Fortifying graph neural networksagainst adversarial attacks via ensemble learning

Chenyu Zhou

Abstract: Recent research reveals that Graph Neural Networks (GNNs) are vulnerable to adversarial attacks. Existing defense methods attempt to purify perturbed graphs from topological or attribute perspectives. However, such input processing step may lead to a loss of generalization performance in GNNs. Additionally, defending from one perspective has limited effectiveness. This paper proposes a novel ensemble learning framework named ‘‘Fortifier’’ that fortifies GNNs against adversarial attacks. It employs a stacking strategy for defense by integrating two perspectives. Specifically, a low-rank approximation model based on Schur decomposition (Schur) and an edge-enhanced attention (EEA) model are introduced to extract global and local features of graphs, respectively. Following this, the graph fusion model (GFU) is introduced as a meta-learner, aimed at fusing the robust components extracted by the two base learners, thereby further fortifying the defense. Furthermore, a parameter-passing strategy is employed to transfer the robustness learned by GFU to other GNNs, which enhances their resilience while maintaining excellent generalization performance. Extensive experiments show that Fortifier effectively defends against both targeted and non-targeted attacks on homogeneous and heterogeneous graphs, and significantly improves the robustness of GNNs.