arXiv:2501.05015cs.LGcs.AI2025-01KDD被引 2

提出可学习的图攻击隐蔽性度量方法,解决现有方法易被绕过和漏检的问题。

On Measuring Unnoticeability of Graph Adversarial Attacks: Observations, New Measure, and Applications

  • 设计可学习边评分器LEO,识别攻击边与正常边差异
  • 通过不平衡感知聚合提升对微小扰动的检测能力
  • 适用于提升图神经网络鲁棒性,适合安全防御研究者

对抗攻击被认为具有隐蔽性。已有研究基于统计检验比较原始图与攻击后图的拓扑结构来衡量攻击可见性,但存在两大缺陷:一是依赖简单规则,攻击者可轻易绕过;二是仅使用全局统计量(如度分布),对轻微扰动反应迟钝,导致攻击几乎“完全不可见”。为此,我们提出HideNSeek,一种可学习的图攻击可见性度量方法。首先,通过可学习边评分器(LEO)评估每条边为攻击边的概率,以缓解绕过问题;其次,采用不平衡感知聚合所有边得分,提升对细微扰动的敏感性。在六个真实图数据集上,实验表明HideNSeek有效缓解上述问题,且LEO在五种不同攻击方法下优于11个对比模型。此外,将LEO用于剔除攻击特征边,显著提升了鲁棒图神经网络的性能。

原文摘要 · Abstract (English)

Adversarial attacks are allegedly unnoticeable. Prior studies have designed attack noticeability measures on graphs, primarily using statistical tests to compare the topology of original and (possibly) attacked graphs. However, we observe two critical limitations in the existing measures. First, because the measures rely on simple rules, attackers can readily enhance their attacks to bypass them, reducing their attack "noticeability" and, yet, maintaining their attack performance. Second, because the measures naively leverage global statistics, such as degree distributions, they may entirely overlook attacks until severe perturbations occur, letting the attacks be almost "totally unnoticeable." To address the limitations, we introduce HideNSeek, a learnable measure for graph attack noticeability. First, to mitigate the bypass problem, HideNSeek learns to distinguish the original and (potential) attack edges using a learnable edge scorer (LEO), which scores each edge on its likelihood of being an attack. Second, to mitigate the overlooking problem, HideNSeek conducts imbalance-aware aggregation of all the edge scores to obtain the final noticeability score. Using six real-world graphs, we empirically demonstrate that HideNSeek effectively alleviates the observed limitations, and LEO (i.e., our learnable edge scorer) outperforms eleven competitors in distinguishing attack edges under five different attack methods. For an additional application, we show that LEO boost the performance of robust GNNs by removing attack-like edges.

图神经网络对抗攻击隐蔽性度量安全防御

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。