ATTACK GRAPH CONVOLUTIONAL NETWORKS BY ADDING FAKE NODES

Xiaoyun Wang, Joe Eaton, Cho-Jui Hsieh, Felix Wu

Abstract:

Graph convolutional networks (GCNs) have been widely used for classifying graph nodes in the semi-supervised setting.
Previous works have shown that GCNs are vulnerable to the perturbation on adjacency and feature matrices of existing nodes. However, it is unrealistic to change the connections of existing nodes in many applications, such as existing users in social networks. In this paper, we investigate methods attacking GCNs by adding fake nodes. A greedy algorithm is proposed to generate adjacency and feature matrices of fake nodes, aiming to minimize the classification accuracy on the existing ones. In additional, we introduce a discriminator to classify fake nodes from real nodes, and propose a Greedy-GAN algorithm to simultaneously update the discriminator and the attacker, to make fake nodes indistinguishable to the real ones. Our non-targeted attack decreases the accuracy of GCN down to 0.10, and our targeted attack reaches a success rate of 0.99 for attacking the whole datasets, and 0.94 on average for attacking a single node.

Keywords: Graph Convolutional Network, adversarial attack, node classification

TL;DR: non-targeted and targeted attack on GCN by adding fake nodes