[Paper Review] Can Adversarial Network Attack be Defended?

Chen Jin-yin, Yangyang Wu+2 more|arXiv (Cornell University)|Mar 11, 2019

Adversarial Robustness in Machine Learning51 references21 citations

TL;DR

This paper presents the first comprehensive defense framework against adversarial attacks on graph neural networks (GNNs), introducing novel adversarial training strategies (Global-AT, Target-AT) and smooth defense techniques (smoothing distillation, smoothing cross-entropy loss). These methods reduce adversarial gradient amplitude through gradient smoothing, significantly improving robustness across multiple real-world networks and tasks.

ABSTRACT

Machine learning has been successfully applied to complex network analysis in various areas, and graph neural networks (GNNs) based methods outperform others. Recently, adversarial attack on networks has attracted special attention since carefully crafted adversarial networks with slight perturbations on clean network may invalid lots of network applications, such as node classification, link prediction, and community detection etc. Such attacks are easily constructed with serious security threat to various analyze methods, including traditional methods and deep models. To the best of our knowledge, it is the first time that defense method against network adversarial attack is discussed. In this paper, we are interested in the possibility of defense against adversarial attack on network, and propose defense strategies for GNNs against attacks. First, we propose novel adversarial training strategies to improve GNNs' defensibility against attacks. Then, we analytically investigate the robustness properties for GNNs granted by the use of smooth defense, and propose two special smooth defense strategies: smoothing distillation and smoothing cross-entropy loss function. Both of them are capable of smoothing gradient of GNNs, and consequently reduce the amplitude of adversarial gradients, which benefits gradient masking from attackers. The comprehensive experiments show that our proposed strategies have great defensibility against different adversarial attacks on four real-world networks in different network analyze tasks.

Motivation & Objective

• To investigate the feasibility of defending graph neural networks against adversarial network attacks.
• To address the growing security threat posed by adversarial perturbations in network analysis applications.
• To develop robust defense mechanisms that enhance GNNs' resilience to targeted and iterative attacks like NETTACK and FGA.
• To explore the theoretical and empirical robustness properties of smooth defense in GNNs.
• To evaluate defense strategies across diverse network types and downstream tasks (node classification, community detection, link prediction).

Proposed method

• Proposes Global-AT and Target-AT adversarial training strategies that fine-tune GNNs on adversarial examples to improve generalization and robustness.
• Introduces smoothing distillation, a technique that applies knowledge distillation with smoothed labels to smooth the GNN’s gradient updates.
• Develops a smoothing cross-entropy loss function that regularizes the output distribution to reduce gradient sensitivity to input perturbations.
• Employs gradient smoothing to mask adversarial gradients, making it harder for attackers to compute effective perturbations.
• Uses t-SNE visualization on DeepWalk embeddings to demonstrate the stability of node representations under defense.
• Employs standard GNNs (e.g., GCN) with modified training procedures to integrate both adversarial training and smooth defense components.

Experimental results

Research questions

• RQ1 Can adversarial attacks on graph neural networks be effectively defended using adversarial training and smooth defense?
• RQ2 How do smoothing-based defenses like smoothing distillation and smoothing cross-entropy loss affect the robustness of GNNs?
• RQ3 What is the comparative effectiveness of different defense strategies (e.g., Target-AT, Ensemble, AT) against diverse attack types like FGA and NETTACK?
• RQ4 To what extent do defense mechanisms preserve model performance on clean data while improving robustness?
• RQ5 Can gradient masking through smoothing significantly reduce the success rate of adversarial attacks on real-world networks?

Key findings

• The proposed defense strategies, especially Target-AT and Ensemble, significantly outperform standard adversarial training (AT) across all datasets and tasks.
• Smoothing distillation and smoothing cross-entropy loss effectively reduce the amplitude of adversarial gradients, enhancing gradient masking.
• On the PolBook and Dolphins networks, Target-AT and Ensemble defenses achieved over 90% accuracy in community detection under FGA and NETTACK attacks, while standard AT failed or degraded performance.
• Visualization results show that under Ensemble defense, the node embedding of the target node remains stable even after adversarial link changes, unlike in unprotected models.
• Adversarial training with targeted attacks (Target-AT) provided stronger robustness than global adversarial training (Global-AT), particularly in community detection tasks.
• The combination of adversarial training and smooth defense (e.g., Ensemble) yielded the most consistent and robust performance across all attack types and datasets.