A DVERSARIAL A TTACKS ON N ODE E MBEDDINGS
Anonymous authors
Paper under double-blind review
A BSTRACT
The goal of network representation learning is to learn low-dimensional node embeddings that capture the graph structure and are useful for solving downstream tasks.
However, despite the proliferation of such methods, there is currently no study of their robustness to adversarial attacks.
We provide the ﬁrst adversarial vulnerability analysis on the widely used family of methods based on random walks.
We derive efﬁcient adversarial perturbations that poison the network structure and have a negative effect on both the quality of the embeddings and the downstream tasks.
We further show that our attacks are transferable since they generalize to many models, and are successful even when the attacker is restricted.
I NTRODUCTION
Unsupervised node embedding (network representation learning) approaches are becoming increasingly popular and achieve state-of-the-art performance on many network learning tasks (Cai et al., 2017).
The goal is to embed each node in a low-dimensional feature space such that the graph’s structure is captured.
The learned embeddings are subsequently used for downstream tasks such as link prediction, node classiﬁcation, community detection, and visualization.
Among the variety of proposed approaches, techniques based on random walks (RWs) (Perozzi et al.
Grover &
Leskovec) are highly successful since they incorporate higher-order relational information.
Given the increasing popularity of these method, there is a strong need for an analysis of their robustness.
In particular, we aim to study the existence and effects of adversarial perturbations .
A large body of research shows that traditional (deep) learning methods can easily be fooled/attacked: even slight deliberate data perturbations can lead to wrong results (Goodfellow et al., 2014; Mei & Zhu, 2015;
Carlini & Wagner, 2017; Liang et al., 2017; Cisse et al., 2017; Lin et al., 2017; Chen et al., 2017a).
So far, however, the question of adversarial perturbations for node embeddings has not been addressed.
This is highly critical, since especially in domains where graph embeddings are used (e.g. the web) adversaries are common and false data is easy to inject : e.g. spammers might create fake followers on social media or fraudsters might manipulate friendship relations in social networks.
Can node embedding approaches be easily fooled?
The answer to this question is not immediately obvious.
On one hand, the relational (non-i.i.d.)
nature of the data might improve robustness since the embeddings are computed for all nodes jointly rather than for individual nodes in isolation.
On the other hand, the propagation of information might also lead to cascading effects, where perturbations in one part of the graph might affect many other nodes in another part of the graph.
Compared to the existing works on adversarial attacks our work signiﬁcantly differs in various aspects.
First, by operating on plain graph data, we do not perturb the features of individual instances but rather their interaction/dependency structure.
Manipulating the structure (the graph) is a highly realistic scenario.
For example, one can easily add or remove fake friendship relations on a social network, or write fake reviews to inﬂuence graph-based recommendation engines.
Second, the node embedding works are typically trained in an unsupervised and transductive fashion.
This means that we cannot rely on a single end-task that our attack might exploit to ﬁnd appropriate perturbations, and we have to handle a challenging poisoning attack where the model is learned after the attack.
That is, the model cannot be assumed to be static as in most other adversarial attack works.
Lastly, since graphs are discrete classical gradient-based approaches (Li et al.
; Mei & Zhu, 2015) for ﬁnding adversarial perturbations that were designed for continuous data are not well suited.
Particularly for RW-based methods, the gradient computation is not directly possible since they are based on a non-differentiable sampling procedure.
How to design efﬁcient algorithms that are able to ﬁnd adversarial perturbations in such a challenging – discrete and combinatorial – graph domain?
We propose a principled strategy for adversarial attacks on unsupervised node embeddings.
Exploiting results from eigenvalue perturbation theory (Stewart, 1990) we are able to efﬁciently solve a challenging bi-level optimization problem associated with the poisoning attack.
We assume an attacker with full knowledge about the data and the model, thus, ensuring reliable vulnerability analysis in the worst case.
Nonetheless, our experiments on transferability demonstrate that our strategy generalizes – attacks learned based on one model successfully fool other models as well.
Overall, we shed light on an important problem that has not been studied so far.
We show that node embeddings are sensitive to adversarial attacks.
Relatively few changes are needed to signiﬁcantly damage the quality of the embeddings even in the scenario where the attacker is restricted.
Furthermore, our work highlights that more work is needed to make node embeddings robust to adversarial perturbations and thus readily applicable in production systems.
R ELATED WORK
We focus on adversarial attacks on unsupervised node embedding approaches based on random walks (RWs), and further show how one can easily apply a similar analysis to attack other node embeddings based on factorization.
For a recent extensive survey, also of other non-RW based approaches, we refer to Cai et al.
Moreover, while many (semi-)supervised learning methods (Kipf & Welling, 2016; Defferrard et al.) have been introduced, we focus on unsupervised methods since they are often used in practice due to their ﬂexibility in solving various downstream tasks.
Adversarial attacks.
Attacking machine learning models has a long history, with seminal works on SVMs and logistic regression (Biggio et al., 2012; Mei & Zhu, 2015).
Deep neural networks were also shown to be highly sensitive to small adversarial perturbations to the input (Szegedy et al., 2013; Goodfellow et al., 2014).
While most works focus on image classiﬁcation, recent works have shown the existence of adversarial examples also in other domains (Liang et al., 2017; Grosse et al.).
Different taxonomies exist characterizing the attacks/adversaries based on their goals, knowledge, and capabilities (Biggio et al.
; Papernot et al.
; Mu ˜ noz-Gonz ´ alez et al., 2017).
The two dominant attacks types are poisoning attacks that target the training data (the model is trained after the attack) and evasion attacks that target the test data/application phase (the learned model is assumed ﬁxed).
Compared to evasion attacks, poisoning attacks are far less studied (Koh & Liang, 2017; Mu ˜ nozGonz ´ alez et al., 2017; Li et al.
; Mei & Zhu, 2015; Chen et al., 2017a) since they require solving a challenging bi-level optimization problem.
Attacks on semi-supervised graph models.
The robustness of semi-supervised graph classiﬁcation methods to adversarial attacks has recently been analyzed (Z¨ugner et al., 2018; Dai et al., 2018a).
The ﬁrst work, introduced by Z¨ugner et al.
(2018), linearizes a graph convolutional network (GCN) (Kipf & Welling, 2016) to derive a closed-form expression for the change in class probabilities for a given edge/feature perturbation.
They calculate a score for each possible edge ﬂip based on the classiﬁcation margin and greedily pick the top edge ﬂips with highest scores.
Later, Dai et al.
(2018a) proposed a reinforcement (Q-)learning formulation where they decompose the selection of relevant edge ﬂips into selecting the two end-points.
Both approaches focus on targeted attacks (misclassify a given node) for the semi-supervised graph classiﬁcation task.
In contrast, our work focuses on general attacks (decrease the overall quality) on unsupervised node embeddings.
Manipulating graphs.
In the context of graph clustering, Chen et al.
(2017b) measure the changes in the result when injecting noise to a bi-partite graph of DNS queries, but do not focus on automatically generating attacks.
There is an extensive literature on works that optimize the graph structure to manipulate e.g. information spread in a network (Chen et al.
; Khalil et al.), user opinions (Amelkin & Singh, 2017; Chaoji et al.), shortest paths (Phillips; Israeli & Wood), page rank scores and other metrics (Avrachenkov & Litvak; Chan et al.).
Remotely related are poisoning attacks on multi-task relationship learning (Zhao et al., 2018).
While they exploit the relations between different tasks, they still deal with the classical scenario of i.i.d.
instances within each task.
Robustness and adversarial training.
The robustiﬁcation of machine learning models has also been studied – known as adversarial machine learning or robust machine learning.
Such approaches are out of scope for this paper and we do not discuss them.
The goal of adversarial training (e.g. via
GANs (Dai et al., 2018b)) is to improve the embeddings, while our goal is to damage the embeddings produced by existing models by perturbing the graph structure.
A TTACKING NODE EMBEDDINGS
Here we explore poisoning attacks on the graph structure – the attacker is capable of adding or removing (ﬂipping) edges in the original graph within a given budget.
We focus mainly on approaches based on random walks and extend the analysis to spectral approaches (Sec. 6.2 in the appendix).
3. B ACKGROUND AND PRELIMINARIES
Let G =
( V, E ) be an undirected unweighted graph where V is the set of nodes, E is the set of edges, and A ∈ { 0 , 1 } | V |×| V | is the adjacency matrix.
The goal of network representation learning is to ﬁnd a low-dimensional embedding z v ∈ R K for each node with K (cid:28) | V | .
This dense lowdimensional representation should preserve information about the network structure – nodes similar in the original network should be close in the embedding space.
DeepWalk (Perozzi et al.) and node2vec (Grover & Leskovec) learn an embedding based on RWs by extending and adapting the skip-gram architecture (Mikolov et al., 2013) for learning word embeddings.
They sample ﬁnite (biased) RWs and use the co-occurrence of node-context pairs in a given window in each RW as a measure of similarity.
To learn z v they maximize the probability of observing v ’s neighborhood.
3. A TTACK MODEL
We denote with ˆ A the adjacency matrix of the graph obtained after the attacker has modiﬁed certain entries in A .
We assume the attacker has a given, ﬁxed budget and is only capable of modifying f entries, i.e. || ˆ A −
A ||
= 2 f (we have 2 f since G is undirected).
The goal of the attacker is to damage the quality of the learned embeddings, which in turn harms subsequent learning tasks such as node classiﬁcation or link prediction that use the embeddings as features.
We consider both a general attack that aims to degrade the embeddings of the network as a whole, as well as a targeted attack that aims to damage the embedding regarding a speciﬁc target or speciﬁc task.
The quality of the embeddings is measured by the loss L ( A, Z ) of the model under attack, with lower loss corresponding to higher quality, where Z ∈ R N × K is the matrix containing the embeddings of all nodes.
Thus, the goal of the attacker is to maximize the loss.
We can formalize this as the following bi-level optimization problem:
[Equation]
Here, Z ∗ is always the ’optimal’ embedding resulting from the (to be optimized) graph ˆ A , i.e. it minimizes the loss, while the attacker tries to maximize the loss.
Solving such a problem is highly challenging given its discrete and combinatorial nature, thus we derive efﬁcient approximations.
3. G ENERAL ATTACK
Since the ﬁrst step in the embedding approaches is to generate a set of random walks that serve as a training corpus for the skip-gram model, the bi-level optimization problem is even more complicated.
We have Z ∗ =
min Z L ( { r 1 , r 2 , . . .
} , Z )
with r i ∼ RW l ( ˆ A ) , where RW l is an intermediate stochastic procedure that generates RWs of length l given the graph ˆ A which we are optimizing.
By ﬂipping (even a few) edges in the original graph, the attacker necessarily changes the set of possible RWs, thus changing the training corpus.
Therefore, this RW generation process precludes any gradient-based methods.
To tackle this challenge we leverage recent results that show that (given certain assumptions) RW based node embedding approaches are implicitly factorizing the Pointwise Mutual Information (PMI) matrix (Yang & Liu, 2015; Qiu et al., 2017).
We study DeepWalk as an RW-based representative approach since it’s one of the most popular methods and has many extensions.
Speciﬁcally, we use the results from Qiu et al.
(2017) to sidestep the RW stochasticity.
Lemma 1 (Qiu et al.
DeepWalk is equivalent to factorizing ˜ M = log(max( M, 1)) with
M = vol ( A ) T · b S, where S = (cid:0)
T (cid:88) r =
P r (cid:1) D − 1 , where P = D − 1 A (2) where the embedding Z ∗ is obtained by the Singular Value Decomposition of ˜ M = U Σ V T using the top- K largest singular values / vectors, i.e. Z ∗ =
U K Σ 1 / 2 K .
Here, D is the diagonal degree matrix with D ii = (cid:80)
j A ij , T is the window size, b is the number of negative samples and vol ( A )
=
(cid:80) i,j A ij is the volume.
Since M is sparse and has many zero entries the matrix log( M ) where the log is elementwise is ill-deﬁned and dense.
To cope with this, similar to the Shifted Positive PMI (PPMI) approach the elementwise maximum is introduced to form ˜ M .
Using this insight, we see that DeepWalk is equivalent to optimizing min ˜ M K || ˜ M − ˜ M K
|| 2 F where ˜ M K is the best rank- K approximation to ˜ M .
This in turn means that the loss for DeepWalk when using the optimal embedding Z ∗ for a given graph A is L DW 1 ( A, Z ∗ ) =
(cid:113)(cid:80) | V | p =
K +1 σ 2 p where σ p are the singular values of ˜ M ( A ) ordered decreasingly σ 1 ≥ σ 2 · · · ≥ σ | V | .
This result shows that we do not need to construct random walks, nor do we have to (explicitly) learn the embedding Z ∗ – it is implicitly considered via the singular values of ˜ M ( A ) .
Accordingly, we have transformed the bi-level problem into a single-level optimization problem.
However, maximizing L DW 1 is still challenging due to the singular value decomposition and the discrete nature of the problem.
Gradient based approach.
Maximizing L DW 1 with a gradient-based approach is not straightforward since we cannot easily backpropagate through the SVD.
To tackle this challenge we exploit ideas from eigenvalue perturbation theory (Stewart, 1990) to approximate L DW 1 ( A ) in closed-form without needing to recompute the SVD.
This enables us to efﬁciently calculate the gradient.
Theorem 1.
Let A be the initial adjacency matrix and
˜ M ( A ) be the respective co-occurrence matrix.
Let u p be the p -th eigenvector corresponding to the p -th largest eigenvalue of ˜ M .
Given a perturbed matrix A (cid:48) , with A (cid:48)
=
A + ∆ A , and the respective change ∆ ˜ M .
We can approximately compute the loss: L DW 1 ( A (cid:48) )
≈ (cid:113)(cid:80)
Np = K +1 (cid:0) u
Tp ( ˜ M + ∆ ˜ M ) u p (cid:1)
=
L DW 2 ( A (cid:48) ) and the approximation error is bounded by |L DW 1 ( A (cid:48) )
− L DW 2 ( A (cid:48) )
| ≤ || ∆ ˜ M || F .
The proof is given in the appendix.
For a small ∆ A and thus small
∆ ˜ M we obtain a very good approximation, and if ∆ A = ∆ ˜ M =
then the loss is exact.
Intuitively, we can think of using eigenvalue perturbation as analogous to taking the gradient of the loss w.r.t.
˜ M
( A ) .
Now, gradient-based optimization is efﬁcient since ∇ A L DW 2 ( A ) avoids recomputing the eigenvalue decomposition.
The gradient provides useful information for a small (cid:15) change, however, here we are considering discrete ﬂips, i.e. (cid:15)
= ±
so its usefulness is limited.
Furthermore, using gradient-based optimization requires a dense instantiation of the adjacency matrix, which has complexity O ( N 2 ) in both runtime and memory (infeasible for large graphs).
This motivates the need for our more advanced approach.
Sparse closed-form approach.
Our goal is to efﬁciently compute the change in the loss L DW 1 ( A ) given a set of ﬂipped edges.
To do so we will analyze the change in the spectrum of some of the intermediate matrices and then derivate a bound on the change in the spectrum of the co-occurrence matrix, which in turn will give an estimate of the loss.
First, we need some results.
Lemma 2.
The matrix S in Eq.
2 is equal to S
= U ( (cid:80)
Tr =1 Λ r ) U T where the matrices U and Λ contain the eigenvectors and eigenvalues solving the generalized eigen-problem Au = λDu .
The proof is given in the appendix.
We see that the spectrum of S (and, thus, the one of M by taking scalars into account) is obtainable from the generalized spectrum of A .
The difference to Qiu et al.
(2017)’s derivation where a factorization of S using A norm :
= D − 1 / 2 AD − 1 / 2 is important.
As we will show, our formulation using the generalized spectrum of A is key for an efﬁcient approximation.
Let A (cid:48)
=
A + ∆ A be the adjacency matrix after the attacker performed some edge ﬂips.
As above, by computing the generalized spectrum of A (cid:48) , we can estimate the spectrum of the resulting S (cid:48) and
M (cid:48) .
However, recomputing the eigenvalues λ (cid:48) of A (cid:48) for every possible set of edge ﬂips is still not efﬁcient for large graphs, preventing an effective application.
Thus, we derive our ﬁrst main result: an efﬁcient approximation bounding the change in the singular values of M (cid:48) for any edge ﬂip.
Theorem 2.
Let ∆ A be a matrix with only 2 non-zero elements, namely ∆ A ij = ∆
A ji = 1 − 2 A ij corresponding to a single edge ﬂip ( i, j ) , and ∆ D the respective change in the degree matrix, i.e.
A (cid:48)
=
A +∆ A and D (cid:48)
=
D +∆ D .
Let u y be the y -th generalized eigenvector of A with generalized eigenvalue
λ y .
Then the generalized eigenvalue λ (cid:48)
y of A (cid:48) solving λ (cid:48)
y A (cid:48)
=
λ (cid:48)
y D (cid:48) u (cid:48)
y is approximately:
[Equation]
where u yi is the i -th entry of the vector u y , and ∆ w ij = (1 − 2 A ij ) indicates the edge ﬂip, i.e ± 1 .
The proof is provided in the appendix.
By working with the generalized eigenvalue problem in
Theorem 2 we were able to express A (cid:48) and D (cid:48) after ﬂipping an edge as additive changes to A and D , this in turn enabled us to leverage results from eigenvalue perturbation theory to efﬁciently approximate the change in the spectrum.
If we used A norm instead, the change to A (cid:48) norm would be multiplicative preventing efﬁcient approximations.
Using Eq. 3, instead of recomputing λ (cid:48) we only need to compute ∆ λ , signiﬁcantly reducing the complexity when evaluating different edge ﬂips ( i, j ) .
Using this result, we can now efﬁciently bound the change in the singular values of S (cid:48) .
Lemma 3.
Let A (cid:48) be deﬁned as before and S (cid:48) be the resulting matrix.
The singular values of S (cid:48) are bounded: σ p ( S (cid:48) )
≤ ˜ σ p ( i, j ) :
=
[Equation]
where π is a permutation simply ensuring that the ﬁnal ˜ σ p ( i, j ) are sorted decreasingly, where d (cid:48) min is the smallest degree in A (cid:48) .
We provide the proof in the appendix.
Using this result, we can efﬁciently compute the loss for a rank- K approximation/factorization of M (cid:48) , which we would obtain when performing the edge ﬂip ( i, j ) , i.e. L DW 3 ( A (cid:48) )
=
vol ( A )
+2∆ w ij T · b (cid:2) (cid:80) | V | p = K +1 ˜ σ p ( i, j ) 2 (cid:3) 1 / 2 .
While the original loss L DW 1 is based on the matrix ˜ M = log(max( M, 1)) , there are unfortunately currently no tools available to analyze the spectrum of ˜ M given the spectrum of M .
Therefore, we use L DW 3 as a surrogate loss for L DW 1 (Yang et al.
similarly exclude the element-wise logarithm).
As our experimental analysis shows, the surrogate loss is effective and we are able to successfully attack the node embeddings that factorize the actual co-occurrence matrix ˜ M , as well as the original skip-gram model.
Similarly, methods based on spectral embedding, factorize the graph Laplacian and have a strong connection to the RW based approaches.
We provide a similar detailed analysis in the appendix (Sec. 6.2).
The overall algorithm.
Our goal is to maximize L DW 3 by performing f edge ﬂips.
While Eq.enables us to efﬁciently compute the loss for a single edge, there are still O ( n 2 ) possible ﬂips.
To reduce the complexity when adding edges (see Sec. 4.2 for removing) we instead form a candidate set by randomly sampling C candidate ﬂips.
This introduces a further approximation that nonetheless works well in practice.
For every candidate we compute its impact on the loss via L DW 3 and greedily choose the top f ﬂips.
The runtime complexity of our overall approach is: O ( N ·| E | + C · N log N ) .
First, we can compute the generalized eigenvectors of A in a sparse fashion in O ( N · | E | ) .
Then we sample C candidate edges, and for each we can compute the approximate eigenvalues in constant time (Theorem 2).
To obtain the ﬁnal loss, we sort the values leading to the overall complexity.
The approach is easily parallelizable since every candidate edge ﬂip can be evaluated in parallel.
3. T ARGETED ATTACK
If the goal of the attacker is to attack a speciﬁc node t ∈ V , called the target, or a speciﬁc downstream task, it is suboptimal to maximize the overall loss via L DW ∗ .
Rather, we should deﬁne some other target speciﬁc loss that depends on t ’s embedding – replacing the loss function of the outer optimization in Eq.
1 by another one operating on t ’s embedding.
Thus, for any edge ﬂip ( i, j ) we now need the change in t ’s embedding – meaning changes in the eigen vectors – which is inherently more difﬁcult to compute compared to changes in eigen/singular- values .
We study two cases: misclassifying a target node and manipulating the similarity of node pairs (i.e. link prediction task).
Surrogate embeddings.
To efﬁciently compute the change in eigenvectors, we deﬁne surrogate embeddings ¯ Z ∗ .
Speciﬁcally, instead of performing an SVD decomposition on M (or equivalently S with upscaling) and using the results from Lemma 2 we deﬁne ¯ Z ∗ =
U ( (cid:80)
Tr =1 Λ r ) .
Experimentally, using ¯ Z ∗ instead of Z ∗ as the embedding showed no signiﬁcant change in the performance on downstream tasks (even on the clean graph; suggesting its general use since it is more efﬁcient to compute).
Now, we can approximate the generalized eigenvectors, and thus ¯ Z ∗ ( A (cid:48) ) , in closed-form:
Theorem 3.
Let ∆ A, ∆ D and ∆ w ij be deﬁned as before, and
∆ λ y be the change in the y-th generalized eigenvalue λ y as derived in Theorem 2.
Then, the y-th generalized eigenvector u (cid:48) y of A (cid:48) after performing the edge ﬂip ( i, j ) can be approximated with:
[Equation]
where E i ( x ) returns a vector of zeros except at position i where the value is x , d is a vector of the node degrees, ◦ is the Hadamard product, and ( · ) + is the pseudo inverse.
We provide the proof in the appendix.
Computing Eq.
4 seems expensive at ﬁrst due to the pseudo inverse term.
However, note that this term does not depend on the particular edge ﬂip we perform.
Thus, we can pre-compute it once and furthermore, parallelize the computation for each y .
Similarly, we can pre-compute u y d , while the rest of the terms are all computable in O (1) .
For any edge ﬂip we can now efﬁciently compute the optimal embedding ¯ Z ∗ ( A (cid:48) ) using Eqs.
3 and 4.
The t-th row of ¯
Z ∗ ( A (cid:48) ) is the desired embedding for a target node t after the attack.
Targeting node classiﬁcation.
The goal is to enforce misclassiﬁcation of the target t for the downstream task of node classiﬁcation (i.e. node labels are partially given).
To fully specify the targeted attack we need to deﬁne the candidate ﬂips and the target-speciﬁc loss responsible for scoring the candidates.
As candidates we use { ( v, t ) | v (cid:54) = t } .
For the loss, we ﬁrst pre-train a classiﬁer C on the clean embedding ¯ Z ∗ .
Then we predict the class probabilities p t of the target t using the compromised ¯ Z ∗ t, · and we calculate the classiﬁcation margin m ( t ) =
p t,c ( t ) − max c (cid:54) =
c ( t ) p t,c , where c ( t ) is the ground-truth class for t .
That is, our loss is the difference between the probability of the ground truth and the next most probable class after the attack.
Finally, we select the top f ﬂips with smallest margin m (note when m ( t ) < 0 node t is misclassiﬁed).
In practice, we average over 10 randomly trained classiﬁers.
Another (future work) approach is to treat this as a tri-level optimization problem.
Targeting link prediction.
The goal of the attack is: given a set of target node pairs T ⊂ V × V , decrease the similarity between the nodes that have an edge, and increase the similarity between nodes that do not have an edge, by modifying other parts of the graph – i.e. it is not allowed to directly ﬂip pairs in T .
For example, in an e-commerce graph representing users and items, the goal might be to increase the similarity between a certain item and user, by adding/removing connections between other users/items.
To achieve this, we ﬁrst train the initial clean embedding without the target edges.
Then, for a candidate set of ﬂips, we estimate ¯ Z ∗ using Eqs.
3 and
and use them to calculate the average precision score (AP score) on the target set T , with ¯ Z ∗ i ( ¯ Z ∗ j ) T as a similarity measure.
Finally, we pick the top f ﬂips with lowest AP scores and use them to poison the network.
E XPERIMENTAL EVALUATION
Since this is the ﬁrst work considering adversarial attacks on node embeddings there are no known baselines.
Similar to works that optimize the graph structure (Chen et al.
we compare with several strong baselines.
B rnd randomly ﬂips edges (we report averages over ten seeds), B eig removes edges based on their eigencentrality in the line graph L ( A ) , and B deg removes edges based on their degree centrality in L ( A ) – or equivalently sum of degrees in the original graph.
When adding edges we use the same baselines as above, now calculated on the complement graph, except for B eig since it is infeasible to compute even for medium size graphs.
A DW 2 denotes our gradient based attack,
A DW 3 our closed-form attack, A link our link prediction attack, A class our node classiﬁcation attack.
The size of the sampled candidate set for adding edges is 20K (for removing edges see Sec. 4.2).
We aim to answer the following questions: (Q1) how good are our approximations of the loss; (Q2) how much damage is caused to the embedding quality by our attacks/baselines; (Q3) can we still perform a successful attack when restricted; (Q4) what characterizes selected (top) adversarial edges;
We set DeepWalk’s hyperparameters to: T = 5 , b = 5 , K = 64 and use a logistic regression for classiﬁcation.
We analyze three datasets: Cora ( N = 2810 , | E | = 15962 , McCallum et al.),
Citeseer ( N = 2110 , | E | = 7336 , Giles et al.), and PolBlogs ( N = 1222 , | E | = 33428 , Adamic & Glance (2005)).
In all experiments, after choosing the top f ﬂips we retrain the embeddings and report the ﬁnal performance since this is a poisoning attack.
Note, for the general attack , the downstream node classiﬁcation task is only a proxy for estimating the quality of the embeddings after the attack, it is not our goal to damage this task, but rather to attack the unsupervised embeddings in general.
4. A PPROXIMATION QUALITY
To estimate the approximation quality we randomly select a subset of 20K candidate ﬂips and compute the correlation between the actual loss and our approximation as measured by Pearson’s R score.
For example, for K = 32 we have R ( L DW 2 , L DW 1 ) = 0 .
11 and R ( L DW 3 , L DW 1 ) = 0 .
90 , clearly showing that our closed-form strategy approximates the loss signiﬁcantly better compared to the gradient-based one.
Similarly, L DW 3 is a better approximation than L DW 2 for K = 16 , 64 , 128 .
[Figure]
4. G ENERAL ATTACK
To obtain a better understanding we investigate the effect of removing and adding edges separately.
Since real graphs are usually sparse, for removing we set the candidate set to be the set of all edges, with one edge set aside for each node to ensure we do not have singleton nodes.
To obtain candidate edges for adding we randomly sample a set of edges.
We then simply select the top f edges from the candidate set according to our scoring function.
For adding edges, we also implemented an alternative add-by-remove strategy denoted as A abr .
Here, we ﬁrst add cf -many edges randomly sampled from the candidate set to the graph and subsequently remove ( c − 1) f -many of them.
This strategy performed better empirically.
Since the graph is undirected, for each ( i, j ) we also ﬂip ( j, i ) .
Fig.
1 answers question (Q2).
Removed/added edges are denoted on the x-axis with negative/positive values respectively.
On Fig.
1a we see that our strategies achieve a signiﬁcantly higher loss compared to the baselines when removing edges.
To analyze the change in the embedding quality we consider the node classiﬁcation task (i.e. using it as a proxy to evaluate quality; this is not our targeted attack).
Interestingly, B deg is the strongest baseline w.r.t.
to the loss, but this is not true for the downstream task.
As shown in Fig.
1b and 1c, our strategies signiﬁcantly outperform the baselines.
As expected,
A DW 3 and A abr perform better than A DW 2 .
On Cora our attack can cause up to around 5% more damage compared to the strongest baseline.
On PolBlogs, by adding only 6% edges we can decrease the classiﬁcation performance by more than 23%, while being more robust to removing edges.
Restricted attacks.
In the real world, attackers cannot attack any node, but rather only speciﬁc nodes under their control, which translates to restricting the candidate set.
To evaluate the restricted scenario, we ﬁrst initialize the candidate sets as before, then we randomly choose a given percentage p r of nodes as restricted and discard every candidate that includes them.
As expected, the results in
Fig.
1d show that for increasingly restrictive sets with p r = 10% , 25% , 50% , our attack is able to do less damage.
However, we always outperform the baselines (not plotted), and even in the case when half of the nodes are restricted ( p r = 50% ) we are still able to damage the embeddings.
With this we are can answer question (Q3) afﬁrmatively – the attacks are successful even when restricted.
Analysis of selected adversarial edges.
In Fig.
2a we analyze the top 1K edges on Cora-ML.
For each edge we consider its source node degree (destination node, resp.) and plot it on the x-axis (yaxis).
The heatmap shows adversarial edge counts divided by total edge counts for each bin.
We see that low, medium and high degree nodes are all represented.
In Fig.
2b we plot the edge centrality distribution for the top 1K adversarial edges and compare it with the distribution of the remaining edges.
There is no clear distinction.
The ﬁndings highlight the need for a principled method such as ours since using intuitive heuristics such as degree/edge centrality cannot identify adversarial edges.
[Figure]
[Figure] [Figure]
4. T ARGETED ATTACK
To obtain a better understanding of the performance we study the margin m ( t ) before and after the attack considering every node t as a potential target.
We allow only ( d t + 3) ﬂips for attacking each node ensuring the degrees stay similar.
Each dot in Fig.
4 represents one node grouped by its degree in the clean graph (logarithmic bins).
We see that low-degree nodes are easier to misclassify ( m ( t ) < 0 ), and that high degree nodes are more robust in general – the baselines have 0% success.
Our method, however, can successfully attack even high degree nodes.
In general, our attack is signiﬁcantly more effective across all bins – as shown by the numbers on top of each box – with 77 . 89% nodes successfully misclassiﬁed on average compared to e.g. only 33 . 64% for B rnd .
For the link prediction task (Fig. 3) we are similarly able to cause signiﬁcant damage – e.g. A link achieves almost 10% decrease in performance by ﬂipping around 12 .
5% of edges on Cora, signiﬁcantly better than all other baselines.
Here again, compared to adding edges, removing has a stronger effect.
Overall, answering (Q5), both experiments conﬁrm that our attacks hinder the downstream tasks.
4. T RANSFERABILITY
The question of transferability – do attacks learned for one model generalize to other models – is important since in practice the attacker might not know the model used by the system under attack.
However, if transferability holds, such knowledge is not required.
To obtain the perturbed graph, we remove the top f adversarial edges with the A DW 3 attack.
The same perturbed graph is then used to learn node embeddings using several other state-of-the-art approaches.
Table 1 shows the change in node classiﬁcation performance compared to the embeddings learned on the clean graph for each method respectively.
We tune the key hyperparameters for each method (e.g. p and q for node2vec).
[Table]
Answering (Q6), the results show that our attack generalizes: the adversarial edges have a noticeable impact on other models as well.
We can damage DeepWalk trained with the skip-gram objective with negative sampling (SGNS) showing that the factorization analysis is successful.
We can even damage the performance of semi-supervised approaches such as GCN and Label Propagation.
Compared to the transferability of the baselines (Sec. 6.3) our attack causes signiﬁcantly more damage.
C ONCLUSION
We demonstrate that node embeddings are vulnerable to adversarial attacks which can be efﬁciently computed and have a signiﬁcant negative effect on node classiﬁcation and link prediction.
Furthermore, successfully poisoning the system is possible with relatively small perturbations and under restriction.
More importantly, our attacks generalize - the adversarial edges are transferable across different models.
Future work includes modeling the knowledge of the attacker, attacking other network representation learning methods, and developing effective defenses against such attacks.
A PPENDIX 6. P ROOFS AND DERIVATIONS
Proof.
Theorem 1.
Applying eigenvalue perturbation theory we obtain that λ (cid:48) p
= λ p + u Tp (∆ ˜ M ) u p where λ (cid:48)
p is the eigenvalue of ˜ M (cid:48) obtained after perturbing a single edge based on A (cid:48) .
Using the fact that λ p = u
Tp ˜
Mu p , and the fact that singular values are equal to the absolute value of the corresponding eigenvalues we obtain the desired result.
Proof.
Theorem 2.
Denote with e i the vector of all zeros and a single one at position i .
Then, we have ∆ A = ∆ w ij ( e i e Tj + e j e Ti ) and ∆ D =
∆ w ij ( e i e Ti + e j e Tj ) .
From eigenvalue perturbation theory Stewart (1990), we get: λ (cid:48)
y
≈ λ y + u Ty (∆ A − λ y ∆ D ) u y .
Substituting ∆ A / ∆ D concludes the proof.
We include an intermediate result which is required for proving Lemma 2 and Lemma 3.
Lemma 4.
λ is an eigenvalue of D − 1 / 2 AD − 1 / 2 :=
A norm with eigenvector ˆ u
=
D 1 / 2 u
if and only if λ and u solve the generalized eigen-problem Au = λDu .
Proof.
Lemma 4.
We have Az =
λDz = ⇒ ( Q − 1 AQ − T )( Q T z ) =
λ ( Q T z ) for any real symmetric A and any positive deﬁnite D , where D =
QQ T using the Cholesky factorization.
Substituting the adjacency/degree matrix and noticing that Q = Q T = D 1 / 2 we obtain the result.
Proof.
Lemma 2.
S is equal to a product of three matrices S
=
D − 1 / 2 (cid:0)
ˆ U (cid:0) (cid:80)
Tr =1 ˆΛ r (cid:1) ˆ U T (cid:1) D − 1 /where
ˆ U ˆΛ
ˆ U T
= D − 1 / 2 AD − 1 / 2 =:
A norm is the eigenvalue decomposition of A norm (Qiu et al.
From Lemma 4 we have the fact that λ is an eigenvalue of D − 1 / 2 AD − 1 / 2 with eigenvector ˆ u
=
D 1 / 2 u
if and only if λ and u solve the generalized eigen-problem Au = λDu .
Substituting ˆΛ = Λ and ˆ U
= D 1 / 2 U in S , and since D is diagonal, we obtain the result.
Proof.
Lemma 3.
Following Qiu et al.
(2017), the singular values of S can be bounded by σ p ( S ) ≤ 1 d min (cid:12)(cid:12) (cid:80)
Tr =1 (ˆ µ π ( p ) )
r (cid:12)(cid:12) where µ are the (standard) eigenvalues of A norm .
Using Lemma 4, the same bound applies using the generalized eigenvalues λ p of A .
Now using Theorem 2, we obtain ˜ λ (cid:48)
p an approximation of the p-th generalized eigenvalue of A (cid:48) .
Plugging it into the singular value bound we obtain: σ p ( S ) ≤
[Equation]
(cid:12)(cid:12) which concludes the proof.
Please note that the permutation π does not need be computed/determined explicitly.
In practice, for every ˜ λ (cid:48) p , we compute the term (cid:12)(cid:12) (cid:80)
Tr =1 (˜ λ (cid:48) p ) r (cid:12)(cid:12) .
Afterwards, these terms are simply sorted.
6. A NALYSIS OF SPECTRAL EMBEDDING METHODS
Attacking spectral embedding.
Finding the spectral embedding is equivalent to the following trace minimization problem:
[Equation]
subject to orthogonality constraints, where L xy is the graph Laplacian.
The solution is obtained via the eigen-decomposition of L , with Z ∗ =
U K where U K are the K -ﬁrst eigen-vectors corresponding to the K -smallest eigenvalues λ i .
The Laplacian is typically deﬁned in three different ways: the unnormalized Laplacian L = D − A , the normalized random walk Laplacian L rw =
D − 1 L = I −
D − 1 A and the normalized symmetric Laplacian L sym =
D − 1 / 2 LD − 1 / 2 =
I − D − 1 / 2 AD − 1 / 2 =
I − A norm , where A, D, A norm are deﬁned as before.
Lemma 5 (Von Luxburg) .
λ is an eigenvalue of L rw with eigenvector u if and only if λ is an eigenvalue of L sym with eigenvector w = D 1 / 2 u .
Furthermore, λ is an eigenvalue of L rw with eigenvector u if and only if λ and u solve the generalized eigen-problem Lu = λDu .
From Lemma 5 we see that we can attack both normalized versions of the graph Laplacian with a single attack strategy since they have the same eigenvalues.
It also helps us to do that efﬁciently similar to our previous analysis (Theorem. 3).
Theorem 4.
Let L rw (or equivalently L sym ) be the initial graph Laplacian before performing a ﬂip and λ y and u y be any eigenvalue and eigenvector of L rw .
The eigenvalue λ (cid:48)
y of L (cid:48) rw obtained after ﬂipping a single edge ( i, j ) is
[Equation]
where u yi is the i -th entry of the vector u y .
Proof.
From Lemma 5 we can estimate the change in L rw (or equivalently L sym ) by estimating the eigenvalues solving the generalized eigen-problem Lu = λDu .
Let ∆ L = L (cid:48) − L be the change in the unnormalized graph Laplacian after performing a single edge ﬂip ( i, j ) and ∆ D be the corresponding change in the degree matrix.
Let e i be deﬁned as before.
Then ∆ L = (1 − 2 A ij )( e i − e j )( e i − e j ) T and ∆ D
=
(1 − 2 A ij )
( e i e Ti
+ e j e Tj ) .
Based on the theory of eigenvalue perturbation we have λ (cid:48)
y
≈ λ y + u Ty (∆ L − λ y ∆ D ) u y .
Substituting ∆ L and ∆ D are re-arranging we get the above results.
Using now Theorem 4 and Eq.
5 we ﬁnally estimate the loss of the spectral embedding after ﬂipping an edge L SC ( L (cid:48)
rw , Z )
≈ (cid:80)
Kp =1 λ (cid:48) p .
Note that here we are summing over the K -ﬁrst smallest eigenvalues.
We see that spectral embedding and the random walk based approaches are indeed very similar.
We provide similar analysis for the the unnormalized Laplacian:
Theorem 5.
Let L be the initial unnormalized graph Laplacian before performing a ﬂip and λ y and u y be any eigenvalue and eigenvector of L .
The eigenvalue λ (cid:48)
y of L (cid:48) obtained after ﬂipping a single edge ( i, j ) can be approximated by:
[Equation]
Proof.
Let ∆ A =
A (cid:48) − A be the change in the adjacency matrix after performing a single edge ﬂip ( i, j ) and ∆ D be the corresponding change in the degree matrix.
Let e i be deﬁned as before.
Then ∆ L [Equation]
ij )( e i e Ti
+ e j e Tj − ( e i e Tj
+ e j e Ti )) .
Based on the theory of eigenvalue perturbation we have λ (cid:48)
y
≈ λ y + u Ty (∆ L ) u y .
Substituting ∆ L and re-arranging we get the above results.
[Figure]
6. F URTHER EXPERIMENTAL EVIDENCE
Upper bound on singular values.
From Lemma 3 we have that L DW 3 is an upper bound on
L DW 1 (excluding the elementwise logarithm) so maximizing L DW 3 is principled.
To gain a better understanding of the tightness of the bound we visualize the singular values of S and their respective upper-bound for all datasets.
As we can see in Fig.
5, the gap is different for different datasets and relatively small.
Furthermore we can notice that the gap tends to increase for larger singular values.
Transferability of the baselines.
To further support the transferability of our proposed attack we also examine the transferability of the baseline attacks.
Speciﬁcally, we examine the transferability of B eig since it is the strongest baseline when removing edges as shown in Fig.
1b.
We use the same experimental setup as in Sec. 4.4 and show the results in Table 2.
We can see that compared to our proposed attack the baseline can do a signiﬁcantly smaller amount of damage (compare to results in
Table 1).
Interestingly, it can do signiﬁcant damage to GCN when removing 250 edges on Cora, but not when removing 500 edges.
We plan on exploring this counterintuitive ﬁnding in future work.
[Table]