评测图大模型对文本、结构和提示攻击的脆弱性,发现微小修改即可大幅降效。
TrustGLM: Evaluating the Robustness of GraphLLMs Against Prompt, Text, and Structure Attacks
- 从文本、结构、提示三方面设计攻击方法,系统评估图大模型鲁棒性。
- 仅替换节点文本中少数语义相似词,性能下降超30%;随机打乱标签提示导致准确率骤降。
- 提出数据增强与对抗训练防御策略,适合关注图模型安全的研究者参考。
受大语言模型成功的启发,研究正从传统图学习转向基于大模型的图框架(即GraphLLMs)。GraphLLMs通过融合节点文本属性、邻域结构信息及任务提示来发挥大模型的推理能力。然而,其在对抗扰动下的鲁棒性尚未被充分探索,这对高风险场景部署至关重要。为此,我们提出TrustGLM,系统评估GraphLLMs在文本、图结构和提示三类攻击下的脆弱性。我们在六个跨领域基准数据集上实施前沿攻击算法,结果表明:仅替换节点文本中少数语义相近词汇,模型性能显著下降;标准图结构攻击亦能严重损害性能;而随机打乱提示模板中的候选标签集,导致准确率大幅下滑。进一步,我们通过数据增强和对抗训练等防御方法验证了提升鲁棒性的可行性。我们开源了相关工具库,以促进公平快速的评估与后续创新研究。
原文摘要 · Abstract (English)
Inspired by the success of large language models (LLMs), there is a significant research shift from traditional graph learning methods to LLM-based graph frameworks, formally known as GraphLLMs. GraphLLMs leverage the reasoning power of LLMs by integrating three key components: the textual attributes of input nodes, the structural information of node neighborhoods, and task-specific prompts that guide decision-making. Despite their promise, the robustness of GraphLLMs against adversarial perturbations remains largely unexplored-a critical concern for deploying these models in high-stakes scenarios. To bridge the gap, we introduce TrustGLM, a comprehensive study evaluating the vulnerability of GraphLLMs to adversarial attacks across three dimensions: text, graph structure, and prompt manipulations. We implement state-of-the-art attack algorithms from each perspective to rigorously assess model resilience. Through extensive experiments on six benchmark datasets from diverse domains, our findings reveal that GraphLLMs are highly susceptible to text attacks that merely replace a few semantically similar words in a node's textual attribute. We also find that standard graph structure attack methods can significantly degrade model performance, while random shuffling of the candidate label set in prompt templates leads to substantial performance drops. Beyond characterizing these vulnerabilities, we investigate defense techniques tailored to each attack vector through data-augmented training and adversarial training, which show promising potential to enhance the robustness of GraphLLMs. We hope that our open-sourced library will facilitate rapid, equitable evaluation and inspire further innovative research in this field.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。