Everything Perturbed All at Once: Enabling Differentiable Graph Attacks

TL;DR

This paper introduces Differentiable Graph Attack (DGA), a novel method that efficiently generates adversarial attacks on graph neural networks by leveraging continuous relaxation, reducing computational costs significantly while maintaining attack effectiveness.

Contribution

The paper presents DGA, a new differentiable attack method that eliminates the need for retraining and reduces computational costs compared to existing gradient-based meta-learning approaches.

Findings

DGA achieves similar attack performance to state-of-the-art methods.

DGA reduces training time by 6 times and GPU memory by 11 times.

DGA demonstrates transferability and robustness against defenses.

Abstract

As powerful tools for representation learning on graphs, graph neural networks (GNNs) have played an important role in applications including social networks, recommendation systems, and online web services. However, GNNs have been shown to be vulnerable to adversarial attacks, which can significantly degrade their effectiveness. Recent state-of-the-art approaches in adversarial attacks rely on gradient-based meta-learning to selectively perturb a single edge with the highest attack score until they reach the budget constraint. While effective in identifying vulnerable links, these methods are plagued by high computational costs. By leveraging continuous relaxation and parameterization of the graph structure, we propose a novel attack method called Differentiable Graph Attack (DGA) to efficiently generate effective attacks and meanwhile eliminate the need for costly retraining. Compared to the state-of-the-art, DGA achieves nearly equivalent attack performance with 6 times less training time and 11 times smaller GPU memory footprint on different benchmark datasets. Additionally, we provide extensive experimental analyses of the transferability of the DGA among different graph models, as well as its robustness against widely-used defense mechanisms.