Explainable Graph Neural Networks Under Fire
This work highlights a critical vulnerability in GNN explanation methods, which are used for trust in decision-critical applications, but it is incremental as it builds on existing adversarial attack research in machine learning.
The paper demonstrates that post-hoc explanation methods for graph neural networks (GNNs) are highly susceptible to adversarial perturbations, where small changes in graph structure can drastically alter explanations without affecting predictions, calling into question their trustworthiness. It introduces GXAttack, an optimization-based white-box attack method that effectively exploits these vulnerabilities, achieving significant adversarial success rates (e.g., over 90% in some cases).
Predictions made by graph neural networks (GNNs) usually lack interpretability due to their complex computational behavior and the abstract nature of graphs. In an attempt to tackle this, many GNN explanation methods have emerged. Their goal is to explain a model's predictions and thereby obtain trust when GNN models are deployed in decision critical applications. Most GNN explanation methods work in a post-hoc manner and provide explanations in the form of a small subset of important edges and/or nodes. In this paper we demonstrate that these explanations can unfortunately not be trusted, as common GNN explanation methods turn out to be highly susceptible to adversarial perturbations. That is, even small perturbations of the original graph structure that preserve the model's predictions may yield drastically different explanations. This calls into question the trustworthiness and practical utility of post-hoc explanation methods for GNNs. To be able to attack GNN explanation models, we devise a novel attack method dubbed \textit{GXAttack}, the first \textit{optimization-based} adversarial white-box attack method for post-hoc GNN explanations under such settings. Due to the devastating effectiveness of our attack, we call for an adversarial evaluation of future GNN explainers to demonstrate their robustness. For reproducibility, our code is available via GitHub.