[论文解读] Adversarial Attack on Hierarchical Graph Pooling Neural Networks

Haoteng Tang, Guixiang Ma+5 more|arXiv (Cornell University)|May 23, 2020

Adversarial Robustness in Machine Learning参考文献 55被引用 22

一句话总结

本文提出了首个针对图分类任务中层次图池化（HGP）神经网络的对抗性攻击框架。通过使用替代模型对池化算子所选择的关键节点进行扰动，该攻击诱导错误的节点保留，仅通过微小且不易察觉的图结构修改，即显著降低模型性能。

ABSTRACT

Recent years have witnessed the emergence and development of graph neural networks (GNNs), which have been shown as a powerful approach for graph representation learning in many tasks, such as node classification and graph classification. The research on the robustness of these models has also started to attract attentions in the machine learning field. However, most of the existing work in this area focus on the GNNs for node-level tasks, while little work has been done to study the robustness of the GNNs for the graph classification task. In this paper, we aim to explore the vulnerability of the Hierarchical Graph Pooling (HGP) Neural Networks, which are advanced GNNs that perform very well in the graph classification in terms of prediction accuracy. We propose an adversarial attack framework for this task. Specifically, we design a surrogate model that consists of convolutional and pooling operators to generate adversarial samples to fool the hierarchical GNN-based graph classification models. We set the preserved nodes by the pooling operator as our attack targets, and then we perturb the attack targets slightly to fool the pooling operator in hierarchical GNNs so that they will select the wrong nodes to preserve. We show the adversarial samples generated from multiple datasets by our surrogate model have enough transferability to attack current state-of-art graph classification models. Furthermore, we conduct the robust train on the target models and demonstrate that the retrained graph classification models are able to better defend against the attack from the adversarial samples. To the best of our knowledge, this is the first work on the adversarial attack against hierarchical GNN-based graph classification models.

研究动机与目标

• 探究层次图池化（HGP）神经网络在图分类任务中的鲁棒性。
• 解决图级别学习模型，特别是基于HGP的架构，在对抗性攻击研究方面的缺失。
• 提出一种可迁移的对抗性攻击策略，针对图池化机制进行破坏，以干扰分类性能。
• 评估对抗性训练在提升HGP模型对这类攻击鲁棒性方面的有效性。

提出的方法

• 设计一个包含卷积和池化操作的替代模型，以生成对抗性样本。
• 将池化操作中保留的节点识别为主要攻击目标。
• 对攻击目标施加微小且不易察觉的扰动，以误导池化算子选择错误的节点。
• 采用贪心搜索策略优化扰动，以最大化误分类率，同时最小化结构变化。
• 通过在多个最先进HGP模型上测试生成的对抗性样本，评估其迁移性。
• 通过混合原始样本与对抗性样本进行再训练，实现鲁棒训练，以提升模型的抗干扰能力。

实验结果

研究问题

• RQ1 对抗性攻击能否有效破坏层次图神经网络在图分类任务中的性能？
• RQ2 在某一HGP模型上生成的对抗性样本对其他最先进HGP模型的迁移性如何？
• RQ3 对抗性训练在多大程度上能提升HGP模型对这类攻击的鲁棒性？
• RQ4 扰动如何影响图的层次结构，以社区结构和中心性度量为指标？

主要发现

• 所提出的攻击框架在多种数据集上成功生成了具有高度迁移性的对抗性样本，适用于多个HGP模型。
• 原始样本与对抗性样本之间节点度分布的平均KL散度较低（如DD数据集上为7.60e-3），表明扰动微小且不易察觉。
• 统计检验（p值 < 0.05）证实了在GRC和CL度量下图层次结构存在显著差异。
• 鲁棒训练显著提升了模型在对抗性测试集上的准确率，且在干净数据上性能下降极小（如DD和Mutagenicity数据集上下降<5%）。
• 对抗性样本导致原始模型分类准确率显著下降，证明了攻击的高有效性。
• 该攻击专门针对池化机制，通过改变被保留的节点，从而削弱模型学习判别性图表示的能力。