Graph Agent Network: Empowering Nodes with Inference Capabilities for Adversarial Resilience
This addresses adversarial resilience in graph-based machine learning, offering a novel defense against targeted secondary attacks, though it appears incremental as it builds on existing agent-based and decentralized approaches.
The paper tackles the vulnerability of graph neural networks (GNNs) to adversarial edge-perturbing attacks by proposing the Graph Agent Network (GAgN), which empowers nodes with decentralized inference capabilities to filter adversarial edges, achieving optimal classification accuracy on perturbed datasets compared to state-of-the-art defenses.
End-to-end training with global optimization have popularized graph neural networks (GNNs) for node classification, yet inadvertently introduced vulnerabilities to adversarial edge-perturbing attacks. Adversaries can exploit the inherent opened interfaces of GNNs' input and output, perturbing critical edges and thus manipulating the classification results. Current defenses, due to their persistent utilization of global-optimization-based end-to-end training schemes, inherently encapsulate the vulnerabilities of GNNs. This is specifically evidenced in their inability to defend against targeted secondary attacks. In this paper, we propose the Graph Agent Network (GAgN) to address the aforementioned vulnerabilities of GNNs. GAgN is a graph-structured agent network in which each node is designed as an 1-hop-view agent. Through the decentralized interactions between agents, they can learn to infer global perceptions to perform tasks including inferring embeddings, degrees and neighbor relationships for given nodes. This empowers nodes to filtering adversarial edges while carrying out classification tasks. Furthermore, agents' limited view prevents malicious messages from propagating globally in GAgN, thereby resisting global-optimization-based secondary attacks. We prove that single-hidden-layer multilayer perceptrons (MLPs) are theoretically sufficient to achieve these functionalities. Experimental results show that GAgN effectively implements all its intended capabilities and, compared to state-of-the-art defenses, achieves optimal classification accuracy on the perturbed datasets.