[Paper Review] Randomized Message-Interception Smoothing: Gray-box Certificates for Graph Neural Networks

Yan Scholten, Jan Schuchardt+3 more|arXiv (Cornell University)|Jan 5, 2023

Adversarial Robustness in Machine Learning4 citations

TL;DR

This paper proposes gray-box randomized message-interception smoothing for Graph Neural Networks (GNNs), leveraging the message-passing architecture to provide stronger robustness certificates against adversaries controlling entire nodes. By randomly deleting edges or ablating node features, the method computes a smoothed classifier via majority vote, achieving significantly improved certifiable robustness—especially for distant adversarial nodes—while being more efficient than prior methods.

ABSTRACT

Randomized smoothing is one of the most promising frameworks for certifying the adversarial robustness of machine learning models, including Graph Neural Networks (GNNs). Yet, existing randomized smoothing certificates for GNNs are overly pessimistic since they treat the model as a black box, ignoring the underlying architecture. To remedy this, we propose novel gray-box certificates that exploit the message-passing principle of GNNs: We randomly intercept messages and carefully analyze the probability that messages from adversarially controlled nodes reach their target nodes. Compared to existing certificates, we certify robustness to much stronger adversaries that control entire nodes in the graph and can arbitrarily manipulate node features. Our certificates provide stronger guarantees for attacks at larger distances, as messages from farther-away nodes are more likely to get intercepted. We demonstrate the effectiveness of our method on various models and datasets. Since our gray-box certificates consider the underlying graph structure, we can significantly improve certifiable robustness by applying graph sparsification.

Motivation & Objective

• To address the limitations of black-box randomized smoothing in GNNs, which fail to account for the message-passing architecture and produce overly pessimistic robustness certificates.
• To develop a gray-box certification framework that exploits the structural properties of GNNs to provide tighter, more realistic robustness guarantees.
• To enable certification against strong adversaries that can arbitrarily manipulate features of multiple controlled nodes in the graph.
• To improve efficiency and scalability of robustness certification by reducing the number of required Monte Carlo samples through graph sparsification.
• To create a model-agnostic approach that applies to a broad family of message-passing GNNs, unlike white-box methods restricted to specific architectures.

Proposed method

• Proposes a dual smoothing distribution: edge deletion with probability $ p_d $ and node feature ablation with probability $ p_a $, where ablated features are replaced with a learnable token $ m{t} $.
• Constructs a smoothed classifier $ g $ via majority vote over predictions of the base GNN $ f $ under multiple randomized perturbations of the graph $ G $.
• Derives a theoretical bound on label shift $ |p_{v,y}(G) - p_{v,y}(G')| riangleq ext{Pr}(E) $, where $ E $ is the event that at least one message from a perturbed node reaches the target node $ v $.
• Uses the probability $ ext{Pr}(E) $ as an upper bound on label shift, enabling provable robustness certificates under the worst-case assumption that any received adversarial message alters the prediction.
• Applies graph sparsification to reduce the number of messages to intercept, thereby improving certifiable robustness without sacrificing accuracy.
• Employs Monte Carlo sampling to estimate $ p_{v,y}(G) $, with experiments showing certification in under 17 seconds on Cora-ML, significantly faster than prior methods.

Experimental results

Research questions

• RQ1 Can we improve the robustness certificates of GNNs by exploiting their message-passing architecture rather than treating them as black boxes?
• RQ2 How does message-interception smoothing via edge deletion and node ablation affect the probability of adversarial message propagation to a target node?
• RQ3 Can we derive tighter, provable robustness certificates for GNNs under strong threat models where adversaries control entire nodes and manipulate their features arbitrarily?
• RQ4 How does the proposed method compare in efficiency and robustness to existing randomized smoothing and ablation-based certificates for GNNs?
• RQ5 To what extent can graph sparsification enhance certifiable robustness in the proposed framework?

Key findings

• The proposed gray-box certificates significantly outperform existing black-box randomized smoothing methods in certifiable robustness, especially for adversarial attacks at larger distances in the graph.
• The method achieves certifiable robustness against adversaries that control entire nodes and can arbitrarily manipulate their features, a stronger threat model than prior work.
• Certification on Cora-ML is completed in just 17 seconds, a substantial improvement over prior smoothing-based methods that take up to 25 minutes.
• Graph sparsification reduces the number of messages to intercept, leading to stronger certifiable robustness while maintaining high model accuracy.
• The probability $ ext{Pr}(E) $, representing the chance that an adversarial message reaches the target node, serves as a tight upper bound on label shift, enabling effective robustness certification.
• The approach is model-agnostic and applicable to a wide range of message-passing GNNs, unlike white-box certificates that are limited to specific models like GCN.