Graph Neural Networks (GNNs) are vulnerable to adversarial attacks, leading to a significant performance degradation. Many current methods guide graph purification or graph structure learning through predefined robust properties. However, attackers can also apply the same constraints to these properties, rendering the defenses ineffective. This paper proposes an adaptive multi-sapce defense framework that enhances the robustness of GNNs without relying on prior knowledge. The core idea is to generate an estimated graph using clean attribute information and then apply graph convolution to both the perturbed graph and the estimated graph to obtain their respective node embeddings. Common embeddings between the estimated graph and the perturbed graph is then captured through shared parameters, and an attention mechanism is utilized to learn the weights of the three spaces. Extensive experiments demonstrate that our method extracts the information most relevant to classification performance where both attack methods and perturbation rates are unknown, resulting in significant improvements in both classification accuracy and performance stability.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Adaptive Multi-space Defense Framework Against Adversarial Attacks

  • Xiaohui Yu,
  • Qiao Yan

摘要

Graph Neural Networks (GNNs) are vulnerable to adversarial attacks, leading to a significant performance degradation. Many current methods guide graph purification or graph structure learning through predefined robust properties. However, attackers can also apply the same constraints to these properties, rendering the defenses ineffective. This paper proposes an adaptive multi-sapce defense framework that enhances the robustness of GNNs without relying on prior knowledge. The core idea is to generate an estimated graph using clean attribute information and then apply graph convolution to both the perturbed graph and the estimated graph to obtain their respective node embeddings. Common embeddings between the estimated graph and the perturbed graph is then captured through shared parameters, and an attention mechanism is utilized to learn the weights of the three spaces. Extensive experiments demonstrate that our method extracts the information most relevant to classification performance where both attack methods and perturbation rates are unknown, resulting in significant improvements in both classification accuracy and performance stability.