引入度中心性选择攻击节点的对抗攻击算法

doi:10.3778/j.issn.1002-8331.2306-0265

摘要/Abstract

摘要： 图卷积网络（GCN）在图神经网络中应用广泛，在处理图结构数据方面发挥着重要作用。然而，最近的研究表明，GCN容易受到中毒攻击等恶意攻击。在针对GCN的所有可能的对抗性攻击中，有一种特殊的方法是针对图卷积网络的目标通用攻击TUA（target universal attack）。该方法在挑选攻击节点时为了简便采用随机选择策略，该策略忽略了节点邻居对节点的重要性，对攻击成功率有负面影响。针对这个问题，提出了一种基于度中心性的攻击节点选择策略的对抗攻击算法（adversarial attack algorithm based on degree centrality attack node selection strategy，DCANSS）。优化挑选攻击节点的方式，引入度中心性，得到攻击节点。注入假节点并与攻击节点连接。挑选辅助节点并应用图卷积网络的消息传递机制，使节点信息扩散，计算扰动并将扰动特征赋予假节点，完成攻击，达到误分类目标。在三个流行的数据集上的实验表明，当仅使用3个攻击节点和2个假节点时，所提出的攻击对图中任意受害节点的平均攻击成功率达到90%。将DCANSS算法与TUA算法以及其他建立的基线算法进行实验对比，进一步验证了DCANSS算法的攻击能力。

关键词: 度中心性, 目标通用攻击（TUA）, 基于度中心性的攻击节点选择策略（DCANSS）, 图对抗攻击算法, 图神经网络

Abstract: Graph convolutional networks (GCN) are widely used in graph neural networks and play an important role in processing graph structured data. However, recent studies have shown that GCN is vulnerable to malicious attacks such as poisoning attacks. Of all the possible adversarial attacks against GCN, one particular approach is the TUA(target universal attack) against graph convolutional networks. In order to select attack nodes simply, the method adopts random selection strategy, which ignores the importance of neighbor to node, and has a negative impact on the success rate of attack. In response to this problem, adversarial attack algorithm based on degree centrality attack node selection strategy, adversarial attack algorithm based on degree centrality attack node selection strategy (DCANSS). Firstly, the method of selecting attack nodes is optimized, and the degree centrality is introduced to get the attack nodes. Secondly, the fake node is injected and connected to the attack node. Then, the auxiliary node is selected and the message passing mechanism of the graph convolutional network is applied to spread the node information, calculate the disturbance and assign the disturbance feature to the false node to complete the attack and achieve the misclassification goal. Experiments on three popular datasets show that when only three attack nodes and six fake nodes are used, the proposed attack has an average success rate of 90% against any victim node in the graph. By comparing DCANSS algorithm with TUA algorithm and other established baseline algorithms, the attack capability of DCANSS algorithm is further verified.

Key words: degree centrality, target universal attack (TUA), degree centrality attack node selection strategy (DCANSS), graph adversarial attack algorithm, graph neural network

钱榕, 徐雪飞, 刘晓豫, 张克君, 曾俊铭, 吕宗芳, 郭竞桧. 引入度中心性选择攻击节点的对抗攻击算法[J]. 计算机工程与应用, 2024, 60(18): 285-293.

QIAN Rong, XU Xuefei, LIU Xiaoyu, ZHANG Kejun, ZENG Junming, LYU Zongfang, GUO Jinghui. Adversarial Attack Algorithm for Introducing Degree Centrality Selection of Attack Nodes[J]. Computer Engineering and Applications, 2024, 60(18): 285-293.

参考文献

[1] 陈晋音, 张敦杰, 黄国瀚, 等. 面向图神经网络的对抗攻击与防御综述[J]. 网络与信息安全学报, 2021, 7(3): 1-28.
CHEN J Y, ZHANG D J, HUANG G H, et al. Adversarial attack and defense on graph neural networks: a survey[J]. Chinese Journal of Network and Information Security, 2021, 7(3): 1-28.
[2] SUN Y W, WANG S H, HSIEH T, et al. MEGAN: a generative adversarial network for multi-view network embedding[J]. arXiv:1909.01084, 2019.
[3] YU Y W, YAO H X, WANG H J, et al. Representation learning for large-scale dynamic networks[C]//International Conference on Database Systems for Advanced Applications, 2018: 526-541.
[4] ZHANG Y, XIONG Q, FAN Y, et al. Your style your identity: leveraging writing and photography styles for drug trafficker identification in darknet markets over attributed heterogeneous information network[C]//The World Wide Web Conference, 2019.
[5] FAN W Q, MA Y, LI Q, et al. Graph neural networks for social recommendation[J]. arXiv:1902.07243, 2019.
[6] YING R, HE R N, CHEN K F, et al. Graph convolutional neural networks for web-scale recommender systems[J]. arXiv: 1806.01973, 2018.
[7] LIU Z Q, CHEN C C, YANG X X, et al. Heterogeneous graph neural networks for malicious account detection[J]. arXiv:2002.12307, 2020.
[8] DEFFERRARD M, BRESSON X, VANDERGHEYNST P. Convolutional neural networks on graphs with fast localized spectral filtering[J]. arXiv:1606.09375, 2016.
[9] MA Y, WANG S H, AGGARWAL C, et al. Graph convolutional networks with eigenpooling[J]. arXiv:1904.13107, 2019.
[10] TANG X F, LI Y D, SUN Y W, et al. Transferring robustness for graph neural network against poisoning attacks[J]. arXiv:1908.07558, 2019.
[11] WU H J, WANG C, TYSHETSKIY Y, et al. Adversarial examples on graph data: deep insights into attack and defense[J]. arXiv:1903.01610, 2019.
[12] ZUGNER D, AKBARNEJAD A, GUNNEMANN S. Adversarial attacks on neural networks for graph data[C]//Twenty-Eighth International Joint Conference on Artificial Intelligence, 2019.
[13] DAI J Z, ZHU W F, LUO X F. A targeted universal attack on graph convolutional network by using fake nodes[J]. Neural Processing Letters, 2022, 54: 3321-3337.
[14] GILMER J, SCHOENHOLZ S S, RILEY P F, et al. Neural message passing for quantum chemistry[C]//International Conference on Machine Learning, 2017: 1263-1272.
[15] ZANG X, XIE Y, CHEN J. Graph universal adversarial attacks: a few bad actors ruin graph learning models[J]. arXiv:2002.04784, 2020.
[16] DAI H J, LI H, TIAN T, et al. Adversarial attack on graph structured data[J]. arXiv:1806.02371, 2018.