[Paper Review] Adversarial Attacks on Node Embeddings via Graph Poisoning

Aleksandar Bojchevski, Stephan Günnemann|arXiv (Cornell University)|Sep 4, 2018

Adversarial Robustness in Machine LearningComputer Science50 references97 citations

TL;DR

This paper analyzes the robustness of unsupervised node embeddings based on random walks to adversarial graph perturbations and proposes efficient poisoning attacks that degrade embedding quality and transfer across models.

ABSTRACT

The goal of network representation learning is to learn low-dimensional node embeddings that capture the graph structure and are useful for solving downstream tasks. However, despite the proliferation of such methods, there is currently no study of their robustness to adversarial attacks. We provide the first adversarial vulnerability analysis on the widely used family of methods based on random walks. We derive efficient adversarial perturbations that poison the network structure and have a negative effect on both the quality of the embeddings and the downstream tasks. We further show that our attacks are transferable since they generalize to many models and are successful even when the attacker is restricted.

Motivation & Objective

• Assess vulnerability of unsupervised node embeddings (especially DeepWalk-style, RW-based) to adversarial graph perturbations.
• Develop efficient poisoning attack algorithms that operate on graph structure (edges) without features, under a fixed budget.
• Extend analysis to spectral-based embeddings and evaluate transferability of attacks across models.
• Explore targeted attacks (node classification and link prediction) under restricted attack settings.

Proposed method

• Formulate a bi-level attack: maximize embedding loss by perturbing adjacency under a budget while embedding is re-computed after attack.
• Leverage PMI-based interpretation to show DeepWalk corresponds to a rank-K approximation of a co-occurrence matrix, enabling a single-level optimization.
• Use eigenvalue perturbation theory to approximate loss changes without full SVD recomputation (Theorem 1).
• Provide a sparse, closed-form approximation (Theorem 2) to bound changes in the spectrum after a single edge flip, enabling fast evaluation.
• Greedy selection over a candidate set of edge flips to maximize the surrogate loss (L_DW3) with complexity O(|V|·|E| + C|V| log|V|).
• Extend to targeted attacks by approximating target embeddings (Theorem 3) and evaluating misclassification probability (node classification) or AP score (link prediction).

Experimental results

Research questions

• RQ1 Can unsupervised node embeddings based on random walks be meaningfully attacked by perturbing graph structure?
• RQ2 How can one efficiently compute adversarial edge flips in a discrete graph domain without gradient backpropagation through sampling?
• RQ3 Do poisoning attacks transfer across different embedding models and remain effective under attack restrictions?
• RQ4 What is the impact of targeted attacks on downstream tasks like node classification and link prediction?

Key findings

• Adversarial perturbations of edges can significantly degrade embedding quality and downstream task performance compared to baselines.
• A closed-form, gradient-free attack (A_DW3) outperforms gradient-based approaches and closely matches true loss changes.
• Attacks remain effective under restricted budgets and even when only a subset of nodes are targets or candidate edges are limited.
• Targeted attacks can misclassify high-degree nodes and degrade link prediction performance, with notable effects on downstream metrics.
• Attacks show transferability across multiple RW-based and spectral embedding approaches, indicating broader vulnerability.
• Our analyses reveal that adversarial edges are not easily characterized by simple centrality heuristics; effective attacks involve principled spectrum-based perturbations.