A TTACKING
G RAPH
C ONVOLUTIONAL
N ETWORKS
VIA R EWIRING
Anonymous authors
Paper under double-blind review
A BSTRACT
Graph Neural Networks (GNNs) have boosted the performance of many graph related tasks such as node classiﬁcation and graph classiﬁcation.
Recent researches show that graph neural networks are vulnerable to adversarial attacks, which deliberately add carefully created unnoticeable perturbation to the graph structure.
The perturbation is usually created by adding/deleting a few edges, which might be noticeable even when the number of edges modiﬁed is small.
In this paper, we propose a graph rewiring operation which affects the graph in a less noticeable way compared to existing operators.
We then use reinforcement learning to learn the attack strategy based on the proposed rewiring operation.
Experiments on real world graphs demonstrate the effectiveness of the proposed framework.
To understand the proposed framework, we further analyze how its generated perturbation to the graph structure affects the output of the target model and the advantages of the rewiring operation
I NTRODUCTION
Graph structured data are ubiquitous in many real world applications.
Various data from different domains, such as social networks, molecular graphs and transportation networks can all be modeled as graphs.
Recently, increasing effort has been devoted towards developing deep neural networks on graph structured data.
This stream of works, which is known as Graph Neural Networks (GNN) has shown to enhance the performance in many graph related tasks such as node classiﬁcation (Kipf &
Welling, 2016; Hamilton et al., 2017) and graph classiﬁcation (Bruna et al., 2013; Defferrard et al., 2016;
Ying et al., 2018; Zhang et al., 2018).
Recent researches have shown that deep neural networks are highly vulnerable to adversarial attacks (Szegedy et al., 2013; Goodfellow et al., 2014; Kurakin et al., 2016; Carlini & Wagner, 2017).
In computer vision, performing an adversarial attack is to add deliberately created, but unnoticeable, perturbation to a given image such that the deep model misclassiﬁes the perturbed image.
Unlike image data, which can be represented in the continuous space, graph structured data is discrete.
Few efforts have been made to investigate the robustness of graph neural networks against adversarial attacks.
Only recently, such researches about adversarial attacks on graph structured data started to emerge.
A greedy algorithm is proposed to attack the semi-supervised node classiﬁcation task (Z¨ugner et al., 2018).
The method deliberately tries to modify the graph structure and node features such that the label of a targeted node can be changed.
A reinforcement learning based algorithm is proposed to attack both node classiﬁcation and graph classiﬁcation task by only modifying the graph structure(Dai et al., 2018).
A meta-learning based attack method is designed to impair the overall performance of the node classiﬁcation task(Z¨ugner & G¨unnemann, 2019).
For the majority of existing works, the graph structure is modiﬁed by adding or deleting edges.
To ensure that the difference between the attacked graph and the original graph is “unnoticeable”, the number of actions (adding/deleting edges) that can be taken by the attacking algorithms is usually constrained by a budget.
However, even when this budget is small, adding or deleting edges can still make “noticeable” changes to the graph structure (Miller et al., 2019).
For example, it is evident that many important graph properties are based on eigenvalues and eigenvectors of the Laplacian matrix of the graph (Chan & Akoglu, 2016); while adding or deleting an edge can make remarkable changes on the eigenvalues/eigenvectors of the graph Laplacian (Ghosh & Boyd, 2006).
Thus, in this work, we propose a new operation based on graph rewiring.
A single rewiring operation involves three nodes ( v fir , v sec , v thi ) , where we remove the existing edge between v fir and v sec and add edge between v fir and v thi .
Note that v thi is constraint to be the 2-hop neighbor of v fir in our setting.
It is obvious that the proposed rewiring operation preserves some basic properties of the graph such as number of nodes and edges, total degrees of the graph and etc, while operations like adding and deleting edges cannot.
Furthermore, the proposed rewiring operation affects some of the important measures based on graph Laplacian such as algebraic connectivity in a smaller way than adding/deleting edges, which is theoretically demonstrated in Section 4.1.
In addition, the rewiring operation is a more natural way to modify the graph.
For example, in biology, the evolution of DNA and amino acid sequences can lead to pervasive rewiring of protein–protein interactions (Zitnik et al., 2019).
In this paper, we aim to construct adversarial examples by performing rewiring operations for the task of graph classiﬁcation.
More speciﬁcally, we treat the process of applying a series of rewiring operations to a given graph as a discrete Markov decision process (MDP) and use reinforcement learning to learn how to make these decisions.
We demonstrate the effectiveness of the proposed algorithm on real-world graphs.
Then we further analyze how the adversarial changes in the graph structure affect both the graph embedding learned by the graph neural network model and the output label and illustrate the advantages of the rewiring operation.
B ACKGROUND
In this section, we introduce notations and the target graph convolutional model we seek to attack.
We denote a graph as G =
{V , E} ,
where V = { v 1 , . . .
, v |V| } and E = { e 1 , . . .
, e |E| } are the sets of nodes and edges, respectively.
The edges describe the relations between nodes, which can be described by an adjacency matrix A ∈ { 0 , 1 } |V|×|V| .
A ij = 1 means v i and v j are connected,otherwise.
Each node in the graph has some features that are associated with it.
These features are represented as a matrix X ∈ R |V|× d , where the i -th row of X denotes the node features of node v i and d is the dimension of features.
Thus, an attributed graph can be represented as G =
{ A , X } .
2. G RAPH C LASSIFICATION
In the setting of graph classiﬁcation, we are given a set of graphs G = { G i } .
Each of these graphs
G i is associated with a label y
i .
The task is to build a good classiﬁer using the given set of graphs such that it can make correct predictions when new unseen graphs are fed into it.
A graph classiﬁer parameterized by θ can be represented as f ( G | θ )
=
y o , where y o denotes the label of a graph
G ∈ G predicted by the classiﬁer.
The parameters θ in the classiﬁer f ( ·| θ ) can be learned by solving the following optimization problem min θ (cid:80)
i L ( f ( G i | θ ) , y i ) , where L ( · , · ) is used to measure the difference between the predicted and ground truth labels.
Cross entropy is a commonly adopted measurement for L ( · , · ) .
2. G RAPH C ONVOLUTION N ETWORKS
Recently, Graph Neural Networks have been shown to be effective in graph representation learning.
These models usually learn node representations by iteratively aggregating, transforming and propagating node information.
In this work, we adopt the graph convolutional networks (GCN) (Kipf &
Welling, 2016).
A graph convolutional layer in the GCN framework can be represented as
[Equation]
where F j ∈ R N ×
d j is the output of the j -th layer and W j represents the parameters of this layer.
A GCN model usually consists of J graph convolutional layers, with F 0 =
X .
The output of the
GCN model is F J , which is denote as F for convenience.
To obtain a graph level embedding u G for graph G to perform graph classiﬁcation, we apply a global pooling over the node embeddings.
[Equation]
Different global pooling functions can be used, and we adopt the max pooling in this work.
A multilayer perceptron (MLP) and softmax layer are then sequentially applied on the graph embedding to predict the label of the graph
[Equation]
where MLP ( ·| W MLP ) denotes the multilayer perceptron with parameters as W MLP .
A GCNbased classiﬁer for graph classiﬁcation can be described using eq.
equation 1, equation 2 and equation 3 as introduced above.
For simplicity, we summarize it as y o =
f GCN ( G | θ GCN ) , where θ GCN includes all the parameters in the model.
P ROBLEM F ORMULATION
In this work, we aim to build an attacker T that takes a graph as input and modify the structure of the graph to fool a GCN classiﬁer.
Modifying a graph structure is equivalent to modify its adjacency matrix.
The function of the attacker can be represented as ˜ G = T ( G ) =
{T ( A ) , X } = { ˜ A , X } .
Given a classiﬁer f ( · ) , the goal of the attacker is to modify the graph structure so that the classiﬁer outputs a different label from what it originally predicted.
Note here, we neglect the θ inside f ( · ) , as the classiﬁer is already trained and ﬁxed.
Mathematically, the goal of the attacker can be represented as: f ( T ( G )) (cid:54) =
f ( G ) .
As described above, the attacker T is speciﬁcally designed for a given classiﬁer f ( · ) .
To reﬂect this in the notation, we now denote the attacker for the classiﬁer f ( · ) as T f .
In our work, the attacker T f has limited knowledge of the classiﬁer.
The only information the attacker can get from the classiﬁer is the label of (modiﬁed) graphs.
In other words, the classiﬁer f ( · ) is treated as a black-box model for the attacker T f .
An important constraint to the attacker T f is that it is only allowed to make “unnoticeble” changes to the graph structure.
To account for this, we propose the rewiring operation, which is supposed to make more subtle changes than adding or deleting edges.
We will show that the rewiring operation can better preserve a lot of important properties of the graph compared to adding or deleting edges in Section 4.1.
We also empirically compare the rewiring operation with the deleting/adding edges in Appendix C. The deﬁnition of the proposed rewiring is given below:
Deﬁnition 1.
A rewiring operation a involves three nodes and it can be denoted as a = { v fir , v sec , v thi } , where v sec ∈ N 1 ( v fir ) and v thi ∈ N 2 ( v fir ) /N
1 ( v fir ) .
N k
( v fir ) denotes the k -th hop neighbors of v fir and the sign / stands for exclusion.
The rewiring operation deletes the existing edge between nodes v fir and v sec , while adding an edge to connect nodes v fir and v thi .
The attacker T f is given a budget of K proposed rewiring operations to modify the graph structure.
A straightforward way to set K is choosing a small ﬁx number.
However, it is likely that graphs in a given data set have various graph sizes.
The same number of rewiring operations can affect the graphs of different size in various magnitude.
Hence, a more suitable way is to allow ﬂexible number of rewiring operations according to the graph size.
Thus, we propose to use K = p · |E| for a given graph G , where p ∈ (0 , 1) is a ratio.
The process of the attacker on a graph G can be now denoted as T f ( G ) ↔ ( a 1 , a 2 , . .
. , a M )[ G ] , where the right hand part means to sequentially apply the rewiring operations a 1 , . .
. , a M to the graph G , and M is the number of rewiring operations taken with M ≤ K .
R EWIRING - BASED A TTACK TO G RAPH C ONVOLUTIONAL N ETWORKS
Next, we ﬁrst discuss the properties of the proposed rewiring operation to show its advantages.
We then introduce the proposed attacking framework ReWatt based on reinforcement learning and rewiring.
4. P ROPERTIES OF THE P ROPOSED R EWIRING O PERATION
The proposed rewiring operation has several advantages compared to simply adding or deleting edges.
More empirical discussions can be found in Appendix C. One obvious advantage of the proposed rewiring operation is that it does not change the number of nodes, the number of edges and the total degree of a graph.
However, operations like “adding” or “deleting” edges may change those properties.
Many important graph properties are based on the eigenvalues of the Laplacian matrix of a graph (Chan & Akoglu, 2016) such as Algebraic Connectivity Fiedler (1973) and Effective Graph
Resistance Ellens et al.
A detailed description of Algebraic Connectivity and Effective
Graph Resistance are given in Appendix A. Next, we demonstrate that the proposed rewiring operation is likely to make smaller changes to eigenvalues, which result in unnoticeable changes under graph Laplacian based measures.
For a graph G with A as its adjacency matrix, its Laplacian matrix L is deﬁned as L = D − A , where D is the diagonal degree matrix (Mohar et al., 1991).
Let λ 1 , . . .
, λ |V| denote the eigenvalues of the Laplacian matrix arranged in the increasing order with x 1 , . . .
, x |V| being the corresponding eigenvectors.
We show how a single proposed rewiring operation affects the eigenvalues.
Our analysis is based on the following lemma:
Lemma 1.
(Stewart, 1990) Let ( α i , h i ) be the eigen-pairs of a symmetric matrix M ∈ R N × N .
Given a perturbation ∆ M to matrix M , its eigenvalues can be updated by ∆ α i = h
Ti ∆ Mh i .
The proof can be found in (Stewart, 1990).
Using this lemma, we have the following corollary
Corollary 1.
For a given graph G with Laplacian matrix L , one proposed rewiring operation ( v fir , v sec , v thi ) affects the eigen-value λ i by ∆ λ i , for i = 1 , . .
, |V| , where
[Equation]
where x i [ index ] denotes the index -th value of the eigenvector x i .
The proof can be found in Appendix B.
Furthermore, each eigenvalue λ i of the Laplacian matrix measures the “smoothness” of its corresponding eigenvector x i (Shuman et al., 2012; Sandryhaila & Moura, 2014).
The “smoothness” of an eigenvector measures how different its elements are from their neighboring nodes.
Thus, the ﬁrst few eigenvectors with relatively small eigenvalues are rather “smooth”.
Note that in the proposed rewiring operation, v sec is the direct neighbor of v fir and v thi is the 2 -hop neighbor of v fir .
Thus, the difference x i [ fir ] − x i [ thi ] is expected to be smaller than the difference x i [ fir ] − x i [ can ] , where x i [ can ] can be any other node that is further away.
This means that the proposed rewiring operation (to 2 -hop neighbors) is likely to make smaller changes to the ﬁrst few eigenvalues than rewiring to any further away nodes or adding an edge between two nodes that are far away from each other.
4. G RAPH A DVERSARIAL A TTACK WITH R EINFORCEMENT L EARNING
Given a graph G , the process of the attacker T is a general decision making process M = ( S , A , P, R ) , where A = { a t } is the set of actions, which consists of all valid rewiring operations, S = { s t } is the set of states that consists of all possible intermediate and ﬁnal graphs after rewiring, P is the transition dynamics that describes how a rewiring action a t changes the graph structure p ( s t +1 | , s t , . . .
, s 1 , a t ) .
R is the reward function, which gives the reward for the action taken at a given state.
Thus, the procedure of attacking a graph can be described by a trajectory ( s 1 , a 1 , r 1 , . . .
, s M , a M , r M ) , where s 1 = G .
The key point for the attacker is to learn how to make the decision of picking a suitable rewiring action when at the state s t .
This can be done by learning a policy network to get the probability p ( a t
| s t , . . .
, s 1 ) and sample the rewiring operation correspondingly.
Modelling in this way, the decision making at a state s t is dependant on all its previous states, which could be difﬁcult to model due to the long-term dependency.
It is easy to notice that the intermediate states s t are all predicted to have the same label as the original graph.
Thus, we can treat each of the states as a brand new graph to be attacked regardless of what leads to it.
That is to say, the decision making at the state s t can be solely dependant on the current state, p ( a t
| s t , . . .
, s 1 )
= p ( a t | s t ) .
Thus, we model the process of attack as a Markov Decision Process (MDP) Sutton & Barto (2018).
Hence, we adopt reinforcement learning to learn how to make effective decisions.
We name the proposed framework as ReWatt.
The key elements of the environment for the reinforcement learning are deﬁned as follows:
State Space
The state space of the environment consists of all the intermediate graphs generated after the possible rewiring operations.
Action Space
The action space consists of the valid rewiring operations as deﬁned in Deﬁnition 1.
State Transition Dynamics Given an action (rewiring operation) a t
= { v fir , v sec , v thi } at state s t .
The next state s t +1 is achieved by deleting the edge between v fir and v sec in the current state s t and adding an edge to connect v fir with v thi .
Reward Design The main goal of the attacker is to make the classiﬁer f ( · ) predict a different label than originally predicted.
We also encourage the attacker to take as few actions as possible so that the modiﬁcation to the graph structure is minimal.
Thus, we assign a positive reward when the attack is successful and assign a negative reward for each action step taken.
The reward R ( s t , a t ) is given as
[Equation]
where n r is the negative reward to penalize each step taken.
Similar to how we set a ﬂexible rewiring budget K , here we propose to use n r = − 1 K = − 1 p ·|E| , which depends on the size of the graph.
Termination The attack process will stop either when the number of actions reaches the budget K or the attacker successfully “changed” the label of the slightly modiﬁed graph.
4. P OLICY N ETWORK
In this subsection, we introduce the policy network to learn the policy p ( a t | s t ) on top of the graph representations learned by GCN.
However, this GCN is different from the target classiﬁer one, since it has 2 convectional layers.
To choose a valid proposed rewiring action, we decompose the rewiring action to 3 steps: 1) choosing an edge e t = ( v e 1 , v e 2 ) from the set of edges of the intermediate graph s t ; 2) determining v e t 1 or v e t 2 to be v fir t and the other to be v sec t ; and 3) choosing the third node v thi t from N 2 s t ( v fir t ) /N
1 s t ( v fir t ) .
Correspondingly, we decompose p ( a t | s t ) as follows
[Equation]
We design three policy networks based on GCN to estimate the three distributions in the right hand of the equation equation 5, which will be introduced next.
To select an edge from the edge set E s t , we generate the edge representation from the node representations F s t ∈ R |V st |× d F learned by GCN.
For an edge e = ( v e 1 , v e 2 ) , the edge representation can be represented as e = concat ( u s t , h ( F s t [ e 1 , :] , F s t [ e 2 , :])) , where u s t is the graph representation of the state s t , h ( · , · ) is a function to combine the two node representations and concat ( · , · ) denotes the concatenation operation.
We include u st in the representation of the edge to incorporate the graph information when making the decision.
The representation of all the edges in E s t can be represented as a matrix
E s t ∈ R |E st |× 2 d F , where each row represents an edge.
The probability distribution over all the edges can be represented as
[Equation]
where we use MLP ( ·| θ edge ) to denote a Multilayer Perceptron that maps E s t ∈ R |E st |× 2 d F to a vector in R |E st | , which, after going through the softmax layer, represents the probability of choosing each edge.
Let e t = ( v e t 1 , v e t 2 ) denote the edge sampled according to eq.
equation 6.
To decide which node is going to be the ﬁrst node, we estimate the probability distribution over these two nodes as
[Equation]
where v e ti = concat ( e t , F s t [ e ti , :])
∈ R 3 d F for i = 1 , 2 .
The ﬁrst node can be sampled from the two nodes v e t 1 , v e t 2 according to eq.
equation 7.
We then proceed to estimate the probability distribution p ( ·| v fir t , e t , s t ) .
For any node v c ∈ N 2 ( v fir t ) /N
1 ( v fir t ) , we use ˆ v c = concat ( v e t 1 , F s t [ c, :]) to represent it.
The representations for all the nodes in N 2 ( v fir t ) /N
1 ( v fir t ) can be represented by a matrix
ˆ V s t ∈ R | N 2 ( v firt ) /N
1 ( v firt ) |× 4 d F with each row representing a node.
The probability distribution of choosing the third node over all the candidate nodes can be modeled as:
[Equation]
The third node v thi t can be sampled from the set of candidate nodes N 2 ( v fir t )
[Equation]
N 1 ( v fir t ) according to the probability distribution in eq equation 8.
An action a t can be generated by sequentially estimating and sampling from the probability distributions in eq.
equation 6, equation 7 and equation 8.
4. P ROPOSED F RAMEWORK - R E W ATT
With the rewiring and the policy network deﬁned above, our overall framework can be summarized as follows.
With State s t , the Attacker uses GCN to learn node and edge embeddings, which are used as input to Policy Networks to make decision about the next action.
Once the new action is sampled from the policy network, rewiring is performed on s t and we arrive in the new state s t +1 .
We query the black-box classiﬁer to get the prediction f
( S t +1 ) , which is compared with f ( s 1 ) to get reward.
Policy gradient (Sutton & Barto, 2018) is adopted to learn the policies by maximizing the rewards.
E XPERIMENT
In this section, we conduct experiments to evaluate the performance of the proposed framework
ReWatt.
We also carry out a study to analyze how the trained attacker works.
Some empirical investigation on the advancements of the rewiring operation can be found in Appendix C.
5. A TTACK P ERFORMANCE
To demonstrate the effectiveness of ReWatt, we conduct experiments on three widely used social network data sets (Kersting et al., 2016) for graph classiﬁcation, i.e., REDDIT-MULTI-12K, REDDITMULTI-5K and IMDB-MULTI (Yanardag & Vishwanathan, 2015).
The statistics can be found in
Appendix D. Note that the re-wiring operation (as well as the other operations) may lead to abnormal structure of some kinds of graphs, which can make the graphs invalid, especially for chemical molecules.
So in this paper, We avoid chemical related datasets but only use social networks datasets.
In the social domain, if the changes are subtle, it is most likely that we will not we will not introduce abnormal structures.
Meanwhile, it is straightforward to extend our framework to datsets from the other domains if we have expertise in them.
For example, if we know what structures are abnormal, we can use such knowledge to constraint the the state space of the RL framework.
We leave it as one future work.
In this work, the classiﬁer we target to attack is the GCN-based classiﬁer as introduced in Section 2.
We set the number of layers to 3 .
We need to train the classiﬁer using a fraction of the data and then treat the classiﬁer as a black box to be attacked.
We then use part of the remaining data to train the attacker and use the rest of the data to test the performance of the attacker.
Thus, for each data set, we split it into three parts with the ratio of a % : b % : c % , where a % of the data set is used to train the classiﬁer, b % of the data set is used to train the attacker and the remaining c % of the data set is used to test the performance of the attacker.
For the REDDIT-MULTI-12K and REDDIT-MULTI5K data sets, we set a = 90 , b = 8 and c = 2 .
As the size of the IMDB-MULTI data set is quite small, to have enough data for testing, we set a = 50 , b = 30 and c = 20 .
We compare the attacking performance of the proposed framework with the RL-S2V proposed in (Dai et al., 2018), random selection method and some variants of our proposed framework.
We brieﬂy describe these baselines: 1) RL-S2V is a reinforcement learning based attack framework (Dai et al., 2018), which allows adding and deleting edges to the graph with a ﬁxed budget for all the graphs; 2) Random denotes an attacker that performs the proposed rewiring operations randomly; 3) Random-s is also based on random rewiring.
Note that ReWatt can terminate before using all the budget.
We record the actual number of rewiring actions made in our method and only allow the
Random-s to take exactly the same number of rewiring actions as ReWatt; 4) ReWatt-n denotes a variant of the ReWatt, where the negative reward is ﬁxed to − 0 .
5 for all the graphs in the testing set; and 5) ReWatt-a is a variant of ReWatt, where we allow any nodes in the graph to be the third node v thi t instead of only 2 -hop neighbors.
As RL-S2V only allows a ﬁxed budget for the all the graphs, when comparing to it, for ReWatt, we also ﬁx the number of proposed rewiring operations to a ﬁxed number K for all the graphs.
Note that a single proposed rewiring operation involves two edges, thus, for a fair comparison, we allow the RL-S2V to take 2 K actions (adding/deleting edges).
We set K = 1 , 2 , 3 in the experiments.
To compare with the random selection method and the variants of ReWatt, we use ﬂexible budget, more specially, we allow at most p · |E i | proposed rewiring operations for graph G i .
Here, p is a ﬁxed percentage and we set it to p = 1% , 2% , 3% in our experiments.
We use the success rate as measure to evaluate the performance of the attacker.
A graph is said to be successfully attacked if its label is changed when it is modiﬁed within the given budget.
The results are shown in Table 1.
From the table, we can make the following observations: 1)
Compared to RL-S2V, ReWatt can perform more effective attacks.
Especially, in the IMDB-MULTI
[Table]
data set, where ReWatt outperforms the RL-S2V with a large margin; 2) ReWatt outperforms the
Random method as expected.
Especially, ReWatt is much more effective than Random-s which performs exactly the same number of proposed rewiring operations ReWatt.
This also indicates that the Random method uses more rewiring operations for successful attacking than ReWatt; 3)
The variant ReWatt-a outperforms ReWatt, which means if we do not constraint the rewiring operation to 2-hop neighbors, the performance of ReWatt can be further improved.
However, as we discussed in earlier sections, this may lead to more “noticeable” changes of the graph structure; and 4) ReWattn performs worse than our ReWatt, which shows the advancement of using a ﬂexible reward design.
5. A TTACKER A NALYSIS
In this subsection, we carry out experiments to analyze how ReWatt’s change in graph structure affects the graph representation u calculated by eq.
equation 2 and the logits P (the output immediately after the softmax layer of the classiﬁer).
For convenience, we denote the original graph as G o and the attacked graph as G a in this section.
Correspondingly, the graph representation and logits for the original (attacked) graph are denoted as u o ( u a ) and P o
( P a ), respectively.
To measure the difference in graph representation, we used the relative difference in terms of 2 -norm deﬁned as
RC ( u
[Equation]
, u
[Equation]
) =
[Equation]
o (cid:107) 2 .
The logits denote the probability distribution that the given graph belongs to each of the classes.
Thus, we use the KL-divergence Kullback (1997) to measure the difference between the logits of the original and attacked graphs KL ( P o , P
[Equation]
) =
[Equation]
(cid:80)
[Equation] [Equation]
] (cid:17) , where C is the number of classes in the data set and P [ i ] denotes the logit for the i -th class.
We perform the experiments on the REDDIT-MULTI-12K data set under the setting of allowing at most 3% · |E| proposed rewiring operations.
The results for the graph representation and logits are shown in Figure 1 and Figure 2, respectively.
The graphs in the testing set are separated in two groups, one group contains all the graphs successfully attacked by ReWatt (shown in Figure 1a and
Figure 2a), and the other one contains those survived from ReWatt’s attack (shown in Figure 1b and
Figure 2b).
Note that, for comparison, we also include the results of Random-s on these two groups of graphs.
In these ﬁgures, a single point represents a testing graph, the x-axis is the ratio M |E| , where
M is the number of rewiring operations ReWatt used before the attacking process terminating.
Note that M can be smaller than the budget as the process terminates once the attack successes.
As we can observe from the ﬁgures, compared with the Random-s, ReWatt can make more changes to both the graph representation and logits, using exactly the same number of proposed rewiring operations.
Comparing Figure 1a with Figure 1b, we ﬁnd that the perturbation generated by ReWatt affects the graph representation a lot even when it fails to attack the graph.
This means our attack is perturbing the graph structure in a right way to fool the classiﬁer, although it fails potentially due to the limited budget.
Similar observation can be made when we compare Figure 2a with Figure 2b.
R ELATED W ORK
In recent years, adversarial attacks on deep learning models have attracted increasing attention in the area of computer vision.
Many deep models are found to be easily fooled by adversarial samples, which are generated by adding deliberately designed unnoticeable perturbation to normal im-
[Figure] [Figure]
ages (Szegedy et al., 2013; Goodfellow et al., 2014).
More algorithms with different level access to the target classiﬁer have been proposed, including white-box attack models, which have access to the gradients (Moosavi-Dezfooli et al., 2016; Kurakin et al., 2016; Carlini & Wagner, 2017) and black-box attack model, which have limited access to the target classiﬁer (Chen et al., 2017; Cheng et al., 2018; Ilyas et al., 2018).
Most of the aforementioned works are focusing in the computer vision domain, where the data sample can be represented in the continues space.
Few attention has been payed into the discrete data structure such as graphs.
Graph Neural Networks have been shown to bring impressive advancements to many different graph related tasks such as node classiﬁcation and graph classiﬁcation.
Recent researches show that the graph neural networks are also venerable to adversarial attacks.
(Z ¨ ugner et al., 2018) proposed a greedy algorithm to perform adversarial attack to node classiﬁcation task.
Their algorithm tries to change the label of a target node by modifying both the graph structure and node features.
(Dai et al., 2018) proposed a deep reinforcement learning based attacker to attack both the node classiﬁcation and the graph classiﬁcation task.
(Z¨ugner & G¨unnemann, 2019) designed an algorithm to impair the overall performance of node classiﬁcation based on meta learning.
All the three mentioned methods modify the graph structure by adding or deleting edges.
A more recent work Wang et al.
(2018) on attacking node classiﬁcations proposed to modify the graph structure by adding fake nodes.
In this work, we propose to modify the graph structure using rewiring, which is shown to make less noticeable changes to the graph structure.
C ONCLUSION
In this paper, we proposed a graph rewiring operation, which affect the graph structure in a less noticeable way than adding/deleting edges.
The rewiring operation preserves some basic graph properties such as number of nodes and number of edges.
We then designed an attacker ReWatt based on the rewiring operations using reinforcement learning.
Experiments in 3 real world data sets show the effectiveness of the proposed framework.
Analysis on how the graph representation and logits change while the graph being attacked provide us with some insights of the attacker.
A G RAPH L APLACIAN B ASED M EASURES
Many important graph properties are based on the eigenvalues of the Laplacian matrix of a graph (Chan & Akoglu, 2016).
Here we list few:
• Algebraic Connectivity
The algebraic connectivity of a graph G is the second-smallest eigenvalue of its Laplacian matrix (Fiedler, 1973).
Note that we only consider connected graphs in this work, so it is always larger than 0 .
The larger the algebraic connectivity is, the more difﬁcult it is to separate the graph into components (i.e., more edges need to be removed).
The algebraic connectivity has previously been applied to measure network robustness Sydney et al.
• Effective Graph Resistance
The effective graph resistance is a graph measure derived from the ﬁeld of electric circuit analysis, where it is deﬁned as the summation of effective resistance over all node pairs (Ellens et al., 2011).
The effective graph resistance can be represented using the eigenvalues of Laplacian matrix as follows (Ellens et al., 2011)
[Equation]
By Corollary 2, we can represent the change of the algebraic connectivity λ 2 as:
[Equation]
According to the above discussion, ∆ λ 2 is expected to be smaller for the operation of rewiring to 2 -hop neighbor.
Thus, the rewiring to 2 -hop neighbor operation is expected to perturb the algebraic connectivity less compared with adding an edge between two nodes that are far away from each other.
A similar argument can be built for effective graph resistance.
B P ROOF OF C OLLARY
Corollary 2.
For a given graph G with Laplacian matrix L , one proposed rewiring operation ( v fir , v sec , v thi ) affects the eigen-value λ i by ∆ λ i , for i = 1 , . .
, |V| , where
[Equation]
where x i [ index ] denotes the index -th value of the eigenvector x i .
Proof.
Let ∆ L denotes the change in the Laplacian matrix after applying the rewiring operation ( v fir , v sec , v thi ) to graph G .
Then we have ∆ L [ fir, sec ] =
∆ L [ sec, fir ] = 1 , ∆ L [ fir, thi ] =
∆ L [ thi, fir ] = − 1 , ∆ L [ sec, sec ] = − 1 , ∆ L [ thi, thi ] = 1 and 0 elsewhere.
Thus
[Equation]
sec ])
( x i [ sec ] − x i [ thi ]) which completes the proof.
C E MPIRICAL I NVESTIGATION OF THE R EWIRING O PERATION
In this section, we conduct experiments to empirically show the advancements of the proposed rewiring operator compared with the adding/deleting edge operator.
We compare them from two perspectives: 1) connectivity after the attack and 2) change in eigenvalues after the attack.
The experiments are carried out on the REDDIT-MULTI-12K dataset.
On each of the graph successfully attacked by ReWatt, we perform exactly the same number of deleting/adding edge operator on it.
For connectivity, the average number of components in the clean graphs is 2 . 6 , this number becomes 3 .
02 after the rewiring attack while it becomes 5 .
2 after the deleting/adding edges attack.
On the other hand, only 20% of the graphs get more disconnected (having more components) after ReWattattack than the original ones, while 87% of the graphs get more disconnected after the adding/deleting edges attack.
Clearly, the rewiring operator is less likely to disconnect the graph.
The comparison of the change in eigenvalues is shown in Figure 3, where we compare the change in different eigenvalues of the graphs after these two attacks.
Speciﬁcally, we ﬁrst compute the average relative change in the i -th eigenvalue after both attacks as follows:
[Equation]
where λ orii denotes the i -th eigenvalue of the clean graph while λ attacki denotes the i -th eigenvalue of the attacked graph.
We then take the average of the above value over all the succeeded graphs, which we denoted as ¯ r λ i .
Specially, we use ¯ r reλ i to denote the average change ratio after ReWatt while using ¯ r d/a λ i to denote the average change ratio after deleting/adding edge attack.
To compare the these two attacks, we calculate ¯ r d/aλ i / ¯ r reλ i and the results are shown in Figure 3.
The results show that in most of the cases, the deleting/adding edges attack makes much more changes to the eigenvalues as the value ¯ r d/aλ i / ¯ r reλ
i is way larger than 1 .
By conducting these two experiments, we empirically conclude that the proposed re-wiring operator makes more subtle changes to graphs than existing methods.
[Figure]
D S TATISTICS OF THE D ATASETS
The statistics of the datasets are given in Table 2.
In this table, #nodes denotes the average number of nodes over all graphs and #edges denotes the average number of edges over all graphs. ACC denotes the mean of Average Clustering Coefﬁcient (ACC) over all graphs. GCC denotes the mean of Global Clustering Coefﬁcient (GCC) over all graphs.
[Table]