Defending against adversarial attacks on graph neural networks via similarity property

Article type: Research Article

Authors: Yao, Minghong^a | Yu, Haizheng^{a; *} | Bian, Hong^b

Affiliations: [a] College of Mathematics and System Sciences, Xinjiang University, Urumqi 830046, China | [b] School of Mathematical Sciences, Xinjiang Normal University, Urumqi 830017, China

Correspondence: [*] Corresponding author. E-mail: yuhaizheng@xju.edu.cn.

Abstract: Graph Neural Networks (GNNs) are powerful tools in graph application areas. However, recent studies indicate that GNNs are vulnerable to adversarial attacks, which can lead GNNs to easily make wrong predictions for downstream tasks. A number of works aim to solve this problem but what criteria we should follow to clean the perturbed graph is still a challenge. In this paper, we propose GSP-GNN, a general framework to defend against massive poisoning attacks that can perturb graphs. The vital principle of GSP-GNN is to explore the similarity property to mitigate negative effects on graphs. Specifically, this method prunes adversarial edges by the similarity of node feature and graph structure to eliminate adversarial perturbations. In order to stabilize and enhance GNNs training process, previous layer information is adopted in case a large number of edges are pruned in one layer. Extensive experiments on three real-world graphs demonstrate that GSP-GNN achieves significantly better performance compared with the representative baselines and has favorable generalization ability simultaneously.

Keywords: Graph neural network, adversarial attack, defense, similarity property

DOI: 10.3233/AIC-220120

Journal: AI Communications, vol. 36, no. 1, pp. 27-39, 2023