[Paper Review] Adversarial Attacks on Classification Models for Graphs

Daniel Zügner, Amir Akbarnejad+1 more|arXiv (Cornell University)|May 21, 2018

Advanced Graph Neural Networks12 citations

TL;DR

This paper introduces Nettack, the first adversarial attack framework for graph neural networks targeting both node features and graph structure. It uses incremental computation to generate unnoticeable, transferable perturbations that significantly degrade node classification accuracy with minimal changes, even under limited model knowledge.

ABSTRACT

Deep learning models for graphs have achieved strong performance for the task of node classification. Despite their proliferation, currently there is no study of their robustness to adversarial attacks. Yet, in domains where they are likely to be used, e.g. the web, adversaries are common. Can deep learning models for graphs be easily fooled? In this work, we introduce the first study of adversarial attacks on attributed graphs, specifically focusing on models exploiting ideas of graph convolutions. In addition to attacks at test time, we tackle the more challenging class of poisoning/causative attacks, which focus on the training phase of a machine learning model. We generate adversarial perturbations targeting the node's features and the graph structure, thus, taking the dependencies between instances in account. Moreover, we ensure that the perturbations remain unnoticeable by preserving important data characteristics. To cope with the underlying discrete domain we propose an efficient algorithm Nettack exploiting incremental computations. Our experimental study shows that accuracy of node classification significantly drops even when performing only few perturbations. Even more, our attacks are transferable: the learned attacks generalize to other state-of-the-art node classification models and unsupervised approaches, and likewise are successful even when only limited knowledge about the graph is given.

Motivation & Objective

• To investigate the robustness of graph neural networks against adversarial attacks in real-world settings where adversaries are common.
• To develop a method for crafting adversarial perturbations that modify both node features and graph structure while preserving data characteristics.
• To address the more challenging poisoning/causative attacks during model training, rather than just test-time attacks.
• To ensure perturbations remain unnoticeable by maintaining important data properties such as sparsity and feature distribution.
• To enable transferability of attacks across different state-of-the-art models and unsupervised methods with limited model knowledge.

Proposed method

• Proposes Nettack, an efficient algorithm that leverages incremental computation to handle the discrete nature of graph data and reduce computational cost during attack generation.
• Generates adversarial perturbations targeting both node features and graph structure, explicitly modeling dependencies between nodes in the graph.
• Imposes constraints to preserve key data characteristics—such as sparsity and feature distribution—ensuring perturbations remain unnoticeable to human observers.
• Employs a gradient-based optimization strategy adapted for discrete domains, enabling effective search in the space of possible graph modifications.
• Supports both test-time and poisoning/causative attacks by manipulating training data to degrade model performance.
• Utilizes transferability by crafting attacks that generalize across different models, including unsupervised baselines, even with partial knowledge of the target model.

Experimental results

Research questions

• RQ1 Can graph neural networks be effectively fooled by adversarial attacks that modify both node features and graph structure?
• RQ2 How effective are poisoning attacks that alter training data in degrading the performance of graph classification models?
• RQ3 To what extent do adversarial perturbations remain unnoticeable while still causing significant performance drops?
• RQ4 Can attacks trained on one model successfully transfer to other state-of-the-art models and unsupervised approaches?
• RQ5 How well do attacks perform when only limited information about the target model or graph structure is available?

Key findings

• Adversarial perturbations targeting both node features and graph structure significantly degrade node classification accuracy, even with only a few modifications.
• The proposed attacks are highly transferable, successfully fooling other state-of-the-art node classification models and unsupervised methods.
• Even with limited knowledge of the target model, the attacks remain effective, demonstrating strong generalization capabilities.
• The perturbations are unnoticeable because they preserve key data characteristics such as sparsity and feature distribution.
• Poisoning attacks during training are effective in degrading model performance, highlighting vulnerabilities in the training phase.
• The Nettack algorithm efficiently generates adversarial examples by exploiting incremental computation, reducing computational overhead in discrete domains.