[Paper Review] Data Poisoning Attack against Unsupervised Node Embedding Methods

Mingjie Sun, Jian Tang+5 more|arXiv (Cornell University)|Oct 30, 2018

Adversarial Robustness in Machine Learning23 references45 citations

TL;DR

This paper presents a data poisoning framework that attacks unsupervised graph embedding methods (DeepWalk, LINE) for link prediction, using projected gradient descent to add or remove edges and evaluating integrity and availability attacks with transferability across methods.

ABSTRACT

Unsupervised node embedding methods (e.g., DeepWalk, LINE, and node2vec) have attracted growing interests given their simplicity and effectiveness. However, although these methods have been proved effective in a variety of applications, none of the existing work has analyzed the robustness of them. This could be very risky if these methods are attacked by an adversarial party. In this paper, we take the task of link prediction as an example, which is one of the most fundamental problems for graph analysis, and introduce a data positioning attack to node embedding methods. We give a complete characterization of attacker's utilities and present efficient solutions to adversarial attacks for two popular node embedding methods: DeepWalk and LINE. We evaluate our proposed attack model on multiple real-world graphs. Experimental results show that our proposed model can significantly affect the results of link prediction by slightly changing the graph structures (e.g., adding or removing a few edges). We also show that our proposed model is very general and can be transferable across different embedding methods. Finally, we conduct a case study on a coauthor network to better understand our attack method.

Motivation & Objective

• Motivate robustness concerns for unsupervised graph embeddings used in link prediction.
• Develop a unified optimization framework to perform data poisoning on graphs by adding or removing edges.
• Characterize attacker utilities and constraints for integrity and availability attacks.
• Demonstrate effectiveness, transferability, and case studies on real-world graphs.

Proposed method

• Model unsupervised graph embeddings (DeepWalk, LINE) as implicit matrix factorization (minimize ||R_Omega(Z-XY^T)||_F^2].
• Formulate data poisoning as optimizing edge modifications to maximize attacker utility under two goals: integrity and availability.
• Use a two-step PGD procedure: (1) gradient descent on a weighted adjacency matrix; (2) projection back to binary adjacency by selecting edges to add/delete.
• Compute gradients via backpropagation using first-order KKT conditions to obtain ∇_A L for DeepWalk and LINE.
• Derive gradient components for DeepWalk and LINE from their respective Z definitions (Eq. 1 and Eq. 2) and the chain rule.
• In projection, choose candidate edges based on closeness of A_opt values to 1 (add) or to 0 (delete).

Experimental results

Research questions

• RQ1 How vulnerable are unsupervised graph embeddings (DeepWalk, LINE) to data poisoning attacks?
• RQ2 Can a unified optimization framework effectively degrade link prediction by adding or removing a small number of edges?
• RQ3 Are poisoning perturbations transferable across different embedding methods?
• RQ4 What characteristics of network structure influence attack effectiveness (integrity and availability)?

Key findings

• The proposed Opt-attack framework can significantly alter link prediction scores with only a small number of edge additions or deletions.
• The attack is transferable across different embedding methods (e.g., from DeepWalk/LINE to other methods).
• Experiments on real-world graphs (Facebook, Cora, Citeseer) show stronger performance than random or heuristic baselines for both integrity and availability attacks.
• Direct attacks (modifying edges adjacent to target nodes) and indirect attacks (modifying other edges) are both effective, with edge additions often more impactful than deletions.
• A case study on a coauthor network illustrates how the attack reduces similarity scores for targeted cross-field links and tends to add cross-field edges under availability attacks.