Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

SFR-GNN: Simple and Fast Robust GNNs against Structural Attacks

Xing Ai, Guanyu Zhu, Yulin Zhu, Yu Zheng, Gaolei Li, Jianhua Li, Kai Zhou

TL;DR

This work tackles the vulnerability of GNNs to adversarial structural attacks by showing that such attacks exploit the mutual information between the poisoned structure and node labels conditioned on attributes $I(oldsymbol{A}'; oldsymbol{Y}|oldsymbol{X})$. It proposes SFR-GNN, a two-stage method that first learns clean node embeddings from attributes and then fine-tunes on the attacked graph with a contrastive objective and InterNAA to align information toward less contaminated distributions. Theoretical analysis via mutual information lemmas and theorems justifies the design, while extensive experiments demonstrate competitive robustness and substantial runtime savings (e.g., 24%–162% speedup) on both small and large-scale graphs, including heterophilic settings. The approach offers a practical, hyper-parameter-free pathway to robust GNNs suitable for real-world deployment under structural attack scenarios. $I(oldsymbol{A}'; oldsymbol{Y}|oldsymbol{X})$ is central to attacks, and disrupting the paired effect through attribute-centered pre-training and contrastive structure fine-tuning yields robust performance with minimal overhead.

Abstract

Graph Neural Networks (GNNs) have demonstrated commendable performance for graph-structured data. Yet, GNNs are often vulnerable to adversarial structural attacks as embedding generation relies on graph topology. Existing efforts are dedicated to purifying the maliciously modified structure or applying adaptive aggregation, thereby enhancing the robustness against adversarial structural attacks. It is inevitable for a defender to consume heavy computational costs due to lacking prior knowledge about modified structures. To this end, we propose an efficient defense method, called Simple and Fast Robust Graph Neural Network (SFR-GNN), supported by mutual information theory. The SFR-GNN first pre-trains a GNN model using node attributes and then fine-tunes it over the modified graph in the manner of contrastive learning, which is free of purifying modified structures and adaptive aggregation, thus achieving great efficiency gains. Consequently, SFR-GNN exhibits a 24%--162% speedup compared to advanced robust models, demonstrating superior robustness for node classification tasks.

SFR-GNN: Simple and Fast Robust GNNs against Structural Attacks

TL;DR

This work tackles the vulnerability of GNNs to adversarial structural attacks by showing that such attacks exploit the mutual information between the poisoned structure and node labels conditioned on attributes . It proposes SFR-GNN, a two-stage method that first learns clean node embeddings from attributes and then fine-tunes on the attacked graph with a contrastive objective and InterNAA to align information toward less contaminated distributions. Theoretical analysis via mutual information lemmas and theorems justifies the design, while extensive experiments demonstrate competitive robustness and substantial runtime savings (e.g., 24%–162% speedup) on both small and large-scale graphs, including heterophilic settings. The approach offers a practical, hyper-parameter-free pathway to robust GNNs suitable for real-world deployment under structural attack scenarios. is central to attacks, and disrupting the paired effect through attribute-centered pre-training and contrastive structure fine-tuning yields robust performance with minimal overhead.

Abstract

Graph Neural Networks (GNNs) have demonstrated commendable performance for graph-structured data. Yet, GNNs are often vulnerable to adversarial structural attacks as embedding generation relies on graph topology. Existing efforts are dedicated to purifying the maliciously modified structure or applying adaptive aggregation, thereby enhancing the robustness against adversarial structural attacks. It is inevitable for a defender to consume heavy computational costs due to lacking prior knowledge about modified structures. To this end, we propose an efficient defense method, called Simple and Fast Robust Graph Neural Network (SFR-GNN), supported by mutual information theory. The SFR-GNN first pre-trains a GNN model using node attributes and then fine-tunes it over the modified graph in the manner of contrastive learning, which is free of purifying modified structures and adaptive aggregation, thus achieving great efficiency gains. Consequently, SFR-GNN exhibits a 24%--162% speedup compared to advanced robust models, demonstrating superior robustness for node classification tasks.
Paper Structure (33 sections, 10 theorems, 27 equations, 3 figures, 6 tables, 1 algorithm)

This paper contains 33 sections, 10 theorems, 27 equations, 3 figures, 6 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Related Works
  3. Structural Attacks in Graph Learning.
  4. Robust GNNs.
  5. Background
  6. Structural Attacks.
  7. Robust GNNs as Defense.
  8. Methodology
  9. Design Intuition
  10. Detailed Construction
  11. Attributes Pre-training.
  12. Structure Fine-tuning.
  13. Computational Complexity.
  14. Theoretical Analysis
  15. Experiments
  16. ...and 18 more sections

Key Result

Lemma 1

Structural attacks degrade GNNs’ performance through generating the modified adjacency matrix $\mathbf{A}'$ to contaminate the mutual information between the labels $\mathbf{Y}$ and $\mathbf{A}'$ conditioned by $\mathbf{X}$, which essentially uses the mutual information $I(\mathbf{A}'; \mathbf{Y}|\m

Figures (3)

  • Figure 1: Computational Complexity and Hyper-parameter Complexity Comparison of Existing Robust GNNs. Our method SFR-GNN is highlighted with a red star.
  • Figure 2: Framework of SFR-GNN.
  • Figure 3: Ablation studies of SFR-GNN.

Theorems & Definitions (15)

  • Lemma 1: Essence of Structural Attacks
  • Lemma 2: Paired Effect of Structural Attacks
  • Theorem 1
  • Lemma 3
  • Theorem 2
  • Lemma 4
  • proof
  • Lemma 5
  • proof
  • Theorem 3
  • ...and 5 more