[Paper Review] Fast Gradient Attack on Network Embedding

Jinyin Chen, Yangyang Wu+4 more|arXiv (Cornell University)|Sep 8, 2018

Advanced Graph Neural Networks46 references135 citations

TL;DR

The paper introduces Fast Gradient Attack (FGA), an adversarial network generator using gradient information from a trained GCN to perturb networks and attack various network embedding methods, achieving high attack success with few modified links and strong transferability.

ABSTRACT

Network embedding maps a network into a low-dimensional Euclidean space, and thus facilitate many network analysis tasks, such as node classification, link prediction and community detection etc, by utilizing machine learning methods. In social networks, we may pay special attention to user privacy, and would like to prevent some target nodes from being identified by such network analysis methods in certain cases. Inspired by successful adversarial attack on deep learning models, we propose a framework to generate adversarial networks based on the gradient information in Graph Convolutional Network (GCN). In particular, we extract the gradient of pairwise nodes based on the adversarial network, and select the pair of nodes with maximum absolute gradient to realize the Fast Gradient Attack (FGA) and update the adversarial network. This process is implemented iteratively and terminated until certain condition is satisfied, i.e., the number of modified links reaches certain predefined value. Comprehensive attacks, including unlimited attack, direct attack and indirect attack, are performed on six well-known network embedding methods. The experiments on real-world networks suggest that our proposed FGA behaves better than some baseline methods, i.e., the network embedding can be easily disturbed using FGA by only rewiring few links, achieving state-of-the-art attack performance.

Motivation & Objective

• Motivate privacy and robustness concerns in network embedding by showing how easily embeddings can be distorted.
• Develop an adversarial network generator that uses gradient information from a GCN to create perturbations.
• Demonstrate FGA’s effectiveness across multiple embedding methods beyond GCN.
• Assess the transferability of GCN-derived perturbations to other network embedding methods.

Proposed method

• Define network embedding and network embedding attack frameworks.
• Train a two-layer GCN and compute the gradient of a target loss with respect to adjacency to form a link gradient network (LGN).
• Iteratively select the pair of nodes with maximum absolute gradient and update the adversarial adjacency by adding/removing the edge according to the gradient sign (Algorithm 1).
• Generate adversarial networks with K modifications to maximize the target node’s loss, creating perturbations that are transferable to other embeddings.
• Evaluate white-box attacks on GCN (direct, indirect, unlimited) and black-box attacks on GraRep, DeepWalk, node2vec, LINE and GraphGAN; compare to baseline methods (RA, DICE, NETTACK).
• Use ASR (attack success rate) and AML (average modified links) as primary metrics across Pol.Blogs, Cora, and Citeseer datasets.

Experimental results

Research questions

• RQ1 Can a GCN-based gradient framework effectively generate adversarial perturbations that mislead target node classifications in network embeddings?
• RQ2 Do perturbations crafted via FGA transfer to other embedding methods beyond GCN?
• RQ3 What is the trade-off between perturbation size (number of modified links) and attack success across different datasets and methods?
• RQ4 How does FGA compare to baseline attacks (RA, DICE, NETTACK) in terms of ASR and AML?
• RQ5 How does attack type (direct vs indirect vs unlimited) affect effectiveness on various network structures?

Key findings

• FGA generally achieves higher attack success rates and requires fewer modified links than baseline attacks across several embedding methods and datasets.
• On Cora and Citeseer, unlimited FGA attains 100% ASR when 20 links are changed per target node in node classification tasks.
• Direct FGA often outperforms NETTACK and DICE, especially on Pol.Blogs, Cora, and Citeseer datasets.
• White-box attacks (targeted at GCN) tend to be slightly more effective than black-box attacks, with fewer link changes needed on average.
• FGA shows strong transferability, enabling effective attacks on GraRep, DeepWalk, node2vec, LINE and GraphGAN despite being derived from a GCN gradient framework.
• Time complexity of FGA is lower than NETTACK for equivalent attack scopes, while maintaining competitive ASR/AML.