GraphMU: Repairing Robustness of Graph Neural Networks via Machine Unlearning

TL;DR

GraphMU is a novel method that repairs poisoned Graph Neural Networks by unlearning adversarial data, restoring their robustness without full retraining, across various datasets and attack scenarios.

Contribution

Introducing a model repair framework for GNNs that unlearns adversarial samples, filling the gap between defense and complete retraining.

Findings

Effectively restores GNN performance after poisoning.

Works under various knowledge scenarios of perturbations.

Validated on multiple datasets and attack types.

Abstract

Graph Neural Networks (GNNs) have demonstrated significant application potential in various fields. However, GNNs are still vulnerable to adversarial attacks. Numerous adversarial defense methods on GNNs are proposed to address the problem of adversarial attacks. However, these methods can only serve as a defense before poisoning, but cannot repair poisoned GNN. Therefore, there is an urgent need for a method to repair poisoned GNN. In this paper, we address this gap by introducing the novel concept of model repair for GNNs. We propose a repair framework, Repairing Robustness of Graph Neural Networks via Machine Unlearning (GraphMU), which aims to fine-tune poisoned GNN to forget adversarial samples without the need for complete retraining. We also introduce a unlearning validation method to ensure that our approach effectively forget specified poisoned data. To evaluate the effectiveness of GraphMU, we explore three fine-tuned subgraph construction scenarios based on the available perturbation information: (i) Known Perturbation Ratios, (ii) Known Complete Knowledge of Perturbations, and (iii) Unknown any Knowledge of Perturbations. Our extensive experiments, conducted across four citation datasets and four adversarial attack scenarios, demonstrate that GraphMU can effectively restore the performance of poisoned GNN.