Graphs are gaining increasing popularity in research and the industry due to their high
representational power, which uses the interactions between different objects in the data.
Different tasks can take advantage of the graph’s unique properties.
Specifically, Graph Neural Networks (GNNs) are Deep Learning models where the nodes
represent the neurons and propagate the data via the edges. By doing so, our forward and
backward paths are both directly affected by the network’s structure. Indeed, GNN achieves state-of-the-art results for graph-structured tasks.
However, GNNs have some challenges. Firstly, their tasks can be easily tilted, for example, by changing a small part of the original graph. We will refer to a network that tries to badly affect another network as an ‘attacker’. An attacker can also try and ‘steal’ sensitive information by inspecting the encoding of the data done by the original network, which we will refer to as the defender.
Many efforts have been made to cope with these challenges. Recent research has presented
GAL (which stands for Graph AdversariaL network): GAL is a deep learning model that encodes sensitive data by applying a convolutional neural network (CNN) upon the data. Then, the GNN performs its task based on the encoded data. The better we encode the data, the harder it will be for the network to perform its original task. However, GAL manages to fend off attackers’ attempts to steal sensitive data (typical decrease by 30-50%) while maintaining excellent performance results (typical decrease by about 5%).
In recent research done at the Technion, a new attack has been invented based on a slight perturbation of a single arbitrary node in the graph that is not the target node. This attack is called SINGLE, and it is optimized to be as least noticeable as possible, using the least frequently used features the defender uses to take its decisions while still managing to sabotage its decisions.
We activated SINGLE attack upon GAL and received the following results: Upon all three datasets that we checked (Citeseer with ~3300 nodes, Cora with ~2700 nodes, and Pubmed with ~19700 nodes), task performance has been greatly damaged by SINGLE (by 20%, 12% and 4% in accordance. Note that the 4% refers to Pubmed which is the largest dataset, and in absolute numbers, it is the biggest number). However, it seemed that when testing information theft, SINGLE success was lower than the reference attacks (by 20-30%).
To raise GAL’s robustness and improve its resistance to attacks such as GAL, we took the following steps:
• slight deepening of the network from 2 layers to 3 layers
• making the layer sizes reduction more gradual
• adding a minor dropout rate (p=0.1)
With these changes, in hundreds of measurements, we showed that GAL managed to gain a small portion of its performance back (by around 5%).
To sum up, GAL is a strong defense. However, it is very vulnerable to single node attacks such as SINGLE.
SINGLE manages to reduce GAL’s performance significantly. Slight deepening and using a minor dropout made it more robust, and therefore we conclude that a finely tuned network would be more resistant to this type of attack. The results under SINGLE attack can still be improved, and there is a place for more research in that direction.