[Paper Review] Adversarial Attacks on Graph Neural Networks via Meta Learning

Daniel Zügner, Stephan Günnemann|arXiv (Cornell University)|Feb 22, 2019

Adversarial Robustness in Machine Learning368 citations

TL;DR

The paper presents a training-time poisoning attack on graph neural networks for node classification using meta-gradients, treating the graph as a hyperparameter to optimize. It shows that small, constrained graph perturbations can substantially degrade performance and transfer across models and tasks.

ABSTRACT

Deep learning models for graphs have advanced the state of the art on many tasks. Despite their recent success, little is known about their robustness. We investigate training time attacks on graph neural networks for node classification that perturb the discrete graph structure. Our core principle is to use meta-gradients to solve the bilevel problem underlying training-time attacks, essentially treating the graph as a hyperparameter to optimize. Our experiments show that small graph perturbations consistently lead to a strong decrease in performance for graph convolutional networks, and even transfer to unsupervised embeddings. Remarkably, the perturbations created by our algorithm can misguide the graph neural networks such that they perform worse than a simple baseline that ignores all relational information. Our attacks do not assume any knowledge about or access to the target classifiers.

Motivation & Objective

• Demonstrate training-time (poisoning) attacks on graph neural networks for node classification without access to the target model.
• Develop a meta-learning based method that optimizes graph structure as a hyperparameter to maximize attack impact.
• Show that small constrained perturbations degrade performance and transfer to different models and tasks.

Proposed method

• Formulate poisoning as a bilevel optimization where the graph is perturbed to maximize attacker loss after training.
• Use meta-gradients to compute how changes in the graph affect the trained model’s performance.
• Relax discreteness to enable gradient-based updates and apply a greedy, per-edge scoring rule to preserve sparsity.
• Employ a surrogate two-layer GCN-like model and evaluate attacks on multiple datasets (Cora-ML, Citeseer, PolBlogs).
• Consider two attacker losses: negative training loss and negative self-labeled loss (transductive setting).
• Offer first-order meta-gradient approximations to reduce computational burden while preserving attack effectiveness.

Experimental results

Research questions

• RQ1 Can poisoning attacks degrade global node classification performance in graphs without access to the target model?
• RQ2 Can meta-gradients be employed to efficiently identify graph perturbations that worsen training outcomes?
• RQ3 Do attacks transfer across different graph neural networks and evaluation tasks (supervised and unsupervised)?

Key findings

• Meta-gradient based attacks substantially increase misclassification rates on unlabeled nodes across datasets and models.
• Self-training synergy (Meta-Self) yields the strongest performance degradation among tested variants.
• Approximate meta-gradient methods (memory-efficient) often match or exceed baselines and remain effective.
• Attacks remain potent under limited knowledge scenarios (subgraphs) and can transfer to unseen models.
• Attacks can reduce performance below a graph-only baseline, highlighting training dynamics as the primary failure vector.