Collective learning methods exploit relations among data points to enhance classification performance. However, such relations, represented as edges in the underlying graphical model, expose an extra attack surface to the adversaries. We study adversarial robustness of an important class of such graphical models, Associative Markov Networks (AMN), to structural attacks, where an attacker can modify the graph structure at test time. We formulate the task of learning a robust AMN classifier as a bi-level program, where the inner problem is a challenging non-linear integer program that computes optimal structural changes to the AMN. To address this technical challenge, we first relax the attacker problem, and then use duality to obtain a convex quadratic upper bound for the robust AMN problem. We then prove a bound on the quality of the resulting approximately optimal solutions, and experimentally demonstrate the efficacy of our approach. Finally, we apply our approach in a transductive learning setting, and show that robust AMN is much more robust than state-of-the-art deep learning methods, while sacrificing little in accuracy on non-adversarial data.
Quantifying the Noise of Structural Perturbations on Graph Adversarial Attacks
Department of Electrical Engineering, City University of Hong Kong（香港城市大学电气工程系）；School of Computer Science and Engineering, Sun Yat-sen University（中山大学计算机科学与工程学院）；School of Software Engineering, Sun Yat-sen University（中山大学软件工程学院）
Securing Deep Spiking Neural Networks against Adversarial Attacks through Inherent Structural Parameters
IEMN CNRS-UMR8520（法国国家科学研究中心电子、微电子与纳米技术研究所 UMR8520）；Université Polytechnique Hauts-De-France（上法兰西理工大学）；Institute of Computer Engineering, Technische Universität Wien（维也纳技术大学计算机工程研究所）；New York University Abu Dhabi（纽约大学阿布扎比分校）
Active Subspace of Neural Networks: Structural Analysis and Universal Attacks
University of California Santa Barbara（加州大学圣巴巴拉分校）；Skolkovo Institute of Science and Technology（斯科尔科沃科学技术研究院）；Institute of Numerical Mathematics of Russian Academy of Sciences（俄罗斯科学院数值数学研究所）
对抗攻击旨在混淆机器学习系统，同时保持人类几乎无法感知。对图像分类系统的攻击通常根据像素特征空间中的$p$范数失真来衡量。我们进行了行为研究，表明像素$p$ -规范的任何$0\le p \le \infty$，和几个替代措施，包括推土机的距离，结构相似性指数，和深网嵌入，不适合人类的感知。我们的研究结果有可能提高对对抗攻击和防御策略的理解。
Mitigating the Structural Bias in Graph Adversarial Defenses
Department of Electrical Engineering, City University of Hong Kong（香港城市大学电子工程系）；School of Computer Science and Engineering, Sun Yat-sen University（中山大学计算机科学与工程学院）；School of Software Engineering, Sun Yat-sen University（中山大学软件工程学院）
Robust Graph Contrastive Learning with Information Restoration
Department of Computer Science, Hong Kong Chu Hai College（香港 Chu Hai 学院计算机科学系）；Department of Computing, The Hong Kong Polytechnic University（香港理工大学计算系）；Department of Computer Science and Engineering, Washington University in St. Louis（华盛顿大学圣路易斯分校计算机科学与工程系）
Structack: Structure-based Adversarial Attacks on Graph Neural Networks
Graz University of Technology（格拉茨工业大学）；Know Center GmbH（知识中心有限公司）；RWTH Aachen（亚琛工业大学）；GESIS - Leibniz Institute for the Social Sciences（GESIS-莱布尼茨社会科学研究所）
