Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Quantifying the Noise of Structural Perturbations on Graph Adversarial Attacks

Junyuan Fang, Han Yang, Haixian Wen, Jiajing Wu, Zibin Zheng, Chi K. Tse

TL;DR

This work addresses the robustness of graph neural networks to adversarial perturbations by introducing a noise-based metric that quantifies the attack strength of individual structural links. It develops three strategies—NGA, NMA, and NMAB—that leverage this noise concept together with classification margins to generate targeted evasion attacks under a budget. Across Cora, Citeseer, and PubMed, and against GCN, SGC, and GAT, NMAB achieves the strongest attack performance while dramatically reducing the perturbation search space; the study also reveals patterns in adversarial node selection, such as exploiting low-degree, high-confidence, cross-class neighbors, which lowers homophily and disrupts neighborhood aggregation. These findings provide both a deeper understanding of perturbation effectiveness and practical guidance for designing defenses.

Abstract

Graph neural networks have been widely utilized to solve graph-related tasks because of their strong learning power in utilizing the local information of neighbors. However, recent studies on graph adversarial attacks have proven that current graph neural networks are not robust against malicious attacks. Yet much of the existing work has focused on the optimization objective based on attack performance to obtain (near) optimal perturbations, but paid less attention to the strength quantification of each perturbation such as the injection of a particular node/link, which makes the choice of perturbations a black-box model that lacks interpretability. In this work, we propose the concept of noise to quantify the attack strength of each adversarial link. Furthermore, we propose three attack strategies based on the defined noise and classification margins in terms of single and multiple steps optimization. Extensive experiments conducted on benchmark datasets against three representative graph neural networks demonstrate the effectiveness of the proposed attack strategies. Particularly, we also investigate the preferred patterns of effective adversarial perturbations by analyzing the corresponding properties of the selected perturbation nodes.

Quantifying the Noise of Structural Perturbations on Graph Adversarial Attacks

TL;DR

This work addresses the robustness of graph neural networks to adversarial perturbations by introducing a noise-based metric that quantifies the attack strength of individual structural links. It develops three strategies—NGA, NMA, and NMAB—that leverage this noise concept together with classification margins to generate targeted evasion attacks under a budget. Across Cora, Citeseer, and PubMed, and against GCN, SGC, and GAT, NMAB achieves the strongest attack performance while dramatically reducing the perturbation search space; the study also reveals patterns in adversarial node selection, such as exploiting low-degree, high-confidence, cross-class neighbors, which lowers homophily and disrupts neighborhood aggregation. These findings provide both a deeper understanding of perturbation effectiveness and practical guidance for designing defenses.

Abstract

Graph neural networks have been widely utilized to solve graph-related tasks because of their strong learning power in utilizing the local information of neighbors. However, recent studies on graph adversarial attacks have proven that current graph neural networks are not robust against malicious attacks. Yet much of the existing work has focused on the optimization objective based on attack performance to obtain (near) optimal perturbations, but paid less attention to the strength quantification of each perturbation such as the injection of a particular node/link, which makes the choice of perturbations a black-box model that lacks interpretability. In this work, we propose the concept of noise to quantify the attack strength of each adversarial link. Furthermore, we propose three attack strategies based on the defined noise and classification margins in terms of single and multiple steps optimization. Extensive experiments conducted on benchmark datasets against three representative graph neural networks demonstrate the effectiveness of the proposed attack strategies. Particularly, we also investigate the preferred patterns of effective adversarial perturbations by analyzing the corresponding properties of the selected perturbation nodes.
Paper Structure (30 sections, 4 theorems, 9 equations, 4 figures, 8 tables, 2 algorithms)

This paper contains 30 sections, 4 theorems, 9 equations, 4 figures, 8 tables, 2 algorithms.

Table of Contents

  1. Introduction
  2. Related Work
  3. Graph Neural Network Models
  4. Categories of Graph Adversarial Attacks
  5. Existing Methods of Graph Adversarial Attacks
  6. Preliminaries
  7. Graph Neural Networks
  8. Graph Adversarial Attacks
  9. Proposed Methods
  10. Noise Propagation
  11. Noise-Based Greedy Attacks
  12. Noise and Margin-Based Attacks
  13. Noise and Margin-Based Attacks-Boost
  14. Overall Framework
  15. Experiments
  16. ...and 15 more sections

Key Result

Proposition 4.1

Let $G = (A, X, E)$ be a simple graph, and $Y = \{0,1,\cdots,C-1\}$ be the possible label. We simplify the feature of each node to be a one-hot vector corresponding to its label, denoted as $\mu(Y)$. Namely, the feature vector of node $u$ is $x_{u} = \mu(Y_u)$. Assuming that most of the original nei

Figures (4)

  • Figure 1: A systematic framework of targeted attacks based on the proposed three strategies.
  • Figure 2: Classification margin comparisons between different methods on three datasets.
  • Figure 3: Average homophily ratios of target nodes before and after NMA/NMAB attacks on three datasets.
  • Figure 4: Attack success rate of the proposed NMA and NMAB methods on three datasets under different parameter combinations.

Theorems & Definitions (4)

  • Proposition 4.1
  • Proposition 4.2
  • Proposition A.1
  • Proposition A.2