Attacking Graph Classiﬁcation via Bayesian Optimisation
Abstract
Graph neural networks have been shown to be vulnerable to adversarial attacks.
While the majority of the literature focuses on such vulnerability in node-level classiﬁcation tasks, little effort has been dedicated to attacks on graph-level classiﬁcation, an important problem with numerous real-life applications such as biochemistry and social network analysis.
The few existing methods often require unrealistic setups, such as access to internal information of the victim models, or an impractically-large number of queries.
We present a novel Bayesian optimisation-based attack method for graph classiﬁcation models.
Our method is black-box , query-efﬁcient and parsimonious with respect to the perturbation applied.
We empirically validate the effectiveness and ﬂexibility of the proposed method and analyse patterns behind the adversarial samples produced, which may shed further light on the adversarial robustness of graph classiﬁcation models.
1. Introduction
Graphs are a general-purpose data structure consisting of entities represented by nodes and edges which encode pairwise relationships.
In recent years, graph-based machine learning models has been widely used in a variety of important applications such as semi-supervised learning, link prediction, community detection and graph classiﬁcation (Cai et al., 2018; Hamilton, 2020;
Zhou et al., 2020).
Despite the growing interest it has been shown that, like many other machine learning models, graph-based models are vulnerable to adversarial attacks (Jin et al., 2020; Sun et al., 2018).
Adversarial attacks on graphs can be aimed at different learning tasks.
This paper focuses on graphlevel classiﬁcation, where given an input graph, we wish to learn a function that predicts a property of interest related to the graph.
Graph classiﬁcation is an important task with many real-life applications, especially in bioinformatics and chemistry (Morris et al., 2020a;b).
For example, the task may be to accurately classify if a molecule, modelled as a graph whereby nodes represent atoms and edges model bonds, inhibits HIV replication or not.
Although there are a few attempts on performing adversarial attacks on graph classiﬁcation (Dai et al., 2018; Ma et al., 2019), they operate under unrealistic assumptions such as the need to query the target model a large number of times or access a portion of the test set to train the attacking agent.
To address these limitations, we formulate the adversarial attack on graph classiﬁcation as a black-box optimisation problem and solve it with Bayesian optimisation (BO), a query-efﬁcient state-of-the-art black-box optimiser.
Unlike existing work, our method is query efﬁcient, parsimonious in perturbations and does not require supervised training on a labelled dataset to effectively attack a new sample.
Another beneﬁt of our method is that it can be easily adapted to perform various modes of attacks such as deleting or rewiring edges and node injection.
Furthermore, we investigate the topological properties of the successful adversarial examples found by our method and offer valuable insights on the connection between the graph topology change and the model robustness.
2. Proposed Method: GRABNEL
Problem Setup A graph G =
( V , E ) is deﬁned by a set of nodes V = { v i } ni =1 and edges E = { e i } mi =1 where each edge e k
= { v i , v j } connects between nodes v i and v j .
The overall topology can be represented by the adjacency matrix A ∈ { 0 , 1 } n × n where A ij = 1 1 if the edge { v i , v j } is present.
The attack objective in our case is to degrade the predictive performance of the pretrained victim graph classiﬁer f θ by ﬁnding a graph G (cid:48) perturbed from the original test graph G (ideally with the minimum amount of perturbation)
such that f θ produces an incorrect class label for
G .
In this paper, we consider the black-box evasion attack setting, where the adversary agent cannot access or modify the the victim model f θ (i.e. its network architecture, its
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table]
weights θ or gradients) or its training data { ( G i , y i ) } Li =1 ; the adversary can only interact with f θ by querying it with an input graph G (cid:48) and observe the model output as pseudoprobabilities over all classes f θ ( G (cid:48) ) ∈ [0 , 1] C .
Additionally, we assume that sample efﬁciency is highly valued; the number of queries should be as few as possible to avoid detection in a real-life scenario.
Formally, the objective can be formulated as a black-box maximisation problem on graph G as the objective function of our BO attack agent:
[Equation]
where f θ is the pretrained victim model that remains ﬁxed in the evasion attack setup and y is the correct label of the original input G .
Denote the output logit for the class y as f θ ( G ) y , the attack loss L attack (cid:16) f θ ( G (cid:48) ) , y (cid:17) is given by max t ∈Y ,t (cid:54) =
y log f θ ( G (cid:48) )
t − log f θ ( G (cid:48) )
y for untargeted attack , or log f θ ( G (cid:48) )
t − log f θ ( G (cid:48) )
y for targeted attack on class t , where f θ ( · ) t denotes the logit output for class t .
Such attack loss deﬁnition is commonly used both in the traditional image attack and the graph attack literature (Carlini and
Wagner, 2017; Zügner et al., 2018).
Furthermore, Ψ( G ) refers to the set of possible G (cid:48) generated from perturbing G .
In this work, we experiment with a diverse modes of attacks to show that our attack method can be generalised to different set-ups including but not limited to creating/removing edges and rewiring/swapping edges.
The overall routine of
GRABNEL is presented in Algorithm 1, and we now elaborate each of its key components, and we describe the method to optimise acquisition function in App.
A
Surrogate model we propose to ﬁrst use a WeisfeilerLehman (WL) feature extractor to extracts a vector space representation of G , followed by a sparse Bayesian linear regression which balances performance with efﬁciency and gives an probabilistic output.
With reference to Algorithm 1, given a perturbation graph G (cid:48) as a proposed adversarial sample, the WL feature extractor ﬁrst extracts a vector representation φ ( G (cid:48) ) in line with the WL subtree kernel procedure (but without the ﬁnal kernel computation) (Shervashidze et al., 2011).
For the case where the node features are discrete, let x 0 ( v ) be the initial node feature of node v ∈ V , we iteratively aggregate and hash the features of v with its neighbours, { u i } deg( v ) i
= , using the original WL procedure at all nodes to transform them into discrete labels: x h +1 ( v ) = hash (cid:16) x h ( v ) ,
x h ( u 1 ) , ..., x h ( u deg( v ) ) (cid:17) , (2) for all h ∈ { 0 , 1 , . . .
, H − 1 } and H is the total number of WL iterations, a hyperparameter of the procedure.
At each level h , we compute the feature vector φ h ( G (cid:48) )
=
[ c ( G (cid:48) , X
[Equation]
1 ) , ..., c ( G (cid:48) , X h |X h | )] (cid:62) , where X h is the set of distinct node features x h that occur in all input graphs at the current level and c ( G (cid:48) , x ) is the counting function that counts the number of times a particular node feature x appears in G (cid:48) .
For the case with continuous node features and/or weighted edges, we instead use the modiﬁed WL procedure proprosed in Togninalli et al.
[Equation]
for all h ∈ { 0 , 1 , . . .
, H − 1 } , and we simply have φ h ( G (cid:48) )
= vec( X h ) where we vectorise the feature matrix of graph G (cid:48) at level h .
In both cases, at the end of H WL iterations we obtain the feature vector φ ( G (cid:48) )
=
concat (cid:16) φ 1 ( G (cid:48) ) , ..., φ H ( G (cid:48) )
(cid:17) for each training graph in [1 , n G (cid:48) ] to form the feature matrix Φ =
[ φ ( G (cid:48) 1 ) , ...
φ ( G (cid:48)| n G(cid:48) | )] (cid:62) to be passed to the Bayesian regressor.
The WL iterations capture both information related to individual nodes and topological information (via neighbourhood aggregation), and have been shown to have comparable distinguishing power to some GNN models (Morris et al., 2019), and hence the procedure is expressive.
At the same time, the extraction G (cid:48) → φ ( G (cid:48) ) is also unsupervised , thereby avoiding the need for the surrogate to learn representation from the data to ensure good sample efﬁciency.
When H or G (cid:48)
(with many WL features) are large, the resulting feature matrix will likely be very high-dimensional, which would lead to high-variance regression coefﬁcients α being estimated if the number of input samples is comparatively few.
To attain a good predictive performance in such a case, we employ Bayesian regression surrogate with the automatic relevance determination (ARD) prior to learn the mapping Φ → L attack ( f θ ( G (cid:48) ) , y ) , which regularises weights and encourages sparsity in α (Wipf et al., 2007):
[Equation]
where Λ is the diagonal covariance matrix.
To estimate α and the noise variance σ 2 n , we optimise the model marginal log-likelihood.
Overall, the WL routines scales as O ( Hm ) , whereas training of Bayesian linear regression has a linear scaling w.r.t.
the number of queries to the victim model; these ensure the surrogate is scalable to both larger graphs and/or a large number of graphs, both of which are commonly encountered in graph classiﬁcation.
Other options include GP and Bayesian neural network surrogates.
While theoretically more expressive, empirically we ﬁnd they perform similarly in this particular case, but are more noticeably more expensive than linear models.
Sequential perturbation selection In the default structural perturbation setting, given an attack budget of ∆ (i.e. we are allowed to ﬂip up to ∆ edges from G ), ﬁnding exactly the set of perturbations δ A that leads to the largest increase in L attack entails an combinatorial optimisation over (cid:0) n 2 ∆ (cid:1) candidates.
This is a huge search space that is difﬁcult for the surrogate to learn meaningful patterns in a sample-efﬁcient way even for modestly-sized graphs.
To tackle this challenge, we adopt the strategy illustrated in Fig.
1: given the query budget B (i.e. the total number of times we are allowed to query f θ for a given G ), we amortise B into ∆ stages and focus on selecting one edge perturbation at each stage.
While this strategy is greedy in the sense that it always commits the perturbation leading to the largest increase in loss at each stage, it is worth noting that we do not treat the previously modiﬁed edges differently, and the agent can, and does occasionally as we observe empirically, “correct” previous modiﬁcations by ﬂipping edges back: this is possible due to the edge selection being permutation invariant.
Another beneﬁt of this strategy is that it can potentially make full use of the entire attack budget ∆ while remaining parsimonious w.r.t.
the amount of perturbation introduced, as it only progresses to the next stage and modiﬁes the G further when it fails to ﬁnd a successful adversarial example in the current stage.
3. Related Works
Recently there has been an increasing attention in the study of adversarial attacks in the context of graph neural networks (Jin et al., 2020; Sun et al., 2018).
Applying adversarial attack methods from other domains to the graph setting is not straightforward, especially those based on gradient information, since the graph domain is inherently discrete.
One of the earliest models, Nettack, attacks a GCN node classiﬁer by optimising the attack loss of a surrogate model using a greedy algorithm (Zügner et al., 2018).
DICE attacks node classiﬁers by adding edges between nodes of different classes and deleting edges connecting nodes of the same class (Waniek et al., 2018).
Several reinforcement learningbased techniques (Ma et al., 2019; Zügner et al., 2018) have also been introduced for attacks on both node and graph classiﬁers .
Compared to both these methods, our method does not use the training data of the victim model and is much more query efﬁcient.
Adversarial attacks on graph classiﬁers outside of the evasion setting have also been considered such as backdoor attacks (Xu et al., 2021; Zhang et al., 2020).
On the other hand, BO as a black-box evasion attacking agent has been explored on tabular (Suya et al., 2017) and image data (Munoz-González, 2017; Ru et al., 2019; Shukla et al., 2019;
Zhao et al., 2019).
However, we address the problem for graph classiﬁcation models, which work on structurally and topologically fundamentally different inputs, implying several nontrivial challenges that require our method to go beyond the vanilla usage of BO.
4. Experiments
In this section, we validate the performance of the proposed method in a number of graph classiﬁcation tasks.
All additional details, including the statistics of the datasets used and implementation details of the victim models and attack methods, are presented in App.
D.
[Figure]
[Table]
We conduct experiments on three common TU datasets (Morris et al., 2020b)
In all cases, we deﬁne the attack budget ∆ in terms of the maximum structural perturbation ratio r where ∆ ≤ rN 2 and we set r = 0 .
We similarly link the maximum numbers of queries B allowed for individual graphs to their sizes as B = 50∆ , thereby giving larger graphs and thus potentially more difﬁcult instances higher attack and query budgets similar to the conventional image adversarial attack literature (Ru et al., 2019).
We cap the maximum number of queries to be 2 × 10 4 on any graph.
We compare against random search, genetic algorithm originally introduced in Dai et al.
(2018) and an additional simple gradient-based method which greedily adds or delete edges based on the magnitude computed input gradient similar to the gradient based method described in Dai et al.
(note that this method is white-box as access to parameter weights and gradients is required).
Furthermore, noting that the original implementation of RL-S2V, the primary algorithm in Dai et al.
(2018), primarily focus on a S2V-based victim model (Dai et al., 2016), we also compare GRABNEL against it in the same dataset considered in Dai et al.
(2018) in App.
C.
We use a Graph Convolutional Network (GCN) (Kipf and
Welling, 2017) victim model, and show the classiﬁcation performance of both victim models before and after attacks using various methods in Table 1: The results show that
GRABNEL typically leads to the largest degradation in victim predictions in all tasks, often performing on par or better than Gradient, a white-box method.
Further, GRABNEL typically outperforms in a larger extent for the larger graphs (e.g. COLLAB) on which the beneﬁt of the sequential selection of edge perturbation is more signiﬁcant.
5. Attack Analysis
In this section we provide a qualitative analysis on the common interpretable patterns behind the adversarial samples found, which provides further insights into the robustness of graph classiﬁcation models against structural attacks.
We believe such analysis is especially valuable, as it may facilitate the development of even more effective attack methods, and may provide insights that could be useful for identiﬁcation of real-life vulnerabilities for more effective defence.
We show some examples of the adversarial samples in Fig.
2, and we summarise some key ﬁndings below.
Adversarial edges tend to cluster closely together : We observe that the distribution of the adversarial edges in a graph is highly uneven, with many adversarial edges often sharing common end-nodes or having small spatial distance to each other.
This is empirically consistent with recent theoretical ﬁndings on the stability of spectral graph ﬁlters in Kenlay et al.
Adversarial edges often attempt to destroy or modify community structures : for example, the original graphs in the IMDB-M dataset can be seen to have community structure, and the attack tends to ﬂip
the edges between the communities, and thereby destroying the structure by either merging communities or deleting edges within a cluster.
With similar observations also present in, for example, PROTEINS dataset, this may suggest that the models may be fragile to modiﬁcation of the community structure.
6. Conclusion
This work proposes a novel and ﬂexible black-box method to attack graph classiﬁers using Bayesian optimisation.
We demonstrate the effectiveness and query efﬁciency of the method empirically.
Unlike many existing works, we qualitatively analyse the adversarial examples generated.
We believe such analysis is important to the understanding of adversarial robustness of graph-based learning models.
In future work, we will analyse adversarial patterns quantitatively and consider their effectiveness as a prior to guide the edge selection step of our method.
A current limitation is that our model is speciﬁc to graph classiﬁcation.
It is straightforward to apply our method to other graph models, and We believe it is also possible to adapt to node classiﬁcation tasks by suitably modifying the loss function.
Appendix A. Optimisation of acquisition function
At each BO iteration, there is need for the inner-loop optimisation of the acquisition function α ( · ) to select the next point(s) to query f θ
(we use expected improvement (EI) (Jones et al., 1998) as the default acquisition function).
While sample efﬁciency is typically not an issue in optimising α , the problem nonetheless entails the graph combinatorial space on which common tools like gradient-based optimisers cannot be used.
We instead optimise α via the genetic algorithm (GA), which has recently been shown to be competitive in BO acquisition optimisation (Cowen-Rivers et al., 2020) and does not require a continuous search space.
We outline the ingredients of GA used below:
• Initialisation: In our case, we are not totally ignorant about the search space as we might have already queried and observed f θ with a few different perturbed graphs G (cid:48) .
A possible smoothness assumption on the search space, for example, would be that if a G (cid:48) with an edge ( u, v ) ﬂipped from G led to a large L attack , then another G (cid:48) with ( u, s ) , s (cid:54)∈ { u, v } ﬂipped is more likely to do so too.
To reﬂect this
we ﬁll the initial population by mutating the top- k queried G (cid:48)
s leading to the largest L attack seen so far in the current stage
where for G (cid:48) with ( u, v ) ﬂipped from the base graph we 1) randomly choose an end node ( u or v ) and 2) change that node to another node in the graph except u or v such that the perturbed edges in all children shares one common end node with the parent.
• Evolution : After the initial population is built, we follow the standard evolution routine by evaluating the acquisition function value for each member as its ﬁtness , selecting the top- k performing members as the breeding population and
repeating the mutation procedure in initialisation for a ﬁxed number of rounds.
At termination, we simply query f θ with the graph(s) seen so far (i.e. computing the loss in Fig. 1) with the largest acquisition function value(s) seen during the GA procedure.
B. WL feature extractor
In this section we describe WLFeatureExtract in Algorithm 1 in greater detail.
The module takes in both the input graph itself and the set of all input graphs (including itself), as the second argument is to construct a collection of all WL features seen in any of the input graphs and controls the dimensionality of the output feature vector so that the entries in feature vectors of different input graphs represent the same WL feature.
For an illustrated example of the procedure, the readers are referred to Fig.
C. Comparison with RL-S2V
We compare GRABNEL with RL-S2V on the graph classiﬁcation dataset described in Dai et al.
Each input graph is made of 1 , 2 or 3 connected components.
Each connected component is generated using the Erd˝os–Rényi random graph model (additional edges are added if the generated graph is disconnected).
The label node features are set to a scalar value of 1 and the corresponding graph label is the number of connected components.
The authors consider three variants of this dataset using different graph sizes, we consider the variant with the smallest graphs ( 15 − 20 nodes.
The victim model, as well as the surrogate model used to compute Q-values in RLS2V is structure2vec (Dai et al., 2016).
This embedding has a hyper-parameter determining the depth of the computational graph.
We ﬁx both to be the the smallest model considered in Dai et al.
These choices were made to keep the computational budget to a minimum.
To adapt to the settings in Dai et al.
, we only allow one edge edit (addition/deletion), and for GRABNEL we allow up to 100 queries to the victim model per sample in the validation set.
For Random baseline, we instead allow up to 400 queries.
Similar to Dai et al.
(2018), we enforce the constraint such that any edge edit must not result in a change of the number of disconnected components (i.e. the label) and any such edit proposed is rejected before querying the victim model.
We show the results in Fig. 5, and we similarly visualise some of the adversarial samples found by GRABNEL in Fig.
The ﬁnal performance of RLS2V is similar to that reported in Dai et al.
(2018), whereas we ﬁnd
that random perturbation is actually a very strong baseline if we give it sufﬁcient query budget 2 .
Again, we ﬁnd that GRABNEL outperforms the baselines, offering orders-of-magnitude speedup compared to RL-S2V, with the main reasons being 1) GRABNEL is designed to be sample-efﬁcient, and 2) GRABNEL does not require a separate training set within the validation to train a policy like what RL-S2V does.
Fig.
4 shows that the edge addition is more common than deletion in the adversarial examples in this particular case, and often the attack agent forms ring structures .
Such structures are rather uncommon in the original graphs generated from the Erdos-Renyi generator, and are thus might not be familiar to the classiﬁer during training.
This might explain why the victim model seems particularly vulnerable to such attacks.
D. Implementation Details
Datasets We provide some key descriptive statistics of the TU datasets (Morris et al., 2020b) in Table 2.
All
TU datasets may be downloaded at https://chrsmrrs.
github.io/datasets/docs/datasets/ .
Computing Environment We conduct all experiments on a server with an Intel Xeon CPU with 256GB of RAM.
[Table]
[Figure]
[Table]
[Figure]
[Table]
[Figure]
[Table]
[Figure]
Victim models We use the popular graph convolutional network (GCN) (Kipf and Welling, 2017) as the victim model.
The graph convolution layers work by aggregating information across the graph edges and then updating combined node features to output new node features.
Multiple layers of graph convolution are used.
A readout layer transforms the ﬁnal node embeddings into a ﬁxed-sized graph embedding which can then be fed through a linear layer and a softmax activation function to provide predicted probabilities for each class.
The GCN graph convolutions take the form
[Equation]
GRABNEL GRABNEL, which uses the WL feature extractor, involves a number of hyperparameters: the WL procedure is parameterised by a single hyperparameter H , which speciﬁes the number of Weisﬁler-Lehman iterations to perform.
While it is possible for H to be selected automatically via, for example, maximising the log-marginal likelihood of the surrogate model (e.g. (Ru et al., 2020)), in our case we ﬁnd ﬁxing H = 1 to be performing well.
For the sparse Bayesian linear regression model used, we always normalise the input data into hypercubes [0 , 1] d and standardise the target by deducting its mean and dividing by standard deviation.
We optimise the marginal log-likelihood via a simple gradient optimiser and we set the maximum number of iterations to be 300 .
As described in Sec. 2, we need to specify a Gamma prior over over { λ i } and we use shape parameter and inverse scale parameters of 1 × 10 − 6 .
For the acquisition optimisation, we set the maximum number of evaluation of the acquisition function to be 1000 : we initialise with 100 randomly sampled perturbed graphs, each of which is generated from ﬂipping one pair of randomly selected end nodes from the base graph.
To generate the initial population, we ﬁll generate 100 candidates by mutating from the top-3 queried graphs that previously led to the largest attack loss (if we have not yet queried any graphs, we simply sample 100 randomly perturbed graphs).
We then evolve the population 10 times, with each evolution cycle involving mutating the current population to generate offspring and popping the oldest members in the population.
Finally, we select the top 5 unique candidates seen during the evolution process that have the highest acquisition function value (we use the expected improvement (EI) acquisition function) to query the victim model.