arXiv:2606.08467cs.LGcs.AI2026-06KDD

提出新型图神经网络校准攻击框架,揭示其在对抗扰动下的脆弱性。

The Confidence Trap: Calibration Attacks for Graph Neural Networks

论文配图:The Confidence Trap: Calibration Attacks for Graph Neural Networks
图 1 · 摘自论文原文
  • 设计统一攻击框架,用KL散度诱导预测分布均匀化。
  • 实验显示攻击使期望校准误差显著上升,准确率仍保持不变。
  • 适合研究GNN安全性的研究人员,尤其关注模型可信度者。

尽管置信度校准对安全关键应用中的可信决策至关重要,但校准后的图神经网络(GNN)对对抗性结构扰动的鲁棒性尚未被充分探索。研究图校准攻击面临三大挑战:(1) 图结构的离散性使基于梯度的优化困难;(2) 现有欠自信目标无法驱动预测趋向均匀分布;(3) GNN对边扰动高度敏感,常导致意外标签变化,违反攻击约束。为此,我们提出统一图校准攻击(UGCA)框架,用于白盒场景下的最坏情况分析。UGCA引入KL散度损失以促进预测分布均匀化,采用重排序机制减少标签翻转,结合混合损失在违规时恢复标签,并使用束搜索拓展对抗搜索空间。我们还提供了理论分析,揭示模型泛化能力、数据集复杂度与校准脆弱性之间的关系,表明准确率更高或在类别更多数据集上训练的模型更易受此威胁。大量实验表明,UGCA显著提升期望校准误差(ECE),同时保持分类准确率。代码已公开于https://github.com/CaptainCuong/Graph-Calibration-Attack.git。

原文摘要 · Abstract (English)

While confidence calibration is essential for trustworthy decision-making in safety-critical applications, the robustness of calibrated GNNs to adversarial structural perturbations remains largely unexplored. However, studying calibration attacks on graphs presents unique technical challenges: (1) the discrete nature of graph structures complicates gradient-based optimization, (2) existing underconfidence objectives fail to drive predictions toward uniform distributions, and (3) GNNs are highly sensitive to edge perturbations, often causing unintended label changes that violate attack constraints. To address these challenges, we propose a \textbf{Unified Graph Calibration Attack (UGCA)} framework designed for \textbf{worst-case (white-box) analysis} of GNN calibration robustness. UGCA introduces a KL-divergence loss to encourage uniform predictive distributions, a reranking mechanism to reduce label flipping, a hybrid loss to recover labels when violations occur, and beam search to explore a broader adversarial search space. We further provide theoretical insights linking model generalization, dataset complexity, and calibration vulnerability, showing that models with higher accuracy or trained on datasets with more classes are more susceptible under this threat model. Extensive experiments demonstrate that UGCA substantially increases Expected Calibration Error while preserving classification accuracy. Our code is publicly available at https://github.com/CaptainCuong/Graph-Calibration-Attack.git.

图神经网络校准攻击对抗样本安全性

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。