Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

IDEA: Invariant Defense for Graph Adversarial Robustness

Shuchang Tao, Qi Cao, Huawei Shen, Yunfan Wu, Bingbing Xu, Xueqi Cheng

TL;DR

The causalities in graph adversarial attacks are analyzed and concluded that causal features are key to achieve graph adversarial robustness, owing to their determinedness for labels and invariance across attacks, and an Invariant causal DEfense method against adversarial Attacks (IDEA).

Abstract

Despite the success of graph neural networks (GNNs), their vulnerability to adversarial attacks poses tremendous challenges for practical applications. Existing defense methods suffer from severe performance decline under unseen attacks, due to either limited observed adversarial examples or pre-defined heuristics. To address these limitations, we analyze the causalities in graph adversarial attacks and conclude that causal features are key to achieve graph adversarial robustness, owing to their determinedness for labels and invariance across attacks. To learn these causal features, we innovatively propose an Invariant causal DEfense method against adversarial Attacks (IDEA). We derive node-based and structure-based invariance objectives from an information-theoretic perspective. IDEA ensures strong predictability for labels and invariant predictability across attacks, which is provably a causally invariant defense across various attacks. Extensive experiments demonstrate that IDEA attains state-of-the-art defense performance under all five attacks on all five datasets. The implementation of IDEA is available at https://anonymous.4open.science/r/IDEA.

IDEA: Invariant Defense for Graph Adversarial Robustness

TL;DR

The causalities in graph adversarial attacks are analyzed and concluded that causal features are key to achieve graph adversarial robustness, owing to their determinedness for labels and invariance across attacks, and an Invariant causal DEfense method against adversarial Attacks (IDEA).

Abstract

Despite the success of graph neural networks (GNNs), their vulnerability to adversarial attacks poses tremendous challenges for practical applications. Existing defense methods suffer from severe performance decline under unseen attacks, due to either limited observed adversarial examples or pre-defined heuristics. To address these limitations, we analyze the causalities in graph adversarial attacks and conclude that causal features are key to achieve graph adversarial robustness, owing to their determinedness for labels and invariance across attacks. To learn these causal features, we innovatively propose an Invariant causal DEfense method against adversarial Attacks (IDEA). We derive node-based and structure-based invariance objectives from an information-theoretic perspective. IDEA ensures strong predictability for labels and invariant predictability across attacks, which is provably a causally invariant defense across various attacks. Extensive experiments demonstrate that IDEA attains state-of-the-art defense performance under all five attacks on all five datasets. The implementation of IDEA is available at https://anonymous.4open.science/r/IDEA.
Paper Structure (36 sections, 2 theorems, 19 equations, 6 figures, 5 tables, 2 algorithms)

This paper contains 36 sections, 2 theorems, 19 equations, 6 figures, 5 tables, 2 algorithms.

Table of Contents

  1. Introduction
  2. Preliminary
  3. Methodology
  4. Interaction Causal Model
  5. IDEA: Invariant causal DEfense method against adversarial Attack
  6. Invariance Objective
  7. Loss Approximation
  8. Predictive loss.
  9. Node-based invariance loss.
  10. Structure-based invariance loss.
  11. Overall loss.
  12. Domain Construction
  13. Overall Framework
  14. Experiments
  15. Experimental Settings
  16. ...and 21 more sections

Key Result

Proposition 1

The node-based invariance goal $I(Y,D|Z)$ reaches its minimum value if $\mathbb{E}_{p(z,d)} KL[p(y \mid z, d) \| q_{d}(y \mid z, d)]$ and $\hat{I}(Y,D|Z)$ are minimized

Figures (6)

  • Figure 1: Limitation of existing methods: Defenses suffer performance degradation under various attacks and on clean graph.
  • Figure 2: Left: Interaction causal model for graph adversarial attacks. Right: Causality and conditional independences.
  • Figure 3: Overall architecture of our IDEA method. IDEA contains feature encoder, classifier, domain-based classifier, and domain learner. The black arrows denote the workflow of IDEA during training, while the red arrows denote how IDEA predicts in the test phase.
  • Figure 4: Ablation Study.
  • Figure 5: Hyperparameter analysis: The average accuracy of clean and attacked graphs, including Clean, nettack, PGD, TDGIA, and G-NIA.
  • ...and 1 more figures

Theorems & Definitions (4)

  • Proposition 1
  • Proposition 2
  • proof
  • proof