Adversarial Training for Graph Neural Networks: Pitfalls, Solutions, and New Directions
This addresses the vulnerability of GNNs to adversarial attacks, which is crucial for applications like social networks or bioinformatics, but it is incremental as it builds on existing adversarial training concepts.
The paper tackled the problem of adversarial training for Graph Neural Networks (GNNs) against graph structure perturbations, showing that prior work had limitations and proposing solutions like flexible GNNs and new attacks, resulting in adversarial training becoming a state-of-the-art defense.
Despite its success in the image domain, adversarial training did not (yet) stand out as an effective defense for Graph Neural Networks (GNNs) against graph structure perturbations. In the pursuit of fixing adversarial training (1) we show and overcome fundamental theoretical as well as practical limitations of the adopted graph learning setting in prior work; (2) we reveal that more flexible GNNs based on learnable graph diffusion are able to adjust to adversarial perturbations, while the learned message passing scheme is naturally interpretable; (3) we introduce the first attack for structure perturbations that, while targeting multiple nodes at once, is capable of handling global (graph-level) as well as local (node-level) constraints. Including these contributions, we demonstrate that adversarial training is a state-of-the-art defense against adversarial structure perturbations.