Robust Graph Learning Against Adversarial Evasion Attacks via Prior-Free Diffusion-Based Structure Purification

TL;DR

This paper introduces DiffSP, a prior-free diffusion-based framework that purifies graph structures to defend against adversarial evasion attacks, improving robustness without relying on heuristic priors.

Contribution

The paper proposes a novel diffusion-based structure purification method for robust graph learning that does not depend on priors about clean graphs or attack strategies.

Findings

DiffSP significantly enhances robustness against evasion attacks.

The nonisotropic diffusion mechanism effectively preserves valuable information.

Graph transfer entropy guided denoising improves semantic alignment.

Abstract

Adversarial evasion attacks pose significant threats to graph learning, with lines of studies that have improved the robustness of Graph Neural Networks (GNNs). However, existing works rely on priors about clean graphs or attacking strategies, which are often heuristic and inconsistent. To achieve robust graph learning over different types of evasion attacks and diverse datasets, we investigate this problem from a prior-free structure purification perspective. Specifically, we propose a novel Diffusion-based Structure Purification framework named DiffSP, which creatively incorporates the graph diffusion model to learn intrinsic distributions of clean graphs and purify the perturbed structures by removing adversaries under the direction of the captured predictive patterns without relying on priors. DiffSP is divided into the forward diffusion process and the reverse denoising process, during which structure purification is achieved. To avoid valuable information loss during the forward process, we propose an LID-driven nonisotropic diffusion mechanism to selectively inject noise anisotropically. To promote semantic alignment between the clean graph and the purified graph generated during the reverse process, we reduce the generation uncertainty by the proposed graph transfer entropy guided denoising mechanism. Extensive experiments demonstrate the superior robustness of DiffSP against evasion attacks.