A DVERSARIAL W EIGHT P ERTURBATION I MPROVES G ENERALIZATION IN G RAPH N EURAL N ETWORKS
Anonymous authors
Paper under double-blind review
A BSTRACT
A lot of theoretical and empirical evidence shows that the ﬂatter local minima tend to improve generalization.
As an emerging technique to efﬁciently and effectively ﬁnd such minima, Adversarial Weight Perturbation (AWP) minimizes the loss w.r.t.
a bounded worst-case perturbation of the model parameters by (approximately) solving an associated min-max problem, i.e. favoring local minima with a small loss in a neighborhood around them.
The beneﬁts of AWP, and more generally the connections between ﬂatness and generalization, have been extensively studied for i.i d. data such as images.
In this paper, we initiate the ﬁrst study of this phenomenon for non-i.i d. graph data.
Along the way, we ﬁrst derive a generalization bound for non-i i d. graph classiﬁcation tasks, then we identify a vanishinggradient issue with all existing formulations of AWP and we propose new
Weighted Truncated AWP (WT-AWP) to alleviate this issue.
We show that regularizing graph neural networks with WT-AWP consistently improves both natural and robust generalization across many different graph learning tasks and models.
I NTRODUCTION
Simply minimizing the standard cross-entropy loss for highly non-convex and non-linear models such as (deep) neural networks is not guaranteed to obtain solutions that generalize well, especially for today’s overparamatrized networks.
The key underlying issue is that these models have many different local minima which can have wildly different generalization properties despite having nearly the same performance on training and validation data.
Naturally, there is a rich literature that studies the properties of well-behaving local minima, as well as the design choices that improve our chances of ﬁnding them (Stutz et al., 2021).
The notion of ﬂatness which measure how quickly the loss changes in a neighbourhood around a given local minimum has been empirically shown to correlate with generalization among a variety of different measures (Jiang et al., 2019).
In addition, generalization bounds based on the PAC-Bayes framework (McAllester, 1999; Foret et al., 2021) provide theoretical insights that corroborate the mounting empirical data.
Since the evidence implies that ﬂatter minima tend to generalize better, the obvious question is how to efﬁciently ﬁnd them.
Not only do ﬂat minima improve generalization from the training to the test data, i.e. the clean accuracy (Foret et al., 2021; Zheng et al., 2021; Kwon et al., 2021), but they also improve generalization to adversarial examples, i.e. the robust accuracy (Wu et al., 2020a; Stutz et al., 2021).
Improving adversarial robustness is important, especially for models deployed in safety-critical domain or models deployed in the real-world, since most standard (undefended) models are vulnerable to adversarial attacks.
Attackers can easily craft deliberate and unnoticeable input perturbations that change the prediction of the classiﬁer.
Flat minima show higher resistance to such adversarially perturbed inputs while maintaining good clean accuracy (Stutz et al., 2021).
Among the variety of techniques for ﬁnding ﬂat minima Adversarial Weight Perturbation (AWP) (Wu et al., 2020a), and the closely-related (adaptive) sharpness-aware minimization (Foret et al., 2021; Kwon et al., 2021) and adversarial model perturbation (Zheng et al., 2021), seems to be quite effective in practice.
The key idea is to minimize the loss w.r.t.
a bounded worst-case perturbation of the model parameters, i.e. minimize a local notion of sharpness.
The beneﬁts of this approach, and more generally the correlation between ﬂatness and (clean/robust) generalization, have been extensively studied for i.i.d.
data such as images.
In this paper we study this phenomenon for graph data for the ﬁrst time.
Concretely, we analyze and improve the robustness of Graph Neural Networks (GNNs) which have become a fundamental building block (in addition to CNNs and RNNs).
Blindly applying existing weight perturbation techniques to GNNs is unfortunately not effective in practice due to a vanishing-gradient issue.
Intuitively, the adversarially perturbed weights tend to have a higher norm which in turn leads to a saturation in the last layer where that logits for one class are on a signiﬁcantly larger scale compared to the rest.
Even though this limitation plagues all formulations of AWP, for both GNNs and other models (e.g. ResNets), it has gone unnoticed so far.
To address it we propose Weighted Truncated Adversarial Weight Perturbation (WT-AWP) where rather than directly minimizing the (robust) AWP loss we use it as a regularizer in addition to the standard cross-entropy loss.
Moreover, we propose to abstain from perturbation in the last layer(s) of the network for a more ﬁne-grained control of the training dynamics.
These two modiﬁcations are simple, but necessary and effective.
With our resulting formulation the models can obtain useful gradient signals for training even when the perturbed weights have a high norm, mitigating the gradient-vanishing issue.
Furthermore, we theoretically study the AWP learning objective and show its invariance for local extrema.
We can summarize our contributions as follows:
• We provide a theoretical analysis of AWP on non-i.i.d.
graph data and identify a vanishinggradient issue that plagues all previous AWP variants.
Based on this analysis we propose Weighted Truncated Adversarial Weight Perturbation (WT-AWP) that mitigates this issue.
• We study for the ﬁrst time the connections between ﬂatness and generalization for Graph Neural Networks.
We show that GNNs trained with our WT-AWP formulation have simultaneously improved natural and robust generalization.
The improvement is statistically signiﬁcant and consistent across tasks (node-level and graph-level classiﬁcation) and across models (standard and robustness-aware GNNs).
All this at a negligible computational cost.
B ACKGROUND AND R ELATED W ORK
Adversarial Weight Perturbation for Images.
AWP is motivated by the connection between the ﬂatness of the loss landscape and model generalization.
Given a learning objective L ( · ) and an image classiﬁcation model with parameters θ , the generalization gap (Wu et al., 2020a), also named the sharpness term (Foret et al., 2021), which measures the worst-case ﬂatness of the loss landscape, is deﬁned by [max || δ ||≤ ρ L ( θ + δ ) − L ( θ )] .
This gap is known to control a PAC-Bayes generalization bound (Neyshabur et al., 2017), with a smaller gap implying better generalization.
The AWP objective optimizes the generalization gap and the loss function simultaneously via min
θ [(max || δ ||≤ ρ L ( θ + δ ) − L ( θ ))
+ L ( θ )]
= min θ max || δ ||≤ ρ L ( θ + δ ) .
Providing further theoretical justiﬁcation for the effectiveness of the AWP, Zheng et al.
(2021) prove that this objective favors solutions corresponding to ﬂatter local minima assuming that the loss surface can be approximated as an inverted Gaussian surface.
Relatedly, they show that AWP penalizes the gradient-norm.
Keskar et al.
(2016) show that large-batch training may reach sharp minima, however GNNs usually use a small batch size.
In some cases we can rescale the weights to achieve arbitrarily sharp minima that also generalize well (Dinh et al., 2017).
Investigating this issue for GNNs is out of our scope.
GNNs, Graph attacks, and Graph defenses.
Graph Neural Networks (GNNs) are emerging as a fundamental building block.
They have achieved spectacular results on a variety of graph learning tasks across many high-impact domains (see survey (Wu et al., 2020b)).
Despite their success, it has been demonstrated that GNNs suffer from evasion attacks at test time (Z¨ugner et al., 2018) and poisoning attacks at training time (Z¨ugner and G¨unnemann, 2019).
Meanwhile, a series of methods have been developed to improve their robustness.
For example, GCNJaccard (Wu et al., 2019) drops dissimilar edges in the graph, as it found that attackers tend to add edges between nodes with different features.
GCNSVD (Entezari et al., 2020) replaces the adjacency matrix with its low-rank approximation motivated by the observation that mostly the high frequency spectrum of the graph is affected by the adversarial perturbations.
We also have provable defenses that provide robustness certiﬁcates (Bojchevski et al., 2020).
Both heuristic defenses (e.g. GCNJaccard and GCNSVD) and certiﬁcates are improved with our WT-AWP.
For an overview of attacks and defenses see Sun et al.
A DVERSARIAL W EIGHT P ERTURBATION ON G RAPH N EURAL N ETWORKS
To simplify the exposition we focus on the semi-supervised node classiﬁcation task.
Nonetheless, in
Sec.
5.8 we show that AWP also improves graph-level classiﬁcation.
Let G =
( A , X ) be a given (attributed) graph where A is the adjacency matrix and X contains the node attributes.
Let V be the set of all nodes.
Normally we optimize min θ L train ( θ ; A , X ) , where L train = (cid:80) v ∈V train l ( f θ ( A , X ) , y v ) , f is a GNN parametrized by weights θ =
( θ 1 , ..., θ k ) , y v is the ground-truth label for node v , and l is some loss function (e.g. cross-entropy) applied to each node in the training set V train ⊂ V .
In AWP we ﬁrst ﬁnd the worst-case weight perturbation
δ ∗ ( θ ) that maximizes the loss.
Then we minimize the loss with the perturbed weights.
The worst-case perturbation for a given θ is deﬁned as
[Equation]
where ρ ( θ ) is the strength of perturbation.
Then the AWP learning objective is
[Equation]
Since the PAC-Bayes bound proposed by McAllester (1999) only holds for i.i.d.
training tasks and semi-supervised node classiﬁcation is a non-i.i.d.
task, analysis in Wu et al.
(2020a)
and Foret et al.
(2021) could not be naturally extended to node classiﬁcation tasks.
We derived a new generalization bound for node classiﬁcation tasks on GNNs based on the sub-group generalization (Ma et al., 2021).
Theorem 1.
(informal).
Let L all ( θ ; A , X ) be the loss on all nodes, including the unseen test nodes.
It is bounded by the adversarially weight perturbed loss on the training nodes as follows:
[Equation]
The formal version, the details for h () , and the proof are in
Appendix E. This bound justiﬁes the use of AWP since the perturbed loss on training nodes bounds the standard loss on all nodes.
Moreover, as h ( || θ || 22 /ρ
( θ ) 2 ) is monotonously decreasing with ρ ( θ ) , increasing the perturbation strength ρ can make the bound in Eq.
3 sharper, i.e. the resulting AWP objective should lead to better generalization.
Since ﬁnding the optimal perturbation (Eq. 1) is intractable, we approximate it with a one-step projected gradient descent as in previous work (Wu et al., 2020a;
Foret et al., 2021; Zheng et al., 2021),
[Equation]
where B ( ρ ( θ )) is an l 2 ball with radius ρ ( θ ) and Π B ( ρ ( θ )) ( · ) is a projection operation, which projects the perturbation back to the surface of B ( ρ ( θ )) when the perturbation is out of the ball.
The maximum perturbation norm ρ ( θ ) could either be a constant (Foret et al., 2021; Zheng et al., 2021) or layer dependent (Wu et al., 2020a).
We specify a layer-dependent norm constraint ρ ( θ ) :
=
ρ ||
θ ||because the scales of different layers in a neural network vary greatly.
With the approximation ˆ δ ∗ ( θ ) , the deﬁnition of the ﬁnal AWP learning objective is given by
[Equation]
If L train ( θ ; A , X ) is smooth enough, ∇ θ L train ( θ ; A , X ) = 0 when θ ∗ is a local extremum.
In this case L awp ( θ ) =
L train ( θ ; A , X ) .
A natural question is whether θ ∗ will also be the extremum of
L awp ( θ ) ?
We show that L awp ( θ ) keeps the local extremum of L train ( θ ; A , X ) unchanged.
Theorem 2.
(Invariant of local minimum and maximum) With the AWP learning objective in Eq. 5, and for continuous L train ( θ ; A , X ) , ∇ θ L train ( θ ; A , X ) , ∆ θ L train ( θ ; A , X ) , if θ ∗ is a local minimum of L train ( θ ; A , X ) and the Hessian matrix ∆ θ L train ( θ ; A , X ) | θ ∗ is positive deﬁnite, θ ∗ is also a local minimum of L awp ( θ ) .
The proof is provided in Appendix A.
The exact gradient of this new objective is
[Equation]
Since ∇ θ ˆ δ ∗ ( θ ) includes second and higher order derivative of θ , which are computationally expensive, they are omitted during training, obtaining the following approximate gradient of the AWP loss
[Equation]
Foret et al.
(2021) show the models trained with the exact gradient (Eq. 6) have almost the same performance as model trained with the estimated ﬁrst-order gradient (Eq. 7).
(a) Vanilla GCN 0.
(b) AWP ρ = 0 .0.
(c) AWP ρ = 1 .0.
(d) AWP ρ = 2 .
W EIGHTED T RUNCATED AWP
In this section we discuss the theoretical limitations of existing AWP methods on GCN, and illustrate them empirically on a toy dataset.
We also propose two approaches to improve AWP.
Our improved
AWP works well on both toy data and on real-world GNN benchmarks across many tasks and models.
We also show that similar problems also exist for multi-layer perceptrons (see Appendix B).
4. T HE VANISHING - GRADIENT ISSUE OF AWP
Consider a GCN
[Equation]
with a softmax activation at the output layer, where ˆ A is the graph Laplacian given by ˆ A :
= D − 1 / 2 ( A + I N ) D − 1 / 2 , D ii = (cid:80) j
( A + I N ) ij .
The perturbed model is ˆ y =
σ ( ˆ A ( ... ( ˆ AX ( W 1 + δ 1 ))) ...
( W n + δ n )) .
Since the norm of each perturbation δ i could be as large as ρ || W i || 2 , in the worst case the norm of each layer is ( ρ + 1)
||
W i || 2 , and thus the model will have exploding logit values when ρ is large.
After feeding large logits into the softmax layer, the output will approximate a one-hot encoded vector, because the difference between the entries of the logits may also be large.
In this case the gradient will be close to 0 and the weights will not be updated.
Notice, although in practice the number of GCN layers is always less than 3, we still observe the vanish gradient issue in both toy datasets and GNN benchmarks.
To verify our conclusion, we train a 2-layer GCN network with hidden dimension 64, which is a common setting for
GCNs, on a linearly separable dataset.
The dataset contains 2 classes {− 1 , 1 } and each class has 100 nodes.
We apply k -nearest neighbor ( k = 3) to obtain the adjacency matrix, and use the position of the nodes as the features.
The number of training epochs is 200.
We use 10% nodes for training, 10% for validating and the rest 80% for testing.
In Fig.
1 we show the trained classiﬁers for different ρ values.
Models with AMP crash quickly when ρ increased from 0 .
5 to 2 .
When ρ = 0 .
5 , the classiﬁcation accuracy is 0.97, which is nearly the same as the vanilla model, but
when ρ = 2 . 5 , the classiﬁcation accuracy is 0.51, which is the same as a random guess.
Besides, when ρ = 1 .and 2 . 5 , the loss of AWP method is almost constant during training (Fig. 2) and the prediction score (Fig.
1(c) and Fig.
1(d)) is around 0 .
This indicates that the weights are barely updated during training.
So with the AWP objective, we cannot select a large ρ .
Yet, as we discussed in Sec. 3, we prefer larger values of ρ since they lead to a tighter bound (Eq. 3) and are more like to generalize better.
As we shown next, our suggested improvements ﬁx this issue.
4. T RUNCATED AWP AND W EIGHTED AWP
Intuition for WT-AWP.
The vanishing gradient is mainly due to the exploding of the logit values, which is caused by perturbing all layers in the model.
Thus, a natural idea is to only apply AWP on certain layers to mitigate the issue.
This it the truncated AWP.
Another idea is to provide a second
(a) Vanilla model 0.
(b) AWP 0.
(c) T-AWP 0.
(d) W-AWP, λ =0 .0.
(e) WT-AWP, λ =0 .
Input: Graph G =
( A , X ) ; model parameters θ =
[ θ ( awp ) ; θ ( n ) ] with and without AWP; number of epochs N ; loss function L train ; perturbation strength ρ , AWP weight λ ; learning rate α .
Initialize weight θ 0 ; for t ∈ 1:N do
Compute the loss for training nodes: L train ( θ t − 1 ; A , X )
Compute the approximating weight perturbation for θ ( awp ) t − 1 : ˆ δ ∗ (
[Equation]
via Eq.
Compute the approximating gradient for θ :
[Equation]
Update the weight via θ t = θ t − 1 − αg endreturn θ N source of valid gradients which we do by adding the the vanilla loss L train ( θ ; A , X ) to the AWP loss.
Even when the AWP loss suffers from the vanishing gradient issue, the vanilla loss is not affected.
Deﬁnition 1.
(Truncated AWP)
We split the model parameters into two parts θ =
[ θ ( awp ) , θ ( normal ) ] , and we only perform AWP on θ ( awp ) .
The Truncated AWP objective is
[Equation]
where ˆ δ ( awp ) ∗ ( θ ( awp ) )
= Π B ( ρ ( θ ( awp ) ))
( ∇ θ ( awp ) L train ( θ ( awp ) ; A , X )) .
Recall in Sec. 2, the AWP objective is the unweighted combination of the regular loss function
L ( θ ) and the sharpness term max δ ≤ ρ [ L ( θ + δ ) − L ( θ )] .
The weight perturbation in this term can lead to vanishing gradients as we discussed in Sec. 4.1.
Therefore, another way to deal with this issue is to assign a smaller weight λ to the sharpness term in the AWP objective.
The weighted combination is [ λ max δ ≤ ρ [ L ( θ + δ ) − L ( θ )]
+ L ( θ )]
=
[ λ max δ ≤ ρ L ( θ + δ ) + (1 − λ )
L ( θ )] .
Deﬁnition 2.
(Weighted AWP)
Given a weight λ ∈ [0 , 1] the Weighted AWP objective is
[Equation]
We compare these two improvements with AWP and natural training on a linearly separable dataset using the same setup as in Sec. 4.1.
Fig.
3 illustrates the trained models with ρ = 2 .
In Fig.
3(b) we can see that the model with AWP objective suffers from vanishing gradients and it fails to learn anything useful.
The models with Truncated AWP 1 ( θ ( awp ) =
ﬁrst layer and θ ( normal ) = last layer) (Fig. 3(c)) and Weighted AWP (Fig. 3(e)) work well and have relatively good performance (96% and 98% accuracy respectively).
Besides, comparing to the vanilla model (Fig. 3(a)), they both have a signiﬁcantly smoother decision boundary.
In order to obtain a more powerful approach against the vanishing-gradient issue, we combine Truncated AWP and Weighted AWP, into a Weighted Truncated Adversarial Weight Perturbation (WTAWP).
The details of WT-AWP are shown in Algorithm 1 (description in Sec.
B.1). WT-AWP has two important parameters λ and ρ .
We will study how they inﬂuence model performance in Sec. 5.7.
E XPERIMENTAL E VALUATIONS
We conduct comprehensive experiments to show the effect of our WT-AWP on the natural and robustness performance of different GNNs for both node classiﬁcation and graph classiﬁcation tasks.
Training frameworks and setup.
We utilize the open-source libraries Pytorch-Geometric (Fey and Lenssen, 2019) and Deep-Robust (Li et al., 2020) for evaluation clean and robust node classiﬁcation performance respectively.
To achieve fair comparison we keep the same training settings for all models.
We report the mean and standard deviation over 20 different train/val/test splits andrandom weight initializations.
See Sec.
D.4 for further details and for the training hyperparameters.
Datasets.
We use three benchmark datasets, including two citation networks, Cora and Citeseer (Sen et al., 2008), and one blog dataset Polblogs (Adamic and Glance, 2005).
We treat all graphs as undirected and only select the largest connected component (more details and statistics in Sec. D.3).
Baseline models and attacks.
We aim to evaluate the impact of our WT-AWP on natural and robust node classiﬁcation tasks.
We train three vanilla GNNs: GCN (Kipf and Welling, 2017), GAT (Veliˇckovi´c et al., 2018), and PPNP (Klicpera et al., 2018), and four graph defense methods: RGCN (Zhu et al., 2019) 2 , GCNJaccard (Wu et al., 2019), GCNSVD (Entezari et al., 2020), and SimpleGCN (Jin et al., 2021).
For detailed baseline descriptions see Sec.
D.1.
To generate the adversarial perturbations, we apply three methods including: DICE (Waniek et al., 2018), PGD (Xu et al., 2019), and Metattack (Z¨ugner and G¨unnemann, 2019).
For a discussion of the attacks see Sec. D.2.
Certiﬁed robustness.
We obtain provable guarantees for our models using a black-box (sparse) randomized smoothing certiﬁcate (Bojchevski et al., 2020).
We report the the certiﬁed accuracy, i e. the percentage of nodes guaranteed to be correctly classiﬁed, given an adversary that can delete up to r d edges or add up to r a edges to graph (similarly for the node features).
See Sec.
D.8 for details.
Settings for WT-AWP.
All baseline models have a 2-layer structure.
When applying the WT-AWP objective, we only perform weight perturbation on the ﬁrst layer i.e. we assign θ ( awp ) = ﬁrst layer and θ ( normal ) = last layer.
For generating the weight perturbation we use a 1-step PGD as discussed in Sec. 3.
In the ablation study Sec. 5.7 we also apply 5-step PGD to generate weight perturbation, in which we utilize SGD optimizer with learning rate 0.2 and update the perturbation for 5 steps, and ﬁnally the perturbation is projected on the l 2 ball B ( ρ ( θ )) .
5. C LEAN A CCURACY
We evaluate the clean accuracy of node classiﬁcation tasks for different GNNs and benchmarks.
The baseline methods include GCN, GAT, and PPNP .
We use a 2-layer structure (input-hidden-output) for these three models.
For GCN and PPNP, the hidden dimensionality is 64; for GAT, we use 8 heads with size 8.
We choose K = 10 , α = 0 .
1 in PPNP.
We also ﬁnd that the hyperparameters ( λ, ρ ) of
WT-AWP are more related to the dataset than the backbone models.
We use ( λ = 0 .
7 , ρ = 1) for all three baseline models on Cora, ( λ = 0 .
7 , ρ = 2 . 5) on Citeseer, and ( λ = 0 .
3 , ρ = 1) for GCN, ( λ = 0 .
3 , ρ = 2) for GAT and PPNP on Polblogs.
Table 1 show our results, WT-AWP clearly improves the accuracy of all baseline models, while having smaller standard deviations.
Note, we do not claim that these models are state of the art, but rather that WT-AWP provides consistent and statistically signiﬁcant (two-sided t-test, p < 0 .
001 ) improvements over the baseline models.
These results support our claim that WT-AWP ﬁnds local minima with better generalization properties.
5. A VERAGE OF G RADIENT N ORM IN THE I NPUT S PACE
To estimate the smoothness of the loss landscape around the adjacency matrix A and the node attributes X , we compute the average norm of the gradient of L train ( θ ; A , X ) w.r.t.
A and X .
We compare a vanilla GCN model with GCN+WT-AWP ( λ = 0 .
5 , ρ = 1 ) model on Cora and Citeseer.
We train 10 models with different random initializations.
For each model we randomly sample 100 noisy inputs around A and X , and we average the gradient norm for these noisy inputs.
When comparing models trained with and without WT-AWP, we keep everything else ﬁxed, including the random initialization, to isolate the effect of WT-AWP.
In Fig.
4, we can observe that in most cases (37 out of 40) the models trained with WT-AWP have both better accuracy and smaller average gradient norm, i.e. are smoother.
This provides evidence that WT-AWP can help us ﬁnd ﬂatter minima. [Table] [Figure]
5. V ISUALIZATION OF L OSS L ANDSCAPE
We train GCN, GCN+AWP ( ρ = 0 . 1 ) and GCN+WT-AWP ( λ = 0 .
5 , ρ = 0 . 5 ) models with the same initialization, and we compare their loss landscapes.
The accuracy is 83.55% for GCN, 84.21% for GCN+AWP, and 85.51% for GCN+WTAWP.
Similar to Stutz et al.
(2021), Fig.
5 shows the loss landscape in a randomly chosen direction u in weight space, i.e. we plot L train ( θ + α · u ; A , X ) for different steps α .
We generate 10 random directions u and show the average loss.
The loss landscape of GCN+AWP is slightly smoother than the vanilla
GCN, because of the small perturbation strength ρ = 0 . 1 .
GCN+WT-AWP is ﬂatter (and more accurate) than both of them due to the larger perturbation strength ρ = 0 .
This provides further evidence for the effectiveness of WT-AWP.
5. R OBUST A CCURACY WITH P OISONING A TTACKS
Next we show that our WT-AWP can improve existing defense methods against graph poisoning attacks.
We select two poisoning attacks: PGD and Metattack (Z¨ugner and G¨unnemann, 2019), with a 5% adversarial budget.
The baseline models are vanilla GCN, and three GCN-based graph-defense models: GCNJaccard, GCNSVD, and SimpleGCN.
For all attack and defense methods, we apply the default hyperparameter settings in Li et al.
(2020), which re-implements the corresponding models with the same hyperparameters as the original works.
We use Cora, Citeseer, and Polblogs as the benchmark datasets.
Note that GCNJaccard does not work on Polblogs as it requires node features.
Table 10 in the appendix shows the hyperparameters ( λ, ρ ) we select for all WT-AWP models.
As we can see in Table 2, none of the defense methods have dominant performance across benchmarks.
More importantly, our WT-AWP consistently improves the robust accuracy for both vanilla and robust models.
We also evaluate the models against the DICE poisoning attack in Sec.
C.2, and again the results demonstrate that WT-AWP adds meaningful improvement over the baselines.
[Table] [Table]
5. R OBUST A CCURACY WITH E VASION A TTACKS
Next we show that WT-AWP also improves existing defense methods against graph evasion attacks.
We select two evasion attacks, DICE and PGD, with perturbation strengths of 5% and 10%.
The baseline model is GCN and we perform experiments on three benchmarks: Cora, Citeseer, and Polblogs.
For the PGD attack the hyperparameters ( λ, ρ ) are (0.5, 0.5) for all datasets.
For the DICE attack we use (0.5, 0.5) for Cora, (0.7, 2) for Citeseer, and (0.3, 1) for Polblogs.
Table 3 shows the experimental results.
WT-AWP again meaningfully improves the robustness of GCN under both
PGD and DICE evasion attacks.
5. C ERTIFIED R OBUSTNESS
In this subsection, we measure the certiﬁed robustness of GCN and GCN+WT-AWP on the Cora dataset with sparse randomized smoothing (Bojchevski et al., 2020).
We use λ = 0 .
5 , ρ = 1 as the hyperparameters for the WT-AWP models.
We plot the certiﬁed accuracy S ( r a , r d ) for different addition r a and deletion r d radii.
In Fig.
6, we see that compared to vanilla GCN training,
our
WT-AWP loss signiﬁcantly increases the certiﬁed accuracy w.r.t.
feature perturbations for all radii, while maintaining comparable performance when certifying perturbations of the graph structure.
For additional results see Sec.
C.3.
[Figure]
[Table] [Table]
5. A BLATION AND H YPERPARAMETER S ENSITIVITY S TUDY
We compare the performance of GCN+WT-AWP on the Cora dataset for different λ and ρ values.
We also compare GCN+WT-AWP with GCN+AWP under different perturbation sizes ρ .
Table 4 lists the results.
The accuracy of GCN+WT-AWP ﬁrst increases with λ and ρ and then slightly decreases.
Truncated AWP is a special case for λ = 1 (since the (1 − λ ) term disappears in Eq. 9) and it does not perform well, especially for larger ρ .
Similarly, WT-AWP outperforms the vanilla AWP that suffers from the vanishing-gradient issue.
Weighted but not truncated AWP with λ = 0 .
5 (last row) is also worse than WT-AWP, although in general weighting seems to be more important than truncation.
These results justify the decision to combine our proposed weighted and truncated AWP methods.
We also generate perturbations as in Eq.
4 but with multi-step PGD.
We repeat the above experiment with applying 5-step PGD for WT-AWP.
As shown in Table 5, the performance of 5-step WT-AWP is similar to the 1-step WT-AWP, the accuracy of both models
ﬁrst increases with λ and ρ , and then decreases.
The optimal hyperparameters ( λ, ρ ) are ρ = 1 , λ = 0 .
Since 5-step PGD offers no beneﬁts and 1-step PGD is faster, we suggest this as the default setting when applying WT-AWP.
5. G RAPH C LASSIFICATION
Finally, we conduct experiments on graph classiﬁcation tasks with three benchmark datasets: Protein, IMDB-Binary and IMDB-Multi.
Detailed description is in Sec.
D.9.
Table 6 shows the experimental results.
Generally, WT-AWP improves the accuracy with a large margin.
Besides, the variance of the accuracy of GCN+WT-AWP across different random seeds is signiﬁcantly smaller than the vanilla GCN, which indicates that WT-AWP is also more stable.
Note, we do not claim that our models are state of the art, but rather that WT-AWP provides consistent improvements.
[Table]
C ONCLUSION
We proposed a new adversarial weight perturbation method, WT-AWP, and we evaluated it on graph neural networks.
We showed that our WT-AWP can improve the regularization of GNNs by ﬁnding ﬂat local minima.
We conducted extensive experiments to validate our method.
In all empirical results, WT-AWP consistently improves the performance of GNNs on a wide range of graph learning tasks including node classiﬁcation, graph defense, and graph classiﬁcation.
Further exploring the connections between ﬂat minima and generalization in GNNs is a promising research direction.
R EPRODUCIBILITY S TATEMENT
All datasets, baseline models and general training settings are listed at the beginning of Sec.
For speciﬁc tasks we include the detailed settings in the corresponding sections.
For example, the detailed model structure and hyperparameter settings for GCN clean accuracy is discussed in Sec. 5.1.
We will make our code available to the reviewers via an anonymous link posted on OpenReview as suggested by the guidelines.
E THICS S TATEMENT
In this paper we design a new regularization method that can improve the robustness of graph neural networks again adversarial attacks.
Making GNNs more robust can have positive or negative broader impacts depending on the application and the domain.
While we observed that WT-AWP improves both clean and robust generalization, we did not study whether these improvements come at a cost to e.g. the fairness of the model or whether they introduce certain biases in the model.
Supplementary Material A P ROOFS
Proof.
(Theorem 2)
We only show the proof with local minimums, the proof with local maximum is analogous.
For ease of calculation we denote L train ( θ ; A , X ) by L ( θ ) .
We need to show a) ∇ θ L ( θ + ∇ θ L ( θ ))
| θ ∗ = 0 , and b) ∆ θ L ( θ + ∇ θ L ( θ )) | θ ∗ is positive deﬁnite.
a) Since θ ∗ is a local minimum of L , we have ∇ θ L ( θ ) | θ ∗ = 0 , thus
[Equation]
b)
[Equation]
Because ( I + ∆ θ L ( θ )) | θ ∗ and ∆ θ L ( θ ) | θ ∗ are positive deﬁnite matrices, and ∇ θ ( ∇ θ L ( θ + ∇ θ L ( θ )))
| θ ∗ =
( I + ∆ θ L ( θ )) | θ ∗ ∆ θ L ( θ ) | θ ∗ ( I + ∆ θ L ( θ ))
T | θ ∗ is symmetric, ∇ θ ( ∇ θ L ( θ + ∇ θ L ( θ )))
| θ ∗ is positive deﬁnite.
Thus θ ∗ is also the local minimum of L ( θ + ∇ θ L ( θ )) .
B V ANISHING - GRADIENT I SSUE OF AWP ON MLP
In this section we show that the vanishing-gradient issue also happens in multi-layer perceptrons.
Consider an MLP ˆ y =
σ ( W n ( ... ( W 1 X )))
with a softmax activation at the output layer.
The perturbed model is ˆ y =
σ ((( W n + δ n )( ... (( W 1 + δ 1 ) X ))) .
Since the norm of each perturbation δ i could be as large as ρ || W i || 2 , in the worst case the norm of each layer is ( ρ +1)
||
W i || 2 , and thus the model will have exploding logit values when ρ is large.
After feeding large logits into the softmax layer, the output will approximate a one-hot encoded vector, because the difference between the entries of the logits will also be large.
The gradient will be close to 0 and the weights will not be updated.
To verify our conclusion we train a 3-layer linear network with W 1 ∈ R 2 × 100 , W 2 ∈ R 100 × 100 , W 3 ∈ R 100 × 2 on a linearly separable dataset, the number of training epochs is 2000.
In Fig.
7 we show the trained classiﬁers with different ρ .
We ﬁnd that models with AWP are crushed quickly when ρ increased from 0 .
2 to 0 .
When ρ = 0 .
25 , the value of loss function remains unchanged during training and the prediction score is around 0 , which indicates the weights are almost not updated during training.
So with the AWP objective, we cannot select a large ρ .
[Figure]
We repeat the experiment using the same 3-layer linear network on a 2d moons dataset and perform the weight perturbation only on the ﬁrst two layers.
Fig.
8 Illustrates the trained models with ρ = 0 . 4 .
[Figure]
In Fig.
8(b) we can see the model suffers from vanishing gradients, while the model with truncated
AWP works well (Fig. 8(c)).
Besides, comparing to the overﬁtted natural model (Fig. 8(a)), the truncated AWP model has a smoother decision boundary.
We also remove the weight perturbation on the middle or the ﬁrst layer and train the model correspondingly, the results are similar to Fig. 8(c).
As Fig. 8(d) shows, the model with the weighted AWP objective is able to learn the representation of the input data, and the decision boundary is also smoother than the nature model in Fig. 8(a).
B. D ESCRIPTION OF A LGORITHM
In the WT-AWP algorithm (Algorithm 1) we apply a numerical optimizer such as Adam to the WT-AWP objective [Equation]
Since in our empirical experiments the GNNs always have a 2-layer structure, we assign θ awp as the ﬁrst layer and θ normal as the last layer.
Then the perturbation ˆ δ ( awp ) ∗ (ﬁrst layer) is computed via
Eq.
Next the gradient g of L WT − AWP is calculated with Eq.
[Equation]
Finally we update the weight via θ t = θ t − 1 − αg .
C A DDITIONAL E XPERIMENTS C. L EARNING C URVES AND G ENERALIZATION G AP D URING T RAINING
In this part, we train GCN, GCN+AWP ( ρ = 0 . 1 ) and GCN+WT-AWP ( λ = 0 .
5 , ρ = 0 . 5 ) models with the same random initialization and compare their learning curves, and generalization gap.
The accuracy is 0.8355 for GCN, 0.8421 for GCN+AWP, and 0.8551 for GCN+WT-AWP.
Fig.
9(a) illustrates the learning curve of vanilla loss L train ( θ ; A , X ) during training.
The loss of all three models converges well.
The ﬁnal value of GCN+WT-AWP is larger than the rest two models.
We believe it is because GCN+WT-AWP ﬁnds a different (ﬂatter) local minimum.
Fig. 9(b) shows the generalization gap during training.
Because we use a large perturbation bound ρ in GCN+WT-AWP, its generalization gap ﬂuctuates more and decrease slower compared to the gap of GCN+AWP.
The ﬂuctuation is due to the exploding logit problem in AWP with a large ρ value.
When it happens, the regular loss included in WT-AWP can minimize (but not completely eliminate) its inﬂuence.
Despite the ﬂuctuation, the generalization gap of GCN+WT-AWP decreases with time as well.
C. R OBUST A CCURACY WITH P OISONING DICE A TTACK
We conduct additional experiments on poisoning the graph with DICE attacks.
The general model settings are the same as Sec. 5.4.
The WT-AWP hyperparameters ( λ, ρ ) are shown in Table 8.
Tableillustrates the experimental results.
The models that achieve best performance on a given dataset are all based on WT-AWP.
Besides, WT-AWP also consistently boost the performance of the baselines.
[Figure]
[Table]
[Figure]
[Table]
C. C ERTIFIED ROBUSTNESS ON C ITESEER DATASET
We measure the certiﬁed robustness of GCN and GCN+WT-AWP with randomized smoothing (Bojchevski et al., 2020) on the Citeseer dataset.
We use λ = 0 .
5 , ρ = 1 as the hyperparameters for
WT-AWP models.
We plot the certiﬁed accuracy S ( r a , r d ) w.r.t.
r a and r d .
As seen in Fig.
10, comparing with the vanilla GCN, WT-AWP signiﬁcantly increases the certiﬁed accuracy for perturbations to the node features for all radii, while having comparable performance for certiﬁcation of the graph structure.
D E XPERIMENTAL D ETAILS D. D ESCRIPTION OF B ASELINE M ODELS
We aim to evaluate the impact of our WT-AWP on natural and robust node classiﬁcation tasks, thus we utilize the well-known graph neural networks and graph defense methods as baseline.
We ﬁrst train the baseline models and compare their performance with the baseline models trained with
WT-AWP objective (if applicable).
The baseline GNN models include:
• GCN (Kipf and Welling, 2017): is one of the most representative graph convolution neural networks.
Currently it can still achieve SOTA on different graph learning tasks.
• GAT (Veliˇckovi´c et al., 2018): utilizes multi-head attention mechanism to learn different weights for each node and its neighbor node without requiring the spectral decomposition.
• PPNP (Klicpera et al., 2018): improves the GCN propagation scheme based on the personalized Pagerank.
This approach generates predictions from each node’s own features and propagates these predictions using an adaptation of personalized PageRank.
• RGCN (Zhu et al., 2019): applies the Gaussian distribution to model the node representations.
This structure is expected to absorb effects of adversarial attacks.
It also penalizes nodes with large variance with an attention mechanism.
Notice, the WT-AWP cannot be applied to RGCN, as the weights of RGCN are modeled by distributions.
We can regard RGCN as another model inspired by PAC-Bayes theorem, as it models the objective E δ ∼N (0 ,σ I )
[ L train ( θ + δ ; A , X )] , which also bounded L all ( θ ; A , X ) according to PAC-Bayes theorem.
• GCNJaccard (Wu et al., 2019): is a graph defense method based on GCN.
It pre-processes the graph by deleting edges, which connect nodes with a small Jaccard similarity of features, because attackers prefer connecting nodes with dissimilar features.
This method only works on graph with node features.
For example it cannot work on Polblogs because the node features are unavailable.
• GCNSVD (Entezari et al., 2020): is a graph defense method based on GCN, which focuses on defending nettack Z¨ugner et al.
Since nettack is a high-rank attack, GCN-SVD preprocesses the perturbed graph with its low-rank approximation.
It is straightforward to extend it to non-targeted and random attacks.
• SimpleGCN (Jin et al., 2021): utilizes similarity preserving aggregation to integrate the graph structure and the node features, and employs self-supervised learning to capture the similarity between node features.
Notice SimpleGCN is not speciﬁcally designed for graph defense, and we ﬁnd it also has good performance under the poisoning attacks, thus we add this method as another graph defense baseline.
D. D ESCRIPTION OF G RAPH A TTACK M ETHODS
Generally speaking, there are two types of the adversarial attacks on node classiﬁcation tasks: testtime attack (evasion) and train-time attack (poisoning).
In both types of attacks we ﬁrst generate a perturbed adjacency matrix based on a victim model, and then in evasion attacks we test it directly on the victim model, and in poisoning attacks we train a new model with the perturbed adjacency matrix.
For generating the adversarial perturbations, we apply three methods:
• DICE (Waniek et al., 2018): is a baseline attack method (delete internally, connect externally).
In each perturbation, we randomly choose whether to insert or remove an edge.
Edges are only removed between nodes from the same classes, and only inserted between nodes from different classes.
• PGD
(Xu et al., 2019): calculates the gradient of the adjacency matrix, and the gradient serves as a probabilistic vector, then a random sampling is applied for generating a near-optimal binary perturbation based on this vector.
• Metattack (Z ¨ ugner and G ¨ unnemann, 2019): was proposed to generate poisoning attacks based on meta-learning.
It has an approximate version A-Metattack.
In our experiments, we apply the original Metattack.
D. D ATASETS S TATISTICS
Cora and Citeseer (Sen et al., 2008) are citation datasets commonly used for evaluating GNNs.
Polblogs (Adamic and Glance, 2005) is another common benchmark dataset where each node is a political blog.
In Table 9 we provide the statistics for each graph.
We preprocess the graph and only use the largest connected component.
[Table]
D. T RAINING S ETUP
Optimization hyperparameters.
We use the Adam optimizer with a learning rate 0.01 and weight decay of 0.0005.
All models are trained for 200 epochs with no weight scheduling.
We add a dropout layer with rate p = 0 .
5 after each GNN layer during training.
We apply no early stopping and the optimal model is selected with its performance on the validation set.
The test set is never touched during training.
Train/val/test split.
The evaluation procedures of GNNs on node classiﬁcation tasks have suffered overﬁtting bias from using a single train-test split.
Shchur et al.
(2018) showed that different splits could signiﬁcantly affect the performance and ranking of models.
In all our experiments on node classiﬁcation tasks, we apply the split setting in Z¨ugner and G¨unnemann (2019), which utilizes 10% samples for training, 10% samples for validating, and 80% samples for testing.
We generaterandom splits and for each split we train 10 models with different random initialization.
We report the mean and standard deviation of the accuracy of the 200 random models in our results.
D. S ETTINGS OF THE A VERAGE OF G RADIENT N ORM
For the results in Sec.
5.2 we generate noise z A , z X from Gaussian distribution
N ( A , σ 2 I ) and
N ( X , σ 2 I ) , then calculate the l 2 norm of the loss gradient ||∇ A L train ( θ ; A , X ) |
A =
z A || 2 and ||∇ X L train ( θ ; A , X ) |
A =
z
A || 2 .
In our experiments we choose σ = 0 . 0005 , because we expect the perturbed input to be close to the clean input.
D. S ETTINGS OF V ISUALIZATION OF L OSS L ANDSCAPE
For the results in Sec.
5.3, we generate a random direction u from a Gaussian distribution and perform l 2 normalization, it is equal to randomly selecting a direction on the l 2 unit ball.
As seen in
Fig.
9(a), there is a large gap between the ﬁnal loss value of WT-AWP and vanilla GCN, we have to parallel move the loss landscape of WT-AWP and GCN to the same level for making comparison.
The experiments are performed on Cora, similar results also hold for other datasets
. D. H YPERPARAMETERS ( λ, ρ ) FOR P OISONING A TTACKS
attack and Metattack of Sec. 5.
[Table]
D. R ANDOMIZED SMOOTHING
Following Bojchevski et al.
(2020), we create smoothed versions of our GNN models by randomly perturbing the adjacency matrix (or the node features) and predicting the majority vote for the randomly-perturbed samples.
We denote with p a the probability of ﬂipping an entry from 0 to 1 , i.e. adding an edge or a feature, and with p d the probability of ﬂipping an entry from 1 to 0 , i.e. deleting an edge or a feature.
In all experiments, for the certiﬁcation of node features we generate random perturbations with p a = 0 .
01 , p d = 0 .
6 , and for perturbing the adjacency matrix we use p a = 0 .
001 , p d = 0 .
We consider the prediction of the smoothed GNN for a given node correct if and only if it is correct and certiﬁably robust.
This means the prediction of the node does not change for any perturbation within the radius (i.e. for any r d deletions or r a additions).
D. G RAPH C LASSIFICATION
[Table]
Datasets.
We use three popular graph classiﬁcation datasets, including one bioinformatics dataset
Proteins, and two social network datasets IMDB-Binary and IMDB-Multi (Yanardag and Vishwanathan, 2015) for evaluation.
The details are shown in Table 11.
Settings.
We use 80% samples for training, 10% samples for validating and the rest 10% for testing.
The baseline model is a two-layer GCN with 16 hidden dimension and a global mean pooling layer after the second graph convolution layer.
A linear read-out layer is attached to the output of the GCN to generate predictions.
We apply the same training settings for GCN and GCN+WT-AWP.
We train both models for 200 epoches with the Adam optimizer, learning rate 0.01 and weight decay 0.0005.
The best model is selected with only the validation accuracy.
For each of GCN and GCN+WTAWP we take 10 random initialization and report the average accuracy and standard deviation.
The hyperparameters ( λ, ρ ) of WT-AWP is (0.3, 0.5) for Proteins, (0.05, 0.1) for IMDB-M and (0.5, 0.1) for IMDB-B.
D. N ORM OF GRADIENT DURING TRAINING
In this experiment we train a vanilla GCN, GCN+AWP with ρ = 0 .
1 , GCN+WT-AWP with λ = 0 .
5 , ρ = 1 on Cora and plot the relative gradient norm ||∇ θ || 2 /
||
θ
|| 2 during training.
Both AWP and WT-AWP have small relative gradient norm compared to GCN when epoch is larger than 100.
[Figure]
D. A BLATION STUDY OF THE PERTURBED LAYER
Since in all experiment above we only perturb the ﬁrst layer of GNN with WT-AWP
[Table]
we provide experimental results corresponds to perturb only the second layer with WT-AWP.
The backbone is
GCN and the benchmark is Cora.
As Table 12 shows, skipping the ﬁrst layer in WT-AWP methods have worse performance than skipping the last layer.
[Table]
E G ENERALIZATION BOUND ON GNN NODE CLASSIFICATION
Theorem 3.
(generalization bound)
Assuming L all ( θ ; A, X )
≤ E z ∼N (0 , Σ) [ L all ( θ + z ; A, X )] , for any set of training nodes V train from V all , ∀ m > √ d , with probability at least 1 − δ , we have
[Equation]
where d is the number of parameters in the GNN, K is the number of groundtruth labels, (cid:15) all is a ﬁxed constant w.r.t.
V all , N 0 is the volume of V train .
We use the assumption in Foret et al.
(2021), L all ( θ ; A, X ) ≤ E z ∼N (0 , Σ)
[ L all ( θ + z ; A, X )] , which means that adding Gaussian perturbation should not decrease the test error.
Proof.
Our proof is motivated by the subgroup generation bound on node classiﬁcation tasks (Ma et al., 2021) and the intuition of theorem 1 in Foret et al.
Lemma 1.
(PAC-Bayes bound node classiﬁcation tasks (Ma et al., 2021))
For any set of training nodes V train from V all , for any subgroup of nodes V m ⊂ V all , for any prior distribution P , with probability at least 1 − δ , for any distribution Q we have
[Equation]
where N 0 is the volume of the training set V train , K is the total number of classes, (cid:15) m is a constant depend on the subgroup V m .
If we take V m =
V all in Lemma 1, we have
[Equation]
Assume both P and Q are Gaussian distributions with diagonal covariance matrix, i.e. P i ∼
N ( µ p , σ 2 p I d } ) , Q i ∼ N ( µ q , σ 2 q I d } ) , where d is the dimension of θ , we have
[Equation]
Take µ q = θ, µ p = 0 , we expect the KL-divergence D KL ( Q||P ) to be as small as possible w.r.t.
σ p .
Lemma 2.
(Foret et al., 2021)
Take µ q = θ, µ p = 0 .
There exist pre-deﬁned σ p such that
[Equation]
Thus we have the generalization bound
[Equation]
As Q ∼ N ( θ, diag { σ 2 q } ) , consider z ∼ N (0 , diag { σ 2 q } ) , we have zσ q ∼ N (0 , I d ) and
E θ ∼Q
[ L train ( θ ; A, X )]
=
E z [ L train ( θ + z ; A, X )] .
Thus we have ∀ m >
[Equation]
[Equation]
As zσ q ∼ N (0 , I d ) , by Chernoff bound of chi-squred distribution we have when m > √ d ,
[Equation]
Thus
[Equation]
combining it with Eq.
17 and denote
σ q = ρ/m we have
[Equation]