{"type":"ScholarlyArticle","title":"Adversarial Examples for Graph Data: Deep Insights into Attack and Defense","authors":[{"name":"Huijun Wu","slug":"huijun-wu","given":"Huijun","family":"Wu","affiliation":"University of New South Wales , Australia; Data61 , CSIRO"},{"name":"Chen Wang","slug":"chen-wang","given":"Chen","family":"Wang","affiliation":"Data61 , CSIRO"},{"name":"Yuriy Tyshetskiy","slug":"yuriy-tyshetskiy","given":"Yuriy","family":"Tyshetskiy","affiliation":"Data61 , CSIRO"},{"name":"Andrew Docherty","slug":"andrew-docherty","given":"Andrew","family":"Docherty","affiliation":"Data61 , CSIRO"},{"name":"Kai Lu","slug":"kai-lu","given":"Kai","family":"Lu","affiliation":"National University of Defense Technology , China"},{"name":"Liming Zhu","slug":"liming-zhu","given":"Liming","family":"Zhu","affiliation":"University of New South Wales , Australia; Data61 , CSIRO"}],"abstract":"Graph deep learning models, such as graph convolutional networks (GCN) achieve state-of-the-art performance for tasks on graph data. However, similar to other deep learning models, graph deep learning models are susceptible to adversarial attacks. However, compared with non-graph data the discrete nature of the graph connections and features provide unique challenges and opportunities for adversarial attacks and defenses.  In this paper, we propose techniques for both an adversarial attack and a defense against adversarial attacks. Firstly, we show that the problem of discrete graph connections and the discrete features of common datasets can be handled by using the integrated gradient technique that accurately determines the effect of changing selected features or edges while still benefiting from parallel computations. In addition, we show that an adversarially manipulated graph using a targeted attack statistically differs from un-manipulated graphs. Based on this observation, we propose a defense approach which can detect and recover a potential adversarial perturbation. Our experiments on a number of datasets show the effectiveness of the proposed techniques.","doi":"10.24963/ijcai.2019/669","url":"https://ijcai.org/proceedings/2019/669","pdf":"https://ijcai.org/proceedings/2019/0669.pdf","markdown":"https://ijcai.org/proceedings/2019/669.md","bibtex":"https://ijcai.org/proceedings/2019/bibtex/669","volume":{"slug":"2019","title":"Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2019","url":"https://ijcai.org/proceedings/2019/","year":2019,"location":"Macao","dates":"10-16 August 2019","editors":"Sarit Kraus","isbn":"978-0-9992411-4-1","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2019"},"section":"Multidisciplinary Topics and Applications","track":"Main track","number":669,"pages":{"first":4816,"last":4823},"keywords":["Machine Learning: Adversarial Machine Learning","Machine Learning: Interpretability","Multidisciplinary Topics and Applications: Security and Privacy"],"videos":[],"references":[{"position":1,"raw":"[Adamic and Glance, 2005] Lada A Adamic and Natalie Glance. The political blogosphere and the 2004 us elec- tion: divided they blog. In Proceedings of the 3rd Interna- tional Workshop on Link Discovery, pages 36-43. ACM, 2005.","title":"The political blogosphere and the 2004 us election: divided they blog","authors":"A Lada, Natalie Adamic, Glance","year":"2005","venue":"Proceedings of the 3rd International Workshop on Link Discovery","doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Allen, 1970] Frances E Allen. Control flow analysis. In ACM Sigplan Notices, volume 5, pages 1-19. ACM, 1970.","title":"Control flow analysis","authors":"Frances E, Allen","year":"1970","venue":"ACM Sigplan Notices","doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Bhagat et al., 2011] Smriti Bhagat, Graham Cormode, and S Muthukrishnan. Node classification in social networks. In Social network data analytics, pages 115-148. Springer, 2011.","title":"Node classification in social networks","authors":"Smriti Bhagat, Graham Cormode, Muthukrishnan","year":"2011","venue":"Social network data analytics","doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[Bojchevski and Günnemann, 2018] Aleksandar Bojchevski and Stephan Günnemann. Deep gaussian embedding of at- tributed graphs: Unsupervised inductive learning via rank- ing. In ICLR'18, 2018.","title":"Deep gaussian embedding of attributed graphs: Unsupervised inductive learning via ranking","authors":"Aleksandar Bojchevski, Stephan Günnemann","year":"2018","venue":"ICLR'18","doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[Bruna et al., 2013] Joan Bruna, Wojciech Zaremba, Arthur Szlam, and Yann LeCun. Spectral networks and lo- cally connected networks on graphs. arXiv preprint arXiv:1312.6203, 2013.","title":"Spectral networks and locally connected networks on graphs","authors":"Joan Bruna, Wojciech Zaremba, Arthur Szlam, Yann Lecun","year":"2013","venue":null,"doi":null,"url":null,"internal_url":null},{"position":6,"raw":"[Cao et al., 2016] Shaosheng Cao, Wei Lu, and Qiongkai Xu. Deep neural networks for learning graph represen- tations. In In AAAI'16, 2016.","title":"Deep neural networks for learning graph representations","authors":"Cao","year":"2016","venue":"AAAI'16","doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[Dai et al., 2018] Hanjun Dai, Hui Li, Tian Tian, Xin Huang, Lin Wang, Jun Zhu, and Le Song. Adversarial attack on graph structured data. In ICML'18, 2018.","title":"Adversarial attack on graph structured data","authors":"Hanjun Dai, Hui Li, Tian Tian, Xin Huang, Lin Wang, Jun Zhu, Le Song","year":"2018","venue":"ICML'18","doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[Edwards and Xie, 2016] Michael Edwards and Xianghua Xie. Graph based convolutional neural network. In BMVC'16, 2016.","title":"Graph based convolutional neural network","authors":"Xie Edwards, Michael Edwards, Xianghua Xie","year":"2016","venue":"BMVC'16","doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[Goodfellow et al., 2015] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In ICLR'15, 2015.","title":"Explaining and harnessing adversarial examples","authors":"Ian J Goodfellow, Jonathon Shlens, Christian Szegedy","year":"2015","venue":"ICLR'15","doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[Hart, 1989] Sergiu Hart. Shapley value. In Game Theory, pages 210-216. Springer, 1989.","title":"Shapley value","authors":"Sergiu Hart","year":"1989","venue":"Game Theory","doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[Henaff et al., 2015] Mikael Henaff, Joan Bruna, and Yann LeCun. Deep convolutional networks on graph-structured data. In NeurIPS'15, 2015.","title":"Deep convolutional networks on graph-structured data","authors":"Mikael Henaff, Joan Bruna, Yann Lecun","year":"2015","venue":"NeurIPS'15","doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[Ian J. Goodfellow, 2014] Christian Szegedy Ian J. Goodfel- low, Jonathon Shlens. Explaining and harnessing adver- sarial examples. arXiv preprint arXiv:1412.06572, 2014.","title":"Explaining and harnessing adversarial examples","authors":"Ian J Goodfellow, Christian Szegedy, Ian J Goodfellow, Jonathon Shlens","year":"2014","venue":null,"doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[Kipf and Welling, 2017] Thomas N Kipf and Max Welling. Semi-supervised classification with graph convolutional networks. In ICLR'17, 2017.","title":"Semi-supervised classification with graph convolutional networks","authors":"N Thomas, Max Kipf, Welling","year":"2017","venue":"ICLR'17","doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[Lundberg and Lee, 2016] Scott Lundberg and Su-In Lee. An unexpected unity among methods for interpreting model predictions. In NeurIPS'16, 2016.","title":"An unexpected unity among methods for interpreting model predictions","authors":"Lee ; Lundberg, Scott Lundberg, Su-In Lee","year":"2016","venue":"NeurIPS'","doi":null,"url":null,"internal_url":null},{"position":15,"raw":"[McCallum et al., 2000] Andrew Kachites McCallum, Ka- mal Nigam, Jason Rennie, and Kristie Seymore. Automat- ing the construction of internet portals with machine learn- ing. Information Retrieval, 3(2):127-163, 2000.","title":"Automating the construction of internet portals with machine learning","authors":"Andrew Kachites Mccallum, Kamal Nigam, Jason Rennie, Kristie Seymore","year":"2000","venue":"Information Retrieval","doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[Newman et al., 2002] Mark EJ Newman, Duncan J Watts, and Steven H Strogatz. Random graph models of social networks. Proceedings of the National Academy of Sci- ences, 99(suppl 1):2566-2572, 2002.","title":"Random graph models of social networks","authors":"Duncan J Mark Ej Newman, Steven H Watts, Strogatz","year":"2002","venue":"Proceedings of the National Academy of Sciences","doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[Papernot and McDaniel, 2018] Nicolas Papernot and Patrick McDaniel. Deep k-nearest neighbors: Towards confident, interpretable and robust deep learning. arXiv preprint arXiv:1803.04765, 2018.","title":"Nicolas Papernot and Patrick McDaniel. Deep k-nearest neighbors: Towards confident, interpretable and robust deep learning","authors":"Mcdaniel Papernot","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":18,"raw":"[Papernot et al., 2016] Nicolas Papernot, Patrick McDaniel, Somesh Jha, Matt Fredrikson, Z Berkay Celik, and Anan- thram Swami. The limitations of deep learning in adver- sarial settings. In Security and Privacy (EuroS&P), 2016 IEEE European Symposium on, pages 372-387. IEEE, 2016.","title":"The limitations of deep learning in adversarial settings","authors":"Nicolas Papernot, Patrick Mcdaniel, Somesh Jha, Matt Fredrikson, Z Berkay Celik, Ananthram Swami","year":"2016","venue":"Security and Privacy (EuroS&P)","doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Ron and Shamir, 2013] Dorit Ron and Adi Shamir. Quan- titative analysis of the full bitcoin transaction graph. In International Conference on Financial Cryptography and Data Security, pages 6-24. Springer, 2013.","title":"Quantitative analysis of the full bitcoin transaction graph","authors":"Ron, Shamir, Dorit Ron, Adi Shamir","year":"2013","venue":"International Conference on Financial Cryptography and Data Security","doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Shaham et al., 2018] Uri Shaham, James Garritano, Yutaro Yamada, Ethan Weinberger, Alex Cloninger, Xiuyuan Cheng, Kelly Stanton, and Yuval Kluger. Defending against adversarial images using basis functions transfor- mations. arXiv preprint arXiv:1803.10840, 2018.","title":"Defending against adversarial images using basis functions transformations","authors":"Shaham","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":21,"raw":"[Sundararajan et al., 2017] Mukund Sundararajan, Ankur Taly, and Qiqi Yan. Axiomatic attribution for deep net- works. In ICML'17, 2017.","title":"Axiomatic attribution for deep networks","authors":"Mukund Sundararajan, Ankur Taly, Qiqi Yan","year":"2017","venue":"ICML'17","doi":null,"url":null,"internal_url":null},{"position":22,"raw":"[Tramèr et al., 2018] Florian Tramèr, Alexey Kurakin, Nico- las Papernot, Ian Goodfellow, Dan Boneh, and Patrick Mc- Daniel. Ensemble adversarial training: Attacks and de- fenses. In ICLR'18, 2018.","title":"Ensemble adversarial training: Attacks and defenses","authors":"Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, Patrick Mc-Daniel","year":"2018","venue":"ICLR'18","doi":null,"url":null,"internal_url":null},{"position":23,"raw":"[Veličković et al., 2018] Petar Veličković, Guillem Cucurull, Arantxa Casanova, Adriana Romero, Pietro Lio, and Yoshua Bengio. Graph attention networks. In ICLR'18, 2018.","title":"Graph attention networks","authors":"Petar Veličković, Guillem Cucurull, Arantxa Casanova, Adriana Romero, Pietro Lio, Yoshua Bengio","year":"2018","venue":"ICLR'18","doi":null,"url":null,"internal_url":null},{"position":24,"raw":"[Wu et al., 2019] Felix Wu, Tianyi Zhang, Amauri Holanda Souza Jr., Christopher Fifty, Tao Yu, and Kilian Q. Wein- berger. Simplifying graph convolutional networks. arXiv preprint arXiv:1902.07153, 2019.","title":"Simplifying graph convolutional networks","authors":"Felix Wu, Tianyi Zhang, Holanda Amauri, Christopher Souza, Tao Fifty, Kilian Q Yu, Weinberger","year":"2019","venue":null,"doi":null,"url":null,"internal_url":null},{"position":25,"raw":"[Xie et al., 2018] Cihang Xie, Jianyu Wang, Zhishuai Zhang, Zhou Ren, and Alan Yuille. Mitigating adversarial effects through randomization. In ICLR'18, 2018.","title":"Mitigating adversarial effects through randomization","authors":"Cihang Xie, Jianyu Wang, Zhishuai Zhang, Alan Zhou Ren, Yuille","year":"2018","venue":"ICLR'18","doi":null,"url":null,"internal_url":null},{"position":26,"raw":"[Xu et al., 2013] Huan Xu, Yujiu Yang, Liangwei Wang, and Wenhuang Liu. Node classification in social network via a factor graph model. In Pacific-Asia Conference on Knowledge Discovery and Data Mining, pages 213-224. Springer, 2013.","title":"Node classification in social network via a factor graph model","authors":"Huan Xu, Yujiu Yang, Liangwei Wang, Wenhuang Liu","year":"2013","venue":"Pacific-Asia Conference on Knowledge Discovery and Data Mining","doi":null,"url":null,"internal_url":null},{"position":27,"raw":"[Xu et al., 2018] Weilin Xu, David Evans, and Yanjun Qi. Feature squeezing: Detecting adversarial examples in deep neural networks. In NDSS'18, 2018.","title":"Feature squeezing: Detecting adversarial examples in deep neural networks","authors":"Weilin Xu, David Evans, Yanjun Qi","year":"2018","venue":"NDSS'18","doi":null,"url":null,"internal_url":null},{"position":28,"raw":"[Yuan et al., 2019] Xiaoyong Yuan, Pan He, Qile Zhu, and Xiaolin Li. Adversarial examples: Attacks and defenses for deep learning. IEEE Transactions on Neural Networks and Learning Systems, 2019.","title":"Adversarial examples: Attacks and defenses for deep learning","authors":"Xiaoyong Yuan, Pan He, Qile Zhu, Xiaolin Li","year":"2019","venue":"IEEE Transactions on Neural Networks and Learning Systems","doi":null,"url":null,"internal_url":null},{"position":29,"raw":"[Zügner et al., 2018] Daniel Zügner, Amir Akbarnejad, and Stephan Günnemann. Adversarial attacks on neural net- works for graph data. In Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discov- ery & Data Mining, pages 2847-2856. ACM, 2018.","title":"Adversarial attacks on neural networks for graph data","authors":"Daniel Zügner, Amir Akbarnejad, Stephan Günnemann","year":"2018","venue":"Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining","doi":null,"url":null,"internal_url":"/proceedings/2019/872"}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}