possible action a numerical value indicating its (estimated) impact on the attacker objective L atk .
Revised: → R that assigns each possible action a numerical value indicating its (estimated) impact on the attacker objective L atk .

Original: Given the meta-gradient for a node pair ( u, v ) , we deﬁne S ( u, v ) =
Revised: Given the meta-gradient for a node pair ( u, v ) , we deﬁne S ( u, v ) =

Original: ∇ meta a uv · ( − 2 · a uv + 1) where a uv is the entry at position ( u, v ) in the adjacency matrix A .
Revised: ∇ meta a uv · ( − 2 · a uv + 1) where a uv is the entry at position ( u, v ) in the adjacency matrix A .

Original: We essentially ﬂip the sign of the meta-gradients for connected node pairs as this yields the gradient for a change in the negative direction (i.e., removing the edge).
Revised: We essentially ﬂip the sign of the meta-gradients for connected node pairs as this yields the gradient for a change in the negative direction (i.e., removing the edge).

Original: We greedily pick the perturbation e (cid:48)
Revised: We greedily pick the perturbation e (cid:48)

Original: =
Revised: =

Original: ( u (cid:48) , v (cid:48) ) with the highest score one at a time
Revised: ( u (cid:48) , v (cid:48) ) with the highest score one at a time

Original: [Equation]
Revised: [Equation]

Original: where M ( A, e ) ∈
Revised: where M ( A, e ) ∈

Original: Φ( G ) ensures that we only perform changes compliant with our attack constraints (e.g., unnoticeability).
Revised: Φ( G ) ensures that we only perform changes compliant with our attack constraints (e.g., unnoticeability).

Original: The meta update function M ( A, e ) inserts the edge e
Revised: The meta update function M ( A, e ) inserts the edge e

Original: = ( i, j ) by setting a ij = 1 if nodes ( i, j ) are currently not connected and otherwise deletes the edge by setting a ij = 0 .
Revised: = ( i, j ) by setting a ij = 1 if nodes ( i, j ) are currently not connected and otherwise deletes the edge by setting a ij = 0 .

Original:  A PPROXIMATING M ETA -G RADIENTS
Revised: 4. A PPROXIMATING M ETA -G RADIENTS

Original: Computing the meta gradients is expensive both from a computational and a memory point-of-view.
Revised: Computing the meta gradients is expensive both from a computational and a memory point-of-view.

Original: To alleviate this issue, Finn et al.
Revised: To alleviate this issue, Finn et al.

Original: (2017) propose a ﬁrst-order approximation, leading to 
Revised: (2017) propose a ﬁrst-order approximation, leading to ∇ meta A

Original: [Equation]
Revised: [Equation]

Original: We denote by ˜ θ t the parameters at time t independent of the data A (and ˜ θ t − 1 ), i.e. ∇ A ˜ θ t = 0 ; the gradient is thus not propagated through ˜ θ t .
Revised: We denote by ˜ θ t the parameters at time t independent of the data A (and ˜ θ t − 1 ), i.e. ∇ A ˜ θ t = 0 ; the gradient is thus not propagated through ˜ θ t .

Original: This corresponds to taking the gradient of the attack loss L atk w.r.t.
Revised: This corresponds to taking the gradient of the attack loss L atk w.r.t.

Original: the data, after training the model for T steps.
Revised: the data, after training the model for T steps.

Original: We compare against this baseline in our experiments; as also done in Z ¨ ugner et al.
Revised: We compare against this baseline in our experiments; as also done in Z¨ugner et al.

Original: However, unlike the meta-gradient, this approximation completely disregards the training dynamics.
Revised: However, unlike the meta-gradient, this approximation completely disregards the training dynamics.

Original: Nichol & Schulman (2018) propose a heuristic of the meta gradient in which they update the initial weights θ 0 on a line towards the local optimum θ T to achieve faster convergence in a multi-task learning setting: ∇ meta θ≈ (cid:80)
Revised: Nichol & Schulman (2018) propose a heuristic of the meta gradient in which they update the initial weights θ 0 on a line towards the local optimum θ T to achieve faster convergence in a multi-task learning setting: ∇ meta θ≈ (cid:80)

Original: Tt =1 ∇ ˜ θ t L train ( f ˜ θ t ( A ; X )) .
Revised: Tt =1 ∇ ˜ θ t L train ( f ˜ θ t ( A ; X )) .

Original: Again, they assume ˜ θ t to be independent of ˜ θ t − 1 .
Revised: Again, they assume ˜ θ t to be independent of ˜ θ t − 1 .

Original: While there is no direct connection to the formulation of the meta gradient in Eq.
Revised: While there is no direct connection to the formulation of the meta gradient in Eq.

Original: (5), there is an intuition behind it: the heuristic meta gradient is the direction, in which, on average , we have observed the strongest increase in the training loss during the training procedure.
Revised: (5), there is an intuition behind it: the heuristic meta gradient is the direction, in which, on average , we have observed the strongest increase in the training loss during the training procedure.

Original: The authors’ experimental evaluation further indicates that this heuristic achieves similar results as the meta gradient while being much more efﬁcient to compute (see Appendix C for a discussion on complexity).
Revised: The authors’ experimental evaluation further indicates that this heuristic achieves similar results as the meta gradient while being much more efﬁcient to compute (see Appendix C for a discussion on complexity).

Original: Adapted to our adversarial attack setting on graphs, we get ∇ meta
Revised: Adapted to our adversarial attack setting on graphs, we get ∇ meta

Original: A
Revised: A

Original: [Equation]
Revised: [Equation]

Original: We can view this as a heuristic of the meta gradient when L atk = −L train .
Revised: We can view this as a heuristic of the meta gradient when L atk = −L train .

Original: Likewise, again taking the transductive learning setting into account, we can use self-learning to estimate the loss on the unlabeled nodes, replacing L train by L self .
Revised: Likewise, again taking the transductive learning setting into account, we can use self-learning to estimate the loss on the unlabeled nodes, replacing L train by L self .

Original: Indeed, we combine these two views
Revised: Indeed, we combine these two views

Original: [Equation]
Revised: [Equation]

Original: where λ can be used to weight the two objectives.
Revised: where λ can be used to weight the two objectives.

Original: This approximation has a much smaller memory footprint than the exact meta gradient since we don’t have to store the whole training trajectory ˜ θ 1 , . . .
Revised: This approximation has a much smaller memory footprint than the exact meta gradient since we don’t have to store the whole training trajectory ˜ θ 1 , . . .

Original: , ˜ θ T in memory; additionally, there there are no second-order derivatives to be computed.
Revised: , ˜ θ T in memory; additionally, there there are no second-order derivatives to be computed.

Original: A summary of our algorithm can be found in Appendix A.
Revised: A summary of our algorithm can be found in Appendix A.

Original: [Table] [Table]
Revised: [Table] [Table]

Original:  E XPERIMENTS
Revised:  E XPERIMENTS

Original: Setup.
Revised: Setup.

Original: We evaluate our approach on the well-known C ITESEER (Sen et al., 2008), C ORA -ML (McCallum et al., 2000)
Revised: We evaluate our approach on the well-known C ITESEER (Sen et al., 2008), C ORA -ML (McCallum et al., 2000)

Original: [Table]
Revised: [Table]

Original: and P OL B LOGS (Adamic & Glance, 2005) datasets; an overview is given in Table 6.
Revised: and P OL B LOGS (Adamic & Glance, 2005) datasets; an overview is given in Table 6.

Original: We split the datasets into labeled (10%) and unlabeled (90%) nodes.
Revised: We split the datasets into labeled (10%) and unlabeled (90%) nodes.

Original: The labels of the unlabeled nodes are never visible to the attacker or the classiﬁers and are only used to evaluate the generalization performance of the models.
Revised: The labels of the unlabeled nodes are never visible to the attacker or the classiﬁers and are only used to evaluate the generalization performance of the models.

Revised: Our code is available at https://www.kdd.in.

Revised: tum.de/gnn-meta-attack .

Original: We evaluate the transferability of adversarial attacks by training deep node classiﬁcation models on the modiﬁed (poisoned) data.
Revised: We evaluate the transferability of adversarial attacks by training deep node classiﬁcation models on the modiﬁed (poisoned) data.

Original: For this purpose, we use Graph Convolutional Networks (GCN) (Kipf & Welling, 2017) and Column Networks (CLN) (Pham et al., 2017).
Revised: For this purpose, we use Graph Convolutional Networks (GCN) (Kipf & Welling, 2017) and Column Networks (CLN) (Pham et al., 2017).

Original: Both are models utilizing the message passing framework (a.k.a.
Revised: Both are models utilizing the message passing framework (a.k.a.

Original: graph convolution) and trained in a semi-supervised way.
Revised: graph convolution) and trained in a semi-supervised way.

Original: We further evaluate the node classiﬁcation performance achieved by training a standard logistic regression model on the node embeddings learned by DeepWalk (Perozzi et al., 2014).
Revised: We further evaluate the node classiﬁcation performance achieved by training a standard logistic regression model on the node embeddings learned by DeepWalk (Perozzi et al., 2014).

Original: DeepWalk itself is trained in an unsupervised way and without node attributes or graph convolutions; thus, this is arguably an even more difﬁcult transfer task.
Revised: DeepWalk itself is trained in an unsupervised way and without node attributes or graph convolutions; thus, this is arguably an even more difﬁcult transfer task.

Original: We repeat all of our attacks on ﬁve different splits of labeled/unlabeled nodes and train all target classiﬁers ten times per attack (using the split that was used to create the attack).
Revised: We repeat all of our attacks on ﬁve different splits of labeled/unlabeled nodes and train all target classiﬁers ten times per attack (using the split that was used to create the attack).

Original: In our tables, the uncertainty indicates 95 % conﬁdence intervals of the mean obtained via bootstrapping.
Revised: In our tables, the uncertainty indicates 95 % conﬁdence intervals of the mean obtained via bootstrapping.

Original: For our meta-gradient approaches, we compute the meta-gradient ∇ meta A L atk ( f θ T ( A ; X )) by using gradient descent with momentum for 100 iterations.
Revised: For our meta-gradient approaches, we compute the meta-gradient ∇ meta A L atk ( f θ T ( A ; X )) by using gradient descent with momentum for 100 iterations.

Original: We refer to our meta-gradient approach with self-training as Meta-Self and to the variant without self-training as Meta-Train.
Revised: We refer to our meta-gradient approach with self-training as Meta-Self and to the variant without self-training as Meta-Train.

Original: Similarly, we refer to our approximations as A-Meta-Self (with λ =0 ), A-Meta-Train ( λ =1 ), and A-Meta-Both ( λ =0 . 5 ).
Revised: Similarly, we refer to our approximations as A-Meta-Self (with λ =0 ), A-Meta-Train ( λ =1 ), and A-Meta-Both ( λ =0 . 5 ).

Original: Comparing meta-gradient heuristics.
Revised: Comparing meta-gradient heuristics.

Original: First, we analyze the different meta gradient heuristics described in Section 4.3.
Revised: First, we analyze the different meta gradient heuristics described in Section 4.3.

Original: The results can be seen in Table 1.
Revised: The results can be seen in Table 1.

Original: All principles successfully increase the misclassiﬁcation rate (i.e., 1 − accuracy on unlabeled nodes) obtained on the test data, compared to the results obtained with the unperturbed graph.
Revised: All principles successfully increase the misclassiﬁcation rate (i.e., 1 − accuracy on unlabeled nodes) obtained on the test data, compared to the results obtained with the unperturbed graph.

Original: Since A-Meta-Self consistently shows a weaker performance than A-Meta-Both, we do not further consider A-Meta-Self in the following.
Revised: Since A-Meta-Self consistently shows a weaker performance than A-Meta-Both, we do not further consider A-Meta-Self in the following.

Original: Comparison with competing methods.
Revised: Comparison with competing methods.

Original: We compare our meta-gradient approach as well as its approximations with various baselines and Nettack (Z¨ugner et al., 2018).
Revised: We compare our meta-gradient approach as well as its approximations with various baselines and Nettack (Z ¨ ugner et al., 2018).

Original: DICE (‘delete internally, connect externally’) is a baseline where, for each perturbation, we randomly choose whether to insert or remove an edge.
Revised: DICE (‘delete internally, connect externally’) is a baseline where, for each perturbation, we randomly choose whether to insert or remove an edge.

Original: Edges are only removed between nodes from the same class, and only inserted between nodes from different classes.
Revised: Edges are only removed between nodes from the same class, and only inserted between nodes from different classes.

Original: This baseline has all true class labels (train and test) available and thus more knowledge than all competing methods.
Revised: This baseline has all true class labels (train and test) available and thus more knowledge than all competing methods.

Original: First-order refers to the approximation proposed by Finn et al.
Revised: First-order refers to the approximation proposed by Finn et al.

Original: (2017), i.e. ignoring all second-order derivatives.
Revised: (2017), i.e. ignoring all second-order derivatives.

Original: Note that Nettack is not designed for global attacks.
Revised: Note that Nettack is not designed for global attacks.

Original: In order to be able to compare to them, for each perturbation we randomly select one target node from the unlabeled nodes and attack it using Nettack while considering all nodes in the network.
Revised: In order to be able to compare to them, for each perturbation we ran- [Figure] [Figure] [Table]

Original: In this case, its time and memory complexity is O ( N 3 ) and thus it was not
Revised: [Figure] [Table]

Original: [Figure]
Revised: [Figure]

Revised: [Table]

Original: [Figure]
Revised: [Figure]

Original: [Table]
Revised: [Table]

Original: [Figure]
Revised: [Figure]

Original: [Table]
Revised: [Table]

Original: [Figure]
Revised: [Figure]

Original: [Table]
Revised: [Table]

Original: [Figure]
Revised: [Figure]

Original: [Table]
Revised: [Table]

Original: [Figure]
Revised: [Figure]

Original: [Table]
Revised: [Table]

Original: feasible to run it on any but the sparsest dataset.
Revised: [Figure] [Table] [Figure] [Table]

Revised: [Figure]

Revised: [Table]

Revised: [Figure]

Revised: [Table]

Revised: [Figure]

Revised: [Table]

Revised: [Figure]

Revised: [Table]

Revised: [Figure]

Revised: [Table]

Revised: [Figure]

Revised: [Table]

Revised: [Figure]

Revised: [Table]

Revised: domly select one target node from the unlabeled nodes and attack it using Nettack while considering all nodes in the network.

Revised: In this case, its time and memory complexity is O ( N 3 ) and thus it was not feasible to run it on any but the sparsest dataset.

Original: Meta w/ Oracle corresponds to our meta-gradient approach when supplied with all true class labels on the test data – this only serves as a reference point since it cannot be carried out in real scenarios where the test nodes’ labels are unknown.
Revised: Meta w/ Oracle corresponds to our meta-gradient approach when supplied with all true class labels on the test data – this only serves as a reference point since it cannot be carried out in real scenarios where the test nodes’ labels are unknown.

Original: For all methods, we enforce the unnoticeability constraint introduced by Z ¨ ugner et al.
Revised: For all methods, we enforce the unnoticeability constraint introduced by Z ¨ ugner et al.

Original: (2018), which ensures that the graph’s degree distribution changes only slightly.
Revised: (2018), which ensures that the graph’s degree distribution changes only slightly.

Original: In Appendix D we show that the unnoticeability constraint does not signiﬁcantly limit the impact of our attacks.
Revised: In Appendix D we show that the unnoticeability constraint does not signiﬁcantly limit the impact of our attacks.

Original: In Table 2 we see the misclassiﬁcation rates (i [Figure] e., 1 - accuracy on unlabeled nodes) achieved by changing 5% of E LCC edges according to the different methods (larger is better, except for the average rank).
Revised: In Table 2 we see the misclassiﬁcation rates (i.e., 1 - accuracy on unlabeled nodes) achieved by changing 5% of E LCC edges according to the different methods (larger is better, except for the average rank).

Original: That is, each method is allowed to modify 5% of E LCC , i.e. the number of edges present in the graph before the attack.
Revised: That is, each method is allowed to modify 5% of E LCC , i.e. the number of edges present in the graph before the attack.

Original: We present similar tables for 1% and 10% changes in Appendix F.
Revised: We present similar tables for 1% and 10% changes in Appendix F.

Original: Our meta-gradient with self-training (Meta-Self) produces the strongest drop in performance across all models and datasets as indicated by the average rank .
Revised: Our meta-gradient with self-training (Meta-Self) produces the strongest drop in performance across all models and datasets as indicated by the average rank .

Original: Changing only 5% of the edges leads to a relative increase of up to 48% in the misclassiﬁcation rate of GCN on C ORA -ML.
Revised: Changing only 5% of the edges leads to a relative increase of up to 48% in the misclassiﬁcation rate of GCN on C ORA -ML.

Original: Remarkably, our memory efﬁcient meta-gradient approximations lead to strong increases in misclassiﬁcations as well.
Revised: Remarkably, our memory efﬁcient meta-gradient approximations lead to strong increases in misclassiﬁcations as well.

Original: They outperform both baselines and are in many cases even on par with the more expensive meta-gradient.
Revised: They outperform both baselines and are in many cases even on par with the more expensive meta-gradient.

Original: In Appendix F, Table 11 we also show that using only T = 10 training iterations of the surrogate models for computing the meta gradient (or its approximations) can signiﬁcantly hurt the performance across models and datasets.
Revised: In Appendix F, Table 11 we also show that using only T = 10 training iterations of the surrogate models for computing the meta gradient (or its approximations) can signiﬁcantly hurt the performance across models and datasets.

Original: Moreover, in Table 8 in Appendix F we show that our heuristic is successful at attacking a dataset with roughly 20K nodes.
Revised: Moreover, in Table 8 in Appendix F we show that our heuristic is successful at attacking a dataset with roughly 20K nodes.

Original: While the focus of our work is poisoning attacks by modifying the graph structure, our method can be applied to node feature attacks as well.
Revised: While the focus of our work is poisoning attacks by modifying the graph structure, our method can be applied to node feature attacks as well.

Original: In Appendix E we show a proof of concept that our attacks are also effective when attacking by perturbing both node features and the graph structure.
Revised: In Appendix E we show a proof of concept that our attacks are also effective when attacking by perturbing both node features and the graph structure.

Original: In Fig.
Revised: In Fig.

Original: 1 we see the drop in classiﬁcation performance of GCN on C ORA -ML for increasing numbers of edge insertions/deletions (similar plots for the remaining datasets and models are provided in Appendix F).
Revised: 1 we see the drop in classiﬁcation performance of GCN on C ORA -ML for increasing numbers of edge insertions/deletions (similar plots for the remaining datasets and models are provided in Appendix F).

Original: Meta-Self is even able to reduce the classiﬁcation accuracy below 50%.
Revised: Meta-Self is even able to reduce the classiﬁcation accuracy below 50%.

Original: Fig.shows the classiﬁcation accuracy of GCN and CLN as well as a baseline operating on the node attributes only, i.e. ignoring the graph.
Revised: Fig.shows the classiﬁcation accuracy of GCN and CLN as well as a baseline operating on the node attributes only, i.e. ignoring the graph.

Original: Not surprisingly, deep models achieve higher accuracy than the baseline when trained on the clean C ITESEER graph – exploiting the network information improves classiﬁcation.
Revised: Not surprisingly, deep models achieve higher accuracy than the baseline when trained on the clean C ITESEER graph – exploiting the network information improves classiﬁcation.

Original: However, by only perturbing 5% of the edges, we obtain the opposite: GCN and CLN perform worse than the baseline – the graph structure now hurts classiﬁcation.
Revised: However, by only perturbing 5% of the edges, we obtain the opposite: GCN and CLN perform worse than the baseline – the graph structure now hurts classiﬁcation.

Original: Impact of graph structure and trained weights.
Revised: Impact of graph structure and trained weights.

Original: Another interesting property of our attacks can be seen in Table 3, where W and ˆ W correspond to the weights trained on the clean C ORA -ML network
Revised: Another interesting property of our attacks can be seen in Table 3, where W and ˆ W correspond to the weights trained on the clean C ORA -ML network

Original: A and a version ˆ A poisoned by our algorithm (here with even 25 % modiﬁed edges), respectively.
Revised: A and a version ˆ A poisoned by our algorithm (here with even 25 % modiﬁed edges), respectively.

Original: Note that the classiﬁcation accuracy barely changes when modifying the underlying network for a given set of trained weights; even when applying the clean weights W on the highly corrupted ˆ A , the performance drops only marginally.
Revised: Note that the classiﬁcation accuracy barely changes when modifying the underlying network for a given set of trained weights; even when applying the clean weights W on the highly corrupted ˆ A , the performance drops only marginally.

Original: Likewise, even the clean graph A only leads to a low accuracy when using it with the weights ˆ W .
Revised: Likewise, even the clean graph A only leads to a low accuracy when using it with the weights ˆ W .

Original: This result emphasizes the importance of the training procedure for the performance of graph models and shows that our poisoning attack works by derailing the training procedure from the start, i.e. leading to ‘bad’ weights.
Revised: This result emphasizes the importance of the training procedure for the performance of graph models and shows that our poisoning attack works by derailing the training procedure from the start, i.e. leading to ‘bad’ weights.

Original: [Figure]
Revised: [Figure]

Original: ORA -ML

Original: [Table]

Original: [Table]
Revised: [Table]

Original: Analysis of attacks.
Revised: Analysis of attacks.

Original: An interesting question to ask is why the adversarial changes created by our meta-gradient approach are so destructive, and what patterns they follow.
Revised: An interesting question to ask is why the adversarial changes created by our meta-gradient approach are so destructive, and what patterns they follow.

Original: If we can ﬁnd out what makes an edge insertion or deletion a strong adversarial change, we can circumvent expensive metagradient computations or even use this knowledge to detect adversarial attacks.
Revised: If we can ﬁnd out what makes an edge insertion or deletion a strong adversarial change, we can circumvent expensive metagradient computations or even use this knowledge to detect adversarial attacks.

Original: In Fig.
Revised: In Fig.

Original: 3 we compare edges inserted by our meta-gradient approach to the edges originally present in the C ORA -ML network.
Revised: 3 we compare edges inserted by our meta-gradient approach to the edges originally present in the C ORA -ML network.

Original: Fig.
Revised: Fig.

Original: 3 (a) shows the shortest path lengths betweenall nodes pairs before being connected by adversarially inserted edges vs. shortest path lengths between all nodes in the original graph.
Revised: 3 (a) shows the shortest path lengths between nodes pairs before being connected by adversarially inserted edges vs. shortest path lengths between all nodes in the original graph.

Original: In Fig.
Revised: In Fig.

Original: 3 (b) we compare the edge betweenness centrality ( C E ) of adversarially inserted edges to the centrality of edges present in the original graph.
Revised: 3 (b) we compare the edge betweenness centrality ( C E ) of adversarially inserted edges to the centrality of edges present in the original graph.

Original: In (c) we see the node degree distributions of the original graph and the node degrees of the nodes that are picked for adversarial edges.
Revised: In (c) we see the node degree distributions of the original graph and the node degrees of the nodes that are picked for adversarial edges.

Original: For all three measures no clear distinction can be made.
Revised: For all three measures no clear distinction can be made.

Original: There is a slight tendency for the algorithm to connect nodes that have higher-than-average shortest paths and low degrees, though.
Revised: There is a slight tendency for the algorithm to connect nodes that have higher-than-average shortest paths and low degrees, though.

Original: As we can see in Table 5, roughly 80% of our meta attack’s perturbations are edge insertions (INS).
Revised: As we can see in Table 5, roughly 80% of our meta attack’s perturbations are edge insertions (INS).

Original: As expected by the homophily assumption, in most cases edges inserted connect nodes from different classes and edges deleted connect same-class nodes.
Revised: As expected by the homophily assumption, in most cases edges inserted connect nodes from different classes and edges deleted connect same-class nodes.

Original: However, as the comparison with the DICE baseline shows, this by itself can also not explain the destructive performance of the meta-gradient.
Revised: However, as the comparison with the DICE baseline shows, this by itself can also not explain the destructive performance of the meta-gradient.

Original: Limited knowledge about the graph structure.
Revised: Limited knowledge about the graph structure.

Original: In the experiments described above, the attacker has full knowledge about the graph structure and all node attributes (as typical in a transductive setting).
Revised: In the experiments described above, the attacker has full knowledge about the graph structure and all node attributes (as typical in a transductive setting).

Original: We also tested our algorithm on a sub-graph of C ORA -ML and C ITESEER .
Revised: We also tested our algorithm on a sub-graph of C ORA -ML and C ITESEER .

Original: That is, we select the 10% labeled nodes and randomly select neighbors of these until we have a subgraph with number of nodes n = 0 .
Revised: That is, we select the 10% labeled nodes and randomly select neighbors of these until we have a subgraph with number of nodes n = 0 .

Original: 3 N .
Revised: 3 N .

Original: We run our attacks on this small subgraph, and afterwards plug in the perturbations into the original graphs to train GCN and CLN as before.
Revised: We run our attacks on this small subgraph, and afterwards plug in the perturbations into the original graphs to train GCN and CLN as before.

Original: Table 4 summarizes the results: Even in this highly restricted setting, our attacks consistently increase misclassiﬁcation rate across datasets and models, highlighting the effectiveness of our method.
Revised: Table 4 summarizes the results: Even in this highly restricted setting, our attacks consistently increase misclassiﬁcation rate across datasets and models, highlighting the effectiveness of our method.

Original:  C ONCLUSION
Revised:  C ONCLUSION

Original: We propose an algorithm for training-time adversarial attacks on (attributed) graphs, focusing on the task of node classiﬁcation.
Revised: We propose an algorithm for training-time adversarial attacks on (attributed) graphs, focusing on the task of node classiﬁcation.

Original: We use meta-gradients to solve the bilevel optimization problem underlying the challenging class of poisoning adversarial attacks.
Revised: We use meta-gradients to solve the bilevel optimization problem underlying the challenging class of poisoning adversarial attacks.

Original: Our experiments show that attacks created using our meta-gradient approach consistently lead to a strong decrease in classiﬁcation performance of graph convolutional models and even transfer to unsupervised models.
Revised: Our experiments show that attacks created using our meta-gradient approach consistently lead to a strong decrease in classiﬁcation performance of graph convolutional models and even transfer to unsupervised models.

Original: Remarkably, even small perturbations to a graph based on our approach can lead to graph neural networks performing worse than a baseline ignoring all relational information.
Revised: Remarkably, even small perturbations to a graph based on our approach can lead to graph neural networks performing worse than a baseline ignoring all relational information.

Original: We further propose approximations of the metagradients that are less expensive to compute and, in many cases, have a similarly destructive impact on the training of node classiﬁcation models.
Revised: We further propose approximations of the metagradients that are less expensive to compute and, in many cases, have a similarly destructive impact on the training of node classiﬁcation models.

Original: While we are able to show small statistical differences of adversarial and ‘normal’ edges, it is still an open question what makes the edges inserted/removed by our algorithm so destructive, which could then be used to detect or defend against attacks. 
Revised: While we are able to show small statistical differences of adversarial and ‘normal’ edges, it is still an open question what makes the edges inserted/removed by our algorithm so destructive, which could then be used to detect or defend against attacks. A CKNOWLEDGEMENTS

Revised: This research was supported by the German Research Foundation, grant GU 1409/2-1.

Original: B D ATASET STATISTICS
Revised: B D ATASET STATISTICS

Original: [Table]
Revised: [Table]

Original: In Table 6 we see the characteristics of the datasets used in this work.
Revised: In Table 6 we see the characteristics of the datasets used in this work.

Original: Results for P UBMED can be found in Table 8 in Appendix F.
Revised: Results for P UBMED can be found in Table 8 in Appendix F.

Original: C C OMPLEXITY ANALYSIS
Revised: C C OMPLEXITY ANALYSIS

Original: In our attack we handle both edge insertions and deletions, i.e. each element in the adjacency matrix
Revised: In our attack we handle both edge insertions and deletions, i.e. each element in the adjacency matrix

Original: A ∈ { 0 , 1 } N × N can be changed.
Revised: A ∈ { 0 , 1 } N × N can be changed.

Original: This means that without further optimization, the (approximate) meta gradient for each node pair has to be computed, leading to a baseline memory and computational complexity of O ( N 2 ) .
Revised: This means that without further optimization, the (approximate) meta gradient for each node pair has to be computed, leading to a baseline memory and computational complexity of O ( N 2 ) .

Original: For the meta gradient computation we additionally have to store the entire weight trajectory during training, adding O ( T · | θ | ) to the memory cost, where T is the number of inner training steps and | θ | the number of weights.
Revised: For the meta gradient computation we additionally have to store the entire weight trajectory during training, adding O ( T · | θ | ) to the memory cost, where T is the number of inner training steps and | θ | the number of weights.

Original: Thus, memory complexity of our meta gradient attack is O ( N 2 + T · | θ | ) .
Revised: Thus, memory complexity of our meta gradient attack is O ( N 2 + T · | θ | ) .

Original: The second-order derivatives at each step T in the meta gradient formulation can be computed in O ( N 2 ) using Hessian-vector products, leading to a computational complexity of O ( T · N 2 ) .
Revised: The second-order derivatives at each step T in the meta gradient formulation can be computed in O ( N 2 ) using Hessian-vector products, leading to a computational complexity of O ( T · N 2 ) .

Original: For the meta gradient heuristics, the computational complexity is similar since we have to evaluate the gradient w.r.t.
Revised: For the meta gradient heuristics, the computational complexity is similar since we have to evaluate the gradient w.r.t.

Original: the adjacency matrix at every training step.
Revised: the adjacency matrix at every training step.

Original: However, the training trajectory of the weights does not have to be kept in memory, yielding a memory complexity of O ( N 2 ) .
Revised: However, the training trajectory of the weights does not have to be kept in memory, yielding a memory complexity of O ( N 2 ) .

Original: This is highly beneﬁcial, as memory (especially on GPUs) is limited.
Revised: This is highly beneﬁcial, as memory (especially on GPUs) is limited.

Original: The computational and memory complexity of our adversarial attacks implies that (as-is) it can be executed for graphs with roughly 20 K nodes using a commodity GPU.
Revised: The computational and memory complexity of our adversarial attacks implies that (as-is) it can be executed for graphs with roughly 20 K nodes using a commodity GPU.

Original: The complexity, however, can be drastically reduced by pre-ﬁltering the elements in the adjacency matrix for which the (meta) gradient needs to be computed, since only a fraction of entries in the adjacency matrix are promising candidate perturbations.
Revised: The complexity, however, can be drastically reduced by pre-ﬁltering the elements in the adjacency matrix for which the (meta) gradient needs to be computed, since only a fraction of entries in the adjacency matrix are promising candidate perturbations.

Original: We leave such performance optimization for future work.
Revised: We leave such performance optimization for future work.

Original: [Figure]
Revised: [Figure]

Original: [Table]
Revised: [Table]

Original: D U NNOTICEABILITY CONSTRAINT
Revised: D U NNOTICEABILITY CONSTRAINT

Original: In all our experiments, we enforce the unnoticeability constraint on the degree distribution proposed by (Z ¨ ugner et al., 2018).
Revised: In all our experiments, we enforce the unnoticeability constraint on the degree distribution proposed by (Z ¨ ugner et al., 2018).

Original: In Fig.
Revised: In Fig.

Original: 4 we show that this constraint does not signiﬁcantly limit the destructive performance of our attacks.
Revised: 4 we show that this constraint does not signiﬁcantly limit the destructive performance of our attacks.

Original: Thus we conclude that these constraints should always be enforced, since they improve unnoticeability while at the same time our attacks remain effective.
Revised: Thus we conclude that these constraints should always be enforced, since they improve unnoticeability while at the same time our attacks remain effective.

Original: E A TTACKS WITH CHANGES TO THE NODE FEATURES
Revised: E A TTACKS WITH CHANGES TO THE NODE FEATURES

Original: While the focus of our work is poisoning attacks by modifying the graph structure, our method can be applied to node feature attacks as well.
Revised: While the focus of our work is poisoning attacks by modifying the graph structure, our method can be applied to node feature attacks as well.

Original: The most straightforward case is when the node features are binary, since then we can use the same greedy algorithm as for the graph structure (ignoring the degree distribution constraints).
Revised: The most straightforward case is when the node features are binary, since then we can use the same greedy algorithm as for the graph structure (ignoring the degree distribution constraints).

Original: Among the datasets we evaluated, C ITESEER has binary node features, hence in Table 7 we display the results when attacking both node features and graph structure (while the total number of perturbations stays the same).
Revised: Among the datasets we evaluated, C ITESEER has binary node features, hence in Table 7 we display the results when attacking both node features and graph structure (while the total number of perturbations stays the same).

Original: We can observe that the impact of the combined attacks is slightly lower than the structure-only attack.
Revised: We can observe that the impact of the combined attacks is slightly lower than the structure-only attack.

Original: We attribute this to the fact that we assign the same cost to structure and feature changes, but arguably we expect a structure perturbation to have a stronger effect on performance than a feature perturbation.
Revised: We attribute this to the fact that we assign the same cost to structure and feature changes, but arguably we expect a structure perturbation to have a stronger effect on performance than a feature perturbation.

Original: Future work can provide a framework where structure and feature changes impose a different cost on the attacker.
Revised: Future work can provide a framework where structure and feature changes impose a different cost on the attacker.

Original: When the node features are continuous, there also needs to be some tuning of the meta step size and considerations whether multiple features per instance can be changed in a single step.
Revised: When the node features are continuous, there also needs to be some tuning of the meta step size and considerations whether multiple features per instance can be changed in a single step.

Original: F A DDITIONAL R ESULTS
Revised: F A DDITIONAL R ESULTS

Original: In this section we present additional results of our experiments.
Revised: In this section we present additional results of our experiments.

Original: In Table 8 we see that our heuristic is successful at attacking P UBMED , a dataset with roughly 20K nodes.
Revised: In Table 8 we see that our heuristic is successful at attacking P UBMED , a dataset with roughly 20K nodes.

Original: Tables 9 and 10 show misclassiﬁcation rates with 1% and 10% perturbed edges, respectively.
Revised: Tables 9 and 10 show misclassiﬁcation rates with 1% and 10% perturbed edges, respectively.

Original: Table 11 displays results when training the surrogate model for T = 10 iterations to obtain the (meta) gradients.
Revised: Table 11 displays results when training the surrogate model for T = 10 iterations to obtain the (meta) gradients.

Original: Finally, Figures 5 through 12 show how the respective models’ classiﬁcation accuracies change for different attack methods and datasets
Revised: Finally, Figures 5 through 12 show how the respective models’ classiﬁcation accuracies change for different attack methods and datasets

Original: [Table]
Revised: [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: [Figure] [Figure]
Revised: [Figure] [Figure]