[Paper Review] Attacking Graph Convolutional Networks via Rewiring

Yao Ma, Suhang Wang+3 more|arXiv (Cornell University)|Jun 10, 2019

Adversarial Robustness in Machine Learning32 references62 citations

TL;DR

The paper introduces a graph rewiring adversarial attack against GCNs, using reinforcement learning to learn rewiring strategies that perturb graph structure subtly while preserving global graph properties, achieving higher attack success than edge-add/delete baselines on several datasets.

ABSTRACT

Graph Neural Networks (GNNs) have boosted the performance of many graph related tasks such as node classification and graph classification. Recent researches show that graph neural networks are vulnerable to adversarial attacks, which deliberately add carefully created unnoticeable perturbation to the graph structure. The perturbation is usually created by adding/deleting a few edges, which might be noticeable even when the number of edges modified is small. In this paper, we propose a graph rewiring operation which affects the graph in a less noticeable way compared to adding/deleting edges. We then use reinforcement learning to learn the attack strategy based on the proposed rewiring operation. Experiments on real world graphs demonstrate the effectiveness of the proposed framework. To understand the proposed framework, we further analyze how its generated perturbation to the graph structure affects the output of the target model.

Motivation & Objective

• Motivate robust evaluation of GNNs against adversarial structure perturbations.
• Propose a rewiring operation that preserves node/edge counts and minimizes Laplacian perturbations.
• Develop ReWatt, an RL-based attacker that learns rewiring policies under a budget.
• Evaluate attack effectiveness on real-world social graphs and analyze perturbation effects on graph embeddings and outputs.

Proposed method

• Define a rewiring operation: replace an edge (v_fir, v_sec) with (v_fir, v_thi) where v_sec is a 1-hop neighbor and v_thi is a 2-hop neighbor of v_fir.
• Model the attack as a Markov Decision Process with states as intermediate graphs and actions as rewiring operations.
• Use a policy network (three components) to select edges, the first or second node, and the third node for rewiring, based on GCN-derived embeddings.
• Treat attacker as black-box to the target GCN classifier and optimize the policy via policy gradient to maximize attack reward.
• Reward structure: +1 if the attacked graph’s predicted label differs from the original; negative reward per step to encourage shorter attacks.
• Budget for rewiring is proportional to graph size: K = p * |E|, with p in {1%, 2%, 3%}.

Experimental results

Research questions

• RQ1 Can graph rewiring achieve adversarial impact with smaller perceptual changes than edge addition/deletion?
• RQ2 How does RL-learned rewiring compare to existing edge-add/delete attacks in effectiveness under similar budgets?
• RQ3 What is the effect of rewiring on graph Laplacian-based properties and the resulting GCN outputs?
• RQ4 Does flexible budgeting (p * |E|) improve attack success across diverse graph sizes?

Key findings

• ReWatt outperforms RL-S2V and random baselines in attack success across REDDIT-MULTI-12K, REDDIT-MULTI-5K, and IMDB-MULTI datasets for K = 1, 2, 3 at various p values.
• On REDDIT-MULTI-12K, ReWatt achieves 14.4% (K=1) to 38.7% (K=3) success rates; on REDDIT-MULTI-5K it achieves 8.99% to 23.3%; on IMDB-MULTI it attains 23.0% to 23.3% (depending on setup).
• ReWatt-a (without 2-hop constraint) improves performance over ReWatt, indicating greater flexibility yields stronger attacks but potentially more noticeable changes.
• Flexible reward design (ReWatt-n) underperforms compared to the main ReWatt setup, highlighting the benefit of the proposed reward structure.
• Attack perturbations significantly alter graph representations and logits for both succeeded and failed attacks, showing the RL policy meaningfully steers rewiring.
• ReWatt-Random variants show that learned policy contributes to efficiency, requiring fewer rewiring actions to reach similar or better success.