RIDA: A Robust Attack Framework on Incomplete Graphs

2024-07-25

arXiv.org

AI Summary

To address the poor robustness and low efficiency of gray-box poisoning attacks against Graph Neural Networks (GNNs) on incomplete graphs, this paper proposes the first gray-box contamination attack framework tailored for sparse or structurally incomplete graphs. Methodologically, it introduces (1) a distant-neighbor information aggregation mechanism to enhance perturbation robustness against missing edges and nodes, and (2) a gradient-guided structural perturbation optimization combined with an incompleteness-adaptive feature propagation strategy. Evaluated on three real-world datasets, the approach consistently outperforms nine state-of-the-art baselines, achieving an average 12.6% improvement in attack success rate. Notably, it maintains strong effectiveness even under 40% edge missing rate, demonstrating superior stability, computational efficiency, and generalizability across diverse incompleteness patterns.

Technology Category

• Machine Learning: Graph-based Machine Learning
• Computer Vision: Adversarial Attacks & Robustness
• Reasoning under Uncertainty: Graphical Models

Application Category

• Graph Algorithms and Modeling for the Web: Graph neural networks and deep learning approaches for Web-related graphs
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking

Abstract

Graph Neural Networks (GNNs) are vital in data science but are increasingly susceptible to adversarial attacks. To help researchers develop more robust GNN models, it's essential to focus on designing strong attack models as foundational benchmarks and guiding references. Among adversarial attacks, gray-box poisoning attacks are noteworthy due to their effectiveness and fewer constraints. These attacks exploit GNNs' need for retraining on updated data, thereby impacting their performance by perturbing these datasets. However, current research overlooks the real-world scenario of incomplete graphs.To address this gap, we introduce the Robust Incomplete Deep Attack Framework (RIDA). It is the first algorithm for robust gray-box poisoning attacks on incomplete graphs. The approach innovatively aggregates distant vertex information and ensures powerful data utilization.Extensive tests against 9 SOTA baselines on 3 real-world datasets demonstrate RIDA's superiority in handling incompleteness and high attack performance on the incomplete graph.

Problem

• Graph Neural Networks
• Gray-box Poisoning Attacks
• Incomplete Graph Data

Innovation

• RIDA
• Graph Neural Networks
• Gray-box Poisoning Attack