[Paper Review] Adversarial Attack on Graph Structured Data

Hanjun Dai, Hui Li+5 more|arXiv (Cornell University)|Jun 6, 2018

Adversarial Robustness in Machine Learning22 references169 citations

TL;DR

This paper studies adversarial attacks on graph neural networks by modifying graph structure, proposing a reinforcement-learning-based attack (RL-S2V) and several white/black-box variants, and evaluating vulnerability on graph-level and node-level tasks with defense insights.

ABSTRACT

Deep learning on graph structures has shown exciting results in various applications. However, few attentions have been paid to the robustness of such models, in contrast to numerous research work for image or text adversarial attack and defense. In this paper, we focus on the adversarial attacks that fool the model by modifying the combinatorial structure of data. We first propose a reinforcement learning based attack method that learns the generalizable attack policy, while only requiring prediction labels from the target classifier. Also, variants of genetic algorithms and gradient methods are presented in the scenario where prediction confidence or gradients are available. We use both synthetic and real-world data to show that, a family of Graph Neural Network models are vulnerable to these attacks, in both graph-level and node-level classification tasks. We also show such attacks can be used to diagnose the learned classifiers.

Motivation & Objective

• Demonstrate that graph neural networks (GNNs) are vulnerable to adversarial modifications of graph structure.
• Develop a generalizable attack policy using reinforcement learning that only needs prediction labels from the target model.
• Provide additional attack methods under varying access levels to the target classifier (white-box and black-box variants).
• Evaluate attack efficacy on synthetic graph-classification tasks and real-world node-classification datasets, and explore defensive strategies.

Proposed method

• Formulate graph adversarial attack as a finite-horizon MDP where actions add or delete edges.
• Introduce hierarchical Q-learning (RL-S2V) with structure2vec (S2V) node embeddings to parameterize Q-functions.
• Provide two-step action decomposition to reduce the quadratic edge-action space to linear complexity.
• Offer additional attack methods: RandSampling (random), GradArgmax (gradient-based white-box), and GeneticAlg (genetic algorithm for black-box).
• Model equivalence constraints I(G, G~, c) to ensure modifications remain within a predefined semantic or neighborhood scope.

Experimental results

Research questions

• RQ1 Can GNNs be reliably fooled by small, structure-only modifications to graphs without changing node features?
• RQ2 How can an attacker learn a transferable policy for graph modification that works across unseen graphs and limited classifier information?
• RQ3 What are effective attack strategies under different information-access scenarios (white-box, practical black-box, restricted black-box) for graph-structured data?

Key findings

• Graph neural networks are vulnerable to adversarial structural modifications in both graph-level and node-level tasks.
• RL-S2V can learn transferable attack policies that generalize to unseen graphs under restricted information settings.
• Gradient-based and genetic-algorithm approaches offer competitive attack capabilities under white-box and practical black-box settings, respectively.
• Defensive strategies via adversarial training (edge dropping) can improve robustness but do not eliminate vulnerability.
• Attacks remain effective across varying graph sizes and propagation depths in GNNs.