用自监督净化器提升图神经网络抗攻击能力
Self-supervised Adversarial Purification for Graph Neural Networks
- 设计专用净化器分离鲁棒性与分类任务
- 提出GPR-GAE模型实现多步精准图结构修复
- 可即插即用，适配各类图数据与攻击场景
防御图神经网络（GNN）的对抗攻击需在准确率与鲁棒性间权衡，传统方法如对抗训练常将二者耦合于单一分类器中。为此，我们提出一种自监督对抗净化框架：通过引入独立的净化器，在分类前清理输入数据。不同于以往方法，我们设计了GPR-GAE——一种基于广义PageRank滤波器的新型图自编码器（GAE），采用自监督策略训练，可自适应不同图结构。该模型利用多个GPR滤波器捕捉多样化的结构表征，实现高效净化。多步净化流程进一步提升图结构恢复精度，有效抵御结构扰动。在多种数据集与攻击场景下的实验表明，GPR-GAE具备当前最优鲁棒性，可作为独立的即插即用净化模块应用于各类GNN分类器。
原文摘要 · Abstract (English)
Defending Graph Neural Networks (GNNs) against adversarial attacks requires balancing accuracy and robustness, a trade-off often mishandled by traditional methods like adversarial training that intertwine these conflicting objectives within a single classifier. To overcome this limitation, we propose a self-supervised adversarial purification framework. We separate robustness from the classifier by introducing a dedicated purifier, which cleanses the input data before classification. In contrast to prior adversarial purification methods, we propose GPR-GAE, a novel graph auto-encoder (GAE), as a specialized purifier trained with a self-supervised strategy, adapting to diverse graph structures in a data-driven manner. Utilizing multiple Generalized PageRank (GPR) filters, GPR-GAE captures diverse structural representations for robust and effective purification. Our multi-step purification process further facilitates GPR-GAE to achieve precise graph recovery and robust defense against structural perturbations. Experiments across diverse datasets and attack scenarios demonstrate the state-of-the-art robustness of GPR-GAE, showcasing it as an independent plug-and-play purifier for GNN classifiers.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。