[论文解读] GNNGuard: Defending Graph Neural Networks against Adversarial Attacks

Xiang Zhang, Marinka Žitnik|arXiv (Cornell University)|Jun 15, 2020

Advanced Graph Neural Networks参考文献 62被引用 122

一句话总结

GNNGuard 是一种通用防御，通过估计邻居重要性并使用层级内存来裁剪或加权边，提升对图的中毒攻击的鲁棒性。

ABSTRACT

Deep learning methods for graphs achieve remarkable performance across a variety of domains. However, recent findings indicate that small, unnoticeable perturbations of graph structure can catastrophically reduce performance of even the strongest and most popular Graph Neural Networks (GNNs). Here, we develop GNNGuard, a general algorithm to defend against a variety of training-time attacks that perturb the discrete graph structure. GNNGuard can be straight-forwardly incorporated into any GNN. Its core principle is to detect and quantify the relationship between the graph structure and node features, if one exists, and then exploit that relationship to mitigate negative effects of the attack.GNNGuard learns how to best assign higher weights to edges connecting similar nodes while pruning edges between unrelated nodes. The revised edges allow for robust propagation of neural messages in the underlying GNN. GNNGuard introduces two novel components, the neighbor importance estimation, and the layer-wise graph memory, and we show empirically that both components are necessary for a successful defense. Across five GNNs, three defense methods, and five datasets,including a challenging human disease graph, experiments show that GNNGuard outperforms existing defense approaches by 15.3% on average. Remarkably, GNNGuard can effectively restore state-of-the-art performance of GNNs in the face of various adversarial attacks, including targeted and non-targeted attacks, and can defend against attacks on heterophily graphs.

研究动机与目标

• 解决 GNN 对扰乱图结构的中毒攻击鲁棒性不足的问题。
• 提供一种可附加到任何 GNN 的通用防御系统，而不改变其核心架构。
• 利用节点特征–结构相关性来识别并缓解伪边，同时保留学习能力。

提出的方法

• 使用节点嵌入之间的余弦相似度计算边级防御系数，以衡量邻居的重要性。
• 通过对边特征向量的学习型非线性变换，概率性裁剪边。
• 引入层级图内存以在各层之间稳定边的裁剪效果。
• 通过用防御系数调整聚合和更新步骤，将防御整合到任意 GNN 中。
• 证明该防御在多种 GNN 类型和攻击场景下均适用。

实验结果

研究问题

• RQ1 GNN 是否可以通过通用防御同时防护定向和非定向的图中毒攻击？
• RQ2 基于邻居的边权重和基于内存的稳定性是否能提升异构 GNN 架构的鲁棒性？
• RQ3 该防御在异质性图和多样数据集上是否有效？

主要发现

• GNNGuard 在五种 GNN、四个数据集和多种攻击下，平均领先三种 state-of-the-art 防御最多达 15.3%。
• 在直接定向、影响定向和非定向攻击下，该防御使强 GNN 的性能恢复到最先进水平。
• 消融实验表明，邻居重要性估计与层级内存对防御有效性和训练稳定性均有贡献。
• 在异质性图上，GNNGuard 仍然有效，显示其在同质性主导图之外的广泛适用性。