[Paper Review] Understanding Structural Vulnerability in Graph Convolutional Networks

Liang Chen, Jintang Li+4 more|arXiv (Cornell University)|Aug 13, 2021

Advanced Graph Neural Networks28 references4 citations

TL;DR

This paper identifies the non-robust weighted mean aggregation in Graph Convolutional Networks (GCNs) as the root cause of structural vulnerability to adversarial attacks. By replacing it with high-breakdown-point aggregators like median and trimmed mean, the authors achieve state-of-the-art robustness against both direct and indirect structural attacks without sacrificing predictive accuracy, validated across four real-world datasets.

ABSTRACT

Recent studies have shown that Graph Convolutional Networks (GCNs) are vulnerable to adversarial attacks on the graph structure. Although multiple works have been proposed to improve their robustness against such structural adversarial attacks, the reasons for the success of the attacks remain unclear. In this work, we theoretically and empirically demonstrate that structural adversarial examples can be attributed to the non-robust aggregation scheme (i.e., the weighted mean) of GCNs. Specifically, our analysis takes advantage of the breakdown point which can quantitatively measure the robustness of aggregation schemes. The key insight is that weighted mean, as the basic design of GCNs, has a low breakdown point and its output can be dramatically changed by injecting a single edge. We show that adopting the aggregation scheme with a high breakdown point (e.g., median or trimmed mean) could significantly enhance the robustness of GCNs against structural attacks. Extensive experiments on four real-world datasets demonstrate that such a simple but effective method achieves the best robustness performance compared to state-of-the-art models.

Motivation & Objective

• To understand why GCNs are vulnerable to structural adversarial attacks despite their success in node classification.
• To identify the root cause of this vulnerability, focusing on the aggregation mechanism in GCNs.
• To propose a theoretically grounded, simple method to enhance GCN robustness using robust aggregation functions.
• To validate that high-breakdown-point aggregators like median and trimmed mean significantly improve robustness under targeted structural attacks.

Proposed method

• Theoretical analysis using breakdown point theory to quantify the robustness of aggregation functions, showing that weighted mean has a low breakdown point.
• Replacing the standard weighted mean aggregation in GCNs with median or trimmed mean aggregation, both of which have high breakdown points.
• Using the breakdown point as a formal measure to compare the sensitivity of different aggregation functions to edge perturbations.
• Evaluating robustness via targeted evasion attacks (NETTACK) with varying perturbation budgets on four real-world datasets.
• Employing a composite robustness metric ∑ₚ₌₁⁵ q × p_q to holistically assess model performance across different attack strengths.
• Conducting ablation studies comparing the proposed aggregators against GCN, RGCN, SimPGCN, and other SOTA models under both direct and indirect attacks.

Experimental results

Research questions

• RQ1 Why are Graph Convolutional Networks vulnerable to structural adversarial attacks despite their strong performance in node classification?
• RQ2 How does the choice of aggregation function in GCNs influence their robustness to edge perturbations?
• RQ3 Can aggregation functions with high breakdown points, such as median or trimmed mean, significantly improve GCN robustness against structural attacks?
• RQ4 Does replacing the standard weighted mean aggregation with a more robust alternative lead to improved robustness without sacrificing predictive accuracy?

Key findings

• The weighted mean aggregation in GCNs has a low breakdown point, making it highly sensitive to small structural perturbations, which explains the core vulnerability.
• Median and trimmed mean aggregators exhibit high breakdown points, enabling them to resist adversarial edge injections that disrupt standard GCNs.
• On four real-world datasets (Cora, Citeseer, Pubmed, and Reddit), median aggregation outperforms all baselines under direct attacks and matches or exceeds them under indirect attacks.
• The proposed method achieves state-of-the-art robustness with no drop in accuracy, even under perturbation budgets up to 5, demonstrating that robust aggregation is both effective and practical.
• The robustness metric ∑ₚ₌₁⁵ q × p_q shows that models using median or trimmed mean maintain high performance across all perturbation levels, especially when the budget is small (e.g., 1 or 2).
• The results confirm that the attention mechanism in RGCN does not outperform simple robust aggregators, indicating that robustness is more dependent on aggregation design than complex attention mechanisms.