Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Adversarial Attacks on Fairness of Graph Neural Networks

Binchi Zhang, Yushun Dong, Chen Chen, Yada Zhu, Minnan Luo, Jundong Li

TL;DR

This paper proposes G-FairAttack, a general framework for attacking various types of fairness-aware GNNs in terms of fairness with an unnoticeable effect on prediction utility and proposes a fast computation technique to reduce the time complexity of G-FairAttack.

Abstract

Fairness-aware graph neural networks (GNNs) have gained a surge of attention as they can reduce the bias of predictions on any demographic group (e.g., female) in graph-based applications. Although these methods greatly improve the algorithmic fairness of GNNs, the fairness can be easily corrupted by carefully designed adversarial attacks. In this paper, we investigate the problem of adversarial attacks on fairness of GNNs and propose G-FairAttack, a general framework for attacking various types of fairness-aware GNNs in terms of fairness with an unnoticeable effect on prediction utility. In addition, we propose a fast computation technique to reduce the time complexity of G-FairAttack. The experimental study demonstrates that G-FairAttack successfully corrupts the fairness of different types of GNNs while keeping the attack unnoticeable. Our study on fairness attacks sheds light on potential vulnerabilities in fairness-aware GNNs and guides further research on the robustness of GNNs in terms of fairness.

Adversarial Attacks on Fairness of Graph Neural Networks

TL;DR

This paper proposes G-FairAttack, a general framework for attacking various types of fairness-aware GNNs in terms of fairness with an unnoticeable effect on prediction utility and proposes a fast computation technique to reduce the time complexity of G-FairAttack.

Abstract

Fairness-aware graph neural networks (GNNs) have gained a surge of attention as they can reduce the bias of predictions on any demographic group (e.g., female) in graph-based applications. Although these methods greatly improve the algorithmic fairness of GNNs, the fairness can be easily corrupted by carefully designed adversarial attacks. In this paper, we investigate the problem of adversarial attacks on fairness of GNNs and propose G-FairAttack, a general framework for attacking various types of fairness-aware GNNs in terms of fairness with an unnoticeable effect on prediction utility. In addition, we propose a fast computation technique to reduce the time complexity of G-FairAttack. The experimental study demonstrates that G-FairAttack successfully corrupts the fairness of different types of GNNs while keeping the attack unnoticeable. Our study on fairness attacks sheds light on potential vulnerabilities in fairness-aware GNNs and guides further research on the robustness of GNNs in terms of fairness.
Paper Structure (39 sections, 4 theorems, 30 equations, 5 figures, 17 tables, 2 algorithms)

This paper contains 39 sections, 4 theorems, 30 equations, 5 figures, 17 tables, 2 algorithms.

Table of Contents

  1. Introduction
  2. Problem Definition
  3. Methodology
  4. Surrogate Loss Design
  5. Optimization
  6. Fast Computation
  7. Experiments
  8. Experimental Settings
  9. Effectiveness of Attack
  10. Ablation Study
  11. Parameter Study
  12. Related Works
  13. Conclusion
  14. Appendix
  15. Proof
  16. ...and 24 more sections

Key Result

Theorem 1

We have $\Delta_{dp}(\hat{Y},S)$ and $W(\hat{Y},S)$ upper bounded by $TV(\hat{Y},S)$. Moreover, assuming $P_{\hat{Y}}(z)\geq\Pi_i\mathrm{Pr}(S=i)$ holds for any $z\in[0,1]$, $I(\hat{Y},S)$ is also upper bounded by $TV(\hat{Y},S)$.

Figures (5)

  • Figure 1: A toy example of fairness attacks of GNNs with unnoticeable effect on prediction utility.
  • Figure 2: The changes of $\Delta_{dp}$ and the utility loss function $\mathcal{L}$ under different attack budgets.
  • Figure 3: The optimization curves, training time cost, and test fairness on regularization-based victim model corresponding to different values of $a$.
  • Figure 4: The limitation of the gradient-based optimization method. The blue ellipses are isolines of the loss function.
  • Figure 5: The variation of attacker's objective during the optimization process on Facebook, comparing non-gradient methods (G-FairAttack) with gradient-based methods (Gradient Ascent, Metattack).

Theorems & Definitions (8)

  • Theorem 1
  • Proposition 1
  • Theorem 2
  • Proposition 2
  • proof
  • proof
  • proof
  • proof