摘要： 图神经网络在面对节点分类、链路预测、社区检测等与图数据处理相关的任务时，容易受到对抗性攻击的安全威胁。基于梯度的攻击方法具有有效性和高效性，被广泛应用于图神经网络对抗性攻击，高效利用攻击梯度信息与求取离散条件下的攻击梯度是攻击离散图数据的关键。提出基于改进投影梯度下降算法的投毒攻击方法。将模型训练参数看作与扰动相关的函数，而非固定的常数，在模型的对抗训练中考虑了扰动矩阵的影响，同时在更新攻击样本时研究模型对抗训练的作用，实现数据投毒与对抗训练两个阶段的结合。采用投影梯度下降算法对变量实施扰动，并将其转化为二进制，以高效利用攻击梯度信息，从而解决贪婪算法中时间开销随扰动比例线性增加的问题。实验结果表明，当扰动比例为5%时，相比Random、DICE、Min-max攻击方法，在Citeseer、Cora、Cora_ml和Polblogs数据集上图卷积网络模型被该方法攻击后的分类准确率分别平均降低3.27%、3.06%、3.54%、9.07%，在时间开销和攻击效果之间实现了最佳平衡。

关键词: 图卷积网络, 对抗性攻击, 投毒攻击, 投影梯度下降, 对抗训练

Abstract: Graph neural network is widely used in graph data processing-related tasks, such as node classification, link prediction, and community detection.However, it is susceptible to security threats from adversarial attacks.Gradient-based attack methods are widely used in graph neural network adversary attacks because of their effectiveness and efficiency.The efficient use of attack gradient information and the acquisition of the attack gradient under discrete conditions are key to obtain attack discrete graph data.This study proposes a poisoning attack method based on an improved Projection Gradient Descent(PGD) algorithm.Using the model training parameters as a function related to disturbance instead of a fixed constant, the effect of disturbance is considered in the model adversarial training, and the effect of model adversarial training is considered when updating the attack samples to realize the combination of data poisoning and adversarial training.The PGD algorithm is used to perturb the variables and convert them into binary such that the attack gradient information can be used effectively to solve the linear increase in the time cost with the disturbance ratio in the greedy algorithm.Experimental results show that when the disturbance ratio is 5%, compared with the performances of Random, DICE, Min-max, and other attack methods, on Citeseer, Cora, Cora_ml, and Polblogs datasets, the classification accuracy of a Graph Convolutional Network(GCN) model attacked by the proposed method reduced by 3.27%, 3.06%, 3.54%, and 9.07% on average, respectively, demonstrating the best balance between time overhead and attack effect.

Key words: Graph Convolutional Network(GCN), adversarial attack, poisoning attack, Projection Gradient Descent(PGD), adversarial training

中图分类号: 

• TP18