[Paper Review] Certifiable Robustness to Graph Perturbations

Aleksandar Bojchevski, Stephan Günnemann|arXiv (Cornell University)|Oct 31, 2019

Adversarial Robustness in Machine LearningComputer Science52 citations

TL;DR

The paper introduces certifiable robustness guarantees for graph perturbations applicable to graph neural networks and label/feature propagation, using PageRank-based certificates and robust training.

ABSTRACT

Despite the exploding interest in graph neural networks there has been little effort to verify and improve their robustness. This is even more alarming given recent findings showing that they are extremely vulnerable to adversarial attacks on both the graph structure and the node attributes. We propose the first method for verifying certifiable (non-)robustness to graph perturbations for a general class of models that includes graph neural networks and label/feature propagation. By exploiting connections to PageRank and Markov decision processes our certificates can be efficiently (and under many threat models exactly) computed. Furthermore, we investigate robust training procedures that increase the number of certifiably robust nodes while maintaining or improving the clean predictive accuracy.

Motivation & Objective

• Motivate and quantify robustness of graph-based models against adversarial perturbations of graph structure.
• Provide efficient, exact certificates for certifiable robustness under local budgets and exact or lower-bound certificates under global budgets.
• Develop robust training procedures that improve robustness without sacrificing clean accuracy.

Proposed method

• Model predictions as a linear function of personalized PageRank, enabling certificates for robustness under graph perturbations.
• Define threat models with fixed and fragile edges and global/local perturbation budgets.
• Transform the robustness certification into a linear optimization over PageRank under budget constraints, with an exact solution for local budgets via policy iteration.
• Extend to global budgets by formulating an auxiliary graph MDP and solving a quadratically constrained linear program (QCLP) using Reformulation Linearization Technique (RLT) to obtain a lower bound.
• Provide an exact certificate when only local budgets are considered, and a computationally tractable bound when global budgets are included.
• Propose robust training losses that leverage worst-case margins to improve robustness during training.

Experimental results

Research questions

• RQ1 Can we certify whether a node's prediction is robust to all admissible perturbations of fragile edges under given budgets?
• RQ2 How can we efficiently compute certificates for local perturbations, and how can we obtain tractable bounds under global budgets?
• RQ3 Can robustness certificates be used to guide training to improve model resilience without harming clean accuracy?

Key findings

• Exact certificates are computable for local budgets, allowing determination of certifiable robustness for target nodes.
• Global budget scenarios are NP-hard, but a lower bound on worst-case margins can be efficiently computed via an auxiliary-graph MDP and QCLP with RLT relaxation.
• Robust training using worst-case margins can improve robustness while maintaining or improving clean accuracy.
• The method applies broadly to a class of models where predictions are linear in personalized PageRank, including GNNs and label/feature propagation.
• Experiments on benchmark graphs demonstrate the viability of certifiable robustness and robustness-enhancing training.