Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Are Your Models Still Fair? Fairness Attacks on Graph Neural Networks via Node Injections

Zihan Luo, Hong Huang, Yongkang Zhou, Jiping Zhang, Nuo Chen, Hai Jin

TL;DR

A Node Injection-based Fairness Attack (NIFA), exploring the vulnerabilities of GNN fairness in such a more realistic setting and designing two insightful principles for node injection operations, namely the uncertainty-maximization principle and homophily-increase principle.

Abstract

Despite the remarkable capabilities demonstrated by Graph Neural Networks (GNNs) in graph-related tasks, recent research has revealed the fairness vulnerabilities in GNNs when facing malicious adversarial attacks. However, all existing fairness attacks require manipulating the connectivity between existing nodes, which may be prohibited in reality. To this end, we introduce a Node Injection-based Fairness Attack (NIFA), exploring the vulnerabilities of GNN fairness in such a more realistic setting. In detail, NIFA first designs two insightful principles for node injection operations, namely the uncertainty-maximization principle and homophily-increase principle, and then optimizes injected nodes' feature matrix to further ensure the effectiveness of fairness attacks. Comprehensive experiments on three real-world datasets consistently demonstrate that NIFA can significantly undermine the fairness of mainstream GNNs, even including fairness-aware GNNs, by injecting merely 1% of nodes. We sincerely hope that our work can stimulate increasing attention from researchers on the vulnerability of GNN fairness, and encourage the development of corresponding defense mechanisms. Our code and data are released at: https://github.com/CGCL-codes/NIFA.

Are Your Models Still Fair? Fairness Attacks on Graph Neural Networks via Node Injections

TL;DR

A Node Injection-based Fairness Attack (NIFA), exploring the vulnerabilities of GNN fairness in such a more realistic setting and designing two insightful principles for node injection operations, namely the uncertainty-maximization principle and homophily-increase principle.

Abstract

Despite the remarkable capabilities demonstrated by Graph Neural Networks (GNNs) in graph-related tasks, recent research has revealed the fairness vulnerabilities in GNNs when facing malicious adversarial attacks. However, all existing fairness attacks require manipulating the connectivity between existing nodes, which may be prohibited in reality. To this end, we introduce a Node Injection-based Fairness Attack (NIFA), exploring the vulnerabilities of GNN fairness in such a more realistic setting. In detail, NIFA first designs two insightful principles for node injection operations, namely the uncertainty-maximization principle and homophily-increase principle, and then optimizes injected nodes' feature matrix to further ensure the effectiveness of fairness attacks. Comprehensive experiments on three real-world datasets consistently demonstrate that NIFA can significantly undermine the fairness of mainstream GNNs, even including fairness-aware GNNs, by injecting merely 1% of nodes. We sincerely hope that our work can stimulate increasing attention from researchers on the vulnerability of GNN fairness, and encourage the development of corresponding defense mechanisms. Our code and data are released at: https://github.com/CGCL-codes/NIFA.
Paper Structure (32 sections, 2 theorems, 16 equations, 8 figures, 9 tables, 1 algorithm)

This paper contains 32 sections, 2 theorems, 16 equations, 8 figures, 9 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Related work
  3. Preliminary
  4. Notations
  5. Fairness-related concepts
  6. Problem definition
  7. Methodology
  8. Framework overview
  9. Node injection with principles
  10. Feature optimization
  11. Implementation algorithm
  12. Experiments
  13. Experimental settings
  14. Main attack performance
  15. Comparison with other attack Models
  16. ...and 17 more sections

Key Result

Lemma 1

For target node $u$ that will connect with injected nodes, our proposed node injection strategy will lead to the increase of node-level homophily-ratio $\mathcal{H}_u$.

Figures (8)

  • Figure 1: The overall framework of NIFA: (a) Utilizing uncertainty estimation, nodes exhibiting high uncertainty (depicted as shaded nodes) are designated as targeted nodes. (b) Injected nodes are equally assigned to each sensitive group, and only connect targeted nodes with the same sensitive attribute. (c) After node injection, the injected feature matrix and surrogate model are optimized iteratively by diverse objective functions.
  • Figure 2: Ablation study of each module in NIFA
  • Figure 3: Defense performance on Pokec-z with masking $\eta$ training nodes with the highest uncertainty
  • Figure A1: T-SNE visualization of poisoned graph's node features
  • Figure A2: The impact of $\alpha$ on three datasets
  • ...and 3 more figures

Theorems & Definitions (5)

  • Definition 1
  • Definition 2
  • Lemma 1
  • Lemma 1
  • proof