U NDERSTANDING AND I MPROVING G RAPH I NJECTION A TTACK BY P ROMOTING U NNOTICEABILITY
A BSTRACT
Recently Graph Injection Attack (GIA) emerges as a practical attack scenario on
Graph Neural Networks (GNNs), where the adversary can merely inject few malicious nodes instead of modifying existing nodes or edges, i.e., Graph Modiﬁcation Attack (GMA).
Although GIA has achieved promising results, little is known about why it is successful and whether there is any pitfall behind the success.
To understand the power of GIA, we compare it with GMA and ﬁnd that GIA can be provably more harmful than GMA due to its relatively high ﬂexibility.
However, the high ﬂexibility will also lead to great damage to the homophily distribution of the original graph, i.e., similarity among neighbors.
Consequently, the threats of GIA can be easily alleviated or even prevented by homophily-based defenses designed to recover the original homophily.
To mitigate the issue, we introduce a novel constraint – homophily unnoticeability that enforces GIA to preserve the homophily, and propose Harmonious Adversarial Objective (HAO) to instantiate it.
Extensive experiments verify that GIA with HAO can break homophily-based defenses and outperform previous GIA attacks by a signiﬁcant margin.
We believe our methods can serve for a more reliable evaluation of the robustness of GNNs.
I NTRODUCTION
Graph Neural Networks (GNNs), as a generalization of deep learning models for graph structured data, have gained great success in tasks involving relational information (Hamilton et al., 2017a;
Battaglia et al., 2018;
Zhou et al., 2020; Wu et al., 2021; Kipf & Welling, 2017; Hamilton et al., 2017b;
Veli ˇ ckovi ´ c et al., 2018; Xu et al., 2018; 2019b).
Nevertheless, GNNs are shown to be inherently vulnerable to adversarial attacks (Sun et al., 2018; Jin et al., 2021), or small intentional perturbations on the input (Szegedy et al., 2014).
Previous studies show that moderate changes to the existing topology or node features of the input graph, i.e., Graph Modiﬁcation Attacks (GMA), can dramatically degenerate the performance of GNNs (Dai et al., 2018; Z¨ugner et al., 2018; Z¨ugner & G¨unnemann, 2019; Xu et al., 2019a;
Chang et al., 2020).
Since in many real-world scenarios, it is prohibitively expensive to modify the original graph, recently there is increasing attention paid to Graph Injection Attack (GIA), where the adversary can merely inject few malicious nodes to perform the attack (Wang et al., 2018; Sun et al., 2020;
Wang et al., 2020; Zou et al., 2021).
Despite the promising empirical results, why GIA is booming and whether there is any pitfall behind the success remain elusive.
To bridge this gap, we investigate both the advantages and limitations of GIA by comparing it with GMA in a uniﬁed setting (Sec. 2.2).
Our theoretical results show that, in this setting when there is no defense, GIA can be provably more harmful than GMA due to its relatively high ﬂexibility.
Such ﬂexibility enables GIA to map GMA perturbations into speciﬁc GIA perturbations, and to further optimize the mapped perturbations to amplify the damage (Fig. 1a).
However, according to the principle of no free lunch, we further ﬁnd that the power of GIA is built upon the severe damage to the homophily of the original graph.
Homophily indicates the tendency of nodes connecting to others with similar features or labels, which is important for the success of most existing GNNs (McPherson et al., 2001; London & Getoor, 2014; Klicpera et al., 2019;
Battaglia
[Figure]
et al., 2018;
Hou et al., 2020; Zhu et al., 2020;
Yang et al., 2021b).
The severe damage to homophily will disable the effectiveness of GIA to evaluate robustness because non-robust models can easily mitigate or even prevent GIA merely through exploiting the property of homophily damage.
Speciﬁcally, having observed the destruction of homophily, it is straightforward to devise a defense mechanism aiming to recover the homophily, which we term homophily defenders .
Homophily defenders are shown to have strong robustness against GIA attacks.
Theoretically, they can effectively reduce the harm caused by GIA to be lower than GMA.
Empirically, simple implementations of homophily defenders with edge pruning (Zhang & Zitnik, 2020) can deteriorate even the state-ofthe-art GIA attacks (Zou et al., 2021)
(Fig. 1b).
Therefore, overlooking the damage to homophily will make GIA powerless and further limit its applications for evaluating the robustness of GNNs.
To enable the effectiveness of GIA in evaluating various robust GNNs, it is necessary to be aware of preserving the homophily when developing GIA.
To this end, we introduce a novel constraint – homophily unnoticeability that enforces GIA to retain the homophily of the original graph, which can serve as a supplementary for the unnoticeability constraints in graph adversarial learning.
To instantiate the homophily unnoticeability, we propose Harmonious Adversarial Objective (HAO) for GIA (Fig. 1c).
Speciﬁcally, HAO introduces a novel differentiable realization of homophily constraint by regularizing the homophily distribution shift during the attack.
In this way, adversaries will not be easily identiﬁed by homophily defenders while still performing effective attacks (Fig. 1b).
Extensive experiments with 38 defense models on 6 benchmarks demonstrate that GIA with HAO can break homophily defenders and signiﬁcantly outperform all previous works across all settings, including both non-target attack and targeted attack 1 .
Our contributions are summarized as follows:
• We provide a formal comparison between GIA and GMA in a uniﬁed setting and ﬁnd that GIA can be provably more harmful than GMA due to its high ﬂexibility (Theorem 1).
• However, the ﬂexibility of GIA will also cause severe damage to the homophily distribution which makes GIA easily defendable by homophily defenders (Theorem 2).
• To mitigate the issue, we introduce the concept of homophily unnoticeability and a novel objective HAO to conduct homophily unnoticeable attacks (Theorem 3).
P RELIMINARIES 2. G RAPH N EURAL N ETWORKS
Consider a graph G =
( A, X ) with node set V = { v 1 , v 2 , ..., v n } and edge set E = { e 1 , e 2 , ..., e m } , where A ∈ { 0 , 1 } n × n is the adjacency matrix and X ∈ R n × d is the node feature matrix.
We are interested in the semi-supervised node classiﬁcation task (Jin et al., 2021).
That is, given the set of labels Y ∈ { 0 , 1 , .., C − 1 } n from C classes, we can train a graph neural network f θ parameterized by θ on the training (sub)graph G train by minimizing a classiﬁcation loss L train (e.g., cross-entropy).
Then the trained f θ can predict the labels of nodes in test graph G test .
A GNN typically follows a neighbor aggregation scheme to recursively update the node representations as:
[Equation]
where N ( u ) is the set of neighbors of node u , H (0) u =
[Equation]
u ,
[Equation]
is the hidden representation of node u after the k -th aggregation, σ ( · ) is an activation function, e.g., ReLU, and ρ ( · ) is an aggregation function over neighbors, e.g., MEAN or SUM.
2. G RAPH A DVERSARIAL A TTACK
The goal of graph adversarial attack is to fool a GNN model, f θ ∗ , trained on a graph G =
( A, X ) by constructing a graph G (cid:48) =
( A (cid:48) , X (cid:48) ) with limited budgets (cid:107)G (cid:48) − G(cid:107) ≤ (cid:52) .
Given a set of victim nodes V c ⊆ V , the graph adversarial attack can be generically formulated as:
[Equation]
where θ ∗ = arg min θ L train ( f θ ( G train )) and L atk is usually taken as −L train .
Following previous works (Z ¨ ugner et al., 2018; Zou et al., 2021), Graph adversarial attacks can be characterized into graph modiﬁcation attacks and graph injection attacks by their perturbation constraints.
Graph Modiﬁcation Attack (GMA).
GMA generates G (cid:48) by modifying the graph structure A and the node features X of the original graph G .
Typically the constraints in GMA are to limit the number of perturbations on A and X , denoted by (cid:52) A and (cid:52) X , respectively, as:
[Equation]
where the perturbation on X is bounded by (cid:15) via L-p norm, since we are using continuous features.
Graph Injection Attack (GIA).
Differently, GIA generates G (cid:48) by injecting a set of malicious nodes
V atk as X (cid:48) =
[Equation]
, where X atk is the features of the injected nodes, O atk is the adjacency matrix among injected nodes, and A atk is the adjacency matrix between the injected nodes and the original nodes.
Let d u denote the degree of node u , the constraints in GIA are:
[Equation]
where the number and degrees of the injected nodes are limited, D X
= { C ∈ R d , min( X ) · 1 ≤ C ≤ max( X ) · 1 } where min( X ) and max( X ) are the minimum and maximum entries in X respectively.
Threat Model.
We adopt a uniﬁed setting, i.e., evasion, inductive and black-box, which is also used by Graph Robustness Benchmark (Zheng et al., 2021).
Evasion: The attack only happens at test time, i.e., G test , rather than attacking G train .
Inductive: Test nodes are invisible during training.
Black-box: The adversary can not access the architecture or the parameters of the target model.
P OWER AND P ITFALLS OF G RAPH I NJECTION A TTACK
Based on the setting above, we investigate both the advantages and limitations of GIA by comparing it with GMA.
While we ﬁnd GIA is more harmful than GMA when there is no defense (Theorem 1), we also ﬁnd pitfalls in GIA that can make it easily defendable (Theorem 2).
3. P OWER OF G RAPH I NJECTION A TTACK
Following previous works (Z¨ugner et al., 2018), we use a linearized GNN,
i.e., H ( k ) =
ˆ A k X Θ , to track the changes brought by attacks.
Firstly we will elaborate the threats of an adversary as follows.
Deﬁnition 3.1 (Threats) .
Consider an adversary A , given a perturbation budget (cid:52) , the threat of A to a GNN f θ is deﬁned as min [Equation]
)) , i.e., the optimal objective value of Eq. [Figure]
With Deﬁnition 3.1, we can quantitatively compare the threats of different adversaries.
Theorem 1.
Given moderate perturbation budgets (cid:52) GIA for GIA and (cid:52) GMA for GMA, that is, let (cid:52) GIA ≤ (cid:52) GMA (cid:28) | V | ≤ | E | , for a ﬁxed linearized GNN f θ trained on G , assume that G has no isolated nodes, and both GIA and GMA follow the optimal strategy, then, ∀(cid:52) GMA ≥ 0 , ∃(cid:52)
GIA ≤ (cid:52) GMA ,
[Equation]
where G (cid:48)
GIA and G (cid:48)
GMA are the perturbed graphs generated by GIA and GMA, respectively.
We prove Theorem 1 in Appendix E.1.
Theorem 1 implies that GIA can cause more damage than
GMA with equal or fewer budgets, which is also veriﬁed empirically as shown in Fig.
1a.
Intuitively, the power of GIA mainly comes from its relatively high ﬂexibility in perturbation generation.
Such ﬂexibility enables us to ﬁnd a mapping that can map any GMA perturbations to GIA perturbations, leading the same inﬂuences to the predictions of f θ .
We will give an example below.
Deﬁnition 3.2 (Plural Mapping M 2 ) .
M 2 maps a perturbed graph G (cid:48) GMA generated by GMA with only edge addition perturbations, 3 to a GIA perturbed graph G (cid:48)
GIA =
M 2 ( G (cid:48) GMA ) , such that:
[Equation]
As illustrated in Fig.
2a, the procedure of M 2 is, for each edge ( u, v ) added by GMA to attack node u , M 2 can inject a new node w to connect u and v , and change X w to make the same effects to the prediction on u .
Then GIA can be further optimized to bring more damage to node u .
We also empirically verify the above procedure in Fig. 2b.
Details about the comparison are in Appendix C.
3. P ITFALLS IN G RAPH I NJECTION A TTACK
Through M 2 , we show that the ﬂexibility in GIA can make it more harmful than GMA when there is no defense, however, we also ﬁnd a side-effect raised in the optimization trajectory of X w from the above example.
Assume GIA uses PGD (Madry et al., 2018) to optimize X w iteratively, we ﬁnd:
[Equation]
where t is the number of optimization steps and sim ( X u , X v ) =
[Equation]
X [Equation] X
[Equation]
X
[Equation]
We prove the statement in Appendix E.4.
It implies that, under the mapping M 2 , the similarity between injected nodes and targets continues to decrease as the optimization processes, and ﬁnally becomes lower than that in GMA.
We ﬁnd this is closely related to the loss of homophily of the target nodes.
Before that, we will elaborate the deﬁnition of homophily in graph adversarial setting.
Different from typical deﬁnitions that rely on the label information (McPherson et al., 2001; London & Getoor, 2014; Pei et al., 2020; Zhu et al., 2020), as the adversary does not have the access to all labels, we provide another instantiation of homophily based on node feature similarity as follows:
Deﬁnition 3.3 (Node-Centric Homophily) .
The homophily of a node u can be deﬁned with the similarity between the features of node u and the aggregated features of its neighbors:
[Equation]
where d u is the degree of node u and sim ( · ) is a similarity metric, e.g., cosine similarity.
We also deﬁne edge-centric homophily while we will focus primarily on node-centric homophily.
Details and reasons are in Appendix D.1.
With Deﬁnition 3.3, combining Eq.
5, we have:
[Equation]
where h GIA u and h GMA u denote the homophily of node u after GIA and GMA attack, respectively.
It implies that GIA will cause more damage to the homophily of the original graph than GMA.
To verify the discovery for more complex cases, we plot the homophily distributions in Fig. 2c.
The blue part denotes the original homophily distribution.
Notably, there is an outstanding out-ofdistribution (orange) part caused by GIA, compared to the relatively minor (canny) changes caused by GMA.
The same phenomenon also appears in other datasets that can be found in Appendix D.2.
Having observed the huge homophily damage led by GIA, it is straightforward to devise a defense mechanism aiming to recover the original homophily, which we call homophily defenders .
We theoretically elaborate such defenses in the form of edge pruning 4 , adapted from Eq. 1:
[Equation]
We ﬁnd that simply pruning the malicious edges identiﬁed by a proper condition can empower homophily defenders with strong theoretical robustness against GIA attacks.
Theorem 2.
Given conditions in Theorem 1, consider a GIA attack, which (i) is mapped by M(Def. 3.2) from a GMA attack that only performs edge addition perturbations, and (ii) uses a linearized GNN trained with at least one node from each class in G as the surrogate model, and (iii) optimizes the malicious node features with PGD.
Assume that G has no isolated node, and has node features as X u = CC − 1 e Y u − 1 C − 1 1 ∈ R d , where Y u is the label of node u and e Y u ∈ R
d is a one-hot vector with the Y u -th entry being 1 and others being 0 .
Let the minimum similarity for any pair of nodes connected in G be s G = min ( u,v )
∈
E sim ( X u ,
X v ) with sim ( X u , X v ) =
X u · X v (cid:107) X u (cid:107) 2 (cid:107) X v (cid:107) 2 .
For a homophily defender g θ that prunes edges ( u, v ) if sim ( X u , X v ) ≤ s G , we have:
[Equation]
We prove Theorem 2 in Appendix E.3.
It implies that, by specifying a mild pruning condition, the homophily defender can effectively reduce the harm caused by GIA to be lower than that of GMA.
Considering a more concrete example with M 2 , X w is generated to make L atk ( f θ ( M 2 ( G (cid:48) GMA ))) =
L atk ( f θ ( G (cid:48) GMA )) on node u at ﬁrst.
Then, due to the ﬂexibility in GIA, X w can be optimized to some
X (cid:48)
w that greatly destroys the homophily of node u , i.e., having a negative cosine similarity score with u .
Thus, for a graph with relatively high
homophily, i.e., s G ≥ 0 , a mild pruning condition such as 1 sim ( u,v ) ≤ 0 ( u, v ) = 0 could prune all the malicious edges generated by GIA while possibly keeping some of those generated by GMA, which makes GIA less threatful than GMA.
In the literature, we ﬁnd that GNNGuard (Zhang & Zitnik, 2020) serves well for an implementation of homophily defenders as Eq.
With GNNGuard, we verify the strong empirical robustness of homophily defenders against GIA.
As Fig.
1b depicts, when with homophily defenders, GIA can only cause little-to-no damage, while GMA can still effectively perturb the predictions of the target model on some nodes.
To fully demonstrate the power of homophily defenders, we also prove its certiﬁed robustness for a concrete GIA case in Appendix E.6.
H OMOPHILY U NNOTICEABLE G RAPH I NJECTION A TTACK 4. H ARMONIOUS A DVERSARIAL O BJECTIVE
As shown in Sec. 3, the ﬂexibility of GIA makes it powerful while dramatically hinders its performance when combating against homophily defenders, because of the great damage to the homophily distribution brought by GIA.
This observation motivates us to introduce the concept of homophily unnoticeability that enforces GIA to preserve the original homophily distribution during the attack.
Deﬁnition 4.1 (Homophily Unnoticeability) .
Let the node-centric homophily distribution for a graph G be H G .
Given the upper bound for the allowed homophily distribution shift (cid:52) H ≥ 0 , an attack A is homophily unnoticeable if:
[Equation]
where G (cid:48) is the perturbed graph generated by A , and m ( · ) is a distribution distance measure.
Intuitively, homophily unnoticeability can be a supplementary for the unnoticeability in graph adversarial attack that requires a GIA adversary to consider how likely the new connections between the malicious nodes and target nodes will appear naturally .
Otherwise, i.e., unnoticeability is broken, the malicious nodes and edges can be easily detected and removed by database administrators or homophily defenders.
However, homophily unnoticeability can not be trivially implemented as a rigid constraint and be inspected incrementally like that for degree distribution (Z¨ugner et al., 2018).
For example, a trivial implementation such as clipping all connections that do not satisfy the constraint (Def. 4.1) will trivially clip all the injected edges due to the unconstrained optimization in GIA.
Considering the strong robustness of homophily defenders, we argue that they can directly serve as external examiners for homophily unnoticeability check.
Satisfying the homophily constraint can be approximately seen as bypassing the homophily defenders.
Obviously, GIA with constraints as
Eq.
14 can not guarantee homophily unnoticeability, since it will only optimize towards maximizing the damage by minimizing the homophily of the target nodes.
Hence, we propose a novel realization of the homophily constraint for GIA that enforces it to meet the homophily unnoticeability softly .
Deﬁnition 4.2 (Harmonious Adversarial Objective (HAO)) .
Observing the homophily deﬁnition in
Eq. 6 is differentiable with respect to X , we can integrate it into the objective of Eq.
2 as:
[Equation]
where C ( G , G (cid:48) ) is a regularization term based on homophily and λ ≥ 0 is the corresponding weight.
One possible implementation is to maximize the homophily for each injected node as:
[Equation]
HAO seizes the possibility of retaining homophily unnoticeability, while still performing effective attacks.
Hence, given the homophily distribution distance measure m ( · ) in Def. 4.1, we can infer:
Theorem 3.
Given conditions in Theorem 2, we have m ( H G , H G (cid:48) HAO )
≤ m ( H G , H G (cid:48) GIA ) , hence:
[Equation]
where G (cid:48) HAO is generated by GIA with HAO, and G (cid:48)
GIA is generated by GIA without HAO.
We prove Theorem 3 in Appendix E.5.
Intuitively, since GIA with HAO can reduce the damage to homophily, it is more likely to bypass the homophily defenders, thus being more threatful than GIA without HAO.
We also empirically verify Theorem 3 for more complex cases in the experiments.
4. A DAPTIVE I NJECTION S TRATEGIES
GIA is generically composed of two procedures, i.e., node injection and feature update, to solve for
G (cid:48)
=
( A (cid:48) , X (cid:48) ) , where node injection leverages either the gradient information or heuristics to solve for A (cid:48) , and feature update usually uses PGD (Madry et al., 2018) to solve for X (cid:48) .
Most previous works separately optimize A (cid:48) and X (cid:48) in a greedy manner, which implicitly assumes that the other will be optimized to maximize the harm.
However, HAO does not follow the assumption but stops the optimization when the homophily is overly broken.
Thus, a more suitable injection strategy for
HAO shall be aware of retaining the original homophily.
To this end, we propose to optimize A (cid:48) and X (cid:48) alternatively and introduce three adaptive injection strategies to coordinate with HAO.
Gradient-Driven Injection.
We propose a novel bi-level formulation of HAO to perform the alternative optimization using gradients, where we separate the optimization of G (cid:48) =(
A (cid:48) , X (cid:48) )
as:
[Equation]
where Φ( A (cid:48) ) and Φ( X (cid:48) ) are the corresponding feasible regions for A (cid:48) and X (cid:48) induced by the original constraints.
Here we use different homophily constraint weights λ A and λ X for the optimizations of A (cid:48) and X (cid:48) , since A (cid:48) is discrete while X (cid:48) is continuous.
We can either adopt Meta-gradients like
Metattack (Z¨ugner & G¨unnemann, 2019) ( MetaGIA ) or directly optimize edge weights to solve for
A (cid:48) ( AGIA ).
The detailed induction of meta-gradients and algorithms are given in Appendix G.1.
Heuristic-Driven Injection.
As the state-of-the-art GIA methods are leveraging heuristics to ﬁnd
A (cid:48) , based on TDGIA (Zou et al., 2021), we also propose a variant ( ATDGIA ) using heuristics as:
[Equation]
where s u indicates the vulnerability of node u and 1 ( · ) is to early stop destroying homophily.
Sequential Injection for large graphs.
Since gradient methods require huge computation overhead, we propose a novel divide-and-conquer strategy ( SeqGIA ) to iteratively select some of the most vulnerable targets with Eq.
11 to attack.
Detailed algorithm is given in Appendix G.3.
E XPERIMENTS 5. S ETUP & B ASELINES
Datasets.
We comprehensively evaluate our methods with 38 defense models on 6 datasets.
We select two classic citation networks Cora and Citeseer (Yang et al., 2016; Giles et al., 1998) reﬁned by
GRB (Zheng et al., 2021).
We also use Aminer and Reddit (Tang et al., 2008; Hamilton et al., 2017b;
Zeng et al., 2020) from GRB, Arxiv from OGB (Hu et al., 2020), and a co-purchasing network Computers (McAuley et al., 2015) to cover more domains and scales.
Details are in Appendix H.1.
Comparing with previous attack methods.
We incorporate HAO into several existing GIA methods as well as our proposed injection strategies to verify its effectiveness and versatility.
First of all, we select PGD (Madry et al., 2018) as it is one of the most widely used adversarial attacks.
We also select TDGIA (Zou et al., 2021) which is the state-of-the-art GIA method.
We adopt the implementations in GRB (Zheng et al., 2021) for the above two methods.
We exclude FGSM (Goodfellow et al., 2015) and AFGSM (Wang et al., 2020), since PGD is better at dealing with non-linear models than FGSM (Madry et al., 2018), and AFGSM performs comparably with FGSM but is worse than
TDGIA as demonstrated by Zou et al.
For GMA methods, we adopt Metattack (Z ¨ ugner & G ¨ unnemann, 2019) as one of the bi-level implementations.
We exclude Nettack (Z ¨ ugner et al., 2018) as it is hard to perform incremental updates with GCN (the surrogate model used in our experiments) and leave reinforcement learning methods such as RL-S2V
(Dai et al., 2018) and NIPA (Sun et al., 2020) for future work.
More details are given in Appendix H.2.
Categories and complexity analysis of attack methods.
We provide categories and complexity analysis of all attack methods used in our experiments in Table 7, Appendix H.3.
Competing with different defenses.
We select both popular GNNs and robust GNNs as the defense models.
For popular GNNs, we select the three most frequently used baselines, i.e., GCN (Kipf & Welling, 2017), GraphSage
(Hamilton et al., 2017b), and GAT (Veliˇckovi´c et al., 2018).
For robust GNNs, we select GCNGuard (Zhang & Zitnik, 2020) for graph puriﬁcation approach, and
RobustGCN (Zhu et al., 2019) for stabilizing hidden representation approach, as representative ones following the surveys (Sun et al., 2018; Jin et al., 2021).
Notably, the author-released GCNGuard implementation requires O ( n 2 ) complexity, which is hard to scale up.
To make the comparison fair, following the principle of homophily defenders, we implement two efﬁcient robust alternatives, i.e.,
Efﬁcient GCNGuard ( EGuard ) and Robust Graph Attention Network ( RGAT ).
More details are given in Appendix F.2.
Besides, we exclude the robust GNNs learning in a transductive manner like
ProGNN (Jin et al., 2020) that can not be adapted in our setting.
[Table]
† RunswithSeqGIAframeworkonComputersandArxiv
[Table]
[Table]
Thelowernumberindicatesbetterattackperformance
Competing with extreme robust defenses.
To make the evaluation for attacks more reliable, we also adopt two widely used robust tricks Layer Normalization ( LN )
(Ba et al., 2016) and an efﬁcient adversarial training (Goodfellow et al., 2015; Madry et al., 2018) method FLAG (Kong et al., 2020).
Here, as FLAG can effectively enhance the robustness, we exclude other adversarial training methods for efﬁciency consideration.
More details are given in Appendix H.4.
Evaluation protocol.
We use a 3 -layer GCN as the surrogate model to generate perturbed graphs with various GIA attacks, and report the mean accuracy of defenses from multiple runs.
Details are in Appendix H.5.
For in-detail analysis of attack performance, we categorize all defenses into three folds by their robustness: Vanilla, Robust , and Extreme Robust ( Combo )
(Table 8).
To examine how much an attack satisﬁes the homophily unnoticeability and its upper limits, we report maximum test accuracy of both homophily defenders ( Homo ) and defenses from the last two categories.
5. E MPIRICAL P ERFORMANCE
In Table 1 and Table 2, we report the non-targeted and targeted attack performance of various GIA methods, respectively.
We bold out the best attack and underline the second-best attack when combating against defenses from each category.
Full results are in Appendix J.1 and Appendix J.2.
Performance of non-targeted attacks.
In Table 1, we can see that HAO signiﬁcantly improves the performance of all attacks on all datasets up to 30% , which implies the effectiveness and versatility of HAO.
Especially, even coupled with a random injection strategy (PGD), HAO can attack robust models to be comparable with or inferior to simple MLP which does not consider relational information.
Meanwhile, adaptive injection strategies outperform previous methods PGD and TDGIA by a non-trivial margin for most cases, which further indicates that they are more suitable for HAO.
Performance of targeted attack on large-scale graphs.
In Table 2, HAO also improves the targeted attack performance of all attack methods on all datasets by a signiﬁcant margin of up to 15% , which implies that the beneﬁts of incorporating HAO are universal.
Besides, adaptive injections can further improve the performance of attacks and establish the new state-of-the-art coupled with HAO.
[Figure]
T e s t R o bu s t n e ss
GCNGuardMLP (
[Figure]
Varying λ in HAO
Model
Cora † Computers † Arxiv † Computers ‡
Aminer ‡ Reddit ‡
Clean {+84 .92 .
+}
{+51 PGD 
+}
[Figure]
{+99 MetaGIA 60 .
 14 +HAO 58 .60 .
+}
{+14 AGIA 
+}
{+96 +HAO 53 .58 .48 .
 36 TDGIA 66 .
 97 +HAO 65 .
 32 ATDGIA 
+}
[Figure] [Figure]
[Figure]
D e n s i t y orig gia hao (a) Homophily change     100 Node Budgets
T e s t
R o b u s t n e ss
TDGIATDGIA-HAOMLP (b) Varying node budgets      30 Edge Budgets
T e s t
R o b u s t n e ss
[Figure]
5. A NALYSIS AND D ISCUSSIONS
Effects of HAO.
Though HAO can substantially improve GIA methods under defenses, we ﬁnd it essentially trades with the performance under no defenses.
In Fig.
3a, as the weight for regularization term λ increases, HAO trades slightly more of the performance against GCN for the performance against homophily defenders.
Finally, GIA reduces the performance of both GNNs with defenses and without defenses to be inferior to MLP.
Additionally, as also shown in Table 3b, the trade-off will not hurt the overall performance while consistently brings beneﬁts up to 5% .
Analysis of the perturbed graphs.
In Fig.
4a, we also analyze the homophily distribution changes after the attack.
It turns out that GIA with HAO can effectively preserve the homophily while still conducting effective attacks.
Similar analysis on other datasets can be found in Appendix D.2.
Attacks with limited budgets.
We also examine the performance of GIA methods with or without
HAO varying different node and edge budgets.
Fig.
4b and Fig.
4c show that HAO can consistently improve the overall performance by slightly trading with the performance under no defenses.
C ONCLUSIONS
In this paper, we explored the advantages and limitations of GIA by comparing it with GMA.
Though we found that GIA can be provably more harmful than GMA, the severe damage to the homophily makes it easily defendable by homophily defenders.
Hence we introduced homophily unnoticeability for GIA to constrain the damage and proposed HAO to instantiate it.
Extensive experiments show that GIA with HAO can break homophily defenders and substantially outperform all previous works.
We provide more discussions and future directions based on HAO in Appendix A. A CKNOWLEDGEMENTS
We thank the area chair and reviewers for their valuable comments.
This work was partially supported by GRF 14208318 and ECS 22200720 from the RGC of HKSAR, YSF 62006202 from
NSFC, Australian Research Council Projects DE-190101473 and DP-220102121.
E THICS S TATEMENT
Considering the wide applications and high vulnerability to adversarial attacks of GNNs, it is important to develop trustworthy GNNs that are robust to adversarial attacks, especially for safety-critical applications such as ﬁnancial systems.
However, developing trustworthy GNNs heavily rely on the effective evaluation of the robustness of GNNs, i.e., adversarial attacks that are used to measure the robustness of GNNs.
Unreliable evaluation will incur severe more issues such as overconﬁdence in the adopted GNNs and further improve the risks of adopting unreliable GNNs.
Our work tackles an important issue in current GIA, hence enhancing the effectiveness of current evaluation on the robustness of GNNs, and further empowering the community to develop more trustworthy GNNs to beneﬁt society.
Besides, this paper does not raise any ethical concerns.
This study does not involve any human subjects, practices to data set releases, potentially harmful insights, methodologies and applications, potential conﬂicts of interest and sponsorship, discrimination/bias/fairness concerns, privacy and security issues, legal compliance, and research integrity issues.
R EPRODUCIBILITY S TATEMENT
To ensure the reproducibility of our theoretical, we provide detailed proof for our theoretical discovery in Appendix E. Speciﬁcally, we provide detailed proof in Appendix E.1 for Theorem 1, proof in
Appendix E.3 for Theorem 2, and proof in Appendix E.5 for Theorem 3.
To ensure the reproducibility of our experimental results, we detail our experimental setting in Appendix B.2 and Appendix H, and open source our code.
A A DDITIONAL D ISCUSSIONS AND F UTURE D IRECTIONS A. D ISCUSSIONS ON HAO AND ITS L IMITATIONS
Discussions on HAO and future implications.
It is widely received that it is difﬁcult to give a proper deﬁnition of unnoticeability for graphs (More details are also given in Appendix B.2.2)
Based on earliest unnoticeability constraints on degree distribution changes (Z ¨ ugner et al., 2018;
Z ¨ ugner & G ¨ unnemann, 2019) empirical observations that graph adversarial attacks may change some feature statistics and connect dissimilar neighbors are identiﬁed and leveraged as heuristics to develop robust GNNs (Wu et al., 2019; Entezari et al., 2020; Zhang & Zitnik, 2020; Jin et al., 2020).
Though empirically effective, however few of them provide theoretical explanations or relate this phenomenon to unnoticeability.
In this work, starting from the comparison of GMA and
GIA we identiﬁed GIA would lead to severe damage to the original homophily.
Furthermore, the relatively high ﬂexibility of GIA ampliﬁes the destruction and ﬁnally results in the break of homophily unnoticeability.
The main reason for this phenomenon is mainly because of the poorly deﬁned unnoticeability in graph adversarial attack.
Without a proper deﬁnition, the developed attacks tend to the shortcut to incur damage instead of capturing the true underlying vulnerability of GNNs.
Consequently, using these attacks to evaluate robustness of GNNs will bring unreliable results thus hindering the development of trustworthy GNNs.
To be more speciﬁc, due to the poor unnoticeability constraint for graph adversarial learning, the developed attacks tend to leverage the shortcuts to greatly destroy the original homophily, which leads to the break of unnoticeability.
Thus, using homophily defenders can easily defend these seemingly powerful attacks, even with a simple design, which however brings us unreliable conclusions about the robustness of homophily defenders.
Essentially, HAO penalizes GIA attacks that take the shortcuts, and retain their unnoticeability in terms of homophily.
Thus, HAO mitigates the shortcut issue of GIA attacks, urges the attacks to capture the underlying vulnerability of GNNs and brings us a more reliable evaluation result, from which we know simple homophily defenders are essentially not robust GNNs.
In addition, the proposed realization of unnoticeability check for adversarial attacks provides another approach to instantiate the unnoticeability.
Especially for the domains that we can hardly leverage inductive bias from human, we can still try to identify their homophily, or the underlying rationales/causality of the data generation process, e.g., grammar correctness, ﬂuency and semantics for natural languages, to instantiate the unnoticeability constraint with the help of external examiners.
Since people are likely to be more sensitive to quantitative numbers like accuracy, those external examiners can be conveniently leveraged to the corresponding benchmark or leaderboards to further beneﬁt the community.
Limitations of HAO and future implications.
Since HAO are mostly developed to preserve the homophily unnoticeability, it counters the greedy strategy of attacks without HAO that destroys the homophily to incur more damage.
Therefore, it will inevitably reduce the damage of the attacks without HAO against vanilla GNNs.
As observed from the experiments, we ﬁnd HAO essentially trades the attack performance when against vanilla GNNs for the performance when against homophily defenders.
As Fig.
3a shows, the trade-off effects can be further ampliﬁed with a large coefﬁcient lambda in HAO.
As also shown by Fig.
4b and Fig.
4c, when against vanilla GNNs, compared with GIA without HAO, GIA with HAO show fewer threats.
In certain cases, the trade-off might generate the performance of attacks.
Thus, it calls for more tailored optimization methods to solve for better injection matrix and node features in the future.
Moreover, the trade-off effects also reﬂect the importance of homophily to the performance of node classiﬁcations and the utility of homophily unnoticeability, where we believe future theoretical works can further study this phenomenon and reveal the underlying causality for node classiﬁcation or even more other downstream tasks.
Thus, we can develop more robust and trustworthy neural graph models that do not depend on spurious correlations to perform the task.
In addition, as homophilous graph is the most common class of graph benchmarks for node classiﬁcation (Yang et al., 2016; Giles et al., 1998;
Hu et al., 2020; Zheng et al., 2021), our discussions are mostly focused on this speciﬁc class of graphs.
However, when applying HAO to other classes of graphs such as non-attributed graphs, a direct adaption of HAO may not work.
Nevertheless, if the underlying information for making correct predictions still resemble the homophily property, for example, in a non-attributed graph, nodes with similar structures tend to have similar labels, it is still promising to introduce the node features with node embeddings, derive a new deﬁnition of homophily and apply HAO.
Moreover, recently disassortative graphs appear to be interesting to the community (Pei et al., 2020; Zhu et al., 2020), which exhibit heterophily property that neighbors tend to have dissimilar labels, in contrast to homophily.
We conduct an investigation on this speciﬁc class of graphs and detailed results are given in Table 12, from which we surprisingly ﬁnd HAO still maintains the advance when incorporating various GIA attacks.
The reason might be that GNNs and GIA with HAO can still implicitly learn the homophily such as similarity between class label distributions (Ma et al., 2022), even without explicit deﬁnitions.
To summarize, we believe future extension of HAO to other classes of graphs is another interesting direction.
Besides, the discussions in this paper are only considered the relationship between adversarial robustness and homophily.
However, label noises are another widely existing threats that are deserved to be paid attention to (Liu & Tao, 2016; Han et al., 2018; 2020a;b).
Essentially, our discussions in
Appendix B.3 are also closely related to the vulnerability of GNNs to label noises, where GNNs can still achieve near perfect ﬁtting to the datasets with full label noises.
Thus, it is desirable to broader the attention and discussion to include the label noises when developing trustworthy GNNs.
A. M ORE F UTURE D IRECTIONS
Besides the future implications inspired from the limitations of HAO, we believe there are also many promising future works that could be built upon HAO.
Rethinking the deﬁnition of unnoticeability in adversarial robustness.
Though the study of adversarial robustness was initially developed around the deep learning models on image classiﬁcation (Szegedy et al., 2014; Goodfellow et al., 2015; Madry et al., 2018), images and classiﬁcation are far from the only data and the task we want to build neural networks for.
Deep learning models are widely applied to other types of data, such as natural languages and graphs, where human inductive bias can hardly be leveraged to elaborate a proper deﬁnition of unnoticeability.
Moreover, for more complicated tasks involving implicit reasoning, even in the domain of images, the original deﬁnition of unnoticeability, i.e., L-p norm, may not be sufﬁcient to secure all shortcuts that can be leveraged by adversaries.
How to establish and justify a proper deﬁnition of unnoticeability in these domains and tasks, is critical for developing trustworthy deep learning models.
Applications to other downstream tasks.
Given the wide applications of GNNs, we believe the studies on the robustness of GNNs should be extended to other downstream tasks, such as link predictions and graph clustering.
Speciﬁcally, when with a different task objective, it is interesting to ﬁnd whether the underlying task still depend on the homophily property and how the different optimization objectives affect the attack optimization trajectory.
Attack with small budgets.
In real-life scenarios, the budgets of the adversary may be limited to a small number.
It is interesting to study how to maximize the damage given limited budgets and its interplay between homophily.
For example, how to locate the most vulnerable targets.
We show an initial example through ATDGIA.
Mix-up attack of GMA and GIA.
In real-life scenarios, both GMA and GIA could happen while with different budget limits.
It is interesting to see whether and how they could be combined to conduct more powerful attacks.
Injection for defense.
Actually, not only attackers can inject extra nodes, defenders can also inject some nodes to promote the robustness of the networks.
For example, according the Proposition.
E.1, nodes with higher degrees, higher MLP decision margin and higher homophily tend more unlikely to be attacked.
Hence, defenders may directly inject some nodes the promote the above properties of vulnerable nodes.
Attacks on more complicated and deep GNNs.
Most existing graph adversarial works focus on analyzing linearized GNNs and apply the discoveries to more complex cases.
However, with the development of deep learning and GNNs, some models with complicated structures fail to ﬁt those theories.
For example, methods developed by studying linearized GNNs can hardly adapt to GNNs with normalizations as also revealed from our experiments.
Then they can even more hardly be adapted to more complex models such as Transformers.
On the other hand, most graph adversarial studies only focus on relatively shallow GNNs.
Different from other deep learning models, as GNNs go deep, besides more parameters, they also require an exponentially growing number of neighbors as inputs.
How the number of layers would affect their robustness and the threats of attacks remain unexplored.
From both theoretical and empirical perspectives, we believe it is very interesting to study the interplay between the number of GNN layers and homophily, in terms of adversarial robustness and threats, and how to leverage the discoveries to probe the weakness of complicated models.
Reinforcement Learning based GIA.
Reinforcement learning based approaches are shown to exhibit promising performances in previous mixed settings (Dai et al., 2018; Sun et al., 2020).
Though we exclude them for the efforts needed to adapt them to our setting, we believe it is promising and interesting to incorporate reinforcement learning to develop more tailored injection strategies and vulnerable nodes selection.
Meanwhile, it is also interesting to explore how to leverage the idea of SeqGIA proposed in Sec.
4 to reduce the computation overhead of reinforcement learning approaches and enhance their scalability.
B M ORE D ETAILS AND R EASONS ABOUT THE G RAPH A DVERSARIAL A TTACK S ETTING
We provide more details about the perturbation constraints and the threat model used in Sec. 2.2.
B. P ERTURBATION C ONSTRAINTS
Following previous works (Z ¨ ugner et al., 2018; Zou et al., 2021), Graph adversarial attacks can be characterized into graph modiﬁcation attacks and graph injection attacks by their perturbation constraints.
Moreover, we adopt standardization methods (i.e., arctan transformation) following Graph Robustness Benchmark (Zheng et al., 2021) on input features X . Graph Modiﬁcation Attack (GMA).
GMA generates G (cid:48) by modifying the graph structure A and the node features X of the original graph G .
The most widely adopted constraints in GMA is to limit the number of perturbations on A and X , denoted by (cid:52) A and (cid:52) X , respectively, as:
[Equation]
where the perturbation on X is bounded by (cid:15) via L-p norm, since we are using continuous features.
Graph Injection Attack (GIA).
Differently, GIA generates G (cid:48) by injecting a set of malicious nodes
V atk as:
[Equation]
where X atk is the features of the injected nodes, O atk is the adjacency matrix among injected nodes, and A atk is the adjacency matrix between the injected nodes and the original nodes.
Let d u denote the degree of node u , the constraints in GIA are:
[Equation]
(14) where the number and degrees of the injected nodes are limited, D X
= { C ∈ R d , min( X ) · 1 ≤ C ≤ max( X ) · 1 } where min( X ) and max( X ) are the minimum and maximum entries in X respectively.
In other words, each entry of the injected node features are bounded within the minimal entry and maximal entry of the original node feature matrix, following previous setting (Zou et al., 2021).
B. T HREAT M ODEL
We adopt a uniﬁed setting which is also used by Graph Robustness Benchmark (Zheng et al., 2021), that is evasion, inductive, and black-box.
Next we will elaborate more details and reasons for adopting the setting.
B.2. D ETAILS OF THE T HREAT M ODEL
Evasion.
The attack only happens at test time, which means that defenders are able to obtain the original clean graph G train for training, while testing on a perturbed graph G (cid:48) .
The reasons for adopting the evasion setting is as shown in Appendix B.2.2.
Inductive.
The training and testing of GNNs is performed in an inductive manner.
Speciﬁcally, f θ is trained on the (sub) training graph G train , which is consist of the training nodes with their labels and the edges among training nodes.
While during testing, the model will access the whole graph
G test =
G for inferring the labels of test nodes.
In particular, G is consist of all of the nodes and the edges, including G train , the test nodes, the edges among test nodes and the edges between training nodes and the test nodes.
In contrast, if the training and testing is performed in a transductive manner, the model can access the whole graph during both training and testing, i.e., G train =
G test = G .
Since we adopt the evasion setting where the adversary may modify the G test during testing, the GNN has to be learned in an inductive manner.
More reasons are as elaborated in Appendix B.2.2.
Black-box.
The adversary has no information about the target model, but the adversary may obtain the graph and training labels to train a surrogate model for generating perturbed graph G (cid:48) .
Combining all of the above, conducting effective attacks raises special challenges to adversaries, since defenders can adopt the information extracted from training graph G train to learn more robust hidden representations (Zhu et al., 2019), or learn to drop noisy edges (Wu et al., 2019; Zhang &
Zitnik, 2020; Jin et al., 2020), or even perform adversarial training (Jin & Zhang, 2021; Feng et al., 2021) which is known as one of the strongest defense mechanisms in the domain of images (Goodfellow et al., 2015; Madry et al., 2018).
B.2. D ISCUSSIONS ABOUT THE T HREAT M ODEL
Different from images where we can adopt the inductive bias from human vision system to use numerical constraints, i.e., L-p norm, to bound the perturbation range (Goodfellow et al., 2015; Madry et al., 2018), we cannot use similar numerical constraints to deﬁne the unnoticeability for graphs, as they are weakly correlated to the information required for node classiﬁcation.
For example, previous work (Z ¨ ugner et al., 2018) tries to use node degree distribution changes as the unnoticeability constraints.
However, given the same degree distribution, we can shufﬂe the node features to generate multiple graphs with completely different semantic meanings, which disables the functionality of unnoticeability.
Because of the difﬁculty to properly deﬁne the unnoticeability for graphs, adopting a poisoning setting in graph adversarial attack will enlarge the gap between research and practice.
Speciﬁcally, poisoning attacks require an appropriate deﬁnition of unnoticeability so that the defenders are able to distinguish highly poisoned data from unnoticeable poisoned data and the original data.
Otherwise, attackers can always leverage some underlying shortcuts implied by the poorly deﬁned unnoticeability, i.e., homophily in our case, to perform the attacks, since the defenders are blind to these shortcuts.
On the other hand, leveraging shortcuts may generate data which is unlikely to appear in real-world applications.
For example, in a citation network, medical papers are unlikely to cite or be cited by linguistic papers while the attacks may modify the graphs or inject malicious nodes to make medical papers cite or be cited by lots of linguistic papers, which is apparently impractical.
Using these attacks to evaluate the robustness of GNNs may bring unreliable conclusions, i.e., homophily defenders in our case, which will greatly hinders the development of the trustworthy GNNs.
Moreover, under a poor unnoticeability deﬁnition, without the presence of the original data, defenders have no idea about to what extent the data is poisoned and whether the original labels remain the correspondence.
Furthermore, it is well-known that neural networks have universal approximation power (Hornik et al., 1989), thus can easily overﬁt the training set (Goodfellow et al., 2016), or even memorize the labels appeared during training (Zhang et al., 2017).
As a generalization from deep learning models to graphs, GNNs tend to exhibit similar behaviors, which is shown empirically in our experiments (See Appendix B.3 for details).
Thus, even trained on a highly poisoned graph,
GNNs may still converge to 100% training accuracy, even though the correspondence between the data and the underlying labels might be totally corrupted.
In this case, defenders can hardly distinguish whether the training graph is perturbed hence unlikely to make any effective defenses.
Besides, studying the robustness of GNNs trained from such highly poisoned graphs seems to be impractical, since real world trainers are unlikely to use such highly poisoned data to train GNNs.
While in an evasion setting, the defenders are able to use the training graph to tell whether the incoming data is heavily perturbed and make some effective defenses, even simply leveraging some feature statistics (Wu et al., 2019; Jin et al., 2020).
Notably, A recent benchmark (Zheng et al., 2021) also has similar positions.
Thus, we will focus on the evasion setting in this paper.
Given the evasion setting, GNNs can only perform inductive learning where the test nodes and edges are not visible during training.
The reason is that, transductive learning (i.e., the whole graph except test labels is available), requires the training graph and test graph to be the same.
However, it can not be satisﬁed as the adversary will modify the test graph, i.e., changing some nodes or edges during
GMA attack, or injecting new malicious nodes during GIA attack.
Additionally, inductive learning has many practical scenarios.
For example, in an academic network, the graph grows larger and larger day by day as new papers are published and added to the original network.
GNN models must be inductive to be applied to such evolving graphs.
B. M EMORIZATION E FFECTS OF G RAPH N EURAL N ETWORKS
[Figure]
We conduct experiments with GCN (Kipf & Welling, 2017) on Cora (Yang et al., 2016).
The architecture we select is a 2-Layer GCN with 16 hidden units, optimized using Adam (Kingma &
Ba, 2015) with a learning rate of 0 .
01 and a L 2 weight decay of 5 × 10 − 4 for the ﬁrst layer.
We train 1000 epochs and report the training accuracy and test accuracy according to the best validation accuracy.
We randomly sample certain percent of nodes from the whole graph and reset their labels.
It can be seen from Fig.
5 (b) and (c) that even with all random labels, the training accuracy can reach to nearly 100% , which serves as a strong evidence for the existence of memorization effects in GNNs.
In other words, even a GNN is trained on a heavily poisoned graph (changes dramatically in the sense of semantic), it can still achieve good training accuracy while the defender has no way to explicitly ﬁnd it or do anything about it.
That is against to the original setting and purpose of adversarial attacks (Szegedy et al., 2014; Goodfellow et al., 2015; Madry et al., 2018).
Thus, it urges the community for a proper solution to the ill-deﬁned unnoticeability in current graph adversarial learning.
Till the appearance of a silver bullet for unnoticeability on graphs, evasion attack can serve as a better solution than poisoning attack.
C M ORE D ETAILS ABOUT GIA AND GMA C OMPARISON C. I MPLEMENTATION OF G RAPH M ODIFICATION A TTACK
Following Metattack (Z¨ugner & G¨unnemann, 2019), we implement Graph Modiﬁcation Attack by taking A as a hyper-parameter.
Nevertheless, since we are conducting evasion attack, we do not have meta-gradients but the gradient of A with respect to L atk , or ∇ A L atk .
Each step, we take the maximum entry in ∇ A L atk , denoted with max( ∇ A L atk ) , and change the corresponding edge, if it is not contained in the training graph.
Then we perform the perturbation as follows:
(a) If max( ∇ A L atk ) ≤ 0 and the corresponding entry in A is 0 , i.e., the edge does not exist before, we will add the edge.
(b) If max( ∇ A L atk ) ≥ 0 and the corresponding entry in A is 1 , i.e., the edge exists before, we will remove the edge.
If the selected entry can not satisfy neither of the above conditions, we will take the next maximum entry to perform the above procedure until we ﬁnd one that satisfy the conditions.
Here we exclude perturbations on node features given limited budgets, since Wu et al.
(2019) observed the edge perturbations produce more harm than node perturbations.
Besides, as shown in the proof, the damage brought by perturbations on node features is at most the damage brought by a corresponding injection to the targets in GIA, hence when given the same budgets to compare GMA and GIA, we can exclude the perturbations on nodes without loss of generality.
Note that given the deﬁnitions of direct attack and inﬂuencer attack in Nettack (Z¨ugner et al., 2018), our theoretical discussions are applicable to both direct GMA attack and indirect/inﬂuencer GMA attack, since the results are derived by establishing mappings between each kind of perturbations in GMA attack that are agnostic to these two types of GMA attacks.
Moreover, the GMA attack evaluated in our experiments is exactly the direct attack.
As in our case, all of the test nodes become victim nodes and the adversary is allowed to modify the connections and features of these nodes to perform the attack.
C. I MPLEMENTATION OF G RAPH I NJECTION A TTACK WITH P LURAL M APPING
GIA with M 2 is implemented based on the GMA above.
For each edge appears in the perturbed graph produced by GMA but does not exist in the original graph, in GIA, we will inject a node to connect with the corresponding nodes of the edge.
After injecting all of the nodes, then we use
PGD (Madry et al., 2018) to optimize the features of the injected nodes.
D M ORE H OMOPHILY D ISTRIBUTIONS D. E DGE -C ENTRIC H OMOPHILY
In addition to node-centric homophily (Def. 6), we can also deﬁne edge-centric homophily as:
Deﬁnition D.1 (Edge-Centric Homophily) .
The homophily for an edge ( u, v ) can be deﬁned as.
[Equation]
(15) where sim ( · ) is also a distance metric, e.g., cosine similarity.
With the deﬁnition above, we can probe the natural edge-centric homophily distribution of realworld benchmarks, as shown in Fig.
It turns out that the edge-centric homophily distributes follows a Gaussian prior.
However, it seems to be improper to utilize edge-centric homophily to instantiate the homophily unnoticeability for several reasons.
On the one hand, edge similarity does not consider the degrees of the neighbors which is misaligned with the popular aggregation scheme of GNNs.
On the other hand, edge-centric and node-centric homophily basically perform similar functionality to retain the homophily, but if considering the future extension to high-order neighbor relationships, edge similarity might be harder to extend than node-centric homophily.
Thus, we utilize the node-centric homophily for most of our discussions.
D. M ORE H OMOPHILY D ISTRIBUTIONS C HANGES
We provide more homophily distribution results of the benchmarks we used in the experiments for
Cora, Computers and Arxiv, shown as in Fig.
7 and Fig. 8, respectively.
GIA is implemented with
TDGIA (Zou et al., 2021).
Note that the budgets for TDGIA here is different from that in the previous sections, which utilized the budgets resulting in the maximum harm when compared with
GMA.
Similarly, GIA without HAO would severely break the original homophily distribution hence making GIA can be easily defended by homophily defenders.
While incorporated with HAO, GIA would retain the original homophily during attack. [Figure] [Figure]
E P ROOFS AND D ISCUSSIONS OF T HEOREMS E. P ROOF FOR T HEOREM
Theorem 1.
Given moderate perturbation budgets (cid:52) GIA for GIA and (cid:52) GMA for GMA, that is, let (cid:52) GIA ≤ (cid:52) GMA (cid:28) | V | ≤ | E | , for a ﬁxed linearized GNN f θ trained on G , assume that
G has no isolated nodes, and both GIA and GMA adversaries follow the optimal strategy, then, ∀(cid:52) GMA > 0 , ∃(cid:52)
GIA ≤ (cid:52) GMA , such that:
[Equation]
where G (cid:48)
GIA and G (cid:48)
GMA are the perturbed graphs generated by GIA and GMA, respectively.
Proof.
The proof sketch is to show that,
(a) Assume the given GNN model has k layers, there exists a mapping,
that when given the same budget, i e., (cid:52) GIA = (cid:52) GMA (cid:28) | V | ≤ | E | , for each perturbation generated by GMA intended to attack node u by perturbing edge ( u, v ) , or node attributes of node u or some node v that connects to u within k hops, we can always map it to a corresponding injection attack, that injects node x w to attack u , and lead to the same effects to the prediction.
(b) When the number of perturbation budget increases, the optimal objective values achieved of GIA is monotonically non-increasing with respect to (cid:52) GIA , that is
[Equation]
where L k atk ( f θ ( G (cid:48) GIA )) is the optimal value achieved under the perturbation budget of k , which is obvious.
Once we prove both (a) and (b), the L atk ( f θ ( G (cid:48) GIA )) will approach to L k atk ( f θ ( G (cid:48) GMA )) from the above as (cid:52) GIA approaches to (cid:52) GMA , hence proving Theorem 1.
Furthermore, for the ﬂexibility of the constraints on X w , we may adopt the gradient information of X w with respect to L atk ( f θ ( G (cid:48) GIA )) to further optimize X w and make more damages.
Hence, we have L atk ( f θ ( G (cid:48) GIA ))
≤ L k atk ( f θ ( G (cid:48) GMA )) .
To prove (a), the key technique is to show that, under a predeﬁned mapping, there exist a corresponding injection matrix A atk along with the features of the injected nodes X atk , such that the GIA [Figure] adversary can cause the same damage as GMA.
The deﬁnition of the mapping mostly derives how the injection matrix is generated.
While for the generation of X atk , note that all of the input features X is normalized to a speciﬁc range within [ − f l , f r ] where f l , f r ≥ 0 , following previous works (Zheng et al., 2021).
Thus, for any features X v ∈ D X , αX v ∈ D X when 0 ≤ α ≤ 1 .
We will use the statement multiple times during the derivation of X atk .
Next, we will start to prove (a).
Following Wu et al.
(2019), in GMA, adding new connections between nodes from different classes produces the most beneﬁt to the adversarial objective.
Hence, given the limited perturbation budget, we give our primary focus to the action of connecting nodes from different classes and will prove (a) also holds for the remaining two actions, i.e., edge deletion and node attribute perturbation.
We prove (a) by induction on the number of linearized layers.
First of all, we will show prove (a) holds for 1-layer and 2-layer linearized GNN as a motivating example.
The model is as f θ = ˆ A 2 X Θ with H
=
ˆ AX Θ and Z = f θ .
Plural Mapping M 2 .
Here we deﬁne the mapping M 2 for edge addition.
For each edge perturbation pair ( u, v ) generated by GMA, we can insert a new node w to connect u and v .
The inﬂuence of adversaries can be identiﬁed as follows, as Θ is ﬁxed, we may exclude it for simplicity:
In layer (1):
• Clean graph:
[Equation]
[Equation]
• GIA
[Equation]
where d i refers to the degree of node i with self-loops added for simplicity.
Thus, in layer (1), to make the inﬂuence from GMA and GIA on node u equal, the following constraint has to be satisﬁed:
[Equation]
which is trivially held by setting
[Equation]
[Equation] Normally, GMA does not consider isolated nodes (Z¨ugner et al., 2018; Z¨ugner & G¨unnemann, 2019) hence we have d v ≥ 2 and X w ∈ D X .
Note that we can even change X w to make more affects to node u with gradient information, then we may generate a more powerful perturbation in this way.
Then, we go deeper to layer 2.
In layer (2): • Clean graph
[Equation]
GMA:
[Equation]
∈ [Equation] u
[Equation]
v [Equation] otherwise
[Equation]
GIA:
[Equation]
Similarly [Equation] to make Z (cid:48)
u
= Z (cid:48)(cid:48) u [Equation] we have to satisfy the following constraint:
[Equation]
then we let X w = 34 ( RHS − 1 √ 3 ( 1 √ d u +1 X u + 1 √ d v +1 X v )) to get the solution of X w that makes the same perturbation.
Similarly, we can infer X w ∈ D X .
The following proof also applies to layer 2.
Next, we will prove that, for a linearized GNN with k layers ( k ≥ 1 ), i.e., H ( k ) =
ˆ A k X Θ , once ∃ X w , such that the predictions for node u is the same to that perturbed by GMA, i.e., H ( k − 1) u
=
E ( k − 1) u , then ∃ X (cid:48) w , such that H ( k ) u
= E ( k ) u .
Here we use H to denote the prediction of GNN attacked by GMA and E for that of GIA.
Note that, once the theorem holds, as we have already proven the existence for such X w , it naturally generalizes to an arbitrary number of layers.
To be more speciﬁc, when H ( k − 1) u
= E ( k [Equation] 1) u , we need to show that, ∃ X w , s.t.,
[Equation]
Here we make a simpliﬁcation to re-write Eq. 25 by deﬁning the inﬂuence score.
Deﬁnition E.1 (Inﬂuence Score) .
The inﬂuence score from node v to u after k neighbor aggregations with a ﬁxed GNN following Eq. 1, is the weight for X v contributing to H ( k ) u :
[Equation]
which can be calculated recursively through:
[Equation]
As Θ is ﬁxed here, we can simply regard I kuv
= ˆ A kuv .
Compared to the predictions after k -th propagation onto the clean graph, in GMA, H ( k ) u is additionally inﬂuenced by node v , while in GIA,
H ( k ) u is additionally inﬂuenced by node v and node w .
Without loss of generality, we may absorb the inﬂuence from neighbors of node v into that of node v .
Hence we can rewrite Eq.
25 as the following:
[Equation]
where
I k
[Equation]
Then we can further simplify it as,
[Equation]
To show the existence of X w that solves the above equation, it sufﬁces to show I k GIA uw (cid:54) = 0 and
X w ∈ D X .
Note that ∃ X w s.t.,
[Equation]
Since ˆ A k ≥ 0 , ∀ k ≥ 0 , so we have I ( k − 1) GIA uw > 0 .
Moreover,
[Equation]
, then it is obvious that the I kuw > 0 .
Moreover, with the deﬁnition of I kuv
=
ˆ A kuv , it is obvious that
I ( k − 1) GIA uw ≥ I ( k − 1) GMA uv for v with a degree not less than 1 (i.e., v is not an isolated node).
Hence, we have ( I ( k − 1) GMA uv −
I
( k − 1) GIA uv ) /I ( k − 1) GIA uw ≤ 1 and X w ∈ D X .
Now we have proved (a) holds for edge addition.
For the remaining actions of GMA, we can use a new mapping M 1 that injects one node w to node u to prove (a).
For an edge deletion of ( u, v ) , given M 1 , one may rewrite Eq.
25 for the left nodes other than v , as well as the equation involving I kuw , and derive the same conclusions similarly.
Intuitively, for edge deletion, considering the classiﬁcation probability, removing an edge is equivalent to enlarge the predicted classiﬁcation probability for other classes, hence it ﬁctionalizes likewise the edge addition and we can use a similar proof for this action.
Besides, M 1 can also apply to the perturbation of features to node u or the other neighbor nodes of u within k hops, where we inject one node w to make the same effect.
In this case, we can rewrite
Eq. and simplify it as following:
[Equation]
where v ∈ {N k ( u ) ∪ u } , i.e., node u or its k -hop neighbor, and ∆ X v is the perturbation to the attributes of node v .
Similarly, by the deﬁnition of I k uv , for node v with a degree not less than(i.e.
, v is not an isolated node), we have I k GIA uw ≥
I k GMA uv , hence we have I k GMA uv /I k GIA uw ≤ 1 and
X w ∈ D X .
Thus, we complete the whole proof.
Theorem 1 for other GNNs .
We can extend Theorem 1 to other GNNs such as GCN, GraphSage, etc.
Recall the theorem 1 in Xu et al.
Lemma 1.
Given a k-layer GNN following the neighbor aggregation scheme via Eq. 1, assume that all paths in the computation graph of the model are activated with the same probability of success p .
Then the inﬂuence distribution I x for any node x ∈ V is equivalent, in expectation, to the k -step random walk distribution on ˜ G starting at node x .
To apply Lemma 1, we observe that the deﬁnition of I kuw is analogous to random walk starting from node u .
Thus, one may replace the deﬁnition of I kuw here to the inﬂuence score deﬁned by Xu et al.
(2018), conduct a similar proof above with random walk score and obtain the same conclusions, given the mapping M 2 , for each edge addition ( u, v ) , ∃ X w , such that
[Equation]
Though the original theorem only proves Lemma 1 for GCN and GraphSage, it is obvious one can easily extend the proof in Xu et al.
(2018) for aggregation scheme as Eq. 1.
Cases for Less GIA Budget .
We can reduce GIA budgets in two ways.
(a) For GMA that performs both node feature perturbation and edge addition, considering a edge perturbation ( u, v ) , M 2 essentially also applies for node feature perturbations on u or v without additional budgets.
(b) It is very likely that with the mapping above, GIA will produce many similar nodes.
Hence, with one post-processing step to merge similar nodes together and re-optimize them again, GIA tends to require less budgets to make the same or more harm than GMA.
That is also reﬂected in our experiments as shown in Fig.
1b.
E. GIA WITH P LURAL M APPING FOR M ORE GMA O PERATIONS
Here we explain how our theoretical results also apply to the remaining actions, i.e., edge deletion and node feature perturbation, of GMA with M 2 (Def. 3.2).
In the proof for Theorem 1, we have proved the existence of mappings for edge removal and node feature perturbation.
Once the injected node features are set to have the same inﬂuence to the predictions on the targets, they can be further optimized for amplifying the damage, thus all of our theoretical results can be derived similarly like that for edge addition operation.
E. P ROOF FOR T HEOREM
Theorem 2.
Given conditions in Theorem 1, consider a GIA attack, which (i) is mapped by M(Def. 3.2) from a GMA attack that only performs edge addition perturbations, and (ii) uses a linearized GNN trained with at least one node from each class in G as the surrogate model, and (iii) optimizes the malicious node features with PGD.
Assume that G has no isolated node, and has node features as X u = CC − 1 e Y u − 1 C − 1 1 ∈ R d , where Y u is the label of node u and e Y u ∈ R
d is a one-hot vector with the Y u -th entry being 1 and others being 0 .
Let the minimum similarity for any pair of nodes connected in G be s G = min ( u,v )
∈
E sim ( X u ,
X v ) with sim ( X u , X v ) =
X u · X v (cid:107) X u (cid:107) 2 (cid:107) X v (cid:107) 2 .
For a homophily defender g θ that prunes edges ( u, v ) if sim ( X u , X v ) ≤ s G , we have:
[Equation]
Proof.
We prove Theorem 2 by ﬁrstly show the following lemma.
Lemma 2.
Given conditions in Theorem 2, as the optimization on X w with respect to L atk by PGD approaches, we have:
[Equation]
where t is the number of optimization steps.
We prove Lemma 2 in the follow-up section, i.e., Appendix E.4.
With Lemma 2, known that GIA is mapped from GMA with M 2 , X w will be optimized to have the same effects as GMA at ﬁrst and continue being optimized to a more harmful state, hence for the unit perturbation case as Fig.
2a, we know:
[Equation]
as the optimization on X w approaches.
Furthermore, it follows:
[Equation]
where h GIA u and h GMA u denote the homophily of node u after GIA and GMA attack, respectively.
Now if we go back to the homophily defender g θ , for any threshold speciﬁed to prune the edge ( u, v ) , as Lemma 2 and Eq. 33 indicates, direct malicious edges in GIA are more likely to be pruned by g θ .
Let τ GIA and τ GMA denote the corresponding similarity between ( u, w ) in GIA and ( u, v ) in
GMA, we have several possibilities compared with s G = min ( u,v ) ∈
E sim ( X u ,
X v ) :
(a) τ GIA ≤ τ GMA ≤ s G : all the
malicious edges will be pruned, Theorem holds; (b) τ GIA ≤ s G ≤ τ GMA : all the GIA edges will be pruned, Theorem 2 holds;
(c) s G ≤ τ GIA ≤ τ GMA : this is unlikely to happen, otherwise τ GIA can be optimized to even worse case, Theorem 2 holds;
Thus, we complete our proof.
Interestingly, we can also set a speciﬁc threshold τ h for homophily defender s.t., τ h − s G ≤ (cid:15) ≥ 0 , where some of the original edges will be pruned, too.
However, some of previous works indicate promoting the smoothness or slightly dropping some edges will bring better performance (Rong et al., 2020;
Yang et al., 2021a;
Zhao et al., 2021;
Yang et al., 2021b).
The similar discussion can also be applied to this case and obtain the same conclusions.
E. P ROOF FOR L EMMA
Proof.
To begin with, without loss of generality, we may assume the number of classes is 2 and
Y u = 0 , which can be similarly extended to the case of multi-class.
With the feature assignment in the premise, let the label of node u is Y u , we have:
[Equation]
1] T
[Equation]
[Equation]
[Equation]
1] T
[Equation]
[Equation]
After setting it to having the same inﬂuence as that in GMA following Eq.
29, we have:
[Equation]
[Equation]
Then, let L u denote the training loss L train on node u , we can calculate the gradient of X w :
[Equation]
With Cross-Entropy loss, we further have:
[Equation]
Then, we can induce the update step of optimizing X w with respect to L atk =
−L train by PGD:
[Equation]
where t is the number of update steps.
As the model is trained on at least nodes with indicator features following Eq.
35 from each class, without loss of generality, here we may assume Θ ≥ 0 , the optimal Θ would converge to Θ ≥ 0 .
Thus,
[Equation]
Let us look into the change of cosine similarity between node u and node v as:
[Equation]
where α ≥ 0 is the normalized factor.
To determine the sign of ∆ sim ( X u , X w ) , we may compare
X u · X ( t +1) with X u · X ( t ) w .
Here we expand X u · X ( t +1) w .
Let X u 0 , X u 1 to denote the ﬁrst and second element in X u respectively, we have:
[Equation]
where we omit the sign of I k GIA uw for I k GIA uw ≥
according to the deﬁnition.
Recall that we let
Y u = 0 , hence we have ( X u 1 − X u 0 ) ≤ 0 .
Besides, following Eq. 29, we have sign( X w 1 −
X w 0 )
=
sign( X v 1 − X v 0 ) .
As GMA tend to connect nodes from different classes, we further have sign( X w 1 − X w 0 ) ≥ 0 .
Comparing to X u · X ( t ) w , we know in Eq.
41, the numerator decreases and the denominator increases, as (cid:15) ≥ 0 , so the overall scale decreases.
In other words, we have:
[Equation]
which means that the cosine similarity between node u and node v decreases as the optimization of
X w with respect to L atk processes.
Thus, we complete our proof for Lemma 2.
E. P ROOF FOR T HEOREM
Theorem 3.
Given conditions as Theorem 2, when λ > 0 , we have m ( H G , H G (cid:48) HAO ) ≤ m ( H G , H G
[Equation]
GIA ) , hence:
[Equation]
where G (cid:48) HAO is generated by GIA with HAO, and G (cid:48)
GIA is generated by GIA without HAO.
Proof.
Similar with the proof for Theorem 2, we begin with binary classiﬁcation, without loss of generality.
With the feature assignment in the premise, let the label of node u is Y u , we have:
[Equation]
[Equation]
Let L u denote the training loss L train on node u , we look into the gradient of X w with respect to L u :
[Equation]
With Cross-Entropy loss, we further have:
[Equation]
Together with HAO, we can infer the update step of optimizing X w with respect to
L atk
[Equation] G , G [Equation] ) by PGD:
[Equation]
where t is the number of update steps.
Similarly, without loss of generality, we may assume Θ ≥ 0 .
As the optimization approaches, given λ > 0 , GIA with HAO will early stop to some stage that ( I k GIA uw · [ − 1 , 1] T + λ [1 , − 1] T ) = 0 , hence similar to the proof of Theorem 2, it follows:
[Equation]
47) where h GIA u and h HAO u denote the homophily of node u after GIA and GIA with HAO attack, respectively.
Likewise, we can infer that:
[Equation]
Thus, we complete our proof.
E. C ERTIFIED R OBUSTNESS OF H OMOPHILY D EFENDER
Here we prove the certiﬁed robustness of homophily for a concrete GIA case.
We prove via the decision margin as follows:
Deﬁnition E.2 (Decision Margin) .
Given a k -layer GNN, let H ( k ) [ u,c ] denote the corresponding entry in H ( k ) u for the class c , the decision margin on node u with class label Y u can be denoted by:
[Equation]
A Multi-Layer Perceptron (MLP) can be taken as a 0 -layer GNN which the deﬁnition also applies.
Then, we specify the certiﬁed robustness as follows:
Proposition E.1 (Certiﬁed Robustness of Homophily Defender) .
Consider a direct GIA attack uses a linearized GNN trained with at least one node from each class in G , that targets at node u by injecting a node w connecting to u , let node features x u = CC − 1 onehot ( Y u ) − 1 C − 1 1 , the homophily of u be τ , the decision margin of a MLP on u be γ , the minimum similarity for any pair of nodes connected in the original graph be s G = min ( u,v )
∈
E sim ( X u , X v ) , homophily defender g θ can defend such attacks, if − α
[Equation]
and g θ prunes edges
[Equation]
where α, β ≥ 0 are corresponding normalization factors.
Intuitively, effective attacks on a node with higher degrees, homophily or decision margin require a lower similarity between node w and u hence more destruction to the homophily of node u .
GIA without any constraints tends to optimize sim ( X u , X w ) to a even lower value.
Thus, it becomes easier to ﬁnd a suitable condition for g θ , with which it can painlessly prune all vicious edges while keeping all original edges.
Proof.
Analogous to the proof for Lemma 2, without loss of generality, we begin with binary classiﬁcation, normalized indicator features and Y u = 0 as follows:
[Equation]
The decision margin based on k -th layer representation can be denoted by
[Equation]
follows the Deﬁnition E.2.
In our binary classiﬁcation case, we have
[Equation]
where H (0) is the output of a 0 -layer GNN, or MLP (Multi-Layer Perceptron).
A k -layer GNN can be regarded as generating new hidden representation for node u by aggregating its neighbors, hence, we may induce the decision margin for a k -layer GNN at node u as
[Equation]
where we can replace the inﬂuence from neighbors with homophily of node u .
Observe that h u essentially indicates how much neighbors of node u contribute to H ( k ) [ u, 0] , for example, in binary case, let ζ > 0 be the corresponding normalization factor,
[Equation]
which means, [ (cid:88)
[Equation]
X u [Equation] [Equation] replaced with X u = [1 , − 1] T ,
[Equation]
Hence [Equation] we have:
[Equation]
where ζ ≥ 0 is the factor of h u .
With node w injected, the margin can be rewritten as:
[Equation]
To perturb the prediction of node u [Equation] we make m ≤ [Equation]
hence
[Equation]
we have
[Equation]
Observe that sim ( X u , X w ) =
( X [ w, 0] − X
w, 1] ) and h u
= τ , hence, we can write Eq.
54 in a clean form as
[Equation]
where α, β are corresponding normalization factors whose signs are determined by signs of I kuw
and I kuu respectively.
In other words, GIA has to optimize X w satisfying the above requirement to make the attack effective , however, given the premise that all s G = min ( u,v )
∈
E sim ( X u , X v ) ≥ − α (cid:113) d u d u +
( τ + βγ ) , a defense model g θ will directly prune all of the vicious edges satisfying the above requirement and make the attack ineffective , which is exactly what we want to prove.
F M ORE I MPLEMENTATIONS OF H OMOPHILY D EFENDER
There are many ways to design homophily defenders, inheriting the spirit of recovering the original homophily.
In addition to edge pruning, one could leverage variational inference to learn the homophily distribution or the similarity distribution among neighbors.
Then we use adversarial training to train the model to denoise.
Similarly, learning to promote the smoothness of the graph can also be leveraged to build homophily defenders (Zhao et al., 2021; Yang et al., 2021a;b).
Besides, outlier detection can also be adopted to remove or reduce the aggregation weights of malicious edges or nodes.
In the following two subsections, we will present two variants that perform better than GNNGuard (Zhang & Zitnik, 2020).
F. D ETAILS OF E FFICIENT GNNG UARD
The originally released GNNGuard requires O ( n 2 ) computation for node-node similarity, making it prohibitive to run on large graphs.
To this end, we implement an efﬁcient alternative of GNNGuard adopting a similar message passing scheme, let τ be the threshold to prune an edge:
[Equation]
where α
[Equation]
and z uj =
[Equation]
Essentially, it only requires O ( E ) complexity.
We will present the performance of Efﬁcient GNNGuard (EGNNGuard) in table 3.
F. D ETAILS OF R OBUST G RAPH A TTENTION N ETWORK (RGAT)
We introduce another implementation of Robust Graph Attention Network (RGAT).
We adopt the same spirit of GCNGuard (Zhang & Zitnik, 2020), that eliminates unlike neighbors during message passing based on neighbor similarity.
Speciﬁcally, we change the standard GAT (Veliˇckovi´c et al., 2018) attention mechanism as
[Equation]
Additionally, we also adopt the idea of RobustGCN (Zhu et al., 2019) that stabilize the hidden representations between layers, so we add Layer Normalization (Ba et al., 2016) among layers of
RGAT.
Empirical experiments show that RGAT is a more robust model with or without GIA attacks.
For more details, we refer readers to Table 3. [Table]
F. P ERFORMANCE OF H OMOPHILY D EFENDERS
We test the performance of different homophily defenders on Cora.
Natural Accuracy refers to the test accuracy on clean graph.
Test Robustness refers to their averaged performance against all the attacks.
Running time refers to their averaged running time for one training epoch.
We repeat the evaluation 10 times to obtain the average accuracy.
We can see that EGNNGuard has competitive performance with GNNGuard while 20 × faster.
RGAT performs slightly better and 10 × faster.
Hence, for large graphs and adversarial training of GNNGuard, we will use EGNNGuard instead.
G M ORE D ETAILS ABOUT A LGORITHMS USED
Here we provide detailed descriptions of algorithms mentioned in Section.
G. D ETAILS OF M ETA GIA AND AGIA G.1. I NDUCTION OF M ETA G RADIENTS FOR M ETA GIA
With the bi-level optimization formulation of GIA, similar to meta-attack, we can infer the metagradients as follows:
[Equation]
Consider the opt process, we have
[Equation]
With that, we can derive the meta-gradient for A atk :
[Equation]
where
[Equation]
Note that X ( t ) atk depends on A atk according to Eq.
58, so the derivative w.r.t.
A atk need to be traced back.
Finally, the update schema for A atk is as follows:
[Equation]
Directly computing the meta gradients is expensive, following Metattack, we adopt approximations like MAML (Finn et al., 2017) for efﬁciency consideration.
We refer readers to the paper of Metattack for the detailed algorithms by replacing the corresponding variables with those above.
G. D ETAILS OF AGIA
For optimizing weights of edge entries in A atk , we can use either Adam (Kingma & Ba, 2015),
PGD (Madry et al., 2018) or other optimization methods leveraging gradients.
For simplicity, we use PGD to illustrate the algorithm description of AGIA as follows:
Input: A graph G = ( A, X ) , a trained GNN model f θ ∗ , number of injected nodes c , degree budget b , outer attack epochs e outer , inner attack epochs for node features and adjacency matrix e X inner , e A inner , learning rate η , weight for sparsity penalty β , weight for homophily penalty λ ; Output: Perturbed graph G (cid:48) = ( A (cid:48) , X (cid:48) ) ; 1 Random initialize parameters ( A atk
X atk ); 2 Y ← f θ ∗ ( A, X ) ; /* Obtain original predictions on clean graph */ 3 for ← e outer do
Random initialize do do
Here, L h atk refers to the objective of GIA with HAO for the optimization of X atk .
For the optimization of A atk , we empirically ﬁnd the λ
A would degenerate the performance, which we hypothesize that is because of the noises as A atk is a discrete variable.
Hence, we set λ
A = 0 in our experiments.
Additionally, we introduce a sparsity regularization term for the optimization of A atk :
[Equation]
Besides, we empirically observe that Adam performs better than PGD.
Hence, we would use Adam for AGIA in our experiments, and leave other methods for future work.
Adopting Adam additionally brings the beneﬁts to utilize momentum and history information to accelerate the optimization escape from the local optimum, which PGD fails to achieve.
G. D ETAILS OF S EQ GIA
Since gradient methods require huge computation overhead, we propose a novel divide-and-conquer strategy to iteratively select some of the most vulnerable targets with Eq.
11 to attack.
Note that it is different from traditional sequential injection methods which still connect the targets in full batch.
For simplicity, we also illustrate the algorithm with PGD, and one may switch to other optimizer such as Adam to optimize A atk .
The detailed algorithm is as follows:
Input: A graph G = ( A, X ) , a trained GNN model f θ ∗ , number of injected nodes k , degree budget b , outer attack epochs e outer , inner attack epochs for node features and adjacency matrix e X inner , e A inner , learning rate η , weight for sparsity penalty β , weight for homophily penalty λ , sequential step for vicious nodes γ atk , sequential step for target nodes γ c ; Output: Perturbed graph G (cid:48) = ( A (cid:48) , X (cid:48) ) ; injection
Obtain original predictions on clean graph */
Injecting Nodes do ( A ( cur ) atk − η · ∇ A ( cur ) atk ( L A atk ))
; A ( cur ) atk ← (cid:102) n atk i =1 arg max top b ( A ( cur ) atk [ i, :] ) ;
A atk =
A atk (cid:107) A ( cur ) atk ; X atk =
X atk (cid:107) X ( cur ) atk ;
Actually, one may also inject few nodes via heuristic based algorithms ﬁrst, then inject the left nodes with gradients sequentially.
Assume that α nodes are injected by heuristic, we may further optimize the complexity from
[Equation]
to
[Equation]
in Table 7.
H M ORE D ETAILS ABOUT THE E XPERIMENTS H. S TATISTICS AND B UDGETS OF D ATASETS
Here we provide statistics of datasets used in the experiments as Sec. 5.1.
The label homophily utilizes the previous homophily deﬁnition (Zhu et al., 2020), while the avg.
homophily utilizes the node-centric homophily based on node similarity.
Following previous works (Zou et al., 2021; Zheng et al., 2021), we heuristically specify the budgets for each dataset according to the the number of target nodes and average degrees.
For targeted attack, we follow previous works (Z¨ugner et al., 2018) to select 800 nodes as targets according to the classiﬁcation margins of the surrogate model.
Speciﬁcally, we select 200 nodes with the highest classiﬁcation margin, 200 nodes with lowest classiﬁcation margin and 400 randomly.
For the budgets, we scale down the number of injected nodes and the maximum allowable degrees accordingly.
[Table]
[Table]
[Table]
H
A DDITIONAL D ISCUSSIONS ABOUT A TTACK B ASELINES
For the selection of attack baselines, from the literature reviews (Sun et al., 2018; Jin et al., 2021) [Table] existing reinforcement learning (RL) based approaches adopt different settings from ours, which either focus on the poisoning attack, transductive learning, edge perturbation or other application tasks.
Even for NIPA (Sun et al., 2020) which has the closest setting to ours, since it focuses on poisoning and transductive attack, and the features of the injected nodes are generated heuristically according to the labels assigned by the RL agent, without author released code, the adaption requires lots of efforts including redesigning the markov decision process in NIPA, hence we would like to leave them for future work.
More discussions on RL based future works are given in Appendix A.2.
H. C OMPLEXITY OF A LGORITHMS
Here we provide complexity analyses of the GIA algorithms used in the experiments as discussed and selected in Sec. 5.1.
As also deﬁned in algorithm description section from Appendix G, e X inner is the number of epochs optimized for node features, b is the number of maximum degree of vicious nodes, d is the number of feature dimension, N V c is the number of k -hop neighbors of the victim nodes for perform one forwarding of a k -layer GNN, e outer is the number of epochs for optimizing
A atk , γ c is the ratio of target nodes to attack in one batch, γ atk is the ratio of vicious nodes to inject in one batch.
H. D ETAILS OF D EFENSE B ASELINES
Here we provide the categories of defense models used in the experiments as Sec. 5.1.
We categorize all models into Vanilla, Robust and Extreme Robust (Combo).
Basically, popular GNNs are belong to vanilla category, robust GNNs are belong to robust categorty, and a robust trick will enhance the robust level by one to the next Category.
Consistenly to the observation in GRB (Zheng et al., 2021), we ﬁnd adding Layer Normalization (Ba et al., 2016) before or between convulotion layers can enhance the model robustness.
We use LN to denote adding layer norm before the ﬁrst convulotion layer and LNi to denote adding layer norm between convulotion layers.
[Table]
[Table]
H. D ETAILS OF E VALUATION AND M ODEL S ETTINGS H.5. M ODEL S ETTING
By default [Table] all GNNs used in our experiments have 3 layers, a hidden dimension of 64 for Cora,
Citeseer [Table] and Computers, a hidden dimension of 128 for the rest medium to large scale graphs.
We also adopt dropout (Srivastava et al., 2014) with dropout rate of 0 . 5 between each layer.
The optimizer we used is Adam (Kingma & Ba, 2015) with a learning rate of 0 . 01 .
By default, we set total training epochs as 400 and employ the early stop of 100 epochs according to the validation accuracy.
For the set of threshold in homophily defenders, we use PGD (Madry et al., 2018) to ﬁnd the threshold which performs well on both the clean data and perturbed data.
By default, we set the threshold as 0 . 1 , while for Computers and Reddit, we use 0 .
15 for Guard and EGuard, and for
Citeseer and Arxiv we use 0 . 2 for RGAT.
For adversarial training with FLAG (Kong et al., 2020), we set the step size be 1 × 10 − 3 , and train 100 steps for Cora, 50 steps for Citeseer, 10 steps for the rest datasets.
We empirically observe that FLAG can enhance both the natural accuracy and robustness of GNNs.
We refer readers to the results for more details in Sec.
J.1 and Sec.
J.2.
H.5. E VALUATION S ETTING
For ﬁnal model selection, we select the ﬁnal model with best validation accuracy.
For data splits, we follow the split methods in GRB (Zheng et al., 2021) which splits the datasets according to the node degrees, except for non-targeted attack on Arxiv where we use the ofﬁcial split to probe the performances of various methods in a natural setting.
For non-targeted attack, following previous works (Zou et al., 2021; Zheng et al., 2021), we select all test nodes as targets.
While for targeted attacks, we follow previous works (Z¨ugner et al., 2018) to select 200 nodes with highest classiﬁcation margin and lowest classiﬁcation margin of the surrogate model.
Then we randomly selectnodes as targets.
In other words, there are 800 target nodes in total for targeted attack.
Note for targeted attack, the natural accuracy on the target nodes might be different from normal test accuracy.
We also follow previous works to specify the attack budgets as Table.
5 for non-targeted attack and
Table.
6 for targeted attack.
During evaluation, we follow the black-box setting.
Speciﬁcally, we ﬁrstly use the surrogate model to generate the perturbed graph, then we let the target models which has trained on the clean graph to test on the perturbed graph.
We repeat the evaluation for 10 times on Cora, Citeseer, Computers, and Arxiv, and 5 times for Aminer and Reddit since model performs more stably on large graphs.
Then we report mean test accuracy of the target models on the target nodes and omit the variance due to the space limit.
H.5. A TTACKS S ETTING
By default, we use PGD (Madry et al., 2018) to generate malicious node features.
The learning step is 0 .
01 and the default training epoch is 500 .
We also employ the early stop of 100 epochs according to the accuracy of the surrogate model on the target nodes.
While for heuristic approaches such as
TDGIA (Zou et al., 2021) and ATDGIA, we follow the setting of TDGIA to update the features.
Empirically, we ﬁnd the original TDGIA feature update suits better for heuristic approaches while they show no advance over PGD for other approaches.
Besides, as Table 7 shows, MetaGIA requires huge amount of time originally.
Thus, to scale up, we use a batch update which updates the injected edges by a step size of b , i.e., the maximum degree of injected nodes, and limit the overall update epochs by | V atk | / 6 , where we empirically observe this setting performs best in Cora hence we stick it for the other datasets.
For the setting of λ for HAO, we search the parameters within 0 .
5 to 8 by a step size of 0 .
5 such that the setting of λ will not degenerate the performance of the attacks on surrogate model.
Besides heuristic approaches, we additionally use a hinge loss to stabilize the gradient information from
L atk and C ( G , G (cid:48) ) , where the former can be too large that blurs the optimization direction of the latter.
Take Cross Entropy with log softmax as an example, we adopt the following to constrict the magnitude of L atk :
[Equation]
where 1 { exp( H ( k ) [ u,Yu ] ) (cid:80) i exp( H ( k ) [ u,i ] ) ≥ τ } can be taken as the predicted probability for Y u
= u
and τ is the corresponding threshold for hinge loss that we set as 1 × 10 − 8 .
For the hyper-parameter setting of our proposed strategies in Sec.
4.2, we ﬁnd directly adopting λ in PGD for λ X and setting λ A = 0 performs empirically better.
Hence we stick to the setting for λ A and λ X .
For the weight of sparsity regularization term in AGIA, we directly adopt 1 /b .
For the hyper-parameters in heuristic methods, we directly follow TDGIA (Zou et al., 2021).
For SeqGIA, we set γ atk be min(0 .
2 , (cid:98)| V c | / 2 b (cid:99) ) and γ c = min( | V c | , γ atk | V atk | b ) by default.
H. S OFTWARE AND H ARDWARE
We implement our methods with PyTorch (Paszke et al., 2019) and PyTorch Geometric (Fey &
Lenssen, 2019).
We ran our experiments on Linux Servers with 40 cores Intel(R)
Xeon(R)
Silver 4114 CPU @
2.20GHz, 256 GB Memory, and Ubuntu 18.04 LTS installed.
One has 4 NVIDIA RTX 2080Ti graphics cards with CUDA 10.2 and the other has 2 NVIDIA RTX 2080Ti and 2 NVIDIA
RTX 3090Ti graphics cards with CUDA 11.3.
I M ORE E XPERIMENTAL R ESULTS
In this section, we provide more results from experiments about HAO to further validate its effectiveness.
Speciﬁcally, we provide full results of averaged attack performance across all defense models, as well as initial experiments of HAO on two disassortative graphs. [Table]
I. F ULL R ESULTS OF A VERAGED A TTACK P ERFORMANCE
In this section [Table] we provide full results of averaged attack performance across all defense models, as a supplementary for Table 3b.
I.
[Equation] ON D ISASSORTATIVE G RAPHS
In this section, we provide initial investigation into the non-targeted attack performances of various
GIA methods with or without HAO on disassortative graphs.
Speciﬁcally, we select Chameleon and
Squirrel provided by Pei et al.
Statistics and budgets used for attack are given in Tableand Table 11.
[Table]
We also heuristically specify the budgets for each dataset according the the number of target nodes and average degrees.
[Table]
For the settings of hyperparameters in attack methods and evaluation, we basically follow the same setup as given in Appendix H.5.
In particular, we ﬁnd using a threshold of 0 .
05 for homophily defenders work best on Chameleon.
Besides, we also observe robust tricks can not always improve performances of GNNs on these graphs.
For example, we observe that using a large step-size of
FLAG may degenerate the performances of GNNs on these datasets, hence we use a smaller stepsize of 5 × 10 − 4 as well as a small number of steps of 10 .
Moreover, using a LN before the ﬁrst GNN layer may also hurt the performance.
For fair comparison, we remove these results from defenses.
Finally, in Table 12, we report both categorized defense results as Table 1 as well as the averaged attack performance as Table 3b.
From the results, we observe that, although our methods are not initially designed for disassortative graphs, HAO still brings empirical improvements.
Speciﬁcally, on Chameleon, HAO improves the attack performance up to 25% against homophily defenders, up to 12% against robust models, up to 10% against extreme robust models, and ﬁnally brings up to 3% averaged test robustness of all models.
While on Squirrel, the improvements become relatively low while still non-trivial. For [Table] [Table]
[Figure] [Table] [Figure] [Table]
Clean
[Table]
example, HAO improves the attack performance up to 4% in terms of test robustness against homophily defenders.
We hypothesize the reason why HAO also works on disassortative graphs is because GNN can still learn the homophily information implicitly, e.g., similarity between class label distributions (Ma et al., 2022), which we will leave the in-depth analyses to future work.
J D ETAILED R ESULTS OF A TTACK P ERFORMANCE J. D ETAILED R ESULTS OF N ON -T ARGETED A TTACKS
In this section, we present the detailed non-targeted attack results of the methods and datasets used in our experiments for Table 1.
For simplicity, we only give the results of top 20 robust models according to the averaged test accuracy against all attacks.
J. D ETAILED R ESULTS OF T ARGETED A TTACKS
In this section, we present the detailed targeted attack results of the methods and datasets used in our experiments for Table 2.
For simiplicity, we only give the results of top 20 robust models according to the averaged test accuracy against all attacks
[Table] [Table]
[Table] [Table] [Table] [Table]
[Table] [Table] [Table] [Table]
[Table] [Table] [Table] [Table]
[Table] [Table]
TDIGA[-
-]
[Table]
[Table]
[Table]
[Table]
[Table]
[-ATDGIA 
-][Table] [Table] [Table] [Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
TDGIA
[-AVG 61 .
-][Table] [Table] [Table] [Table]
[Table] [Table] [Table] [Table]
ATDIGA
[Table]
[Table]
[Table] [Table] [Table] [Table]
[Table] [Table] [Table]
[Table] [Table] [Table]
[Table] [Table] [Table] [Table]
[Table] [Table] [Table] [Table]