[Paper Review] A Targeted Universal Attack on Graph Convolutional Network

Jiazhu Dai, Weifeng Zhu+1 more|arXiv (Cornell University)|Nov 29, 2020

Adversarial Robustness in Machine Learning20 references4 citations

TL;DR

This paper proposes a targeted universal adversarial attack (TUA) on Graph Convolutional Networks (GCNs) that uses a small number of real attack nodes and fake nodes with perturbed features to misclassify any victim node as the target class. By enhancing attack capability through feature perturbations on fake nodes connected to attack nodes, the method achieves an average attack success rate of 83% with only 3 attack nodes and 6 fake nodes across three benchmark datasets.

ABSTRACT

Graph-structured data exist in numerous applications in real life. As a state-of-the-art graph neural network, the graph convolutional network (GCN) plays an important role in processing graph-structured data. However, a recent study reported that GCNs are also vulnerable to adversarial attacks, which means that GCN models may suffer malicious attacks with unnoticeable modifications of the data. Among all the adversarial attacks on GCNs, there is a special kind of attack method called the universal adversarial attack, which generates a perturbation that can be applied to any sample and causes GCN models to output incorrect results. Although universal adversarial attacks in computer vision have been extensively researched, there are few research works on universal adversarial attacks on graph structured data. In this paper, we propose a targeted universal adversarial attack against GCNs. Our method employs a few nodes as the attack nodes. The attack capability of the attack nodes is enhanced through a small number of fake nodes connected to them. During an attack, any victim node will be misclassified by the GCN as the attack node class as long as it is linked to them. The experiments on three popular datasets show that the average attack success rate of the proposed attack on any victim node in the graph reaches 83% when using only 3 attack nodes and 6 fake nodes. We hope that our work will make the community aware of the threat of this type of attack and raise the attention given to its future defense.

Motivation & Objective

• To address the lack of research on targeted universal adversarial attacks in graph-structured data.
• To expose a new security vulnerability in GCNs where minimal perturbations can universally misclassify any node to a target class.
• To develop a practical and scalable attack method that requires only a few real attack nodes and fake nodes with optimized feature perturbations.
• To evaluate the robustness of GCNs under such attacks using real-world graph datasets.
• To raise awareness of this threat and motivate future defense mechanisms.

Proposed method

• Selects a few real nodes as attack nodes from a target class in the graph.
• Introduces a small number of fake nodes connected to the attack nodes to amplify their influence.
• Computes feature perturbations for the fake nodes using ancillary nodes from non-target classes to maximize attack effectiveness.
• Leverages the GCN’s message-passing mechanism to propagate the adversarial signal, causing any victim node connected to the attack node to be misclassified as the target class.
• Uses iterative optimization to refine the perturbations in the fake node features to maximize attack success rate.
• Employs a universal perturbation strategy that applies to any victim node linked to the attack node, regardless of its original class.

Experimental results

Research questions

• RQ1 Can a targeted universal adversarial attack be effectively constructed for GCNs using minimal real and fake nodes?
• RQ2 How does the number of attack nodes and fake nodes influence the attack success rate?
• RQ3 How stable is the attack performance under random selection of ancillary nodes used for perturbation computation?
• RQ4 What is the maximum achievable attack success rate with a small number of attack and fake nodes?
• RQ5 How does the proposed TUA compare to existing untargeted universal attacks on GCNs?

Key findings

• The proposed targeted universal attack achieves an average attack success rate of 83% on any victim node using only 3 attack nodes and 6 fake nodes.
• The attack success rate increases with more attack nodes but plateaus after 3 attack nodes, indicating diminishing returns.
• Increasing the number of ancillary nodes improves attack success rate, but the gains diminish beyond 15 ancillary nodes.
• The attack performance remains stable under random selection of ancillary nodes, with low standard deviation (e.g., <3.5%) across multiple trials.
• The method demonstrates high robustness and consistency, with average attack success rates exceeding 90% on several classes in Cora and Pubmed when using optimal configurations.
• The attack is effective across three real-world datasets—Cora, Citeseer, and Pubmed—confirming its generalizability.