[Paper Review] Adversarial Defense Framework for Graph Neural Network

Shen Wang, Zhengzhang Chen+5 more|arXiv (Cornell University)|May 9, 2019

Adversarial Robustness in Machine Learning22 references21 citations

TL;DR

This paper proposes DefNet, a novel adversarial defense framework for Graph Neural Networks (GNNs) that addresses layer-specific vulnerabilities through dual-stage aggregation and bottleneck perceptron, while leveraging conditional GAN-based adversarial contrastive learning to enhance robustness. Experiments show DefNet significantly improves GNN robustness under various attacks, achieving up to 65% accuracy under FGSM attacks where standard GNNs drop to 3%.

ABSTRACT

Graph neural network (GNN), as a powerful representation learning model on graph data, attracts much attention across various disciplines. However, recent studies show that GNN is vulnerable to adversarial attacks. How to make GNN more robust? What are the key vulnerabilities in GNN? How to address the vulnerabilities and defense GNN against the adversarial attacks? In this paper, we propose DefNet, an effective adversarial defense framework for GNNs. In particular, we first investigate the latent vulnerabilities in every layer of GNNs and propose corresponding strategies including dual-stage aggregation and bottleneck perceptron. Then, to cope with the scarcity of training data, we propose an adversarial contrastive learning method to train the GNN in a conditional GAN manner by leveraging the high-level graph representation. Extensive experiments on three public datasets demonstrate the effectiveness of DefNet in improving the robustness of popular GNN variants, such as Graph Convolutional Network and GraphSAGE, under various types of adversarial attacks.

Motivation & Objective

• To identify and address latent vulnerabilities in GNN layers, particularly in aggregation and perceptron components.
• To overcome the challenge of discrete adversarial space in graph data, which hinders effective adversarial data augmentation.
• To improve GNN robustness against various adversarial attacks, including structural and feature-based perturbations.
• To develop a scalable defense framework applicable to popular GNN variants like GCN and GraphSAGE.

Proposed method

• Introduces dual-stage aggregation to stabilize node representation learning by decoupling neighborhood message passing.
• Employs bottleneck perceptrons to reduce input dimensionality and mitigate adversarial vulnerability linked to high-dimensional inputs.
• Proposes adversarial contrastive learning (ACL) that models adversarial training as a conditional GAN using high-level graph representations as auxiliary supervision.
• Leverages high-level graph representations to guide the generation of effective, graph-structured adversarial samples for data augmentation.
• Trains GNNs in a conditional GAN manner, where the generator produces adversarial examples conditioned on the graph’s high-level structure.
• Combines the GER (Graph Encoder Refining) and ACL (Adversarial Contrastive Learning) modules into a unified defense framework, DefNet.

Experimental results

Research questions

• RQ1 What are the key architectural vulnerabilities in GNNs that make them susceptible to adversarial attacks?
• RQ2 How can adversarial training be effectively adapted to discrete graph data with combinatorial structure?
• RQ3 Can conditional GANs be used to generate meaningful adversarial examples for graph data to improve robustness?
• RQ4 How does the proposed defense framework compare to standard adversarial training and baseline defenses on real-world graph datasets?
• RQ5 To what extent does DefNet improve robustness across different GNN variants under diverse attack types?

Key findings

• DefNet significantly improves GNN robustness, achieving 65% accuracy under FGSM attacks on Cora, compared to only 3% for standard GCN.
• The ACL module outperforms traditional adversarial training and noise contrastive learning across all datasets and GNN variants.
• Dual-stage aggregation and bottleneck perceptron improve model stability and reduce vulnerability to high-dimensional input perturbations.
• On Polblogs, RGCN with ACL achieves 74% accuracy under attack, compared to 18% for standard RGCN, demonstrating strong defense performance.
• The framework maintains high performance across multiple GNN variants, including GCN and GraphSage, under both targeted and non-targeted attacks.
• The ablation study confirms that both GER and ACL modules contribute significantly to the overall defense performance, with the best results achieved when combined.