[Paper Review] Adversarial Immunization for Improving Certifiable Robustness on Graphs

Shuchang Tao, Huawei Shen+3 more|arXiv (Cornell University)|Jul 19, 2020

HIV, Drug Use, Sexual RiskMedicine1 citations

TL;DR

This paper proposes AdvImmune, a bilevel optimization framework that immunizes a small fraction of node pairs in graphs to enhance certifiable robustness against adversarial attacks. By efficiently computing discrete meta-gradients, AdvImmune improves robust node fractions by 12% to 65% with only 5% edge immunization budget on citation and social networks.

ABSTRACT

Despite achieving strong performance in the semi-supervised node classification task, graph neural networks (GNNs) are vulnerable to adversarial attacks, similar to other deep learning models. Existing research works either focus on developing robust GNN models or attack detection methods against attacks on graphs. However, little research attention is paid to the potential and practice of immunization to adversarial attacks on graphs. In this paper, we formulate the problem of graph adversarial immunization as a bilevel optimization problem, i.e., vaccinating an affordable fraction of node pairs, connected or unconnected, to improve the certifiable robustness of the graph against any admissible adversarial attack. We further propose an efficient algorithm, called AdvImmune, which optimizes meta-gradient in a discrete way to circumvent the computationally expensive combinatorial optimization when solving the adversarial immunization problem. Experiments are conducted on two citation networks and one social network. Experimental results demonstrate that the proposed AdvImmune immunization method remarkably improves the fraction of robust nodes by 12%, 42%, 65%, with an affordable immune budget of only 5% edges.

Motivation & Objective

• To address the vulnerability of graph neural networks (GNNs) to adversarial attacks, which remain under-investigated in the context of graph immunization.
• To formulate graph adversarial immunization as a bilevel optimization problem, where a limited number of node pairs are vaccinated to maximize robustness.
• To develop an efficient algorithm that avoids costly combinatorial optimization by leveraging discrete meta-gradient computation.
• To improve certifiable robustness—ensuring model predictions remain stable under any admissible adversarial perturbation—on real-world graph datasets.

Proposed method

• Formulate adversarial immunization as a bilevel optimization problem: the upper-level selects immunized node pairs, and the lower-level trains a robust GNN under adversarial perturbations.
• Introduce a discrete meta-gradient computation strategy to efficiently optimize the upper-level objective without solving the intractable combinatorial subproblem.
• Use a differentiable surrogate for the lower-level robust training, enabling gradient-based updates to the immunization strategy.
• Apply the method to both connected and unconnected node pairs, allowing flexible immunization across the graph structure.
• Optimize the immunization strategy under a constrained budget (e.g., 5% of edges), ensuring practical deployability.
• Leverage the structure of graph GNNs to compute gradients that reflect how immunization affects robustness certification.

Experimental results

Research questions

• RQ1 Can immunizing a small, strategically selected set of node pairs significantly improve the certifiable robustness of GNNs on graphs?
• RQ2 How can adversarial immunization be formulated and optimized efficiently without resorting to expensive combinatorial search?
• RQ3 What is the impact of immunizing both connected and unconnected node pairs on robustness improvement?
• RQ4 How does the proposed method compare in robustness gains when applied under a limited immunization budget?

Key findings

• AdvImmune improves the fraction of certifiably robust nodes by up to 65% on real-world citation and social networks with only a 5% edge immunization budget.
• The method achieves consistent robustness gains across all tested datasets, with improvements of 12%, 42%, and 65% on different networks.
• Discrete meta-gradient computation enables efficient optimization, avoiding the computational infeasibility of full combinatorial search.
• Immunization of unconnected node pairs contributes meaningfully to robustness, indicating that structural immunization is not limited to existing edges.
• The approach maintains strong performance even under strong adversarial attacks, demonstrating effective certification of robustness.
• The results validate that immunization is a viable and effective strategy for enhancing GNN robustness beyond model architecture or detection-based defenses.