FocusedCleaner: Sanitizing Poisoned Graphs for Robust GNN-based Node Classification

TL;DR

FocusedCleaner is a novel framework that effectively sanitizes poisoned graphs to enhance the robustness of GNNs in node classification tasks, using iterative structural learning and victim node detection.

Contribution

It introduces a bi-level structural learning and victim detection framework for poisoning graph sanitization, significantly improving GNN robustness against data poisoning attacks.

Findings

Outperforms state-of-the-art baselines in graph sanitation.

Significantly improves GNN adversarial robustness.

Effective in identifying and removing poisoned data.

Abstract

Graph Neural Networks (GNNs) are vulnerable to data poisoning attacks, which will generate a poisoned graph as the input to the GNN models. We present FocusedCleaner as a poisoned graph sanitizer to effectively identify the poison injected by attackers. Specifically, FocusedCleaner provides a sanitation framework consisting of two modules: bi-level structural learning and victim node detection. In particular, the structural learning module will reverse the attack process to steadily sanitize the graph while the detection module provides ``the focus" -- a narrowed and more accurate search region -- to structural learning. These two modules will operate in iterations and reinforce each other to sanitize a poisoned graph step by step. As an important application, we show that the adversarial robustness of GNNs trained over the sanitized graph for the node classification task is significantly improved. Extensive experiments demonstrate that FocusedCleaner outperforms the state-of-the-art baselines both on poisoned graph sanitation and improving robustness.