Minimum Topology Attacks for Graph Neural Networks

TL;DR

This work addresses the robustness of Graph Neural Networks to topology-level adversarial perturbations by introducing MiBTack, a minimum-budget topology attack that adaptively finds the smallest number of edge flips required to misclassify each target node. The method reframes topology attacks as a non-convex, discrete optimization solved via a differentiable dynamic projected gradient descent that alternates between updating the perturbation and the perturbation budget, with initialization aimed at approaching the closest decision boundary. Experiments across multiple datasets and GNN architectures show MiBTack consistently achieves misclassification with substantially smaller perturbations than fixed-budget baselines, and the derived per-node budgets offer new insights into node robustness and uncertainty. The results highlight practical implications for assessing node-level robustness and motivate extensions to black-box settings and defenses that account for adaptive budget perturbations.

Abstract

With the great popularity of Graph Neural Networks (GNNs), their robustness to adversarial topology attacks has received significant attention. Although many attack methods have been proposed, they mainly focus on fixed-budget attacks, aiming at finding the most adversarial perturbations within a fixed budget for target node. However, considering the varied robustness of each node, there is an inevitable dilemma caused by the fixed budget, i.e., no successful perturbation is found when the budget is relatively small, while if it is too large, the yielding redundant perturbations will hurt the invisibility. To break this dilemma, we propose a new type of topology attack, named minimum-budget topology attack, aiming to adaptively find the minimum perturbation sufficient for a successful attack on each node. To this end, we propose an attack model, named MiBTack, based on a dynamic projected gradient descent algorithm, which can effectively solve the involving non-convex constraint optimization on discrete topology. Extensive results on three GNNs and four real-world datasets show that MiBTack can successfully lead all target nodes misclassified with the minimum perturbation edges. Moreover, the obtained minimum budget can be used to measure node robustness, so we can explore the relationships of robustness, topology, and uncertainty for nodes, which is beyond what the current fixed-budget topology attacks can offer.

Figures (10)

• Figure 1: Illustrations of the existing fixed-budget topology attacks which may fail to cross decision boundary or cross too much, and our MiBTack can exactly cross the closest green decision boundary $\mathcal{B}_{c_3}$ with no waste.
• Figure 2: The overall framework procedure of our proposed MiBTack. In $i$-th iteration, MiBTack alternatively updates the current perturbation $\boldsymbol{{\delta}}_v^{(i)}$ and $\Delta_v^{(i)}$ with a dynamic PGD algorithm.
• Figure 3: The node classification margins on Polblogs. Our MiBTack leads all target nodes misclassified and affects them most slightly by finding minimum and successful attacks.
• Figure 4: Performance of poisoning attacks on Cora and Citeseer.
• Figure 5: Performance of attacks against defensed GNNs (i.e., JacGCN and RGCN). We report the total budget and the accuracy of target nodes of defensed GNNs under FGA, Nettack, our MiBTack, our variants MiBTack-J and MiBTack-R.

Theorems & Definitions (1)

• Definition 1