首个可证明抵御任意图攻击的GNN防御方法，确保模型在训练时安全。
Deterministic Certification of Graph Neural Networks against Graph Poisoning Attacks with Arbitrary Perturbations
- 基于确定性验证，支持边、节点和特征的任意扰动防御
- 在多个数据集上实现100%准确的鲁棒性保证
- 适用于多种GNN架构，适合高安全性场景使用
图神经网络（GNN）已成为图数据学习的主流方法，在节点和图分类任务中表现优异。然而，近期研究表明，GNN易受训练阶段投毒攻击——对训练图的边、节点或节点特征进行微小扰动，即可显著降低其测试性能。现有防御大多为经验性，易被更强攻击破解；少数可证明防御存在局限：仅限制单一类型扰动、依赖特定模型或任务，且鲁棒性保证不完全。本文提出PGNNCert，首个针对任意（边、节点、节点特征）扰动的确定性认证防御，提供100%准确的鲁棒性保障。大量实验在多个节点与图分类数据集及GNN模型上验证其有效性，显著优于当前最先进的抗边或节点扰动的认证防御方法。
原文摘要 · Abstract (English)
Graph neural networks (GNNs) are becoming the de facto method to learn on the graph data and have achieved the state-of-the-art on node and graph classification tasks. However, recent works show GNNs are vulnerable to training-time poisoning attacks -- marginally perturbing edges, nodes, or/and node features of training graph(s) can largely degrade GNNs' testing performance. Most previous defenses against graph poisoning attacks are empirical and are soon broken by adaptive / stronger ones. A few provable defenses provide robustness guarantees, but have large gaps when applied in practice: 1) restrict the attacker on only one type of perturbation; 2) design for a particular GNN architecture or task; and 3) robustness guarantees are not 100\% accurate. In this work, we bridge all these gaps by developing PGNNCert, the first certified defense of GNNs against poisoning attacks under arbitrary (edge, node, and node feature) perturbations with deterministic robustness guarantees. Extensive evaluations on multiple node and graph classification datasets and GNNs demonstrate the effectiveness of PGNNCert to provably defend against arbitrary poisoning perturbations. PGNNCert is also shown to significantly outperform the state-of-the-art certified defenses against edge perturbation or node perturbation during GNN training.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。