Unsupervised Graph Poisoning Attack via Contrastive Loss Back-propagation

TL;DR

This paper introduces a novel unsupervised gradient-based graph poisoning attack that manipulates graph structures to undermine contrastive learning models without relying on labels, demonstrating effectiveness across various tasks.

Contribution

The authors propose the first unsupervised attack method for graph contrastive learning that leverages gradient ascent on adjacency matrices, avoiding label dependence.

Findings

Outperforms unsupervised baseline attacks

Achieves comparable results to supervised attacks

Transfers effectively to other graph models

Abstract

Graph contrastive learning is the state-of-the-art unsupervised graph representation learning framework and has shown comparable performance with supervised approaches. However, evaluating whether the graph contrastive learning is robust to adversarial attacks is still an open problem because most existing graph adversarial attacks are supervised models, which means they heavily rely on labels and can only be used to evaluate the graph contrastive learning in a specific scenario. For unsupervised graph representation methods such as graph contrastive learning, it is difficult to acquire labels in real-world scenarios, making traditional supervised graph attack methods difficult to be applied to test their robustness. In this paper, we propose a novel unsupervised gradient-based adversarial attack that does not rely on labels for graph contrastive learning. We compute the gradients of the adjacency matrices of the two views and flip the edges with gradient ascent to maximize the contrastive loss. In this way, we can fully use multiple views generated by the graph contrastive learning models and pick the most informative edges without knowing their labels, and therefore can promisingly support our model adapted to more kinds of downstream tasks. Extensive experiments show that our attack outperforms unsupervised baseline attacks and has comparable performance with supervised attacks in multiple downstream tasks including node classification and link prediction. We further show that our attack can be transferred to other graph representation models as well.