Graph Structural Attack by Perturbing Spectral Distance

TL;DR

This paper introduces a spectral distance-based attack method on graph convolutional networks that disrupts their spectral filters by perturbing the graph's eigenvalues, demonstrating high effectiveness in various attack settings.

Contribution

It proposes a novel spectral attack approach that maximizes spectral distance to effectively disrupt GCNs, with an efficient approximation to reduce computational complexity.

Findings

The attack is effective in black-box and white-box scenarios.

Maximizing spectral distance significantly alters graph spectral properties.

The method successfully disrupts GCN performance during training and testing.

Abstract

Graph Convolutional Networks (GCNs) have fueled a surge of research interest due to their encouraging performance on graph learning tasks, but they are also shown vulnerability to adversarial attacks. In this paper, an effective graph structural attack is investigated to disrupt graph spectral filters in the Fourier domain, which are the theoretical foundation of GCNs. We define the notion of spectral distance based on the eigenvalues of graph Laplacian to measure the disruption of spectral filters. We realize the attack by maximizing the spectral distance and propose an efficient approximation to reduce the time complexity brought by eigen-decomposition. The experiments demonstrate the remarkable effectiveness of the proposed attack in both black-box and white-box settings for both test-time evasion attacks and training-time poisoning attacks. Our qualitative analysis suggests the connection between the imposed spectral changes in the Fourier domain and the attack behavior in the spatial domain, which provides empirical evidence that maximizing spectral distance is an effective way to change the graph structural property and thus disturb the frequency components for graph filters to affect the learning of GCNs.