Source-linked AI summary
Transferring Robustness for Graph Neural Network Against Poisoning Attacks
Xianfeng Tang, Yandong Li, Yiwei Sun, Huaxiu Yao, Prasenjit Mitra, Suhang Wang
TL;DR
GNNs can be substantially degraded by poisoning attacks, while existing defenses often lack supervision for distinguishing adversarial from normal edges. PA-GNN learns to penalize perturbations using attacked clean graphs and transfers that ability to poisoned targets through meta-optimization. Experiments on node classification tasks demonstrate efficacy against different poisoning attacks.
Problem
Existing GNN defenses often train only on poisoned target graphs and lack supervision for distinguishing adversarial edges from normal ones, motivating clean-graph-based robustness learning.
Method
PA-GNN uses penalized attention aggregation to reduce information passing through perturbations and meta-optimization to transfer this ability from attacked clean graphs to a poisoned target graph.
Results
Experimental node-classification results demonstrate PA-GNN’s efficacy against different poisoning attacks.
Takeaways & Limitations
Clean graphs from similar domains can be leveraged to learn and transfer robustness for GNNs under poisoning attacks.
Takeaways & Limitations
The paper studies semi-supervised node classification and assumes access to clean graphs from domains similar to the poisoned target graph.
Abstract
from arXiv · showhide
Graph neural networks (GNNs) are widely used in many applications. However, their robustness against adversarial attacks is criticized. Prior studies show that using unnoticeable modifications on graph topology or nodal features can significantly reduce the performances of GNNs. It is very challenging to design robust graph neural networks against poisoning attack and several efforts have been taken. Existing work aims at reducing the negative impact from adversarial edges only with the poisoned graph, which is sub-optimal since they fail to discriminate adversarial edges from normal ones. On the other hand, clean graphs from similar domains as the target poisoned graph are usually available in the real world. By perturbing these clean graphs, we create supervised knowledge to train the ability to detect adversarial edges so that the robustness of GNNs is elevated. However, such potential for clean graphs is neglected by existing work. To this end, we investigate a novel problem of improving the robustness of GNNs against poisoning attacks by exploring clean graphs. Specifically, we propose PA-GNN, which relies on a penalized aggregation mechanism that directly restrict the negative impact of adversarial edges by assigning them lower attention coefficients. To optimize PA-GNN for a poisoned graph, we design a meta-optimization algorithm that trains PA-GNN to penalize perturbations using clean graphs and their adversarial counterparts, and transfers such ability to improve the robustness of PA-GNN on the poisoned graph. Experimental results on four real-world datasets demonstrate the robustness of PA-GNN against poisoning attacks on graphs. Code and data are available here: https://github.com/tangxianfeng/PA-GNN.
1 INTRODUCTION
GNNs are vulnerable to poisoning attacks because message passing can propagate adversarial information. PA-GNN addresses this gap by learning from perturbed clean graphs and transferring adversarial-edge penalization to a poisoned target graph.
- Poisoning attacks alter graph topology or nodal features, contaminating node neighborhoods and significantly degrading GNN performance.
- Existing defenses rely only on the poisoned graph, producing sub-optimal solutions because they lack supervised models of adversarial-edge distributions.
- Clean graphs with similar topological and attribute characteristics can provide supervision by receiving adversarial edges during robust-GNN training.
- PA-GNN uses a penalized aggregation mechanism and meta-optimization to learn perturbation alleviation on clean graphs and transfer it to the target poisoned graph.
- The paper evaluates PA-GNN through extensive experiments on real-world datasets against various poisoning attacks.
2 RELATED WORK
Related work establishes that GNN message passing and graph attacks create robustness challenges. PA-GNN differs by learning perturbation penalization from similar clean graphs and transferring it through meta-learning.
- 2.1 Graph Neural Networks: GNNs include spectral- and spatial-based methods, with spatial models aggregating neighbor information and GATs weighting neighbors through self-attention.
- 2.1 Graph Neural Networks: Neighbor aggregation makes existing GNNs vulnerable to adversarial attacks, especially edges added to graph topology.
- 2.2 Adversarial Attack and Defense on Graphs: Poisoning attacks modify training data and can significantly reduce GNN performance, unlike evasion attacks that generate fake samples for a trained model.
- 2.2 Adversarial Attack and Defense on Graphs: Prior defenses include feature-similarity pruning and Gaussian-distribution-based representations for absorbing adversarial changes.
- 2.2 Adversarial Attack and Defense on Graphs: PA-GNN uses similar-domain clean graphs and meta-learning to learn and transfer the ability to penalize perturbations.
3 PRELIMINARIES
The paper formulates robust semi-supervised node classification on a poisoned target graph with access to similar clean graphs. It introduces standard GNN message passing and the framework’s meta-optimization setting.
- 3.1 Notations: The target graph is represented by nodes, edges, and node features, while similar-domain clean graphs provide additional graph data.
- 3.1 Notations: In semi-supervised learning, only a subset of nodes is labeled, with each labeled node associated with a target label.
- 3.2 Basic GNN Design: Each GNN layer transforms node features using information from first-order neighbors through an aggregation function and an update function.
- 3.2 Basic GNN Design: The GNN output supports node classification by producing predicted labels through a softmax function.
- 3.3 Problem Definition: The formal problem is to predict unlabeled nodes in a poisoned target graph using partially labeled target and clean graphs.
- 3.3 Problem Definition: The study focuses on semi-supervised node classification, while PA-GNN is described as applicable to other graph-mining tasks such as link prediction.
4 PROPOSED FRAMEWORK
PA-GNN combines penalized attention aggregation with meta-optimization over perturbed clean graphs, then adapts the learned initialization to a target poisoned graph.
- 4.2 Transfer with Meta-Optimization: The learned initialization is fine-tuned on the target poisoned graph to defend adversarial attacks while maintaining classification performance.The training framework takes the target graph and clean graphs as input and outputs model parameters.
- 4.1 Penalized Aggregation Mechanism: PA-GNN restricts message passing through perturbed edges by assigning them lower attention coefficients.Because normalized coefficients sum to 1, reducing perturbed-edge attention increases attention allocated to clean neighbors.
- 4.1 Penalized Aggregation Mechanism: The penalty loss reduces the mean attention coefficient of perturbed edges relative to normal edges by a margin controlled by η.Directly minimizing the perturbed-edge score is avoided because it can make attention coefficients unstable and hinder convergence.
- 4.2 Transfer with Meta-Optimization: Clean graphs are attacked to generate known perturbed edges, providing supervised tasks for learning to classify nodes while penalizing adversarial edges.Each graph supplies a task with support and query sets of labeled nodes.
- 4.2 Transfer with Meta-Optimization: Meta-optimization adapts the initialization to each clean-graph task and updates it using task performance after adaptation.The resulting initialization is designed to retain penalizing ability while requiring few gradient steps on a new poisoned graph.
5 EXPERIMENTS
The experiments evaluate whether PA-GNN outperforms robust GNN baselines, assess its two main components, and test sensitivity to hyperparameters.
- 5 EXPERIMENTS: The experiments address PA-GNN’s performance against representative and state-of-the-art graph attacks.They also examine contributions from penalized aggregation and meta-optimization, plus hyperparameter sensitivity.
5.1 Experimental Setup
The setup evaluates PA-GNN in same-domain and similar-domain settings across benchmark and Yelp-derived graphs, using multiple attack types and controlled comparisons.
- 5.1 Experimental Setup: Experiments use same-domain Pubmed and Reddit graphs and similar-domain Yelp graphs constructed from cities with POI, review, feature, label, and co-review information.Cleveland is perturbed in Yelp-Small, while Toronto is perturbed in Yelp-Large to test transferability across cities.
- 5.1 Experimental Setup: Node splits use 10% for training, 20% for validation, and the remainder for testing; clean-graph labeled nodes support meta-training.Forty percent of each clean graph’s nodes are used for support and query sets, randomly split on the fly.
- 5.1 Experimental Setup: Attacks include non-targeted metattack, targeted attacks on Reddit and Yelp-Large, and random attacks on Pubmed and Yelp-Small.The reported comparisons cover all datasets for metattack, with targeted and random attacks evaluated on selected datasets.
- 5.1 Experimental Setup: The evaluation compares PA-GNN with GCN, GAT, PreProcess, RGCN, and VPN, including established robust GNN baselines.PreProcess, RGCN, and VPN are identified as robust GNNs for graph adversarial attacks.
- 5.1 Experimental Setup: Results are averaged over 10 runs, with hyperparameters tuned on validation data and two layers plus 64 hidden units per layer fixed across methods.The implementation sets λ to 1.0 and η to 100 for all settings.
5.2 Robustness Comparison
PA-GNN is evaluated under non-targeted, targeted, and random poisoning attacks using semi-supervised node classification. It consistently demonstrates stronger robustness than compared methods across these attack settings.
- Non-targeted attack: Under non-targeted metattack, vanilla GCN and GAT accuracy decays rapidly as perturbation rates increase, while robust GNNs generally perform better.Experiments were conducted on four datasets, with average accuracy and standard deviation reported over 10 runs.
- Non-targeted attack: PA-GNN achieves higher performance than RGCN across different non-targeted attack scenarios by learning to detect and penalize perturbations from clean graphs.Its mechanism directly restricts attention coefficients on perturbed edges rather than constraining model parameters with Gaussian distributions.
- Targeted attack: PA-GNN outperforms all compared methods under targeted attack, with approximately 5% performance improvements over the second-best methods on both evaluated datasets.The perturbations used to train initialization were generated with non-targeted metattack.
- Random attack: Under random attack, PA-GNN consistently outperforms all compared methods.The result is attributed to transferring perturbation-penalizing ability to a target graph with a different perturbation type.
5.3 Ablation Study
The ablation study examines penalized aggregation and meta-optimization. Results indicate that both components contribute to robustness, particularly as perturbation rates increase.
- Penalized aggregation: PA-GNNnp removes penalized aggregation by setting λ = 0, isolating the contribution of the mechanism that penalizes perturbed edges.The ablation compares PA-GNN with a variant lacking penalized aggregation.
- Penalized aggregation: On Reddit, PA-GNN consistently outperforms PA-GNNnp by 2% accuracy across different perturbation rates.The result supports the role of penalized aggregation in limiting negative effects from perturbed edges.
- Penalized aggregation: Without penalized aggregation, perturbed edges receive relatively higher attention coefficients, whereas PA-GNN assigns relatively higher coefficients to normal edges.The distributions are examined on a poisoned graph, with mean attention coefficients additionally reported in Table 5.
- Meta-optimization: PA-GNN2nd performs worst because treating adversarially generated edges as clean edges is not feasible when those edges substantially harm classification accuracy.PA-GNN2nd ignores clean-graph supervision and relies on a second attack to generate perturbed edges.
- Meta-optimization: PA-GNNft and PA-GNNjt slightly outperform PA-GNN on clean graphs but degrade rapidly as perturbation rates rise.The result indicates that jointly aggregating available data is less effective when perturbation changes the graph data distribution.
- Meta-optimization: PA-GNNnp consistently outperforms PA-GNNft and PA-GNNjt on perturbed graphs, supporting the contribution of meta-optimization using clean graphs.The comparison isolates meta-optimization while evaluating robustness under perturbation.
5.4 Parameter Sensitivity Analysis
The sensitivity analysis varies η and λ on Pubmed and Reddit at a 10% perturbation rate. PA-GNN accuracy remains relatively smooth across the tested parameter settings.
- Parameter roles: η controls the penalty on perturbed edges, while λ balances the classification objective and penalized aggregation mechanism.The analysis varies η over {0, 1, 10, 100, 1000} and λ over {0, 50, 100, 200, 400, 800}.
- Sensitivity results: At a 10% perturbation rate, PA-GNN accuracy is relatively smooth across the tested η and λ values on Pubmed and Reddit.The experiments alter both parameters over their specified ranges and report performance in Figure 4.
6 CONCLUSION AND FUTURE WORK
PA-GNN explores extra clean graphs to learn robust GNNs against poisoning attacks on a target graph. Its penalized attention and meta-optimization framework demonstrates efficacy across different poisoning attacks in node classification tasks.
- PA-GNN uses extra clean graphs to learn a robust GNN for a target graph under poisoning attacks.
- Its penalized attention mechanism learns to reduce the negative impact of perturbations on clean graphs.
- Meta-optimization transfers the learned alleviation ability from clean graphs to the target poisoned graph.
- Experimental node classification results demonstrate PA-GNN’s efficacy against different poisoning attacks.
- Future work will examine transfer learning for robustness in community detection and graph classification.