[论文解读] Towards Reasonable Budget Allocation in Untargeted Graph Structure Attacks via Gradient Debias

Zihan Liu, Luo Yun+3 more|arXiv (Cornell University)|Mar 29, 2023

Adversarial Robustness in Machine Learning被引用 9

一句话总结

该论文揭示在无目标的图结构攻击中，使用负交叉熵作为攻击目标会使梯度偏向低置信度节点，并提出带有简单 GraD 攻击模型的梯度去偏目标，提升灰盒投毒中的攻击效果。

ABSTRACT

It has become cognitive inertia to employ cross-entropy loss function in classification related tasks. In the untargeted attacks on graph structure, the gradients derived from the attack objective are the attacker's basis for evaluating a perturbation scheme. Previous methods use negative cross-entropy loss as the attack objective in attacking node-level classification models. However, the suitability of the cross-entropy function for constructing the untargeted attack objective has yet been discussed in previous works. This paper argues about the previous unreasonable attack objective from the perspective of budget allocation. We demonstrate theoretically and empirically that negative cross-entropy tends to produce more significant gradients from nodes with lower confidence in the labeled classes, even if the predicted classes of these nodes have been misled. To free up these inefficient attack budgets, we propose a simple attack model for untargeted attacks on graph structure based on a novel attack objective which generates unweighted gradients on graph structures that are not affected by the node confidence. By conducting experiments in gray-box poisoning attack scenarios, we demonstrate that a reasonable budget allocation can significantly improve the effectiveness of gradient-based edge perturbations without any extra hyper-parameter.

研究动机与目标

• Motivate: address inefficient budget allocation in untargeted graph structure attacks.
• Analyze how negative cross-entropy causes gradient bias toward low-confidence nodes.
• Propose gradient debias as a new attack objective to balance gradient contributions across nodes.
• Develop GraD, a simple surrogate-model-based attack framework implementing gradient debias.
• Validate GraD through gray-box poisoning experiments across multiple datasets and victim models.

提出的方法

• Use a linear 2-layer GCN surrogate model to generate perturbations.
• Compute A_grad from node-level attack losses via backpropagation.
• Define attack loss using pseudo-labels and node confidences.
• Introduce gradient debias weight lambda_P_i = P_v_i(y_i'|f_theta*)(G) to balance gradients.
• Form L_atk-gd = P_v_i(y_i'|f_theta*) log P_v_i(y_i'|f_theta*), effectively debiasing gradients.
• Evaluate GraD against baselines (Random, DICE, Meta-Train, Meta-Self, EpoAtk) under untargeted gray-box poisoning.

实验结果

研究问题

• RQ1 Does the traditional negative cross-entropy objective lead to inefficient budget allocation in untargeted graph structure attacks?
• RQ2 Can a gradient debias objective equalize node contributions to graph gradients and improve attack effectiveness in gray-box settings?
• RQ3 How does GraD perform across weak and strong transfer scenarios with different victim models?
• RQ4 What is the impact of GraD on the distribution of node confidence in perturbed graphs?
• RQ5 Is GraD robust across multiple datasets (Citeseer, Cora, Cora-ML, Polblogs) and surrogate/victim model pairings?

主要发现

• Negative cross-entropy biases gradients toward low-confidence nodes, causing inefficient budget use.
• Gradient debias (GraD) regularizes gradients so all nodes contribute more evenly to edge perturbations.
• GraD outperforms baselines in untargeted gray-box poisoning across weak-transfer tests (GCN surrogate vs GCN victim).
• In strong-transfer tests (GAT/GraphSage victims), GraD generally maintains superior performance, though gains vary by dataset and victim model.
• GraD reduces extreme high/low confidence node perturbations, leading to more balanced budget allocation.