[论文解读] Can Adversarial Network Attack be Defended?

Chen Jin-yin, Yangyang Wu+2 more|arXiv (Cornell University)|Mar 11, 2019

Adversarial Robustness in Machine Learning参考文献 51被引用 21

一句话总结

本文提出了首个针对图神经网络（GNNs）对抗攻击的全面防御框架，引入了新颖的对抗训练策略（Global-AT、Target-AT）和平滑防御技术（平滑蒸馏、平滑交叉熵损失）。这些方法通过梯度平滑降低对抗梯度的振幅，显著提升了在多个真实世界网络和任务中的鲁棒性。

ABSTRACT

Machine learning has been successfully applied to complex network analysis in various areas, and graph neural networks (GNNs) based methods outperform others. Recently, adversarial attack on networks has attracted special attention since carefully crafted adversarial networks with slight perturbations on clean network may invalid lots of network applications, such as node classification, link prediction, and community detection etc. Such attacks are easily constructed with serious security threat to various analyze methods, including traditional methods and deep models. To the best of our knowledge, it is the first time that defense method against network adversarial attack is discussed. In this paper, we are interested in the possibility of defense against adversarial attack on network, and propose defense strategies for GNNs against attacks. First, we propose novel adversarial training strategies to improve GNNs' defensibility against attacks. Then, we analytically investigate the robustness properties for GNNs granted by the use of smooth defense, and propose two special smooth defense strategies: smoothing distillation and smoothing cross-entropy loss function. Both of them are capable of smoothing gradient of GNNs, and consequently reduce the amplitude of adversarial gradients, which benefits gradient masking from attackers. The comprehensive experiments show that our proposed strategies have great defensibility against different adversarial attacks on four real-world networks in different network analyze tasks.

研究动机与目标

• 探究图神经网络在对抗性网络攻击下防御的可行性。
• 应对网络分析应用中对抗性扰动日益增长的安全威胁。
• 开发增强GNN对目标攻击和迭代攻击（如NETTACK和FGA）鲁棒性的防御机制。
• 探索平滑防御在GNN中的理论与实证鲁棒性特性。
• 在多种网络类型和下游任务（节点分类、社区检测、链接预测）中评估防御策略。

提出的方法

• 提出Global-AT和Target-AT对抗训练策略，通过在对抗样本上微调GNN以提升泛化能力和鲁棒性。
• 引入平滑蒸馏技术，通过使用平滑标签的知识蒸馏来平滑GNN的梯度更新。
• 开发平滑交叉熵损失函数，通过正则化输出分布来降低梯度对输入扰动的敏感性。
• 采用梯度平滑以掩盖对抗梯度，使攻击者更难计算有效的扰动。
• 利用t-SNE对DeepWalk嵌入进行可视化，以证明节点表示在防御下的稳定性。
• 使用标准GNN（如GCN）并结合修改后的训练流程，集成对抗训练与平滑防御组件。

实验结果

研究问题

• RQ1 能否通过对抗训练和平滑防御有效防御图神经网络的对抗攻击？
• RQ2 基于平滑的防御方法（如平滑蒸馏和平滑交叉熵损失）如何影响GNN的鲁棒性？
• RQ3 不同防御策略（如Target-AT、Ensemble、AT）在应对FGA和NETTACK等多样化攻击类型时的相对有效性如何？
• RQ4 防御机制在提升鲁棒性的同时，对干净数据上模型性能的保持程度如何？
• RQ5 通过平滑实现的梯度掩蔽是否能显著降低对抗攻击在真实世界网络中的成功率？

主要发现

• 所提出的防御策略，尤其是Target-AT和Ensemble，相较于标准对抗训练（AT），在所有数据集和任务中均显著更优。
• 平滑蒸馏和平滑交叉熵损失能有效降低对抗梯度的振幅，增强梯度掩蔽效果。
• 在PolBook和Dolphins网络中，Target-AT和Ensemble防御在FGA和NETTACK攻击下实现了超过90%的社区检测准确率，而标准AT则失败或导致性能下降。
• 可视化结果表明，在Ensemble防御下，目标节点的节点嵌入即使在遭受对抗性链接更改后仍保持稳定，而未受保护的模型则表现出明显波动。
• 与全局对抗训练（Global-AT）相比，使用目标攻击的对抗训练（Target-AT）在社区检测任务中提供了更强的鲁棒性。
• 对抗训练与平滑防御的结合（如Ensemble）在所有攻击类型和数据集中均展现出最一致且最鲁棒的性能。