CRII: SaTC: Towards Understanding the Robustness of Graph Neural Networks against Graph Perturbations

利用图学习，如社交网络、生物网络和金融网络，最近受到了持续的关注，其中图神经网络（gnn）已经成为最突出的方法。然而，最近的研究表明，GNN容易受到图摄动攻击：图结构的轻微扰动会使GNN模型的性能严重下降。gnn的鲁棒性不足使得它们的潜在应用存在风险。然而，现有的关于GNN攻击和防御的研究范围非常有限：攻击是在不太实际的场景下假设的（即攻击者对GNN模型具有全部或部分知识），而防御要么是基于启发式的，很容易被打破，要么缺乏防御的鲁棒性。该项目旨在了解如何执行图摄动攻击来欺骗任何对GNN模型了解最少或不了解的GNN。因此，该项目分别受到影响函数和强盗算法的启发，对任何gnn设计了限制和严格的黑盒图摄动攻击。接下来，该项目旨在了解如何通过鲁棒性保证保护任何gnn免受最强白盒攻击。为此，本文通过新颖的随机平滑技术设计了任何gnn针对白盒图摄动攻击的可证明防御，并设计了原则性的方法来优化防御性能。该项目的新颖之处在于全面了解gnn对图摄动攻击的鲁棒性，研究更可行的攻击，最后设计更可证明的防御。该项目更广泛的意义和影响是：1)不仅推进了安全可靠的机器学习领域，而且还推动了图数据模型和图学习广泛使用的其他领域（如社会科学和经济）；2)开发一门新的研讨会课程“对抗环境中的图学习”，3)支持本科生和研究生的跨学科研究。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Learning with graphs, such as social networks, biological networks, and financial networks, has drawn continuous attention recently, wherein graph neural networks (GNNs) have been emerging as the most prominent methodology. However, recent studies show that GNNs are vulnerable to graph perturbation attacks: slightly perturbing the graph structure can make GNN model's performance severely degraded. The lack of robustness of GNNs makes them risky for their potential applications. However, existing studies on GNN attacks and defenses are very limited in scope: the attacks are assumed under less practical scenarios (i.e., the attacker has a full or partial knowledge about the GNN model), while the defenses are either heuristic-based that can be easily broken or their robustness in defense is lacking. This project aims to understand how to perform the graph perturbation attack to fool any GNNs with least/no knowledge about the GNN model. Accordingly, the project designs both restricted and stringent black-box graph perturbation attacks to any GNNs, which are inspired by the influence function and bandit algorithms, respectively. Next, the project aims to understand how to protect any GNNs from the strongest white-box attack with robustness guarantees. To this end, it designs provable defenses for any GNNs against white-box graph perturbation attacks via novel randomized smoothing techniques and designs principled methods to optimize the defense performance.The project’s novelties are to gain a holistic understanding on the robustness of GNNs against graph perturbation attacks, to look into more practicable attacks and lastly to devise a more provable defenses. The project’s broader significance and impact are 1)advancing not only the field of secure and trustworthy machine learning, but also other fields (e.g., social science and economy) where graph data model and graph learning are widely used; 2) developing a new seminar course “Graph Learning in the Adversarial Settings”, and 3)supporting cross-disciplinary research for both undergraduate and graduate students.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.