Spatio-Temporal Sparsification for General Robust Graph Convolution Networks

TL;DR

This paper introduces Spatio-Temporal sparsification (ST-Sparse), a regularization technique for GNNs that enhances robustness against adversarial attacks and improves generalization on both attacked and clean datasets.

Contribution

The paper proposes ST-Sparse, a novel regularization method for GNNs that improves adversarial robustness and generalization, outperforming existing defenses in most cases.

Findings

ST-Sparse increases robust accuracy by up to 6%.

ST-Sparse improves defense performance when combined with existing methods.

ST-Sparse maintains or improves performance on clean datasets.

Abstract

Graph Neural Networks (GNNs) have attracted increasing attention due to its successful applications on various graph-structure data. However, recent studies have shown that adversarial attacks are threatening the functionality of GNNs. Although numerous works have been proposed to defend adversarial attacks from various perspectives, most of them can be robust against the attacks only on specific scenarios. To address this shortage of robust generalization, we propose to defend the adversarial attacks on GNN through applying the Spatio-Temporal sparsification (called ST-Sparse) on the GNN hidden node representation. ST-Sparse is similar to the Dropout regularization in spirit. Through intensive experiment evaluation with GCN as the target GNN model, we identify the benefits of ST-Sparse as follows: (1) ST-Sparse shows the defense performance improvement in most cases, as it can effectively increase the robust accuracy by up to 6\% improvement; (2) ST-Sparse illustrates its robust generalization capability by integrating with the existing defense methods, similar to the integration of Dropout into various deep learning models as a standard regularization technique; (3) ST-Sparse also shows its ordinary generalization capability on clean datasets, in that ST-SparseGCN (the integration of ST-Sparse and the original GCN) even outperform the original GCN, while the other three representative defense methods are inferior to the original GCN.