Abstract:

Graph Neural Network （GNN） is vulnerable to adversarial attacks， leading to performance degradation， which affects downstream tasks such as node classification， link prediction and community detection. Therefore， the defense methods of GNN have important research value. Aiming at the problem that GNN has poor robustness when being adversarially attacked， taking Graph Convolutional Network （GCN） as the model， an improved Singular Value Decomposition （SVD） based poisoning attack defense method was proposed， named ISVDatt. In the poisoning attack scenario， the attacked graph was able to be purified by the proposed method. When the GCN was attacked by poisoning， the connected edges with large different features were first screened and deleted to keep the graph features smooth. Then， SVD and low-rank approximation operations were performed to keep the low rank of the attacked graph and clean it up. Finally， the purified graph was used for training GCN model to achieve effective defense against poisoning attack. Experiments against Metattack and DICE were conducted on the open source datasets such as Citeseer， Cora and Pubmed， and compared with the defense methods based on SVD， Pro_GNN and Robust Graph Convolutional Network （RGCN）， respectively. The results show that ISVDatt has relatively better defense effect， although the classification accuracy is lower than that of Pro_GNN， but it has low complexity and negligible time overhead. Experimental results verify that ISVDatt can resist poisoning attack effectively with the consideration of both the complexity and versatility of the algorithm， and has a high practical value.

Key words: Graph Neural Network (GNN), Graph Convolutional Network (GCN), adversarial attack, poisoning attack, adversarial defense, Singular Value Decomposition (SVD)

摘要：

图神经网络（GNN）容易受到对抗性攻击而导致性能下降，影响节点分类、链路预测和社区检测等下游任务，因此GNN的防御方法具有重要研究价值。针对GNN在面对对抗性攻击时鲁棒性差的问题，以图卷积网络（GCN）为模型，提出一种改进的基于奇异值分解（SVD）的投毒攻击防御方法ISVDatt。在投毒攻击场景下，该方法可对扰动图进行净化处理。GCN遭受投毒攻击后，首先筛选并删除特征差异较大的连边使图保持特征光滑性；然后进行SVD和低秩近似操作使扰动图保持低秩性，并完成对它的净化处理；最后将净化后的扰动图用于GCN模型训练，从而实现对投毒攻击的有效防御。在开源的Citeseer、Cora和Pubmed数据集上针对Metattack和DICE（Delete Internally， Connect Externally）攻击进行实验，并与基于SVD、Pro_GNN和鲁棒图卷积网络（RGCN）的防御方法进行了对比，结果显示ISVDatt的防御效果相对较优，虽然分类准确率比Pro_GNN低，但复杂度低，时间开销可以忽略不计。实验结果表明ISVDatt能有效抵御投毒攻击，兼顾算法的复杂度和通用性，具有较高的实用价值。

关键词: 图神经网络, 图卷积网络, 对抗性攻击, 投毒攻击, 对抗性防御, 奇异值分解