[论文解读] Robust Graph Neural Network Against Poisoning Attacks via Transfer Learning.

Xianfeng Tang, Yandong Li+4 more|arXiv (Cornell University)|Aug 20, 2019

Adversarial Robustness in Machine Learning被引用 9

一句话总结

本文提出PA-GNN，一种鲁棒图神经网络，通过利用相似领域中的干净图来提升对中毒攻击的防御能力。通过元优化，将从扰动干净图中学习到的对抗性边检测知识迁移至中毒目标图，PA-GNN利用学习到的注意力机制对对抗性边施加惩罚，从而在四个真实世界数据集上实现了最先进水平的鲁棒性。

ABSTRACT

Graph neural networks (GNNs) are widely used in many applications. However, their robustness against adversarial attacks is criticized. Prior studies show that using unnoticeable modifications on graph topology or nodal features can significantly reduce the performances of GNNs. It is very challenging to design robust graph neural networks against poisoning attack and several efforts have been taken. Existing work aims at reducing the negative impact from adversarial edges only with the poisoned graph, which is sub-optimal since they fail to discriminate adversarial edges from normal ones. On the other hand, clean graphs from similar domains as the target poisoned graph are usually available in the real world. By perturbing these clean graphs, we create supervised knowledge to train the ability to detect adversarial edges so that the robustness of GNNs is elevated. However, such potential for clean graphs is neglected by existing work. To this end, we investigate a novel problem of improving the robustness of GNNs against poisoning attacks by exploring clean graphs. Specifically, we propose PA-GNN, which relies on a penalized aggregation mechanism that directly restrict the negative impact of adversarial edges by assigning them lower attention coefficients. To optimize PA-GNN for a poisoned graph, we design a meta-optimization algorithm that trains PA-GNN to penalize perturbations using clean graphs and their adversarial counterparts, and transfers such ability to improve the robustness of PA-GNN on the poisoned graph. Experimental results on four real-world datasets demonstrate the robustness of PA-GNN against poisoning attacks on graphs. Code and data are available here: this https URL.

研究动机与目标

• 解决GNN对通过操纵图拓扑或节点特征实施的中毒攻击的脆弱性问题。
• 克服现有方法仅依赖中毒图进行防御的局限性，这些方法缺乏对对抗性边与正常边的区分能力。
• 利用来自相似领域的可用干净图作为监督知识来源，以检测对抗性边。
• 开发一种元优化框架，将干净图中的鲁棒性迁移至中毒目标图。
• 通过施加惩罚的聚合机制提升GNN的鲁棒性，使对抗性边获得更低的注意力权重。

提出的方法

• PA-GNN采用一种施加惩罚的聚合机制，在消息传递过程中降低对抗性边的注意力系数。
• 模型通过一种元优化算法进行训练，该算法在干净图及其对抗性扰动版本之间交替优化。
• 干净图及其对应的扰动版本被用作监督信号，以指导模型区分对抗性边。
• 元优化过程确保模型能将干净数据中的鲁棒性泛化至中毒目标图。
• 该方法通过在干净图数据上初始化模型，并在中毒图上结合对抗性知识进行微调，实现迁移学习。
• 关键组件是基于注意力的聚合机制，并在元优化过程中显式对被识别为对抗性的边施加惩罚。

实验结果

研究问题

• RQ1 能否有效利用来自相似领域的干净图来提升GNN对中毒攻击的鲁棒性？
• RQ2 如何利用干净图中的监督知识来区分对抗性边与正常边？
• RQ3 元优化能否有效将对抗性检测能力从干净图迁移至中毒目标图？
• RQ4 施加惩罚的聚合机制是否通过降低对抗性边的影响来提升GNN的鲁棒性？
• RQ5 在中毒攻击下，PA-GNN与现有防御方法相比在鲁棒性方面表现如何？

主要发现

• PA-GNN在四个真实世界数据集上对中毒攻击实现了最先进水平的鲁棒性。
• 将干净图及其对抗性扰动版本作为监督信号，显著提升了模型检测和缓解对抗性边的能力。
• 元优化框架成功地将干净图中的鲁棒性迁移至中毒目标图。
• 施加惩罚的聚合机制通过为对抗性边分配更低的注意力系数，有效降低了其影响。
• PA-GNN在各种中毒攻击设置下均优于现有防御方法，保持了高性能。
• 该方法表现出强大的泛化能力，尤其在可获得来自相似领域的干净图时更为显著。