PaperlayerView exact revision on arXiv

Source-linked AI summary

GNNGuard: Defending Graph Neural Networks against Adversarial Attacks

Xiang Zhang, Marinka Zitnik

arXiv:2006.08149v3cs.LGstat.ML

TL;DR

GNNs can fail under small adversarial graph perturbations that corrupt message passing and node classification. GNNGUARD revises message passing with neighbor-importance estimation and layer-wise graph memory, outperforming existing defenses by 15.3% on average while supporting multiple GNNs and heterophily graphs.

  • Problem

    Small adversarial graph perturbations can catastrophically reduce the performance of otherwise strong GNNs, while graph attack and defense remain less understood than in non-graph settings.

  • Method

    GNNGUARD modifies an existing GNN’s message passing to downweight or prune suspicious edges using neighbor importance estimation and stabilize changes with layer-wise graph memory.

  • Results

    15.3%: GNNGUARD improves defense performance over existing approaches across multiple GNNs, datasets, and targeted and non-targeted attacks, including heterophily graphs.

  • Takeaways & Limitations

    GNNGUARD provides a general defense that can be integrated with different GNN architectures and can restore strong performance under varied graph attacks.

  • Takeaways & Limitations

    The paper focuses experimentally on semi-supervised node classification, although it presents GNNGUARD as applicable to other graph-mining tasks.

Abstract

from arXiv · show

Deep learning methods for graphs achieve remarkable performance across a variety of domains. However, recent findings indicate that small, unnoticeable perturbations of graph structure can catastrophically reduce performance of even the strongest and most popular Graph Neural Networks (GNNs). Here, we develop GNNGuard, a general algorithm to defend against a variety of training-time attacks that perturb the discrete graph structure. GNNGuard can be straight-forwardly incorporated into any GNN. Its core principle is to detect and quantify the relationship between the graph structure and node features, if one exists, and then exploit that relationship to mitigate negative effects of the attack.GNNGuard learns how to best assign higher weights to edges connecting similar nodes while pruning edges between unrelated nodes. The revised edges allow for robust propagation of neural messages in the underlying GNN. GNNGuard introduces two novel components, the neighbor importance estimation, and the layer-wise graph memory, and we show empirically that both components are necessary for a successful defense. Across five GNNs, three defense methods, and five datasets,including a challenging human disease graph, experiments show that GNNGuard outperforms existing defense approaches by 15.3% on average. Remarkably, GNNGuard can effectively restore state-of-the-art performance of GNNs in the face of various adversarial attacks, including targeted and non-targeted attacks, and can defend against attacks on heterophily graphs.

1 Introduction

GNNs succeed through neighborhood message passing but can be severely damaged by small graph perturbations. GNNGUARD modifies message passing to identify suspicious edges and improve robustness across attacks and graph types.

  • Motivation: GNNs learn node representations by aggregating feature and topological information from neighbors through neural message passing.This aggregation supports downstream graph-learning tasks but also creates exposure to adversarial manipulation of exchanged information.
  • Motivation: Small topology rewiring or feature perturbations can contaminate neighborhoods, degrade representations, and cause major classification failures.The paper frames robustness as important for applications affecting public trust, human decisions, health, and livelihoods.
  • Approach: GNNGUARD revises neural message passing by estimating neighbor importance, pruning likely fake edges, and retaining partial graph memory across layers.Neighbor relevance uses homophily-based cues, while graph memory stabilizes structural changes between layers.
  • Results: 15.3%: GNNGUARD improves defense performance over three state-of-the-art defenders across four datasets and direct targeted, influence targeted, and non-targeted attacks.It is integrated into five GNN architectures and is reported to restore state-of-the-art performance under adversarial attacks.
  • Results: GNNGUARD successfully defends heterophily graphs, extending beyond prior defenders focused on homophily graphs.The introduction also reports applicability to graphs with structural equivalences, where connected nodes may have different features but similar structural roles.

2 Related Work

Prior graph attacks manipulate topology or features to compromise GNN predictions, while graph-defense research remains comparatively limited. Existing defenses differ in preprocessing, architecture, decomposition, or transfer-learning requirements, motivating a general alternative.

  • Adversarial Attacks: Adversarial attacks perturb machine-learning inputs with deliberately small, often unnoticeable changes designed to alter model outputs.Most prior work emphasized grid data or independent samples rather than graphs.
  • Adversarial Attacks: Graph attacks include poisoning attacks that modify training-time structure and evasion attacks that target predictions after training.The supplied passage introduces this distinction but does not fully describe the evasion category.
  • Defense on Graphs: GNNGUARD differs from graph attackers by inspecting the graph and recovering adversarial perturbations rather than generating them.It is presented as a defense against poisoning attacks that alter graph structure.
  • Defense on Graphs: Existing defenses include adjacency preprocessing, probabilistic hidden representations, low-rank adjacency approximation, and transfer learning.The methods named are GNN-Jaccard, RobustGCN, GNN-SVD, and Tang et al.’s transfer-learning approach.
  • Defense on Graphs: Transfer-learning defense requires several unperturbed graphs from a similar domain during training.This requirement is identified as a limitation of the transfer-learning approach.

3 Background and Problem Formulation

This section formalizes message passing, poisoning attacks, and the defense objective. GNNGUARD seeks to approximate clean-graph predictions on poisoned graphs by revising message propagation without access to the clean graph.

  • 3 Background and Problem Formulation: A graph G=(V,E,X) contains nodes, edges, and node features, with adjacency matrix A encoding edge existence.Each node’s neighborhood includes itself, while N and |E| denote node and edge counts.
  • 3 Background and Problem Formulation: GNNs compute node embeddings through message, aggregation, and update functions across layers.The final representation is the output of the K-th layer and captures local neighborhoods and node features.
  • 3 Background and Problem Formulation: Poisoning attackers perturb a small number of training-graph edges to induce incorrect GNN predictions.The perturbed graph is G′=(V,E′,X), and the attack optimizes the perturbed adjacency under an edge-change budget.
  • 3 Background and Problem Formulation: The attack framework covers direct targeted, influence targeted, and non-targeted attacks with different target and attacker-node sets.Non-targeted attacks aim to degrade overall classification performance, while targeted attacks focus on specified nodes.
  • 3.1 GNNGUARD: Problem Formulation: GNNGUARD transforms an existing GNN f into f′ by modifying its message-passing, aggregation, and update functions for robustness on poisoned G′.The defense is designed to preserve representation-learning capacity while mitigating poisoning effects.
  • 3.1 GNNGUARD: Problem Formulation: The defense objective is to make predictions from f′ trained on G′ approximate hypothetical predictions from f trained on clean G.Because clean G is unavailable, the paper proposes recovering its structure through message passing that detects and blocks fake edges.
  • 3.1 GNNGUARD: Problem Formulation: Layer-wise graph memory retains part of the previous pruned structure to stabilize importance estimation and smooth edge pruning across layers.The framework is intended for semi-supervised node classification while remaining general across GNNs and graph-mining tasks such as link prediction.

4 GNNGUARD

GNNGUARD defends GNN message passing by estimating neighbor relevance from node similarity, pruning suspicious edges, and smoothing graph changes across layers. It is designed as a general, efficient modification applicable to many GNN architectures.

  • 4.1 Neighbor Importance Estimation: GNNGUARD detects potentially forged edges by assigning lower importance to dissimilar neighbors and pruning edges likely to be adversarial.Similarity reflects node features in homophily graphs and structural roles in heterophily graphs.
  • 4.1 Neighbor Importance Estimation: Defense coefficients control message propagation by strengthening messages from relevant neighbors and weakening messages from suspicious ones.The revised aggregation propagates information only along the most relevant edges.
  • 4.2 Layer-Wise Graph Memory: Layer-wise graph memory retains partial information from the previous layer to stabilize importance estimation and smooth edge-pruning evolution.The memory coefficient β is learnable and controls how much prior-layer information is retained.
  • 4.3 Overview of GNNGUARD: GNNGUARD transforms an existing GNN f = (MSG, AGG, UPD) into f′ = (MSG′, AGG′, UPD′) while preserving the original message function.The defense combines current-layer importance weights with previous-layer defense coefficients.
  • 4.3 Overview of GNNGUARD: GNNGUARD can defend architectures including GCN, GAT, GIN, JK-Net, GraphSAINT, GraphSAGE, and SignedGCN.Its computational complexity is on the same order as that of the underlying GNN.
  • 4.3 Overview of GNNGUARD: Compared with existing defenders, GNNGUARD dynamically updates coefficients across layers and uses both node features and graph structure without requiring external clean graphs.The cited comparison also distinguishes its broader architecture and attack applicability from several prior methods.

5 Experiments

Experiments evaluate GNNGUARD across attacks, GNN architectures, datasets, ablations, citation examples, and heterophily graphs. The results show broad defense gains, component value, and applicability beyond homophily.

  • Experimental setup: GNNGUARD is evaluated with five GNN models across four graphs and targeted, influence targeted, and non-targeted attacks.The models are GCN, GAT, GIN, JK-Net, and GraphSAINT; datasets include Cora, Citeseer, ogbn-arxiv, and Disease Pathway.
  • Defense against targeted attacks: 15.3% average accuracy improvement over state-of-the-art defenses is reported for direct targeted attacks.GNNGUARD also restores performance to a level comparable to no attack in the reported setting.
  • Ablation study: Full GNNGUARD performs better and with smaller standard deviation than the version without layer-wise graph memory on ogbn-arxiv under Nettack-Di.The ablation therefore supports graph memory’s contribution to defense performance and training stability.
  • Case study: Four injected fake citations change a GIN prediction from the correct IT label to incorrect AI, whereas GNNGUARD restores the correct label after attack.The reported confidence changes from f_u(G)=0.536 on the clean graph to f_u(G′)=0.201 after attack and f′_u(G′)=0.489 with defense.
  • Heterophily graphs: 77.5% accuracy is achieved by GNNGUARD on synthetic heterophily graphs, versus at most 45.0% without defense and a 19.2% gain over the strongest baseline.The graphs contain structural-role labels and graphlet vectors; the result depends on using an appropriate similarity function.

6 Conclusion

GNNGUARD defends GNNs against poisoning attacks by modifying neural message passing, estimating neighbor relevance, and using graph memory. It can prune likely fake edges, reduce suspicious-edge weights, and support heterophily graphs.

  • GNNGUARD defends GNNs against direct targeted, influence targeted, and non-targeted poisoning attacks.
  • Neighbor relevance estimation and graph memory are critical components of GNNGUARD’s defense.
  • GNNGUARD prunes likely fake edges and assigns lower weights to suspicious edges using homophily-based network principles.
  • GNNGUARD outperforms existing defense algorithms by a large margin across four datasets and five GNNs.
  • GNNGUARD can leverage structural equivalence and be used with heterophily graphs.

Broader Impact

GNNGUARD is presented as a broadly integrable graph-learning defense with potential benefits for applications vulnerable to attacked GNN decisions, while requiring thoughtful security-oriented use.

  • GNNGUARD’s compatibility with any existing GNN may give it broader research impact than introducing another robust GNN architecture.
  • GNNGUARD can be integrated with a user-selected GNN for applications including disease diagnosis, drug discovery, and recommendation systems.
  • The authors envision GNNGUARD helping users avoid losses caused by misjudgments from attacked GNNs, including in financial networks.
  • Insights from GNNGUARD could potentially help improve attack algorithms and expose currently unknown GNN vulnerabilities.
  • The paper emphasizes research into both attacks and defenses because GNNs are increasingly used in real-world machine-learning systems.

Appendices to “GNNGUARD: Defending Graph

The supplied passage contains only the title fragment for the appendices.

  • The appendix material belongs to “GNNGUARD: Defending Graph Neural Networks against Adversarial Attacks.”
  • The title identifies graph neural networks as the defended models.
  • The title frames adversarial attacks as the paper’s defense target.

Appendix A Defense Performance Against Influence Targeted Attacks

Against influence targeted attacks, GNNGUARD achieves the best defensive performance across five GNN models and four datasets, improving accuracy and restoring performance toward clean-graph levels.

  • GNNGUARD achieves the best defensive performance against influence targeted attacks across five GNN models and four datasets.
  • 8.77% average improvement over state-of-the-art defense models is reported for influence targeted attacks.
  • 22.6% average accuracy improvement is reported relative to attacking the GNN without defense.
  • GNNGUARD restores defended GNN performance to levels comparable to learning on clean, non-attacked graphs.
  • Table 6 reports defense performance using multi-class classification accuracy against influence targeted attacks.

Appendix B Defense Performance Against Non-Targeted Attacks

Non-targeted attacks substantially reduce GNN accuracy, while GNNGUARD mitigates these effects and generally outperforms baseline defenses.

  • 18.7% average accuracy reduction affects even the strongest GNN under non-targeted attacks.
  • GNNGUARD outperforms baseline defenses in most non-targeted attack experiments.The experiments indicate that it successfully mitigates the negative impacts of these attacks.

Appendix C Classification Accuracy on Clean (i.e., Non-attacked) Datasets with and without GNNGUARD

GNNGUARD preserves GNN performance on clean, non-attacked datasets. Clean-trained GNNs achieve approximately the same accuracy with or without the defense.

  • GNNGUARD does not reduce predictive performance when graphs are clean and non-attacked.This matters because users may not know whether their graph datasets have been altered.
  • Clean-trained GNNs achieve approximately the same performance with and without GNNGUARD.The results suggest that the defense preserves expressive power and representation capacity without adversarial attacks.

Appendix D Further Details on Datasets

The appendix documents the dataset resources, dataset-statistics notation, and the Disease Pathway benchmark, alongside the implementation and experimental-training setup.

  • GNNGUARD implementation, datasets, and relevant data loaders are publicly available in the linked repository.
  • Table 9 defines N, E, M, and C as dataset counts for nodes, edges, node-feature dimensionality, and labels or classes.
  • The Disease Pathway dataset represents interacting human proteins and supports multi-label node classification for predicting disease-associated labels.It uses 73-dimensional graphlet-orbit-count features and selects the 10 most-common diseases as independent balanced binary tasks.
  • The dataset collection includes homophily graphs and a synthesized heterophily graph with structural equivalence.
  • Experiments follow published guidance for five GNN architectures, three baseline defenses, and three adversarial-attack models.
  • Training uses 200 epochs with early stopping, and every experiment is repeated five times with average performance reported.
Loading 2006.08149v3…