{"type":"ScholarlyArticle","title":"Topology Attack and Defense for Graph Neural Networks: An Optimization Perspective","authors":[{"name":"Kaidi Xu","slug":"kaidi-xu","given":"Kaidi","family":"Xu","affiliation":"Electrical & Computer Engineering , Northeastern University , Boston , USA"},{"name":"Hongge Chen","slug":"hongge-chen","given":"Hongge","family":"Chen","affiliation":"Electrical Engineering & Computer Science , Massachusetts Institute of Technology , Cambridge , USA"},{"name":"Sijia Liu","slug":"sijia-liu","given":"Sijia","family":"Liu","affiliation":"MIT-IBM Watson AI Lab , IBM Research"},{"name":"Pin-Yu Chen","slug":"pin-yu-chen","given":"Pin-Yu","family":"Chen","affiliation":"MIT-IBM Watson AI Lab , IBM Research"},{"name":"Tsui-Wei Weng","slug":"tsui-wei-weng","given":"Tsui-Wei","family":"Weng","affiliation":"Electrical Engineering & Computer Science , Massachusetts Institute of Technology , Cambridge , USA"},{"name":"Mingyi Hong","slug":"mingyi-hong","given":"Mingyi","family":"Hong","affiliation":"Electrical & Computer Engineering , University of Minnesota , Minneapolis , USA"},{"name":"Xue Lin","slug":"xue-lin","given":"Xue","family":"Lin","affiliation":"Electrical & Computer Engineering , Northeastern University , Boston , USA"}],"abstract":"Graph neural networks (GNNs) which apply the deep neural networks to graph data have achieved significant performance for the task of semi-supervised node classification. However, only few work has addressed the adversarial robustness of GNNs. In this paper, we first present a novel gradient-based attack method that facilitates the difficulty of tackling discrete graph data. When comparing to current adversarial attacks on GNNs, the results show that by only perturbing a small number of edge perturbations, including addition and deletion, our optimization-based attack can lead to a noticeable decrease in classification performance. Moreover, leveraging our gradient-based attack, we propose the first optimization-based adversarial training for GNNs. Our method yields higher robustness against both different gradient based and greedy attack methods without sacrifice classification accuracy on original graph.","doi":"10.24963/ijcai.2019/550","url":"https://ijcai.org/proceedings/2019/550","pdf":"https://ijcai.org/proceedings/2019/0550.pdf","markdown":"https://ijcai.org/proceedings/2019/550.md","bibtex":"https://ijcai.org/proceedings/2019/bibtex/550","volume":{"slug":"2019","title":"Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2019","url":"https://ijcai.org/proceedings/2019/","year":2019,"location":"Macao","dates":"10-16 August 2019","editors":"Sarit Kraus","isbn":"978-0-9992411-4-1","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2019"},"section":"Machine Learning M-Z","track":"Main track","number":550,"pages":{"first":3961,"last":3967},"keywords":["Machine Learning: Adversarial Machine Learning","Machine Learning: Deep Learning","Machine Learning: Semi-Supervised Learning"],"videos":[],"references":[{"position":1,"raw":"[Bojcheski and Günnemann, 2018] Aleksandar Bojcheski and Stephan Günnemann. Adversarial attacks on node embeddings. arXiv preprint arXiv:1809.01093, 2018.","title":"Adversarial attacks on node embeddings","authors":"Aleksandar Bojcheski, Stephan Günnemann","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Boyd and Vandenberghe, 2004] S. Boyd and L. Vanden- berghe. Convex optimization. Cambridge university press, 2004.","title":"Convex optimization","authors":"S Boyd, L Vandenberghe","year":"2004","venue":null,"doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Carlini and Wagner, 2017] Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In Security and Privacy (SP), 2017 IEEE Symposium on, pages 39-57. IEEE, 2017.","title":"Towards evaluating the robustness of neural networks","authors":"Wagner Carlini, Nicholas Carlini, David Wagner","year":"2017","venue":"Security and Privacy (SP)","doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[Carlini and Wagner, 2018] N. Carlini and D. Wagner. Audio adversarial examples: Targeted attacks on speech-to-text. In 2018 IEEE Security and Privacy Workshops (SPW), pages 1-7. IEEE, 2018.","title":"Audio adversarial examples: Targeted attacks on speech-to-text","authors":"N Carlini, D Wagner","year":"2018","venue":"2018 IEEE Security and Privacy Workshops (SPW)","doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[Chen et al., 2017] R. S. Chen, B. Lucier, Y. Singer, and V. Syrgkanis. Robust optimization for non-convex objec- tives. In NeurIPS, pages 4705-4714, 2017.","title":"Robust optimization for non-convex objectives","authors":"R S Chen, B Lucier, Y Singer, V Syrgkanis","year":"2017","venue":"NeurIPS","doi":null,"url":null,"internal_url":null},{"position":6,"raw":"[Chen et al., 2018a] Hongge Chen, Huan Zhang, Pin-Yu Chen, Jinfeng Yi, and Cho-Jui Hsieh. Attacking visual language grounding with adversarial examples: A case study on neural image captioning. In Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 2587-2597, 2018.","title":"Attacking visual language grounding with adversarial examples: A case study on neural image captioning","authors":"Chen","year":"2018","venue":"Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics","doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[Chen et al., 2018b] Pin-Yu Chen, Yash Sharma, Huan Zhang, Jinfeng Yi, and Cho-Jui Hsieh. EAD: elastic-net attacks to deep neural networks via adversarial examples. AAAI, 2018.","title":"EAD: elastic-net attacks to deep neural networks via adversarial examples","authors":"Chen","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[Dai et al., 2018] H. Dai, H. Li, T. Tian, X. Huang, L. Wang, J. Zhu, and L. Song. Adversarial attack on graph structured data. arXiv preprint arXiv:1806.02371, 2018.","title":"Adversarial attack on graph structured data","authors":"H Dai, H Li, T Tian, X Huang, L Wang, J Zhu, L Song","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[Goodfellow et al., 2015] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In ICLR, 2015.","title":"Explaining and harnessing adversarial examples","authors":"Ian J Goodfellow, Jonathon Shlens, Christian Szegedy","year":"2015","venue":"ICLR","doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[Kipf and Welling, 2016] T. N. Kipf and M. Welling. Semi- supervised classification with graph convolutional net- works. arXiv preprint arXiv:1609.02907, 2016.","title":"Semisupervised classification with graph convolutional networks","authors":"T N Kipf, M Welling","year":"2016","venue":null,"doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[Kurakin et al., 2017] Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial machine learning at scale. In ICLR, 2017.","title":"Adversarial machine learning at scale","authors":"Alexey Kurakin, Ian Goodfellow, Samy Bengio","year":"2017","venue":"ICLR","doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[Liu et al., 2015] S. Liu, S. Kar, M. Fardad, and P. K. Varsh- ney. Sparsity-aware sensor collaboration for linear coher- ent estimation. IEEE Transactions on Signal Processing, 63(10):2582-2596, 2015.","title":"Sparsity-aware sensor collaboration for linear coherent estimation","authors":"S Liu, S Kar, M Fardad, P K Varshney","year":"2015","venue":"IEEE Transactions on Signal Processing","doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[Liu et al., 2016] S. Liu, S. P. Chepuri, M. Fardad, E. Mas ¸azade, G. Leus, and P. K. Varshney. Sensor se- lection for estimation with correlated measurement noise. IEEE Transactions on Signal Processing, 64(13):3509- 3522, 2016.","title":"Sensor selection for estimation with correlated measurement noise","authors":"S Liu, S P Chepuri, M Fardad, E Mas ¸azade, G Leus, P K Varshney","year":"2016","venue":"IEEE Transactions on Signal Processing","doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[Lu et al., 2019a] S. Lu, R. Singh, X. Chen, Y. Chen, and M. Hong. Understand the dynamics of GANs via primal- dual optimization, 2019.","title":"Understand the dynamics of GANs via primaldual optimization","authors":"Lu","year":"2019","venue":null,"doi":null,"url":null,"internal_url":null},{"position":15,"raw":"[Lu et al., 2019b] S. Lu, I. Tsaknakis, and M. Hong. Block alternating optimization for non-convex min-max prob- lems: Algorithms and applications in signal processing and communications. In ICASSP, 2019.","title":"Block alternating optimization for non-convex min-max problems: Algorithms and applications in signal processing and communications","authors":"Lu","year":"2019","venue":"ICASSP","doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[Madry et al., 2017] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083, 2017.","title":"Towards deep learning models resistant to adversarial attacks","authors":"Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, Adrian Vladu","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[Perozzi et al., 2014] Bryan Perozzi, Rami Al-Rfou, and Steven Skiena. Deepwalk: Online learning of social repre- sentations. In Proceedings of the 20th ACM SIGKDD in- ternational conference on Knowledge discovery and data mining, pages 701-710. ACM, 2014.","title":"Deepwalk: Online learning of social representations","authors":"Bryan Perozzi, Rami Al-Rfou, Steven Skiena","year":"2014","venue":"Proceedings of the 20th ACM SIGKDD international conference on Knowledge discovery and data mining","doi":null,"url":null,"internal_url":null},{"position":18,"raw":"[Qian et al., 2018] Qi Qian, Shenghuo Zhu, Jiasheng Tang, Rong Jin, Baigui Sun, and Hao Li. Robust optimization over multiple domains. CoRR, abs/1805.07588, 2018.","title":"Robust optimization over multiple domains","authors":"Shenghuo Qi Qian, Jiasheng Zhu, Rong Tang, Baigui Jin, Hao Sun, Li","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Sen et al., 2008] Prithviraj Sen, Galileo Namata, Mustafa Bilgic, Lise Getoor, Brian Galligher, and Tina Eliassi-Rad. Collective classification in network data. AI magazine, 29(3):93-93, 2008.","title":"Collective classification in network data","authors":"Prithviraj Sen, Galileo Namata, Mustafa Bilgic, Lise Getoor, Brian Galligher, Tina Eliassi-Rad","year":"2008","venue":"AI magazine","doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Veličković et al., 2017] P. Veličković, G. Cucurull, A. Casanova, A. Romero, P. Lio, and Y. Bengio. Graph attention networks. arXiv preprint arXiv:1710.10903, 2017.","title":"Graph attention networks","authors":"P Veličković, G Cucurull, A Casanova, A Romero, P Lio, Y Bengio","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":21,"raw":"[Waniek et al., 2018] Marcin Waniek, Tomasz P Michalak, Michael J Wooldridge, and Talal Rahwan. Hiding individ- uals and communities in a social network. Nature Human Behaviour, 2(2):139, 2018.","title":"Hiding individuals and communities in a social network","authors":"Marcin Waniek, P Tomasz, Michael J Michalak, Talal Wooldridge, Rahwan","year":"2018","venue":"Nature Human Behaviour","doi":null,"url":null,"internal_url":null},{"position":22,"raw":"[Xu et al., 2019a] K. Xu, W. Hu, J. Leskovec, and S. Jegelka. How powerful are graph neural networks? In ICLR, 2019.","title":"How powerful are graph neural networks?","authors":"Xu","year":"2019","venue":"ICLR","doi":null,"url":null,"internal_url":null},{"position":23,"raw":"[Xu et al., 2019b] Kaidi Xu, Sijia Liu, Gaoyuan Zhang, Mengshu Sun, Pu Zhao, Quanfu Fan, Chuang Gan, and Xue Lin. Interpreting adversarial examples by activation promotion and suppression. arXiv preprint arXiv:1904.02057, 2019.","title":"Interpreting adversarial examples by activation promotion and suppression","authors":"Xu","year":"2019","venue":null,"doi":null,"url":null,"internal_url":null},{"position":24,"raw":"[Xu et al., 2019c] Kaidi Xu, Sijia Liu, Pu Zhao, Pin-Yu Chen, Huan Zhang, Quanfu Fan, Deniz Erdogmus, Yanzhi Wang, and Xue Lin. Structured adversarial attack: To- wards general implementation and better interpretability. In International Conference on Learning Representations, 2019.","title":"Structured adversarial attack: Towards general implementation and better interpretability","authors":"Xu","year":"2019","venue":"International Conference on Learning Representations","doi":null,"url":null,"internal_url":null},{"position":25,"raw":"[Zügner et al., 2018] D. Zügner, A. Akbarnejad, and S. Günnemann. Adversarial attacks on neural networks for graph data. In KDD. ACM, 2018.","title":"Adversarial attacks on neural networks for graph data","authors":"D Zügner, A Akbarnejad, S Günnemann","year":"2018","venue":"KDD. ACM","doi":null,"url":null,"internal_url":"/proceedings/2019/872"},{"position":26,"raw":"[Zügner and Günnemann, 2019] Daniel Zügner and Stephan Günnemann. Adversarial attacks on graph neural networks via meta learning. In ICLR, 2019.","title":"Adversarial attacks on graph neural networks via meta learning","authors":"Daniel Zügner, Stephan Günnemann","year":"2019","venue":"ICLR","doi":null,"url":null,"internal_url":null}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}