基于参数差异假设的图卷积网络对抗性攻击

Adversarial Attacks on Graph Convolution Networks Based on Parameter Discrepancy Hypothesis

图神经网络容易受到对抗性攻击安全威胁.现有图神经网络对抗性攻击思想可以概括为构造矛盾的训练数据.矛盾数据假设不能很好地解释图神经网络过拟合训练数据的攻击场景.本文以有效攻击前后图神经网络模型的训练参数应该具有较大差异为基本出发点,以图卷积网络为具体研究对象,建立基于参数差异假设的对抗性攻击模型.将统计诊断的重要结果Cook距离引入对抗性攻击,提出基于Cook距离的参数差异度量方法.采用基于Cook距离梯度的攻击方法,首次得出了攻击梯度的闭式解,并结合梯度下降算法思想和贪心算法思想提出完整的攻击算法.最后设计实验验证了参数差异假设的合理性和基于该假设导出方法的有效性;验证了梯度信息对图场景离散数据的可用性;仿真示例说明了攻击梯度闭式解的正确性;与其他攻击方法对比分析了攻击方法的有效性.

Graph neural networks(GNNs)are vulnerable to adversarial attacks.Existing GNN adversarial attacks can be generalized as constructing contradictory training data.However,the existing methods based on contradictory data hypothesis cannot explain well why the false outputs could be generated when GNNs fit the training data well.Firstly,based on the discrepancy of model parameters of GNNs before and after attack,poisoning attack model is proposed taking graph convolution network as a target.Secondly,a parameter difference metric,Cook distance,is proposed.The closed form solution of attack gradients is obtained for the first time,and an attack algorithm is given based on the idea of gradient descent and greedy algorithm.Finally,the rationality of the hypothesis of parameter discrepancy and the effectiveness of the proposed method are verified by experiments;the availability of gradients to discrete data of graph is verified;the correctness of closed form solution of attack gradients is illustrated by a numerical example;the effectiveness of attack method is analyzed compared with other attacks.