arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2607.04091cs.LG
收藏

针对图神经网络的黑盒节点注入攻击的目标感知交互引导强化学习

Target-Aware Interaction-Guided Reinforcement Learning for Black-Box Node Injection Attacks on Graph Neural Networks

College of Computer and Information Science, Southwest University(西南大学计算机与信息科学学院)

Yi Lan, Ye Yuan

AI总结:

研究针对图神经网络黑盒节点注入攻击问题,提出TIRBA方法,将攻击建模为马尔可夫决策过程,通过设计目标感知交互编码器、引入类中心引导机制和采用拓扑差异感知状态值评估来联合优化节点特征生成与边构建,性能优于现有方法。

摘要:

图神经网络(GNNs)在图表示学习中取得了显著性能,但其易受对抗攻击带来安全风险。黑盒节点注入攻击因不改变原图拓扑注入恶意节点成为主要威胁,但常使恶意节点特征生成与边连接解耦,攻击效果不佳。为此提出TIRBA,将攻击建模为马尔可夫决策过程,在异构动作空间中联合优化节点特征生成和边构建,设计目标感知交互编码器融合节点特征和边信息,引入类中心引导机制利用先验类分布信息,采用拓扑差异感知状态值评估捕获注入节点引起的局部结构异常,稳定强化学习训练过程。实验结果表明TIRBA显著优于现有黑盒节点注入攻击方法。

英文摘要:

Graph Neural Networks (GNNs) have achieved remarkable performance in graph representation learning, yet their inherent vulnerability to adversarial attacks poses severe security risks. Especially, black-box node injection attacks have become a major threat to GNNs since they inject malicious nodes without altering the original graph topology. However, they typically decouple the generation of malicious node features and edge connections, thereby resulting in suboptimal attack efficacy under stringent budgets. To address this critical issue, this study proposes a novel Target-aware Interaction-guided Reinforcement learning for Black-box node injection Attacks on GNNs (TIRBA), which formulates the attack as a Markov Decision Process and jointly optimizes node feature generation and edge construction in a heterogeneous action space. Firstly, TIRBA designs a target-aware interaction encoder to fuse information of node features and edges. Further, it introduces a class-center guidance mechanism to utilize prior class distribution information, thereby guiding efficient exploration of the high-dimensional feature space. Finally, a topology difference-aware state value evaluation is adopted to explicitly capture local structural anomalies caused by injected nodes, thereby stabilizing the reinforcement learning training process. Experimental results demonstrate that the proposed TIRBA significantly outperforms state-of-the-art black-box node injection attack methods.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑