Towards Reasonable Budget Allocation in Untargeted Graph Structure Attacks via Gradient Debias
Anonymous Author(s)
AffiliationAddress email
Abstract
In the untargeted attacks on graph structure, the gradients derived from the attackobjective are the attacker’s basis for evaluating a perturbation scheme.
It hasbecome cognitive inertia to employ cross-entropy loss function in classificationrelated tasks.
Previous methods use negative cross-entropy loss as the attackobjective in attacking node-level classification models.
However, the suitability of the cross-entropy function for constructing the untargeted attack objective has yet been discussed in previous works.
This paper argues about the previous unreason- able attack objective from the perspective of budget allocation.
We demonstratetheoretically and empirically that negative cross-entropy tends to produce moresignificant gradients from nodes with lower confidence in the labeled classes, even if the predicted classes of these nodes have been misled.
To free up these inefficient attack budgets, we propose a simple attack model for untargeted attacks on graph structure based on a novel attack objective which generates unweighted gradients on graph structures that are not affected by the node confidence.
By conducting experiments in gray-box poisoning attack scenarios, we demonstrate that a reasonable budget allocation can significantly improve the effectiveness of gradient-basededge perturbations without any extra hyper-parameter.
Introduction
Graph-structured data are widely used in real-world domains such as social networks [25], trafficnetworks [17] and recommendation systems [21].
As graphs have attracted considerable attention invarious applications [26], the robustness of graph neural networks (GNNs) is rapidly gaining researchattention [24].
As a major approach to robustness research, researchers have investigated variousattack scenarios [15, 23, 27, 28].
The attack scenarios are classified into white-box, gray-box andblack-box attacks mainly based on the information available to the attacker [22].
Unlike white-boxand black-box attacks, in gray-box attacks, the graph and training labels are visible, while the networkarchitecture of the victim model is invisible.
A gray-box attacker typically transfers the attack ona trained surrogate model (i.e., an alternative GNN) to the victim model [7, 27, 28].
Therefore,gray-box attacks are an ideal scenario to study the transferability of attacks.
This paper investigates the impact of attacker’s graph edge perturbation on the robustness of GNNsin the case of poisoning attacks.
Poisoning attacks study the impact of the attacked data on themodel training, which is also the case that may be encountered in attacks where the attacker hascontaminated the data before the model training.
Among the proposed gray-box untargeted attackmethods, gradient-based attackers have been shown to have superior attack performance and havebecome one of the mainstream attack strategies [7, 9, 28].
Attackers are built on constructing asurrogate model, designing an attack objective function, and obtaining the gradient distribution ofthe adjacent matrix by backpropagation.
Thereafter, the attacker selects the edges to be perturbed
[Figure]
based on the saliency of their gradients relative to their connectivity states.
We refer to the gradientdistribution generated by a single node on the graph structure as the partial gradient matrix of thatnode.
The derivation of this partial gradient matrix typically involves the mapping function of thesurrogate model as well as the attack objective.
The key issue of attacks on graph structure is the structural gradients, which (along with the attributegradients) are generated by the nodes’ attack objective.
The attack objective is designed as anegative cross-entropy loss in previous works [7, 28].
We define ‘node confidence’ specifically as theconfidence of a node in the prediction of the pseudo-label class obtained from the unperturbed graph.
Note that the structural gradients are generated by the loss of nodes with the message passing betweennodes.
We argue that there is a strong correlation between structural gradients and nodes’ confidence,and we empirically prove this conjecture (demonstrated in Section 5.3).
When the attack objective isnegative cross-entropy loss, the partial gradient matrix from a low-confidence node has a relativelylarge L2 norm.
Thus, low confidence nodes contribute more significant gradients to the edges; inother words, an edge is more likely to be perturbed because a low-confidence node contributes a highgradient on it.
This phenomenon is defined as the gradient bias with respect to the node confidence.
Figure 1 illustrates the impact of this phenomenon in an example of a binary classification task.
During the process from the initial step to the 1 st step, the attacker reduces the confidence of a nodefrom 0.7 to 0.2 by removing an edge, while the confidence of another node connected by this edge isreduced to 0.6.
Considering that the node with a confidence of 0.2 has produced a false prediction, itis optimal for the attacker to subsequently attack the node with a confidence of 0.6.
However, sincethe cross-entropy loss of the node with confidence 0.2 produces a large gradient, the attacker is likelyto continue attacking the edges of the node based on the importance of the gradient.
The reason forthis phenomenon is that the cross-entropy function is a logarithm-based function.
It generates highergradients for low confidence nodes in the classification task, thus favoring the model to fit these nodes.
When the attack objective is associated with the cross-entropy function, it generates more significantgradients on low confidence nodes.
Since the structural gradient originates from the aggregation ofnode features, the effect of node confidence is reflected in the structural gradients as well.
In this paper, we demonstrate theoretically and empirically that the previous attack objective (i.e.,negative cross-entropy loss) traps the attacker in a vicious cycle of inefficient budget consumption.
The iterative perturbations cause the confidence level of the low confidence nodes to become lower,and the more significant gradients generated by these nodes result in them being allocated more attackbudgets.
To address this design flaw, this paper proposes an improved attack objective, known asgradient debias, which generates unweighted gradients on the graph structure independent of nodeconfidence.
Our approach introduces an additional weight to eliminate the bias due to the confidencerelated weight on partial gradient matrices.
We implement our proposed attack objective to a simple
GNN surrogate model with a basic perturbation strategy to construct our attack model with Gradient
Debias (GraD).
To validate the effectiveness of GraD on untargeted attacks on graph structure, wetest our approach on multiple datasets as well as victim models and compare its performance withstate-of-the-art baselines.
The contribution of this paper can be summarized as follows:
• We demonstrate that the attack objective in previous works lead to a tendency for low-confidencenodes to contribute more significant gradients on the graph structure.
This traps the attacker in avicious cycle of constantly attacking low confidence nodes.
• We propose an improved attack objective, known as gradient debias, which solves the problem oflow confidence nodes dominating the attacker’s decision.•
We propose a novel attack model, GraD, which assembles our proposed attack objective and asimple surrogate model as well as a basic perturbation strategy.•
We verify the effectiveness of GraD by comparing ours’ attack performance with various baselineson untargeted gray-box poisoning attacks.
Related Works
Background The domain of graph adversarial attack is classified in terms of scenarios of attacktasks.
Attacks on graph networks contain two types of attack objectives: targeted and untargetedattacks [22].
Targeted attacks [18, 27] disrupt the network by attacking the neighbors and edges ofthe target node for a given budget, while untargeted attacks try to influence the predictions of as manynodes as possible [10, 23, 28].
Depending on the knowledge of the attacker, attacks are classifiedas white-box [20, 23], gray-box [14, 27, 28] and black-box attacks [3, 11].
White-box attacks canobtain all the information about the victim models; gray-box attacks can obtain samples for trainingthe victim models; black-box attacks can query the predictions of the victim models [22].
Theattacker performs a poisoning attack [14, 28] if the victim model is retrained after the original data iscontaminated; otherwise, it performs an evasion attack [20, 23].
In terms of the attack techniques,attacks can be classified as: modifying node attributes [10, 20], edge perturbation [7, 23, 28], andinjecting artificial nodes with edges [14, 15].
Each attack technique has a limited budget, such as thematrix norm variation on attributes or the changes in the adjacent matrix.
Untargeted poisoning attack The researches closely related to this paper are devoted to the studyof edge perturbation based untargeted attack methods.
Zinger et al.
[28] proposed the attack model
Meta-Self, which modifies the graph structure or node features by the meta-gradient of a trainedsurrogate model in a gray-box setting, which is the first gradient-based attack model.
Subsequently,papers [2, 7, 9, 10, 23] have also proposed new attack strategies and improvements using the gradientinformation provided by the surrogate model in the node features and graph structure.
Theseworks mainly use an attack objective function to obtain the gradient on the adjacency matrix bybackpropagation.
The form of the proposed attack objective function has been a negative crossentropy loss.
Liu et al.
[8] discuss the design of the surrogate model, and the attack losses involved ingraph adversarial attacks are discussed in [4].
To the best of our knowledge, no one has analyzed thedesign of attack loss from the perspective of the limited attack budget in gray-box attack scenarios.
Preliminaries
3.1 Notations
For the node classification task, given a graph G with node attributes X and a subset of node labels
Y , GNNs are expected to predict the class of unlabelled nodes.
Let G =
( V, E, X ) represents anattribute graph, where V = { v 1 , v 2 , ..., v n } is the set of N nodes,
E ⊆
V × V is the set of edges.
Each sample is represented as a node v i associated with its attribute x i ∈ R d and label y
i ∈
R k ,where k is the number of classes.
We denote the adjacency of the nodes as a binary adjacent matrix
A = { 0 , 1 } N × N , where A i,j = 1 if ( i, j ) ⊆
E .
In addition, the surrogate model is denoted byf θ , while the prediction of f θ for node v i is denoted by the probability distribution P v i .
We use
L to represent the loss (objective) function.
The perturbed graph is indicated as G ′ =
( A ′ , X ′ ) todistinguish the perturbed graph from the original graph.
The attack on a graph is limited by a budget∆ .
3.2 Gradient-based Attack on Graph Structure
In scenarios where the attacker performs untargeted attacks on graph structure, the attacker is restrictedby attack imperceptibility.
The l 0 norm of the difference in the perturbed graph with respect to theoriginal graph is bounded by the perturbation budget ∆ .
For an undirected graph, ∆ is expressed as:
[Equation]
∆ is generally no more than 5% of the number of edges in the original graph.
In an untargeted attackscenario, the attacker aims to reduce the test performance of the poisoned victim model.
[Figure]
v
[Figure]
A
[Figure]
Select Perturb
C a l c u l a t e ( G )
[Figure]
f
[Figure]
vvvvv
A gradv i 11 1
[Figure] [Figure]
[Figure]
Gradient-based attackers have become mainstream approaches of edge perturbations on the graphstructure [7, 23, 28].
Unlike the gradient-based attacks widely used in computer vision [24], forgraph data, the discretization of the graph structure dictates that the gradient matrix cannot be directlyadded to the adjacency matrix.
The gradient on the graph structure A grad is considered as a referencefor selecting edge candidates that are more likely to be ideal for perturbations.
It can be derived bythe following equations:
[Equation]
[Equation] [Equation]
) where L atk is the attack loss function and f θ ∗ is the properly trained surrogate model.
In existingmethods, the attack loss is expressed as
[Equation]
(4) where V ∗ is a subnet of nodes that involved in calculating the attack loss.
The subset V ∗ consistsof two forms: V ∗ train and V ∗ self , where V ∗ train contains labeled nodes and V ∗ self uses pseudo-labelsgenerated by the surrogate model so it can contain unlabelled nodes.
For the edge between nodesv i and v j , if A i,j = 1 and A gradi,j < 0 , or if A i,j = 0 and A gradi,j > 0 , then flipping edge E i,j isconsidered as a perturbation that has the potential to negatively affect the victim model.
The processof perturbing the graph using the gradient information can be represented as:
[Equation]
where ϕ denotes the strategy for choosing the edge to be attacked.
The factors that influence theperturbation include the attack loss L atk as well as the strategy ϕ
and the surrogate model f θ ∗ .
In the work [28], the authors do an ablation study on the node sets V ∗ train and V ∗ self .
Their resultsshow that constructing the attack loss using V ∗ self leads to superior performance.
This is due to thefact that node classification tasks are generally semi-supervised and therefore the labeled nodes aretoo sparse respect to the whole graph.
However, we find a fatal problem during the exploration of theattack loss.
The cross-entropy is a function related to the prediction confidence of the node on thelabeled class P v i ( y i | f θ ∗ ( G )) .
That is, the gradient from the cross-entropy function is also correlatedwith the confidence.
The result of this correlation is that the gradient generated by the different nodeswill contain a magnitude.
In the next section, we will discuss the reason why this magnitude appearsand whether it is reasonable in the process of attack.
Methodology
4.1 The Pipeline of Attack Model
We first present the overview of our attack model in Figure 2, which illustrates the entire flow of anattacker perturbing an edge of a graph.
The first step is to retrain a surrogate model f θ ∗ ( G ′ t ) with the perturbation graph G ′ t in the way of Eq.(2).
We use the surrogate model with same network architecture as [28], which is a linear 2-layer graphconvolutional network (GCN) [6]: f θ ( G ) =
softmax( ˆ A 2 XW ) , where ˆ A
= D − 1 / 2 ( A + I ) D − 1 / 2 isthe normalized adjacent matrix and W is a learnable weight matrix.
In the second step, we use the pseudo-label to construct the attack loss of the node.
The pseudo-labely ′
i is calculated from the prediction of the surrogate model f
θ ∗ ( G ) trained with the original graph
G .
Note that we set the attacker’s surrogate model to be consistent with the model used to generatepseudo-labels to avoid inconsistent predictions due to different structures of GNNs.
The attack loss
L atk of node v i is related to the confidence P v i ( y ′ i
| f θ ∗ ( G )) and the pseudo-label y
i , the details ofwhich will be discussed in Section 4.2.
In the third step, the attack loss of each node is backpropagated to produce a partial gradient matrix
A gradv i according to Eq.
A partial gradient matrix A gradv i denotes the structural gradient generatedfrom a single node v i .
For a GCN that aggregates h times, a node will generate gradient values on alledges between that node and its h -hop neighbors.
The overall gradient information A grad passed tothe attack strategy ϕ is the average of all the partial gradient matrices, which can be represented as:
[Equation]
where N ∗ denotes the number of nodes in the node subset V ∗ which is chosen as the set of unlabellednodes in our implementation.
The attack strategy ϕ is a basic edge perturbation selection methodbased on the saliency of gradients, which is represented as follows:
[Figure]
(cid:101)
A grad =
 
A gradi
[Equation]
if
[Equation] [Equation]
A gradi
[Equation]
if A gradi,j
[Equation]
0 & A
i
[Equation]
else (7) where (cid:101)
A grad in Eq.
(7) removes candidates with inconsistent gradient signs and edge states.
Thenthe attacker flips the edge e
i,j = argmax ( i,j ) (cid:101)
A grad , with maximum gradient saliency as the t -thperturbation, which forms the perturbed graph G ′ t
+1 that runs into the next loop.
4.2 Budget Allocation with Gradient Debias
After explaining the attack pipeline, we explain why low confidence nodes dominate the attackbecause of the previous attack objective, i.e., negative cross-entropy loss −L ce .
We first merge theformulation Eq.
(3) and Eq.
[Equation]
The gradient on the graph structure A grad comes from the contribution of each node in V ∗ .
Thewidely used formulation for attack objective is the negative cross-entropy loss, shown in Eq.
Thecross entropy loss L ce can be expressed as:
[Equation]
where the L ce is a function of the prediction confidence of the node v i on the labeled class
y ′
i .
According to the chain rule, the gradient on the adjacent matrix derived from attack loss is:
[Equation]
where term ∂P v i ( y ′ i
| f θ ∗ ) /∂A can produce a matrix of gradient distributions influenced by themapping function of surrogate model, and term ∂ L atk /∂P
v i ( y ′ i
| f θ ∗ ) acts as a weight to it.
Next, weexpand this expression for this weight:
[Equation]
From the Eq.
(11), we observe that the magnitude of a partial gradient matrix is weighted by thereciprocal of node confidence P v i ( y ′ i | f θ ∗ ) − 1 .
When the attack loss is cross-entropy-based, nodes with low confidence generate gradients witha larger magnitude than those that nodes with high confidence generate.
For example, for a nodewith a confidence of 0.1, the derivative of its attack loss with respect to confidence is 10, which isfour times larger than that of a node with a confidence of 0.4.
Since the selection of perturbationsdepends on the significance of gradients, nodes with low confidence are more likely to contributemore significant gradients in their partial gradient matrices.
This causes a low confidence node tobecome more vulnerable when its confidence is reduced.
Note that the budget ∆ should be allocated through the entire graph.
It is ineffective to allocatebudget to a node whose confidence is low enough in the labeled class.
The previous attack loss resultsin a tendency; that is, nodes with lower confidence are more likely to influence the judgment of theattacker.
Therefore, with the increase of low confidence nodes during the attack process, it becomesmore difficult for the attacker to allocate the budget to other nodes, resulting in budget waste.
To address the above problem, we propose a simple but effective attack objective known as gradientdebias.
Since the attack objective based on cross-entropy is what weights the partial gradient matrices,a solution is to apply an additional weight
λ
P
i to balance the former weight.
We propose our gradientdebias attack objective, of which the expression is:
[Equation]
[Equation] [Equation]
(13) where λ P i is a detached term that is numerically equal to the prediction confidence.
Considering
Eq.
(10) and (11), our attack objective regularize each partial gradient matrices A gradv i in the overallgradient matrix A grad .
Since the effect of λ P i essentially cancels out the effect of ∂ L atk /∂P
v i ( y ′ i
| f θ ∗ )in Eq.
(10), Eq.
(13) can be rewrited to a simple form:
[Equation] [Equation]
Compared with L atk , L atk − gd has a simpler formula, which can be understood as globally reducingthe confidence of the nodes.
Based on the gradient debias, the importance of all nodes during theattack is equal for the attacker.
In the previous L atk , if there is a low confidence node affecting thegradient of this edge (i.e., node v i , v j or their ( h − 1) -hop neighbors), then the contribution of thisnode to the gradient of edge A i,j will be significant.
It explains why the previous approach is morelikely to waste the attack budget on low confidence nodes.
In our proposed L atk − gd , the gradientsgenerated by each node are equally superimposed on edges.
That is, the gradient on edge A gradijreflects the expected confidence decrease of perturbing this edge, regardless of the confidence of thenodes.
During the perturbation, L atk − gd prevents the attacker from falling into the vicious circle ofrepeatedly making low confidence nodes even lower and gives the attacker more reliable gradientinformation leading to a more reasonable budget allocation.
Experiments
In this section, we conduct experiments to verify the effectiveness of our proposed attack model,
GraD. We describe the experimental scenarios, including the datasets, baselines, and the experimentsetup.
The practical tests of the computational efficiency of GraD and other attack models areprovided in Appendix B.2.
5.1 Experimental Scenarios
Datasets We adopt datasets of Citeseer [13], Cora [12], Cora-ML [12], and Polblogs [1] to evaluateour approach, which are detailed in Appendix B.1.
Following the setup in [28], datasets are split to10% of labeled nodes and 90% of unlabeled nodes.
The ground-truth labels of unlabeled nodes are
[Table]
invisible to both the attacker and the surrogate and are only used to evaluate the performance of theadversarial attacks.
For the integrity of the experiments, we also provide a comparison on the largestconnected component (LCC) datasets in Appendix B.3.
Baselines This paper takes Random, DICE [19], Meta-Train[28], Meta-Self [28], EpoAtk[7] (awhite-box attack model in the original paper transferred to gray-box attack) as baselines, all of whichattack GNNs by modifying graph structure.
All baselines are open source, which makes them easy toreplicate.
The implementation of baselines is detailed as follows.
Experimental Setup We conduct experiments in untargeted gray-box poisoning attack scenarios.
The gray-box attack scenarios are further split into weak transfer and strong transfer.
In a weaktransfer scenario, the victim model is also a GCN [6] as the surrogate model but has different networkstructures.
In a strong transfer scenario, the victim model has different principles from the surrogate,which is a GAT [16] or a GraphSage [5].
Different GNNs tend to differ from graph representations,challenging the attack transferability.
To ensure absolute fairness in the test scenarios, we save theperturbation graphs generated by all attack models and test them on unified victim models.
Eachexperiment is repeated ten times with different initialization, and we take the mean and variance as aresult.
We compare the attack performance of each method at perturbation rates of 3% and 5%.
Theresults of the experiment are expressed in terms of classification accuracy.
5.2 Performance of Attack Model
Experiments are designed to compare our proposed GraD with several baselines, and the experimentalresults are presented in this section.
We category the experiments into weak transfer scenarios andstrong transfer scenarios based on the differences between the surrogate and victim models.
In graybox attack, experimental scenarios are designed to verify the transferability of the attack methods.
Ina weak transfer scenario, both the victim model and the surrogate model are GCNs.
Although theydiffer in the design of activation functions and network layers, their similar representation learningprinciples make the attack in this scenario relatively simple.
In a strong transfer scenario, the victimmodel is a GAT or a GraphSage, unlike the surrogate model.
They are different in principle fromrepresentation learning, making attacks in this scenario more difficult.
The attacking budget ∆ is setat 3%, and 5% of edges in the original graph in the weak transfer scenarios, while it is set at 5% inthe strong transfer scenarios.
The control group ’Clean’ represents the classification accuracy of thevictim model trained with the original graphs under the same training process.
5.2.1 Weak Transfer Scenarios
Table 1 shows the experimental results when the network structures of the victim model and thesurrogate model are GCNs.
Our proposed GraD uses a linear GCN network similar to [28], while
EpoAtk [7] is a nonlinear GCN network with a different structure.
In this scenario, the representationlearning process of the surrogate model and the victim model is similar, so the transfer of the attackis less difficult.
From the table 1 we can see that GraD is superior to the existing state-of-the-artbaselines in all untargeted poisoning attack experiments and considerably outperforms other workin most scenarios.
In terms of overall attack performance, GraD is far better than the other attackmodels, followed in order by Meta-Self, Meta-Train, and EpoAtk, while Random and DICE, whichare based on randomness, are the worst of all baselines.
GraD outperforms the second-best methodon the Cora dataset by 2.7% and 4.4%.
On Cora-ML, GraD performs better than the second-bestmethod by 1.6% and 1.2%.
On Citeseer, GraD obtains better results than the second-best method by
[Table]
[Figure]
3.8% and 4.6%.
On Polblogs, GraD outperforms the second-best method by 5.0% and 6.3%.
Ourmethod was on average 4.48% higher than the second-best method Meta-Self, with the best resultsbeing 1.2% to 8.0% higher than the second-best.
From the results shown in Table 1, the performanceof GraD exceeds that of other state-of-the-art baselines, which proves that our proposed attack modelsubstantially improves the performance of the attacker.
We experimentally validate our discussionof design flaws on attack loss function in prior work and the effectiveness of our proposed gradientde-weighting.
5.2.2 Strong Transfer Scenarios
Table 2 shows the experimental results for the case where the structures of the victim model and thesurrogate model are different.
The surrogate model is a GCN model, while the victim model is a GATor a GraphSage.
Results show the performance of GraD and baselines at perturbation rates of 5%.
Comparing the results in Table 2 with that in Table 1, although both scenarios belong to the gray-boxsetting, the attack method yields a more significant deviation when the structure of the victim modeldiffers from the surrogate.
On Cora, Cora-ML, and Citeseer, there is consistency between the effectsof each attack method in the strong transfer scenarios and those in the weak transfer scenarios.
For thescenarios where the victim models are GATs, our method improves 3.4%, 1.3%, and 0.2% comparedto the second-best method on Cora, Cora-ML, and Citeseer, respectively.
For the scenario wherethe victim model is GraphSage, our method compared to the second-best method improves by 4.3%,1.7%, and 2.0% on the three datasets.
The performance of each method on Polblogs varies.
Whenthe victim model is GAT, our method outperforms the second best method, DICE, by 11%, whilethe random-based DICE outperforms other gradient-based baselines.
However, when the victimmodel is GraphSage, the effect of GraD is 1.9% lower than the best model.
This result shows thatthe variability of the network structure is what makes the transfer of attacks more difficult.
Overall,
GraD still substantially improves attackers’ performance in strong transfer scenarios, demonstratingthe effectiveness of our approach.
5.3 Correlation between Nodes’ Confidence and Structural Gradients
An important assumption supporting our theory is that the confidence degree of nodes is stronglycorrelated with the gradient of the edge.
To verify our statement that lower confidence nodes producerelatively significant gradients, we do the statistics shown in Figure 3.
It compares the previous attackobjective −L ce with L atk − gd on Citeseer and Cora.
In the figure, the x-axis of each point is theconfidence of the node on the pseudo-label class, and the y-axis is the ℓ 2 norm of its partial gradientmatrix (i.e., the global salience of the gradient generated by that node via the attack loss).
The previous attack objective produces significant gradients for low confidence nodes.
The attack ismore susceptible to low confidence nodes, which limits budgetary planning to a local scope.
Thegradient bias of low confidence nodes is eliminated in our proposed L atk − gd .
The gradient is naturally
[Figure]
F r e qu e n ce
F r e qu e n ce F r e qu e n ce
[Figure]
i
[Figure]
interval
larger on a node at a middle confidence level than at a low or high confidence level.
We believe thisis because the node deviates from the centroid of any class in the hidden space.
Nodes at the middleconfidence level become low confidence nodes when attacked, while low confidence nodes are notvulnerable.
It ensures that the vulnerable nodes continuously change and achieves a global budgetallocation.
5.4 Confidence Distribution Analysis
To demonstrate that our approach solves the problem we state, we visualize the distribution of thesurrogate model’s prediction confidence, as shown in Figure 4.
The confidence level of a node isthe output possibility (obtained from the clean graph) for its pseudo-label class.
We compare theconfidence distributions between the perturbed graphs generated by GraD and Meta-Self. ’
Clean’represents the confidence distribution of the GNN model trained with the unperturbed graph.
The
GNN model for each graph is set up as a GCN with unified network architecture.
In Cora, Cora-ML, and Citeseer, most nodes have confidence levels greater than 0.9 in a clean graph,mainly distributed at the high confidence level.
The nodes in the Polblogs are mainly distributed at aconfidence level of about 0.7.
For the perturbed graphs generated by Meta-Self, the number of nodeswith high and low confidence is significantly more than other nodes, especially in Cora, Citeseer,and Polblogs.
It validates our elaboration that the previous attack objective leads the attacker intorepeatedly attacking low confidence nodes.
Comparing GraD with Meta-Self, graphs perturbed by
GraD have fewer nodes being distributed in the high confidence level.
Moreover, the graphs from
GraD have fewer nodes on the low confidence level than that of Meta-Self.
The results show that GraDattacks more high-confidence nodes and generates fewer low-confidence nodes than Meta-Self.
Theresults illustrates that GraD allocates the attack budget on low confidence nodes to high confidencenodes that have not yet been attacked.
Conclusion
This paper focuses on the budget allocation problem for untargeted gray-box edge perturbations.
We first argue that the loss function used by other methods will lead to an unreasonable budgetallocation during the perturbation process.
The gradient of the attack loss function based on crossentropy is related to the confidence of the node on the pseudo-label, which leads to the problemthat nodes with lower confidence are more likely to be allocated budgets.
Considering that a nodeis successfully attacked after its confidence is below a threshold, it should not be allocated morebudget than other nodes from a budget allocation perspective.
To this end, we propose GraD, anattack model using a gradient de-weighting attack objective.
Our method proposes a simple buteffective attack objective to balance the harmful tendency caused by confidence when the gradientis generated through backpropagation.
In the experimental section, we validate the effectiveness ofour proposed method by experimenting with different settings of the untargeted poisoning gray-boxattack.
The results demonstrate that GraD significantly improves the attacker’s attack success rate,which proves the reliability of our discussion on the shortcoming of the previous attack objective andthe effectiveness of our approach.
Checklist
The checklist follows the references.
Please read the checklist guidelines carefully for information onhow to answer these questions.
For each question, change the default [TODO] to [Yes] , [No] , or[N/A] .
You are strongly encouraged to include a justification to your answer , either by referencingthe appropriate section of your paper or providing a brief inline description.
For example:
• Did you include the license to the code and datasets?
[Yes]
• Did you include the license to the code and datasets?
[No] The code and the data are
proprietary.• Did you include the license to the code and datasets?
[N/A]
Please
do not modify the questions and only use the provided macros for your answers.
Note that the
Checklist section does not count towards the page limit.
In your paper, please delete this instructionsblock and only keep the Checklist section heading above along with the questions/answers below
For all authors...
(a) Do the main claims made in the abstract and introduction accurately reflect the paper’scontributions and scope?
[Yes](b) Did you describe the limitations of your work?
[Yes]
(c) Did you discuss any potential negative societal impacts of your work?
[N/A]
(d) Have you read the ethics review guidelines and ensured that your paper conforms to
them?
[Yes]
If you are including theoretical results...
(a) Did you state the full set of assumptions of all theoretical results?
[Yes]
(b) Did you include complete proofs of all theoretical results?
[Yes]
If you ran experiments...
(a) Did you include the code, data, and instructions needed to reproduce the main experi-
mental results (either in the supplemental material or as a URL)?
[Yes]
(b) Did you specify all the training details (e.g., data splits, hyperparameters,
how they
were chosen)?
[Yes]
(c) Did you report error bars (e
g., with respect to the random seed after running experi-
ments multiple times)?
[No]
(d) Did you include the total amount of compute and the type of resources used (e
g., typeof GPUs, internal cluster, or cloud provider)?
[Yes]
If you are using existing assets (e
g., code, data, models) or curating/releasing new assets...
(a) If your work uses existing assets, did you cite the creators?
[N/A]
(b) Did you mention the license of the assets?
[N/A]
(c) Did you include any new assets either in the supplemental material or as a URL?
[N/A]
(d) Did you discuss whether and how consent was obtained from people whose data you’re
using/curating?
[N/A]
(e) Did you discuss whether the data you are using/curating contains personally identifiable
information or offensive content?
[N/A]
If you used crowdsourcing or conducted research with human subjects...
(a) Did you include the full text of instructions given to participants and screenshots, if
applicable?
[N/A]
(b) Did you describe any potential participant risks, with links to Institutional Review
Board (IRB) approvals, if applicable?
[N/A]
(c) Did you include the estimated hourly wage paid to participants and the total amount
spent on participant compensation?
[N/A]
A Broader Impact
This paper propose a poisoning attack model on graph-structured data.
Our approach is able tosignificantly affect the robustness of graph neural networks by modifying limited edges, which putsit at risk of malicious use.
The attack method proposed in this paper requires 1.attributes of nodes2.training labels 3.graph structure.
We remind the owners to protect the privacy of the data to avoidmalicious attacks.
B AppendixB.1 Detail of Datasets
[Table]
B.2 Computational Efficiency
We compared the computational efficiency of our method with the baseline, shown in Table 4.
Thetable counts the running time of each method from the beginning to the completion of the perturbationprocess.
The experiment is run at a uniform perturbation rate of 5%.
Moreover, the experimentson both baselines and our approach are implemented under the environment of the PyTorch 1.3.1library with Intel(R)
Xeon(R)
Gold 6240R @ 2.40GHz CPU and NVIDIA V100 GPU.
DICE hasthe highest computational efficiency since it depends on randomness without gradient derivation.
The computational efficiency of EpoAtk is the lowest because it carries an exploration modulethat requires additional computation.
Our method is slightly more computationally efficient than
Meta-Train and Meta-Self, among the other methods.
Therefore, as we state, the computationalefficiency of GraD is satisfactory while the performance is competitive.
[Table]
B.3 Attack Performance in LCC Datasets
To further confirm the validity of our method, we replicate part of the experimental attack scenariosin Meta-Train & Meta-Self.
The datasets Cora, Cora-ml, and Citeseer contain singleton nodes thatare not connected to other nodes.
These nodes are removed from the graph in these datasets, named
LCC datasets.
The perturbation rate of the attack scenario is set to 5%, and the victim networkarchitecture is nonlinear two-layer GCN.
The experimental results are shown in Figure 5.
Comparingthe classification accuracy of the attacked graphs, GraD has a 3-4% higher attack success rate thanthe second-ranked Meta-Self.
Among other models, EpoAtk performs better than Meta-Train.
In thereplicated attack scenario, GraD still demonstrates strong competitiveness.
[Figure]