Understanding Universal Adversarial Attack and Defense on Graph

作者：Tianfeng Wang, Zhisong Pan, Guyu Hu, Yexin Duan, Yu Pan · 发表于：International Journal on Semantic Web and Information Systems · 年份：2022 · DOI：10.4018/ijswis.308812 · 被引用次数：13 · 研究领域：Adversarial Robustness in Machine Learning、Advanced Graph Neural Networks、Terrorism, Counterterrorism, and Political Violence

Compared with traditional machine learning model, graph neural networks (GNNs) have distinct advantages in processing unstructured data. However, the vulnerability of GNNs cannot be ignored. Graph universal adversarial attack is a special type of attack on graph which can attack any targeted victim by flipping edges connected to anchor nodes. In this paper, we propose the forward-derivative-based graph universal adversarial attack (FDGUA). Firstly, we point out that one node as training data is sufficient to generate an effective continuous attack vector. Then we discretize the continuous attack vector based on forward derivative. FDGUA can achieve impressive attack performance that three anchor nodes can result in attack success rate higher than 80% for the dataset Cora. Moreover, we propose the first graph universal adversarial training (GUAT) to defend against universal adversarial attack. Experiments show that GUAT can effectively improve the robustness of the GNNs without degrading the accuracy of the model.