Backdoor Attacks to Graph Neural Networks
Backdoor Attacks to Graph Neural Networks
复制标题
DOI：
10.1145/3450569.3463560
复制
发表时间：
2020-06
期刊：
影响因子：
--
通讯作者：
Zaixi Zhang;Jinyuan Jia;Binghui Wang;N. Gong
中科院分区：
文献类型：
--
作者：
Zaixi Zhang;Jinyuan Jia;Binghui Wang;N. Gong
在这项工作中，我们提出了第一个后门攻击图神经网络（GNN）。具体来说，我们提出了一个基于子图的后门攻击GNN的图分类。在我们的后门攻击中，一旦预定义的子图被注入到测试图中，GNN分类器就会预测攻击者为测试图选择的目标标签。我们在三个真实世界的图数据集上的实证结果表明，我们的后门攻击是有效的，对GNN的预测准确性的影响很小。此外，我们推广了一种基于随机平滑的认证防御来抵御我们的后门攻击。我们的实证结果表明，防御在某些情况下是有效的，但在其他情况下无效，突出了我们的后门攻击的新防御的需要。
In this work, we propose the first backdoor attack to graph neural networks (GNN). Specifically, we propose a subgraph based backdoor attack to GNN for graph classification. In our backdoor attack, a GNN classifier predicts an attacker-chosen target label for a testing graph once a predefined subgraph is injected to the testing graph. Our empirical results on three real-world graph datasets show that our backdoor attacks are effective with a small impact on a GNN's prediction accuracy for clean testing graphs. Moreover, we generalize a randomized smoothing based certified defense to defend against our backdoor attacks. Our empirical results show that the defense is effective in some cases but ineffective in other cases, highlighting the needs of new defenses for our backdoor attacks.