{"type":"ScholarlyArticle","title":"Cluster Attack: Query-based Adversarial Attacks on Graph with Graph-Dependent Priors","authors":[{"name":"Zhengyi Wang","slug":"zhengyi-wang","given":"Zhengyi","family":"Wang","affiliation":"Department of Computer Science & Technology , Institute for AI , BNRist Center Tsinghua-Bosch Joint ML Center , THBI Lab , Tsinghua University; Tsinghua University-China Mobile Communications Group Co., Ltd. Joint Institute {wang-zy21 , hzj21 ,"},{"name":"Zhongkai Hao","slug":"zhongkai-hao","given":"Zhongkai","family":"Hao","affiliation":"Department of Computer Science & Technology , Institute for AI , BNRist Center Tsinghua-Bosch Joint ML Center , THBI Lab , Tsinghua University"},{"name":"Ziqiao Wang","slug":"ziqiao-wang","given":"Ziqiao","family":"Wang","affiliation":"Department of Computer Science & Technology , Institute for AI , BNRist Center Tsinghua-Bosch Joint ML Center , THBI Lab , Tsinghua University"},{"name":"Hang Su","slug":"hang-su","given":"Hang","family":"Su","affiliation":"Department of Computer Science & Technology , Institute for AI , BNRist Center Tsinghua-Bosch Joint ML Center , THBI Lab , Tsinghua University; Peng Cheng Laboratory; Tsinghua University-China Mobile Communications Group Co., Ltd. Joint Institute {wang-zy21 , hzj21 ,"},{"name":"Jun Zhu","slug":"jun-zhu","given":"Jun","family":"Zhu","affiliation":"Department of Computer Science & Technology , Institute for AI , BNRist Center Tsinghua-Bosch Joint ML Center , THBI Lab , Tsinghua University; Peng Cheng Laboratory; Tsinghua University-China Mobile Communications Group Co., Ltd. Joint Institute {wang-zy21 , hzj21 ,"}],"abstract":"While deep neural networks have achieved great success in graph analysis, recent work has shown that they are vulnerable to adversarial attacks. Compared with adversarial attacks on image classification, performing adversarial attacks on graphs is more challenging because of the discrete and non-differential nature of the adjacent matrix for a graph. In this work, we propose Cluster Attack --- a Graph Injection Attack (GIA) on node classification, which injects fake nodes into the original graph to degenerate the performance of graph neural networks (GNNs) on certain victim nodes while affecting the other nodes as little as possible. We demonstrate that a GIA problem can be equivalently formulated as a graph clustering problem; thus, the discrete optimization problem of the adjacency matrix can be solved in the context of graph clustering. In particular, we propose to measure the similarity between victim nodes by a metric of Adversarial Vulnerability, which is related to how the victim nodes will be affected by the injected fake node, and to cluster the victim nodes accordingly. Our attack is performed in a practical and unnoticeable query-based black-box manner with only a few nodes on the graphs that can be accessed. Theoretical analysis and extensive experiments demonstrate the effectiveness of our method by fooling the node classifiers with only a small number of queries.","doi":"10.24963/ijcai.2022/108","url":"https://ijcai.org/proceedings/2022/108","pdf":"https://ijcai.org/proceedings/2022/0108.pdf","markdown":"https://ijcai.org/proceedings/2022/108.md","bibtex":"https://ijcai.org/proceedings/2022/bibtex/108","volume":{"slug":"2022","title":"Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2022","url":"https://ijcai.org/proceedings/2022/","year":2022,"location":"Vienna","dates":"23-29 July 2022","editors":"Luc De Raedt","isbn":"978-1-956792-00-3","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2022"},"section":"AI Ethics, Trust, Fairness","track":"Main Track","number":108,"pages":{"first":768,"last":775},"keywords":["Machine Learning: Sequence and Graph Learning","AI Ethics, Trust, Fairness: Safety & Robustness","Machine Learning: Adversarial Machine Learning","Machine Learning: Clustering"],"videos":[{"label":"Video #1","url":"https://slideslive.com/38987030","length_sec":91,"provider":"slideslive"},{"label":"Video #2","url":"https://slideslive.com/38985173","length_sec":601,"provider":"slideslive"}],"references":[{"position":1,"raw":"[Carlini and Wagner, 2017] Nicholas Carlini and David Wag- ner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp), pages 39-57. IEEE, 2017.","title":"Towards evaluating the robustness of neural networks","authors":"Wagner Carlini, Nicholas Carlini, David Wagner","year":"2017","venue":"ieee symposium on security and privacy (sp)","doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Chen et al., 2017] Pin-Yu Chen, Huan Zhang, Yash Sharma, Jinfeng Yi, and Cho-Jui Hsieh. Zoo: Zeroth order opti- mization based black-box attacks to deep neural networks without training substitute models. In Proceedings of the 10th ACM Workshop on Artificial Intelligence and Secu- rity, AISec '17, page 15-26, New York, NY, USA, 2017. Association for Computing Machinery.","title":"Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models","authors":"Chen","year":"2017","venue":"Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security, AISec '17","doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Chen et al., 2019] Weijian Chen, Yulong Gu, Zhaochun Ren, Xiangnan He, Hongtao Xie, Tong Guo, Dawei Yin, and Yongdong Zhang. Semi-supervised user profiling with het- erogeneous graph attention networks. In IJCAI, volume 19, pages 2116-2122, 2019.","title":"Semi-supervised user profiling with heterogeneous graph attention networks","authors":"Weijian Chen, Yulong Gu, Zhaochun Ren, Xiangnan He, Hongtao Xie, Tong Guo, Dawei Yin, Yongdong Zhang","year":"2019","venue":"IJCAI","doi":null,"url":null,"internal_url":"/proceedings/2019/293"},{"position":4,"raw":"[Dai et al., 2018] Hanjun Dai, Hui Li, Tian Tian, Xin Huang, Lin Wang, Jun Zhu, and Le Song. Adversarial attack on graph structured data. In International conference on ma- chine learning, pages 1115-1124. PMLR, 2018.","title":"Adversarial attack on graph structured data","authors":"Hanjun Dai, Hui Li, Tian Tian, Xin Huang, Lin Wang, Jun Zhu, Le Song","year":"2018","venue":"International conference on machine learning","doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[Dong et al., 2018] Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boost- ing adversarial attacks with momentum. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2018.","title":"Boosting adversarial attacks with momentum","authors":"Dong","year":"2018","venue":"Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR)","doi":null,"url":null,"internal_url":null},{"position":6,"raw":"[Hamilton et al., 2017] Will Hamilton, Zhitao Ying, and Jure Leskovec. Inductive representation learning on large graphs. Advances in neural information processing systems, 30, 2017.","title":"Inductive representation learning on large graphs","authors":"Hamilton","year":"2017","venue":"Advances in neural information processing systems","doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[Hu et al., 2020] Weihua Hu, Matthias Fey, Marinka Zitnik, Yuxiao Dong, Hongyu Ren, Bowen Liu, Michele Catasta, and Jure Leskovec. Open graph benchmark: Datasets for machine learning on graphs. Advances in neural informa- tion processing systems, 33:22118-22133, 2020.","title":"Open graph benchmark: Datasets for machine learning on graphs","authors":"Weihua Hu, Matthias Fey, Marinka Zitnik, Yuxiao Dong, Hongyu Ren, Bowen Liu, Michele Catasta, Jure Leskovec","year":"2020","venue":"Advances in neural information processing systems","doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[Ilyas et al., 2018] Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin. Black-box adversarial attacks with limited queries and information. In Proceedings of the 35th International Conference on Machine Learning, ICML 2018, July 2018.","title":"Black-box adversarial attacks with limited queries and information","authors":"Andrew Ilyas, Logan Engstrom, Anish Athalye, Jessy Lin","year":"2018","venue":"Proceedings of the 35th International Conference on Machine Learning, ICML 2018","doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[Kipf and Welling, 2017] Thomas N. Kipf and Max Welling. Semi-Supervised Classification with Graph Convolutional Networks. In Proceedings of the 5th International Confer- ence on Learning Representations, ICLR '17, 2017.","title":"Semi-Supervised Classification with Graph Convolutional Networks","authors":"Thomas N Kipf, Max Welling","year":"2017","venue":"Proceedings of the 5th International Conference on Learning Representations, ICLR '17","doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[Ma et al., 2021] Yao Ma, Suhang Wang, Tyler Derr, Lingfei Wu, and Jiliang Tang. Graph adversarial attack via rewiring. In Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining, KDD '21, page 1161-1169, New York, NY, USA, 2021. Association for Computing Machinery.","title":"Graph adversarial attack via rewiring","authors":"Yao Ma, Suhang Wang, Tyler Derr, Lingfei Wu, Jiliang Tang","year":"2021","venue":"Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining, KDD '21","doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[Madry et al., 2018] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In ICLR, 2018.","title":"Towards deep learning models resistant to adversarial attacks","authors":"Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, Adrian Vladu","year":"2018","venue":"ICLR","doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[Mu et al., 2021] Jiaming Mu, Binghui Wang, Qi Li, Kun Sun, Mingwei Xu, and Zhuotao Liu. A hard label black- box adversarial attack against graph neural networks. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, CCS '21, page 108-125, New York, NY, USA, 2021. Association for Com- puting Machinery.","title":"A hard label blackbox adversarial attack against graph neural networks","authors":"Jiaming Mu, Binghui Wang, Qi Li, Kun Sun, Mingwei Xu, Zhuotao Liu","year":"2021","venue":"Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, CCS '21","doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[Qiu et al., 2018] Jiezhong Qiu, Jian Tang, Hao Ma, Yuxiao Dong, Kuansan Wang, and Jie Tang. Deepinf: Social influ- ence prediction with deep learning. In Proceedings of the 24th ACM SIGKDD International Conference on Knowl- edge Discovery & Data Mining, pages 2110-2119, 2018.","title":"Deepinf: Social influence prediction with deep learning","authors":"Jiezhong Qiu, Jian Tang, Hao Ma, Yuxiao Dong, Kuansan Wang, Jie Tang","year":"2018","venue":"Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining","doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[Schaeffer, 2007] Satu Elisa Schaeffer. Graph clustering. Computer science review, 1(1):27-64, 2007.","title":"Graph clustering","authors":"Elisa Satu, Schaeffer","year":"2007","venue":"Computer science review","doi":null,"url":null,"internal_url":null},{"position":15,"raw":"[Sen et al., 2008] Prithviraj Sen, Galileo Namata, Mustafa Bilgic, Lise Getoor, Brian Galligher, and Tina Eliassi-Rad. Collective classification in network data. AI Magazine, 29(3):93, Sep. 2008.","title":"Collective classification in network data","authors":"Prithviraj Sen, Galileo Namata, Mustafa Bilgic, Lise Getoor, Brian Galligher, Tina Eliassi-Rad","year":"2008","venue":"AI Magazine","doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[Tao et al., 2021] Shuchang Tao, Qi Cao, Huawei Shen, Jun- jie Huang, Yunfan Wu, and Xueqi Cheng. Single node in- jection attack against graph neural networks. Proceedings of the 30th ACM International Conference on Information and Knowledge Management, Oct 2021.","title":"Single node injection attack against graph neural networks","authors":"Tao","year":"2021","venue":"Proceedings of the 30th ACM International Conference on Information and Knowledge Management","doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[Veličković et al., 2017] Petar Veličković, Guillem Cucurull, Arantxa Casanova, Adriana Romero, Pietro Liò, and Yoshua Bengio. Graph attention networks. In ICLR 18, 2017.","title":"Graph attention networks","authors":"Petar Veličković, Guillem Cucurull, Arantxa Casanova, Adriana Romero, Pietro Liò, Yoshua Bengio","year":"2017","venue":"ICLR","doi":null,"url":null,"internal_url":null},{"position":18,"raw":"[Wan et al., 2021] Xingchen Wan, Henry Kenlay, Robin Ru, Arno Blaas, Michael A Osborne, and Xiaowen Dong. Ad- versarial attacks on graph classifiers via bayesian optimi- sation. In Advances in Neural Information Processing Systems, volume 34, pages 6983-6996, 2021.","title":"Adversarial attacks on graph classifiers via bayesian optimisation","authors":"Wan","year":"2021","venue":"Advances in Neural Information Processing Systems","doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Wang et al., 2018] Xiaoyun Wang, Minhao Cheng, Joe Eaton, Cho-Jui Hsieh, and Felix Wu. Attack graph con- volutional networks by adding fake nodes. arXiv preprint arXiv:1810.10751, 2018.","title":"Attack graph convolutional networks by adding fake nodes","authors":"Xiaoyun Wang, Minhao Cheng, Joe Eaton, Cho-Jui Hsieh, Felix Wu","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Yang and Long, 2021] Runze Yang and Teng Long. Derivative-free optimization adversarial attacks for graph convolutional networks. PeerJ Computer Science, 7:e693, 2021.","title":"Derivative-free optimization adversarial attacks for graph convolutional networks","authors":"Yang, Long ;, Runze Yang, Teng Long","year":"2021","venue":"PeerJ Computer Science","doi":null,"url":null,"internal_url":null},{"position":21,"raw":"[Ying et al., 2018] Rex Ying, Ruining He, Kaifeng Chen, Pong Eksombatchai, William L Hamilton, and Jure Leskovec. Graph convolutional neural networks for web- scale recommender systems. In Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, pages 974-983, 2018.","title":"Graph convolutional neural networks for webscale recommender systems","authors":"Rex Ying, Ruining He, Kaifeng Chen, Pong Eksombatchai, William L Hamilton, Jure Leskovec","year":"2018","venue":"Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining","doi":null,"url":null,"internal_url":null},{"position":22,"raw":"[Zou et al., 2021] Xu Zou, Qinkai Zheng, Yuxiao Dong, Xinyu Guan, Evgeny Kharlamov, Jialiang Lu, and Jie Tang. Tdgia: Effective injection attacks on graph neural networks. Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, Aug 2021.","title":"Tdgia: Effective injection attacks on graph neural networks","authors":"Xu Zou, Qinkai Zheng, Yuxiao Dong, Xinyu Guan, Evgeny Kharlamov, Jialiang Lu, Jie Tang","year":"2021","venue":"Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery and Data Mining","doi":null,"url":null,"internal_url":null},{"position":23,"raw":"[Zügner et al., 2018] Daniel Zügner, Amir Akbarnejad, and Stephan Günnemann. Adversarial attacks on neural net- works for graph data. Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discov- ery & Data Mining -KDD '18, 2018.","title":"Adversarial attacks on neural networks for graph data","authors":"Daniel Zügner, Amir Akbarnejad, Stephan Günnemann","year":"2018","venue":"Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining -KDD '18","doi":null,"url":null,"internal_url":"/proceedings/2019/872"}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}