arXivDaily arXiv每日学术速递 周一至周五更新
arXiv周末暂无论文更新,休息一下吧,周末愉快~~
arXiv 2202.12993cs.LGcs.CR
收藏

基于投影排序的GNN规避攻击

Projective Ranking-based GNN Evasion Attacks

Monash University(莫纳什大学);Griffith University(格里菲斯大学);Academy of Mathematics and Systems Science, Chinese Academy of Sciences(中国科学院数学与系统科学研究院)

He Zhang, Xingliang Yuan, Chuan Zhou, Shirui Pan

摘要:

图神经网络(GNNs)为图相关任务提供了有前途的学习方法。然而,GNN面临对抗攻击的风险。目前的规避攻击方法的两个主要局限性突出:(1)目前的GradArgmax忽略了“长期”的扰动的好处。在某些情况下,它面临着零梯度和无效的效益估计。(2)在基于强化学习的攻击方法中,当攻击预算发生变化时,学习到的攻击策略可能无法转移。为此,我们首先制定扰动空间,并提出了一个评估框架和投影排名方法。我们的目标是学习一个强大的攻击策略,然后尽可能少地调整它,以在动态预算设置下生成对抗样本。在我们的方法中,基于互信息,我们排名和评估的攻击效益的每一个扰动的有效的攻击策略。通过投影的战略,我们的方法显着地最大限度地减少了学习一个新的攻击策略时,攻击预算的变化。在与GradArgmax和RL-S2 V的对比评估中,结果表明该方法具有较高的攻击性能和有效的可移植性。我们方法的可视化还揭示了生成对抗样本时的各种攻击模式。

英文摘要:

Graph neural networks (GNNs) offer promising learning methods for graph-related tasks. However, GNNs are at risk of adversarial attacks. Two primary limitations of the current evasion attack methods are highlighted: (1) The current GradArgmax ignores the "long-term" benefit of the perturbation. It is faced with zero-gradient and invalid benefit estimates in certain situations. (2) In the reinforcement learning-based attack methods, the learned attack strategies might not be transferable when the attack budget changes. To this end, we first formulate the perturbation space and propose an evaluation framework and the projective ranking method. We aim to learn a powerful attack strategy then adapt it as little as possible to generate adversarial samples under dynamic budget settings. In our method, based on mutual information, we rank and assess the attack benefits of each perturbation for an effective attack strategy. By projecting the strategy, our method dramatically minimizes the cost of learning a new attack strategy when the attack budget changes. In the comparative assessment with GradArgmax and RL-S2V, the results show our method owns high attack performance and effective transferability. The visualization of our method also reveals various attack patterns in the generation of adversarial samples.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑