[Paper Review] Topology Attack and Defense for Graph Neural Networks: An Optimization Perspective

Kaidi Xu, Hongge Chen+5 more|arXiv (Cornell University)|Jun 10, 2019

Adversarial Robustness in Machine LearningComputer Science24 references81 citations

TL;DR

The paper introduces gradient-based topology attacks for Graph Neural Networks by convex-relaxing edge perturbations, and proposes an optimization-based adversarial training method to improve robustness against such attacks. It shows effectiveness on Cora and Citeseer with limited edge perturbations and demonstrates robustness gains from adversarial training.

ABSTRACT

Graph neural networks (GNNs) which apply the deep neural networks to graph data have achieved significant performance for the task of semi-supervised node classification. However, only few work has addressed the adversarial robustness of GNNs. In this paper, we first present a novel gradient-based attack method that facilitates the difficulty of tackling discrete graph data. When comparing to current adversarial attacks on GNNs, the results show that by only perturbing a small number of edge perturbations, including addition and deletion, our optimization-based attack can lead to a noticeable decrease in classification performance. Moreover, leveraging our gradient-based attack, we propose the first optimization-based adversarial training for GNNs. Our method yields higher robustness against both different gradient based and greedy attack methods without sacrificing classification accuracy on original graph.

Motivation & Objective

• Motivate and formalize topology attacks on GNNs where edges are added or removed under a perturbation budget.
• Develop first-order optimization methods (PGD and min-max attacks) to generate effective topology perturbations.
• Propose adversarial training for GNNs to improve robustness against topology attacks without losing original accuracy.
• Provide theoretical and algorithmic tools to handle discrete graph perturbations via convex relaxation and projection methods.

Proposed method

• Model edge perturbations with a Boolean symmetric perturbation matrix S and relax to continuous s in [0,1]^n for tractable optimization.
• Define attack losses (CE-type and CW-type) for node-level misclassification and formulate attack problems under two threat models: fixed-weight GNN and re-trainable GNN.
• Develop PGD-based topology attack with projection onto the perturbation set, including a closed-form projection operator (Proposition 1).
• Develop min-max topology attack using alternating optimization to handle inner weight retraining and outer edge perturbation updates (Algorithm 3).
• Propose adversarial training (minimax) to robustify GNNs by training W against worst-case perturbations (Algorithm 4).
• Ground the methods in spectral graph theory and robust optimization principles.

Experimental results

Research questions

• RQ1 How can topology perturbations be optimally generated for GNNs within a limited edge-change budget?
• RQ2 Can first-order optimization (PGD, min-max) produce strong topology attacks under edge-disruption budgets, and how do they compare with existing attacks?
• RQ3 Does adversarial training based on these topology attacks improve GNN robustness without sacrificing accuracy on clean graphs?
• RQ4 What is the relationship between fixed-weight attacks and retrainable-weight attacks in terms of effectiveness and defense?

Key findings

• Gradient-based topology attacks outperform several state-of-the-art methods under the same perturbation budget (5% of edges) on Cora and Citeseer.
• PGD-based attacks converge steadily with iterations, demonstrating effective attack loss reduction.
• Min-max topology attacks perform competitively against retrained-model attacks, especially for interactive GCN settings.
• Adversarial training yields notable robustness gains against gradient-based and greedy topology attacks without degrading test accuracy on the original graph.
• Robust models exhibit lower attack success rates across CE-PGD, CW-PGD, and Greedy attacks, with robustness improving as the perturbation budget ε increases (5%–20%).