摘要
最近的许多工作已经表明图神经网络在面对图结构扰动以及节点特征扰动的对抗攻击时表现出非鲁棒性,其预测结果可能是不可靠的,图对比学习方法中也存在这一问题。然而已有的鲁棒性测度方法通常与攻击算法、数据标签以及下游任务相关,这些在自监督设置下图对比学习的鲁棒性测度中是应当尽量避免的。该文提出了基于节点特征对抗性攻击的图对比学习鲁棒性验证算法,来验证节点特征扰动下的图卷积网络的鲁棒性。考虑到图对比学习模型中正负例对的特性,将图对比学习鲁棒性验证问题定义为对抗样本与目标节点及其负例之间相似度比较的问题,并将该问题形式化建模为一个动态规划问题,从而解决了对攻击算法、数据标签以及下游任务的依赖问题。为了求解该动态规划问题,针对图数据通常采用的二元特征,设计了相应的扰动空间;考虑到图对比学习中负例样本空间过大的挑战,设计了负例样本采样策略来提升求解问题的效率;由于二元离散特征和非线性激活函数使得动态规划问题难于求解,对它们分别采用放松到连续数据域和非线性激活放松的方式,并采用寻找对偶问题的方式进一步提高求解效率。通过充分的实验说明了所提出的图对比学习鲁棒性验证算法的有效性;同时验证了针对特定攻击算法设计的图对比学习模型的鲁棒性不具有可泛化性,面对其他的攻击算法可能表现得更加脆弱;还通过参数实验说明了设计的负例样本采样策略是合理的。
[Objective]Many recent studies have indicated that graph neural networks exhibit a lack of robustness when facing adversarial attacks involving perturbations in both graph structures and node features,and the subsequent predictions of these networks may become unreliable under such circumstances.This issue affects graph contrastive learning methods similarly.However,the existing evaluation of robustness methods is often entangled with attack algorithms,data labels,and downstream tasks,which are best avoided,especially within the self-supervised setup of graph contrastive learning.Therefore,this paper introduces a robustness verification algorithm for graph contrastive learning to assess the robustness of graph convolutional networks against node feature adversarial attacks.[Methods]To begin with,considering the nature of positive and negative pairs found in graph contrastive learning models,this paper defines the robustness verification problem of graph contrastive learning as a similarity comparison between adversarial samples and the target node along with its negative samples.This problem is then expressed as a dynamic programming problem,which avoids dependency on attack algorithms,data labels,and downstream tasks.To address this dynamic programming problem,a series of novel and effective methods are proposed in this paper.For the binary attributes commonly used in graph data,corresponding perturbation spaces are therefore constructed here.Considering the challenge posed by a large negative sample space in graph contrastive learning,a negative sample sampling strategy is designed to improve the efficiency of problem-solving.In cases where binary discrete attributes and nonlinear activation functions render the dynamic programming problem difficult to address,this paper employs relaxation techniques and uses dual problem optimization methods to further improve the solution's efficiency.[Results]To assess the effectiveness of the proposed graph contrastive learning robustness verification algorithm,we conducted experiments using the classic GRACE model on the Cora and CiteSeer datasets.Employing the robustness verification algorithm introduced for graph contrastive learning,we evaluated its robustness.As the perturbation intensity increased,the proportion of nodes that were verified as robust decreased rapidly,and the proportion of nodes that were verified as non-robust increased significantly.Simultaneously,the proportion of unverifiable nodes remained at a lower level.These observations show the effectiveness of the proposed framework for verifying the robustness of graph contrastive learning.Additionally,the experiments revealed that the robustness of the contrastive learning model ARIEL,designed against specific attack algorithms,lacks generalizability and exhibits poor verifiable robustness performance,suggesting its vulnerability to other attack algorithms.Besides,ablation experiments identified the adversarial attack components of ARIEL as the main reason for its diminished verifiable robustness.Lastly,parameter experiments demonstrated the reasonability of the proposed negative sample sampling strategy.The results showed that sampling 20 negative samples is sufficient to achieve a favorable performance of our robustness verification algorithm with high efficiency.[Conclusions]Through the analysis of our methods and experimental results,the graph contrastive learning robustness verification algorithm proposed in this study not only eliminates dependency on attack algorithms,data labels,and downstream tasks but also presents a more comprehensive measurement compared to traditional robustness metrics.It can verify robustness in multiple directions,thereby boosting the development of comprehensively robust graph contrastive learning algorithms.
作者
邢宇杰
王啸
石川
黄海
崔鹏
XING Yujie;WANG Xiao;SHI Chuan;HUANG Hai;CUI Peng(School of Computer,Beijing University of Posts and Telecommunications,Beijing 100876,China;School of Software,Beihang University,Beijing 102206,China;Department of Computer Science and Technology,Tsinghua University,Beijing 100084,China)
出处
《清华大学学报（自然科学版）》
EI
CAS
CSCD
北大核心
2024年第1期13-24,共12页
Journal of Tsinghua University(Science and Technology)
关键词
图对比学习
图卷积网络
鲁棒性验证
对抗攻击
对抗训练
graph contrastive learning
graph convolution network
robustness verification
adversarial attack
adversarial training
