Li Xianxian, Gan Zeming, Bai Yan, Su Linlin, Li De, Wang Jinyan
Key Lab of Education Blockchain and Intelligent Technology, Ministry of Education, Guangxi Normal University, Guilin, China; Guangxi Key Lab of Multi-source Information Mining and Security, Guangxi Normal University, Guilin, China; School of Computer Science and Engineering, Guangxi Normal University, Guilin, China.
School of Computer Science and Engineering, Guangxi Normal University, Guilin, China.
Neural Netw. 2025 Mar;183:106938. doi: 10.1016/j.neunet.2024.106938. Epub 2024 Nov 26.
Recent studies show that Graph Neural Networks (GNNs) are vulnerable to structure adversarial attacks, which draws attention to adversarial defenses in graph data. Previous defenses designed heuristic defense strategies for specific attacks or graph properties, and are no longer sufficiently robust across all these attacks. To address this problem, we discuss the abnormal behaviors of GNNs in structure perturbations from a posterior distribution perspective. We suggest that the structural vulnerability of GNNs stems from their dependence on local graph smoothing, which can also lead to unfitting - a first-found phenomenon specific to the graph domain. We demonstrate that abnormal behaviors, except for unfitting, can attribute to a posterior distribution shift. To intrinsically prevent the occurrence of abnormal behaviors, we first propose smooth-less message passing to enhance the tolerance with respect to structure perturbations, while significantly mitigating the unfitting. We also propose the distribution shift constraint to restrict other abnormal behaviors of our model. Our approach is evaluated on six different datasets across over four kinds of attacks and compared to 11 representative baselines. The experimental results show that our method improves the defense performance across various attacks, and provides a great trade-off between accuracy and adversarial robustness.
最近的研究表明，图神经网络（GNN）容易受到结构对抗攻击，这引发了对图数据中对抗防御的关注。先前的防御措施针对特定攻击或图属性设计启发式防御策略，在面对所有这些攻击时不再具有足够的鲁棒性。为了解决这个问题，我们从后验分布的角度讨论了GNN在结构扰动中的异常行为。我们认为，GNN的结构脆弱性源于它们对局部图平滑的依赖，这也可能导致不匹配——一种在图领域首次发现的特定现象。我们证明，除了不匹配之外，异常行为还可归因于后验分布的偏移。为了从本质上防止异常行为的发生，我们首先提出无平滑消息传递，以增强对结构扰动的容忍度，同时显著减轻不匹配。我们还提出了分布偏移约束，以限制我们模型的其他异常行为。我们的方法在六种不同数据集上针对四种以上攻击进行了评估，并与11个有代表性的基线进行了比较。实验结果表明，我们的方法提高了对各种攻击的防御性能，并在准确性和对抗鲁棒性之间实现了很好的权衡。
