VGFL-SA: Vertical Graph Federated Learning Structure Attack Based on Contrastive Learning

TL;DR

This paper introduces VGFL-SA, a novel adversarial attack method on Vertical Graph Federated Learning that leverages contrastive learning to modify client structures without labels, effectively degrading model performance.

Contribution

It proposes a label-free, contrastive learning-based attack method for VGFL that enhances attack applicability in real-world scenarios.

Findings

VGFL-SA effectively degrades VGFL performance in node classification tasks.

The attack demonstrates strong transferability across different datasets.

VGFL-SA outperforms existing label-dependent attack methods.

Abstract

Graph Neural Networks (GNNs) have gained attention for their ability to learn representations from graph data. Due to privacy concerns and conflicts of interest that prevent clients from directly sharing graph data with one another, Vertical Graph Federated Learning (VGFL) frameworks have been developed. Recent studies have shown that VGFL is vulnerable to adversarial attacks that degrade performance. However, it is a common problem that client nodes are often unlabeled in the realm of VGFL. Consequently, the existing attacks, which rely on the availability of labeling information to obtain gradients, are inherently constrained in their applicability. This limitation precludes their deployment in practical, real-world environments. To address the above problems, we propose a novel graph adversarial attack against VGFL, referred to as VGFL-SA, to degrade the performance of VGFL by modifying the local clients structure without using labels. Specifically, VGFL-SA uses a contrastive learning method to complete the attack before the local clients are trained. VGFL-SA first accesses the graph structure and node feature information of the poisoned clients, and generates the contrastive views by node-degree-based edge augmentation and feature shuffling augmentation. Then, VGFL-SA uses the shared graph encoder to get the embedding of each view, and the gradients of the adjacency matrices are obtained by the contrastive function. Finally, perturbed edges are generated using gradient modification rules. We validated the performance of VGFL-SA by performing a node classification task on real-world datasets, and the results show that VGFL-SA achieves good attack effectiveness and transferability.