[논문 리뷰] Towards Reasonable Budget Allocation in Untargeted Graph Structure Attacks via Gradient Debias

Zihan Liu, Luo Yun외 3명|arXiv (Cornell University)|2023. 03. 29.

Adversarial Robustness in Machine Learning인용 수 9

한 줄 요약

본 논문은 비목표 그래프 구조 공격에서 공격 목표로 negative cross-entropy를 사용할 때 그래디언트 편향이 낮 신뢰도 노드로 치우친다는 것을 밝혀내고, 간단한 GraD 공격 모델과 함께 그래디언트 디바이즈(gradient debias) 목표를 제안하여 gray-box poisoning에서 공격 효과를 향상시킨다.

ABSTRACT

It has become cognitive inertia to employ cross-entropy loss function in classification related tasks. In the untargeted attacks on graph structure, the gradients derived from the attack objective are the attacker's basis for evaluating a perturbation scheme. Previous methods use negative cross-entropy loss as the attack objective in attacking node-level classification models. However, the suitability of the cross-entropy function for constructing the untargeted attack objective has yet been discussed in previous works. This paper argues about the previous unreasonable attack objective from the perspective of budget allocation. We demonstrate theoretically and empirically that negative cross-entropy tends to produce more significant gradients from nodes with lower confidence in the labeled classes, even if the predicted classes of these nodes have been misled. To free up these inefficient attack budgets, we propose a simple attack model for untargeted attacks on graph structure based on a novel attack objective which generates unweighted gradients on graph structures that are not affected by the node confidence. By conducting experiments in gray-box poisoning attack scenarios, we demonstrate that a reasonable budget allocation can significantly improve the effectiveness of gradient-based edge perturbations without any extra hyper-parameter.

연구 동기 및 목표

• Motivate: address inefficient budget allocation in untargeted graph structure attacks.
• Analyze how negative cross-entropy causes gradient bias toward low-confidence nodes.
• Propose gradient debias as a new attack objective to balance gradient contributions across nodes.
• Develop GraD, a simple surrogate-model-based attack framework implementing gradient debias.
• Validate GraD through gray-box poisoning experiments across multiple datasets and victim models.

제안 방법

• Use a linear 2-layer GCN surrogate model to generate perturbations.
• Compute A_grad from node-level attack losses via backpropagation.
• Define attack loss using pseudo-labels and node confidences.
• Introduce gradient debias weight lambda_P_i = P_v_i(y_i'|f_theta*)(G) to balance gradients.
• Form L_atk-gd = P_v_i(y_i'|f_theta*) log P_v_i(y_i'|f_theta*), effectively debiasing gradients.
• Evaluate GraD against baselines (Random, DICE, Meta-Train, Meta-Self, EpoAtk) under untargeted gray-box poisoning.

실험 결과

연구 질문

• RQ1 Does the traditional negative cross-entropy objective lead to inefficient budget allocation in untargeted graph structure attacks?
• RQ2 Can a gradient debias objective equalize node contributions to graph gradients and improve attack effectiveness in gray-box settings?
• RQ3 How does GraD perform across weak and strong transfer scenarios with different victim models?
• RQ4 What is the impact of GraD on the distribution of node confidence in perturbed graphs?
• RQ5 Is GraD robust across multiple datasets (Citeseer, Cora, Cora-ML, Polblogs) and surrogate/victim model pairings?

주요 결과

• Negative cross-entropy biases gradients toward low-confidence nodes, causing inefficient budget use.
• Gradient debias (GraD) regularizes gradients so all nodes contribute more evenly to edge perturbations.
• GraD outperforms baselines in untargeted gray-box poisoning across weak-transfer tests (GCN surrogate vs GCN victim).
• In strong-transfer tests (GAT/GraphSage victims), GraD generally maintains superior performance, though gains vary by dataset and victim model.
• GraD reduces extreme high/low confidence node perturbations, leading to more balanced budget allocation.