论文标题
通过中毒邻居的间接对抗攻击图形卷积网络
Indirect Adversarial Attacks via Poisoning Neighbors for Graph Convolutional Networks
论文作者
论文摘要
图形卷积神经网络在邻居节点上学习聚集，在节点分类任务中取得了出色的性能。但是，最近的研究报告说，这种图形卷积节点分类器可以通过图表上的对抗扰动来欺骗。滥用图卷积，节点的分类结果可能会因中毒邻居而影响。给定归因图和节点分类器，我们如何评估这种间接对抗攻击的鲁棒性？我们能否产生强大的对抗扰动，不仅对单跳邻居有效，而且更远离目标？在本文中，我们证明了节点分类器可以通过仅毒化一个节点，甚至距离目标两个或更多。为了实现攻击，我们提出了一种新方法，该方法在远离目标的一个节点上搜索较小的扰动。在我们的实验中，我们提出的方法显示了两个数据集中两个数据集中的两个冲向攻击成功率。我们还证明，M层图卷积神经网络有机会被我们在M-Hop邻居中的间接攻击所欺骗。拟议的攻击可以用作未来防御尝试以具有对手鲁棒性开发图形卷积神经网络的基准。
Graph convolutional neural networks, which learn aggregations over neighbor nodes, have achieved great performance in node classification tasks. However, recent studies reported that such graph convolutional node classifier can be deceived by adversarial perturbations on graphs. Abusing graph convolutions, a node's classification result can be influenced by poisoning its neighbors. Given an attributed graph and a node classifier, how can we evaluate robustness against such indirect adversarial attacks? Can we generate strong adversarial perturbations which are effective on not only one-hop neighbors, but more far from the target? In this paper, we demonstrate that the node classifier can be deceived with high-confidence by poisoning just a single node even two-hops or more far from the target. Towards achieving the attack, we propose a new approach which searches smaller perturbations on just a single node far from the target. In our experiments, our proposed method shows 99% attack success rate within two-hops from the target in two datasets. We also demonstrate that m-layer graph convolutional neural networks have chance to be deceived by our indirect attack within m-hop neighbors. The proposed attack can be used as a benchmark in future defense attempts to develop graph convolutional neural networks with having adversary robustness.
