{"type":"ScholarlyArticle","title":"Adversarial Attacks on Neural Networks for Graph Data","authors":[{"name":"Daniel Zügner","slug":"daniel-zugner","given":"Daniel","family":"Zügner","affiliation":"Technical University of Munich"},{"name":"Amir Akbarnejad","slug":"amir-akbarnejad","given":"Amir","family":"Akbarnejad","affiliation":"Technical University of Munich"},{"name":"Stephan Günnemann","slug":"stephan-gunnemann","given":"Stephan","family":"Günnemann","affiliation":"Technical University of Munich"}],"abstract":"Deep learning models for graphs have achieved strong performance for the task of node classification. Despite their proliferation, currently there is no study of their robustness to adversarial attacks. Yet, in domains where they are likely to be used, e.g. the web, adversaries are common. Can deep learning models for graphs be easily fooled? In this extended abstract we summarize the key findings and contributions of our work, in which we introduce the first study of adversarial attacks on attributed graphs, specifically focusing on models exploiting ideas of graph convolutions. In addition to attacks at test time, we tackle the more challenging class of poisoning/causative attacks, which focus on the training phase of a machine learning model. We generate adversarial perturbations targeting the node's features and the graph structure, thus, taking the dependencies between instances in account. Moreover, we ensure that the perturbations remain unnoticeable by preserving important data characteristics. To cope with the underlying discrete domain we propose an efficient algorithm Nettack exploiting incremental computations. Our experimental study shows that accuracy of node classification significantly drops even when performing only few perturbations. Even more, our attacks are transferable: the learned attacks generalize to other state-of-the-art node classification models and unsupervised approaches, and likewise are successful given only limited knowledge about the graph.","doi":"10.24963/ijcai.2019/872","url":"https://ijcai.org/proceedings/2019/872","pdf":"https://ijcai.org/proceedings/2019/0872.pdf","markdown":"https://ijcai.org/proceedings/2019/872.md","bibtex":"https://ijcai.org/proceedings/2019/bibtex/872","volume":{"slug":"2019","title":"Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2019","url":"https://ijcai.org/proceedings/2019/","year":2019,"location":"Macao","dates":"10-16 August 2019","editors":"Sarit Kraus","isbn":"978-0-9992411-4-1","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2019"},"section":"Best Sister Conferences","track":"Best Sister Conferences","number":872,"pages":{"first":6246,"last":6250},"keywords":["Machine Learning: Relational Learning","Machine Learning: Semi-Supervised Learning","Machine Learning: Adversarial Machine Learning","Machine Learning: Deep Learning"],"videos":[],"references":[{"position":1,"raw":"[Adamic and Glance, 2005] Lada A Adamic and Natalie Glance. The political blogosphere and the 2004 US elec- tion: divided they blog. In International workshop on Link discovery, pages 36-43, 2005.","title":"The political blogosphere and the 2004 US election: divided they blog","authors":"A Lada, Natalie Adamic, Glance","year":"2005","venue":"International workshop on Link discovery","doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Bessi, 2015] Alessandro Bessi. Two samples test for discrete power-law distributions. arXiv preprint arXiv:1503.00643, 2015.","title":"Two samples test for discrete power-law distributions","authors":"Alessandro Bessi","year":"2015","venue":null,"doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Biggio et al., 2014] Battista Biggio, Giorgio Fumera, and Fabio Roli. Security evaluation of pattern classifiers un- der attack. IEEE TKDE, 26(4):984-996, 2014.","title":"Security evaluation of pattern classifiers under attack","authors":"Battista Biggio, Giorgio Fumera, Fabio Roli","year":"2014","venue":"IEEE TKDE","doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[Bojchevski and Günnemann, 2018] Aleksandar Bojchevski and Stephan Günnemann. Deep gaussian embedding of graphs: Unsupervised inductive learning via ranking. In ICLR, 2018.","title":"Deep gaussian embedding of graphs: Unsupervised inductive learning via ranking","authors":"Aleksandar Bojchevski, Stephan Günnemann","year":"2018","venue":"ICLR","doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[Bojchevski and Günnemann, 2019] Aleksandar Bojchevski and Stephan Günnemann. Adversarial attacks on node embeddings via graph poisoning. In Proceedings of the 36th International Conference on Machine Learning, vol- ume 97, pages 695-704, 2019.","title":"Adversarial attacks on node embeddings via graph poisoning","authors":"Aleksandar Bojchevski, Stephan Günnemann","year":"2019","venue":"Proceedings of the 36th International Conference on Machine Learning","doi":null,"url":null,"internal_url":null},{"position":6,"raw":"[Cai et al., 2018] H. Cai, V. W. Zheng, and K. C. Chang. A comprehensive survey of graph embedding: Prob- lems, techniques, and applications. IEEE Transactions on Knowledge and Data Engineering, 30(9):1616-1637, Sep. 2018.","title":"A comprehensive survey of graph embedding: Problems, techniques, and applications","authors":"H Cai, V W Zheng, K C Chang","year":"2018","venue":"IEEE Transactions on Knowledge and Data Engineering","doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[Chapelle et al., 2006] Olivier Chapelle, Bernhard Schölkopf, and Alexander Zien. Semi-Supervised Learning. Adaptive Computation and Machine Learning series. The MIT Press, 2006.","title":"Semi-Supervised Learning","authors":"Olivier Chapelle, Bernhard Schölkopf, Alexander Zien","year":"2006","venue":"Adaptive Computation and Machine Learning series","doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[Eswaran et al., 2017] Dhivya Eswaran, Stephan Günnemann, Christos Faloutsos, Disha Makhija, and Mohit Kumar. Zoobp: Belief propagation for heteroge- neous networks. PVLDB, 10(5):625-636, 2017.","title":"Zoobp: Belief propagation for heterogeneous networks","authors":"Dhivya Eswaran, Stephan Günnemann, Christos Faloutsos, Disha Makhija, Mohit Kumar","year":"2017","venue":"PVLDB","doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[Goodfellow et al., 2015] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In ICLR, 2015.","title":"Explaining and harnessing adversarial examples","authors":"Ian J Goodfellow, Jonathon Shlens, Christian Szegedy","year":"2015","venue":"ICLR","doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[Hamilton et al., 2017] William L Hamilton, Rex Ying, and Jure Leskovec. Inductive representation learning on large graphs. In NIPS, 2017.","title":"Inductive representation learning on large graphs","authors":"Rex William L Hamilton, Jure Ying, Leskovec","year":"2017","venue":"NIPS","doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[Hooi et al., 2016] Bryan Hooi, Neil Shah, Alex Beutel, Stephan Günnemann, Leman Akoglu, Mohit Kumar, Disha Makhija, and Christos Faloutsos. BIRDNEST: bayesian inference for ratings-fraud detection. In SIAM SDM, pages 495-503, 2016.","title":"BIRDNEST: bayesian inference for ratings-fraud detection","authors":"Bryan Hooi, Neil Shah, Alex Beutel, Stephan Günnemann, Leman Akoglu, Mohit Kumar, Disha Makhija, Christos Faloutsos","year":"2016","venue":"SIAM SDM","doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[Kipf and Welling, 2017] Thomas N Kipf and Max Welling. Semi-supervised classification with graph convolutional networks. In ICLR, 2017.","title":"Semi-supervised classification with graph convolutional networks","authors":"N Thomas, Max Kipf, Welling","year":"2017","venue":"ICLR","doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[Klicpera et al., 2019] Johannes Klicpera, Aleksandar Bo- jchevski, and Stephan Günnemann. Predict then propa- gate: Graph neural networks meet personalized pagerank. In International Conference on Learning Representations (ICLR), 2019.","title":"Predict then propagate: Graph neural networks meet personalized pagerank","authors":"Klicpera","year":"2019","venue":"International Conference on Learning Representations (ICLR)","doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[London and Getoor, 2014] Ben London and Lise Getoor. Collective classification of network data. Data Classifi- cation: Algorithms and Applications, 399, 2014.","title":"Collective classification of network data","authors":"Getoor London, Ben London, Lise Getoor","year":"2014","venue":"Data Classification: Algorithms and Applications","doi":null,"url":null,"internal_url":null},{"position":15,"raw":"[McCallum et al., 2000] Andrew Kachites McCallum, Ka- mal Nigam, Jason Rennie, and Kristie Seymore. Automat- ing the construction of internet portals with machine learn- ing. Information Retrieval, 3(2):127-163, 2000.","title":"Automating the construction of internet portals with machine learning","authors":"Mccallum","year":"2000","venue":"Information Retrieval","doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[Mei and Zhu, 2015] Shike Mei and Xiaojin Zhu. Using ma- chine teaching to identify optimal training-set attacks on machine learners. In AAAI, pages 2871-2877, 2015.","title":"Using machine teaching to identify optimal training-set attacks on machine learners","authors":"Zhu ; ] Shike Mei, Xiaojin Mei, Zhu","year":"2015","venue":"AAAI","doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[Monti et al., 2017] Federico Monti, Davide Boscaini, Jonathan Masci, Emanuele Rodolà, Jan Svoboda, and Michael M. Bronstein. Geometric deep learning on graphs and manifolds using mixture model cnns. In 2017 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2017, Honolulu, HI, USA, July 21-26, 2017, pages 5425-5434, 2017.","title":"Geometric deep learning on graphs and manifolds using mixture model cnns","authors":"Federico Monti, Davide Boscaini, Jonathan Masci, Emanuele Rodolà, Jan Svoboda, Michael M Bronstein","year":"2017","venue":"IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2017","doi":null,"url":null,"internal_url":null},{"position":18,"raw":"[Perozzi et al., 2014] Bryan Perozzi, Rami Al-Rfou, and Steven Skiena. Deepwalk: Online learning of social rep- resentations. In SIGKDD, pages 701-710, 2014.","title":"Deepwalk: Online learning of social representations","authors":"Bryan Perozzi, Rami Al-Rfou, Steven Skiena","year":"2014","venue":"SIGKDD","doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Pham et al., 2017] Trang Pham, Truyen Tran, Dinh Q. Phung, and Svetha Venkatesh. Column networks for col- lective classification. In AAAI, pages 2485-2491, 2017.","title":"Column networks for collective classification","authors":"Trang Pham, Truyen Tran, Dinh Q Phung, Svetha Venkatesh","year":"2017","venue":"AAAI","doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Sen et al., 2008] Prithviraj Sen, Galileo Namata, Mustafa Bilgic, Lise Getoor, Brian Galligher, and Tina Eliassi-Rad. Collective classification in network data. AI magazine, 29(3):93, 2008.","title":"Collective classification in network data","authors":"Prithviraj Sen, Galileo Namata, Mustafa Bilgic, Lise Getoor, Brian Galligher, Tina Eliassi-Rad","year":"2008","venue":"AI magazine","doi":null,"url":null,"internal_url":null},{"position":21,"raw":"[Szegedy et al., 2014] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Google Inc, Joan Bruna, Dumitru Erhan, Google Inc, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In ICLR, 2014.","title":"Intriguing properties of neural networks","authors":"Szegedy","year":"2014","venue":"ICLR","doi":null,"url":null,"internal_url":null},{"position":22,"raw":"[Zügner and Günnemann, 2019a] Daniel Zügner and Stephan Günnemann. Adversarial attacks on graph neural networks via meta learning. In International Conference on Learning Representations (ICLR), 2019.","title":"Adversarial attacks on graph neural networks via meta learning","authors":"Günnemann Zügner, Daniel Zügner, Stephan Günnemann","year":"2019","venue":"International Conference on Learning Representations (ICLR)","doi":null,"url":null,"internal_url":null},{"position":23,"raw":"[Zügner and Günnemann, 2019b] Daniel Zügner and Stephan Günnemann. Certifiable robustness and robust training for graph convolutional networks. In SIGKDD, 2019.","title":"Certifiable robustness and robust training for graph convolutional networks","authors":"Günnemann Zügner, Daniel Zügner, Stephan Günnemann","year":"2019","venue":"SIGKDD","doi":null,"url":null,"internal_url":null},{"position":24,"raw":"[Zügner et al., 2018] Daniel Zügner, Amir Akbarnejad, and Stephan Günnemann. Adversarial attacks on neural net- works for graph data. In SIGKDD, pages 2847-2856, 2018.","title":"Adversarial attacks on neural networks for graph data","authors":"Daniel Zügner, Amir Akbarnejad, Stephan Günnemann","year":"2018","venue":"SIGKDD","doi":null,"url":null,"internal_url":null}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}