基于节点特征对抗性攻击的图对比学习鲁棒性验证  

Robust verification of graph contrastive learning based on node feature adversarial attacks

作　　者：邢宇杰 王啸 石川[1] 黄海 崔鹏[3] XING Yujie;WANG Xiao;SHI Chuan;HUANG Hai;CUI Peng(School of Computer,Beijing University of Posts and Telecommunications,Beijing 100876,China;School of Software,Beihang University,Beijing 102206,China;Department of Computer Science and Technology,Tsinghua University,Beijing 100084,China)

机构地区：[1]北京邮电大学计算机学院,北京100876 [2]北京航空航天大学软件学院,北京102206 [3]清华大学计算机科学与技术系,北京100084

出　　处：《清华大学学报（自然科学版）》2024年第1期13-24,共12页Journal of Tsinghua University(Science and Technology)

摘　　要：最近的许多工作已经表明图神经网络在面对图结构扰动以及节点特征扰动的对抗攻击时表现出非鲁棒性,其预测结果可能是不可靠的,图对比学习方法中也存在这一问题。然而已有的鲁棒性测度方法通常与攻击算法、数据标签以及下游任务相关,这些在自监督设置下图对比学习的鲁棒性测度中是应当尽量避免的。该文提出了基于节点特征对抗性攻击的图对比学习鲁棒性验证算法,来验证节点特征扰动下的图卷积网络的鲁棒性。考虑到图对比学习模型中正负例对的特性,将图对比学习鲁棒性验证问题定义为对抗样本与目标节点及其负例之间相似度比较的问题,并将该问题形式化建模为一个动态规划问题,从而解决了对攻击算法、数据标签以及下游任务的依赖问题。为了求解该动态规划问题,针对图数据通常采用的二元特征,设计了相应的扰动空间;考虑到图对比学习中负例样本空间过大的挑战,设计了负例样本采样策略来提升求解问题的效率;由于二元离散特征和非线性激活函数使得动态规划问题难于求解,对它们分别采用放松到连续数据域和非线性激活放松的方式,并采用寻找对偶问题的方式进一步提高求解效率。通过充分的实验说明了所提出的图对比学习鲁棒性验证算法的有效性;同时验证了针对特定攻击算法设计的图对比学习模型的鲁棒性不具有可泛化性,面对其他的攻击算法可能表现得更加脆弱;还通过参数实验说明了设计的负例样本采样策略是合理的。[Objective]Many recent studies have indicated that graph neural networks exhibit a lack of robustness when facing adversarial attacks involving perturbations in both graph structures and node features,and the subsequent predictions of these networks may become unreliable under such circumstances.This issue affects graph contrastive learning methods similarly.However,the existing evaluation of robustness methods is often entangled with attack algorithms,data labels,and downstream tasks,which are best avoided,especially within the self-supervised setup of graph contrastive learning.Therefore,this paper introduces a robustness verification algorithm for graph contrastive learning to assess the robustness of graph convolutional networks against node feature adversarial attacks.[Methods]To begin with,considering the nature of positive and negative pairs found in graph contrastive learning models,this paper defines the robustness verification problem of graph contrastive learning as a similarity comparison between adversarial samples and the target node along with its negative samples.This problem is then expressed as a dynamic programming problem,which avoids dependency on attack algorithms,data labels,and downstream tasks.To address this dynamic programming problem,a series of novel and effective methods are proposed in this paper.For the binary attributes commonly used in graph data,corresponding perturbation spaces are therefore constructed here.Considering the challenge posed by a large negative sample space in graph contrastive learning,a negative sample sampling strategy is designed to improve the efficiency of problem-solving.In cases where binary discrete attributes and nonlinear activation functions render the dynamic programming problem difficult to address,this paper employs relaxation techniques and uses dual problem optimization methods to further improve the solution's efficiency.[Results]To assess the effectiveness of the proposed graph contrastive learning robustness verification algorithm,we conducted

关 键 词：图对比学习 图卷积网络 鲁棒性验证 对抗攻击 对抗训练 

分 类 号：TP181[自动化与计算机技术—控制理论与控制工程]