A Survey of Adversarial Learning on Graph

图的对抗性学习概况

概述：

图上的深度学习模型在各种图分析任务（例如节点分类，链接预测和图聚类）中均取得了卓越的性能。但是，它们暴露了对设计良好的输入（即对抗性样本）的不确定性和不可靠性。因此，针对不同图分析任务中的攻击和防御都出现了各种研究，从而导致了图对抗学习中的军备竞赛。例如，攻击者具有中毒和逃避攻击，防御小组相应地具有基于预处理和对抗的方法。

论文：
A Survey of Adversarial Learning on Graph

原链接：
https://github.com/gitgiter/Graph-Adversarial-Learning

Attack Type (Incoming)

• Defense

  • [1] Transferring Robustness for Graph Neural Network Against Poisoning Attacks
  • [2] Certified Robustness of Community Detection against Adversarial Structural Perturbation via Randomized Smoothing
  • [3] Power Up! Robust Graph Convolutional Network Against Evasion Attacks Based on Graph Powering
  • [4] How Robust Are Graph Neural Networks to Structural Noise?
  • [5] All You Need is Low (Rank): Defending Against Adversarial Attacks on Graphs
  • [6] Certifiable Robustness and Robust Training for Graph Convolutional Networks
  • [7] Topology Attack and Defense for Graph Neural Networks: An Optimization Perspective
  • [8] Adversarial Examples on Graph Data: Deep Insights Into Attack and Defense
  • [9] Adversarial Defense Framework for Graph Neural Network
  • [10] Investigating Robustness and Interpretability of Link Prediction via Adversarial Modifications
  • [11] Robust Graph Convolutional Networks Against Adversarial Attacks
  • [12] Can Adversarial Network Attack Be Defended?
  • [13] Virtual Adversarial Training on Graph Convolutional Networks in Node Classification
  • [14] Comparing and Detecting Adversarial Attacks for Graph Deep Learning
  • [15] Graph Adversarial Training: Dynamically Regularizing Based on Graph Structure
  • [16] Characterizing Malicious Edges Targeting on Graph Neural Networks
  • [17] Batch Virtual Adversarial Training for Graph Convolutional Networks
  • [18] GraphDefense: Towards Robust Graph Convolutional Networks
  • [19] αcyber: Enhancing Robustness of Android Malware Detection System against Adversarial Attacks on Heterogeneous Graph based Model
  • [20] Edge Dithering for Robust Adaptive Graph Convolutional Networks
  • [21] GraphSAC: Detecting Anomalies in Large-scale Graphs
  • [22] Certifiable Robustness to Graph Perturbations
  • [23] Adversarial Robustness of Similarity-Based Link Prediction
  • [24] Improving Robustness to Attacks Against Vertex Classification
  • [25] Adversarial Personalized Ranking for Recommendation

• Baselines

• Metric

• Survey

• Cite

Attack

Venue	Title	Model	Algorithm	Target Task	Target Model	Baseline	Metric	Dataset	Code
Arxiv 2020	[1]	MGA	Gradient-based GCN	Node Classification, Community Detection	GCN, DeepWalk, Node2vec, GraphGAN, LPA, Louvain	GradArgmax, RL-S2V, Nettack, FGA	ASR, AML	Cora, Citeseer, Polblogs, Dolphin, PloBook	-
Arxiv 2020	[2]	RLR, DALR, DILR	Random, Degree	Network Structure	Physical Criteria	-	△M (AML), △L, △C ,△D	Generated simplex networks	-
Arxiv 2020	[3]	GUA	Anchors identified (based on GCN)	Node Classification	GCN, DeepWalk, Node2Vec, GAT	Random, VCA, FGA	AML, ASR	Cora, Citeseer, Polblogs,	-
WWW 2020	[4]	CD-ATTACK	Graph generation based on GCN	Community Detection	GCN, Node2vec + K-means, ComE	DICE, MBA, RTA	Hiding performance measure M1 & M2	DBLP, Finance	Link
AAMAS 2020	[5]	FPTA	-	Node Similarity	Node Similarity Measures	Random, Greedy, High Jaccard Similarity (HJ)	Time, AML	Barabasi-Albert (BA), Erdos-Renyi (ER)
Arxiv 2019	[6]	NIPA	Reinforcement learning, Nodes injection	Node Classification	GCN	Random, Nettack, RL-S2V, FGA, Preferential attack	Accuracy	Cora-ML, Citeseer, Pubmed	-
NIPS 2019	[7]	G-SSL	Gradient based asymptotic linear algorithm	Classification, Regression	Label propagation & regularization algs	Random, PageRank, Degree	Error rate, RMSE	cadata, E2006, mnist17, rcv1	Link
AAAI 2020	[8]	GF-Attack	Graph signal processing	Node Classification	GCN, SGC, DeepWalk, LINE	Random, Degree, RL-S2V,	Accuracy	Cora, CiteSeer, Pubmed	Link
Arxiv 2019	[9]	IG-FGSM, IG-JSMA	Gradient-based GCN	Node Classification	GCN	FGSM, JSMA, Nettack	Classification Margin, Accuracy	Cora, CiteSeer, PolBlogs	-
Arxiv 2019	[10]	EPA	Genetic algorithm	Community Detection	GRE, INF, LOU	,	NMI, ARI	Synthetic networks, Football, Email, Polblogs	-
ICLR 2019	[11]	Meta-Self Meta-Train	Gradient-based GCN	Node Classification	GCN, CLN, DeepWalk	DICE, Nettack, First-order	Misclassification Rate, Accuracy	Cora, CiteSeer, PolBlogs, PubMed	Link
ICML 2019	[12]		Gradient- based random walk	Node Classification, Link Prediction	DeepWalk		F1 Score, Classification Margin	Cora, Citeseer, PolBlogs	Link
Arxiv 2019	[13]	TGA-Tra, TGA-Gre	Gradient-based DDNE	Link Prediction	DDNE, ctRBM, GTRBM, dynAERNN	Random, DGA, CNA	ASR, AML	RADOSLAW, LKML, FB-WOSN	-
Arxiv 2019	[14]	ReWatt	Reinforcement learning based on GCN	Graph Classification	GCN	RL-S2V, RA	ASR	REDDIT-MULTI-12K, REDDIT-MULTI-5K, IMDB-MULTI	-
IJCAI 2019	[15]	PGD Min-Max	Gradient-based GCN	Node Classification	GCN	DICE, Meta-Self, Greedy	Misclassification Rate	Cora, Citeseer	Link
Arxiv 2019	[16]	EDA	Genetic algorithm based on DeepWalk	Node Classification, Community Detection	HOPE, LPA, EM, DeepWalk	Random, DICE, RLS, DBA	NMI, Micro-F1, Macro-F1	Karate, Game, Dolphin	-
Arxiv 2019	[17]	DAGAER	Generative model based on VGAE	Node Classification	GCN	Nettack	ASR	Cora CiteSeer	-
IJCAI 2019	[18]	-	Knowledge embedding	Fact Plausibility Prediction	TransE, TransR, RESCAL	RA	MRR, HR@K	FB15k, WN18	-
CCS 2019	[19]	-	Based on LinLBP	Node Classification, Evasion	LinLBP, JWP, LBP, RW, LINE, DeepWalk, Node2vec, GCN	Random, Nettack	FNR, FPR	Facebook, Enron, Epinions, Twitter, Google+	-
TCSS 2019	[20]	Q-Attack	Genetic algorithm	Community Detection	FN, Lou, SOA, LPA, INF, Node2vec+KM	Random, CDA, DBA	Modularity Q, NMI	Karate, Dolphins, Football, Polbooks	-
CIKM 2019	[21]	HG-Attack	Label propagation algorithm Nodes injection	Malware Detection	Orig-HGC	AN-Attack	TP, TN, FP, FN, F1, Precision, Recall, Accuracy	Tencent Security Lab Dataset	-
Arxiv 2019	[22]	UNAttack	Gradient-based similarity method, Nodes injection	Recommendation	Memory-based CF, BPRMF, NCF	-	Hit@K	Filmtrust, Movielens, Amazon	-
Arxiv 2018	[23]	-	Gradient-based GAN, MF Nodes injection	Recommendation	MF	Random, Average, Popular, Co-visitation	Attack Difference, TVD, JS, Est., Rank Loss @K, Adversarial loss	Movielens 100K, Movielens 1M	-
Arxiv 2018	[24]	Greedy, Greedy GAN	Gradient-based GCN, GAN	Node Classification	GCN	RA	Accuracy, F1 Score, ASR	Cora, Citeseer	-
Arxiv 2018	[25]	CTR OTC	Neighbour score based on graph structure	Link Prediction	Traditional Link Prediction Algs	-	AUC, AP	WTC 9/11, ScaleFree, Facebook, Random network	-
Arxiv 2018	[26]	IGA	Gradient-based GAE	Link Prediction	GAE, LRW DeepWalk, Node2vec, CN, RA, Katz	RAN, DICE, GA	ASR , AML	NS, Yeast, FaceBook	-
ICML 2018	[27]	RL-S2V	Reinforcement learning	Node/Graph Classification	GCN, GNN	Random	Accuracy	Citeseer, Cora, Pubmed, Finance	Link
KDD 2018	[28]	Nettack	Greedy search & gradient based on GCN	Node Classification	GCN, CLN, DeepWalk	Rnd, FGSM	Classification Margin, Accuracy	Cora-ML, Citeseer, PolBlogs	Link
Arxiv 2018	[29]	FGA	Gradient-based GCN	Node Classification, Community Detection	GCN, GraRep, DeepWalk, Node2vec, LINE, GraphGAN	Random, DICE, Nettack	ASR, AML	Cora, Citeseer, PolBlogs	-
Arxiv 2018	[30]	Opt-attack	Gradient based on DeepWalk, LINE	Link Prediction	DeepWalk LINE Node2vec SC GAE	Random, PageRank, Degree sum, Shortest path	Similarity Score AP	Facebook, Cora, Citeseer	-
AAMAS 2018	[31]	Approx-Local	Similarity methods	Link Prediction	Local&Global similarity metrics	Random, GreedyBase	Katz Similarity, ACT Distance, Similarity Score	Random network, Facebook	-
CCS 2017	[32]	Targeted noise injection, Small community attack	Noise injection	Graph Clustering, Community Detection	SVD, Node2vec, Community Detection Algs	-	ASR, FPR	Reverse Engineered DGA Domains, NXDOMAIN	-

Defense

Venue	Title	Model	Algorithm	Defense Type	Target Task	Target Model	Baseline	Metric	Dataset	Code
WSDM 2020	[1]	PA-GNN	Penalized Aggregation, Meta Learning	Structure Based	Node Classification	GNN	GCN, GAT, PreProcess, RGCN, VPN	Accuracy	Pubmed, Reddit, Yelp	-
WWW 2020	[2]	-	Robustness Certification	Hybrid	Community detection	-	-	certified accuracy	Email,DBLP,Amazon
ICLR 2020 OpenReview	[3]	r-GCN, VPN	Graph Powering	Objective Based	Node Classification	GCN	ManiReg, SemiEmb, LP, DeepWalk, ICA, Planetoid, Vanilla GCN	Accuracy, Robustness Merit, Attack Deterioration	Citeseer, Cora, Pubmed	-
Arxiv 2019	[4]	-	Adversarial Training	Adversarial Training	Node Classification	GIN	GIN(without agumented data)	F1 score
WSDM 2019	[5]
KDD 2019	[6]	GNN (trained with RH-U)	Robustness Certification, Objective Based	Hybrid	Node Classification	GNN, GCN	GNN (trained with CE, RCE, RH)	Accuracy, Averaged Worst-case Margin	Citeseer, Cora-ML, Pubmed	Link
IJCAI 2019	[7]	-	Adversarial Training	Adversarial Training	Node Classification	GCN	GCN	Misclassification Rate Accuracy	Citeseer, Cora	Link
IJCAI 2019	[8]	-	Drop Edges	Preprocessing	Node Classification	GCN	GCN	Classfication Margin, Accuracy	Cora-ML, Citeseer, PolBlogs	Link
Arxiv 2019	[9]	DefNet	GAN, GER, ACL	Hybrid	Node Classification	GCN, GraphSAGE	GCN, GraphSage	Classfication Margin	Cora, Citeseer, PolBlogs	-
NAACL 2019	[10]	CRIAGE	Adversarial Modification	Robustness Evaluation	Link Prediction	Knowledge Graph Embedding	-	Hits@K, MRR	Nations, Kinship, WN18, YAGO3-10	-
KDD 2019	[11]	RGCN	Gaussian-based Graph Convolution	Structure Based	Node Classification	GCN	GCN, GAT	Accuracy	Cora, Citeseer, Pubmed	Link
Arxiv 2019	[12]	Global-AT, Target-AT, SD, SCEL	Adversarial Training, Smooth Defense	Hybrid	Node Classification	GNN	AT	ADR, ACD	PolBlogs, Cora, Citeseer	-
PRCV 2019	[13]	SVAT, DVAT	Virtual Adversarial Training	Adversarial Training	Node Classification	GCN	GCN	Accuracy	Cora, Citeseer, Pubmed	-
RLGM@ICLR 2019	[14]	-	KL Divergence	Detection Based	Node Classification	GCN, GAT	-	Classfication Margin, Accuracy, ROC, AUC	Cora, Citeseer, PolBlogs	-
Arxiv 2019	[15]	GCN-GATV	Graph Adversarial Training, Virtual Adversarial Training	Adversarial Training	Node Classification	GCN	LP, DeepWalk, SemiEmb, Planetoid, GCN, GraphSGAN	Accuracy	Citeseer, Cora, NELL	-
ICLR 2019 OpenReview	[16]	SL, OD, GGD, LP+GGD, ENS	Link Prediction, Subsampling, Neighbour Analysis	Hybrid	Node Classification	GNN, GCN	LP	AUC	Cora, Citeseer	-
ICML 2019	[17]	S-BVAT, O-BVAT	Batch Virtual Adversarial Training	Adversarial Training	Node Classification	GCN	ManiReg, SemiEmb, LP, DeepWalk, Planetoid, Monet, GAT, GPNN, GCN, VAT	Accuracy	Cora, Citeseer, Pubmed, Nell	Link
Arxiv 2019	[18]	GraphDefense	Adversarial Training	Adversarial Training	Node Classification	GCN	Drop Edges, Discrete Adversarial Training	Accuracy	Cora, Citeseer, Reddit	-
CIKM 2019	[19]	Rad-HGC	HG-Defense	Detection Based	Malware Detection	Malware Detection System	FakeBank, CryptoMiner, AppCracked, MalFlayer, GameTrojan, BlackBaby, SDKSmartPush, ...	Detection Rate	Tencent Security Lab Dataset	-
Arxiv 2019	[20]	AGCN	Adaptive GCN with Edge Dithering	Structure Based	Node Classification	GCN	GCN	Accuracy	Citeseer, PolBlogs, Cora, Pubmed	-
Arxiv 2019	[21]	GraphSVC	Random, Consensus	Detection Based	Anomaly Detection	Anomaly Model	GAE, Amen, Radar, Degree, Cut ratio, Flake, Conductance	AUC	Citeseer, PolBlogs, Cora, Pubmed	-
NIPS 2019	[22]	GNN (train with , )	Robustness Certification, Objective Based	Hybrid	Node Classification	GNN	GNN	Accuracy, Worst-case Margin	Cora-ML, Citeseer, Pubmed	link
ICDM 2019	[23]	IDOpt, IDRank	Integer Program, Edge Ranking	Heuristic Algorithm	Link Prediction	Similarity-based Link Prediction Models	PPN	DPR	PA, PLD, TVShow, Gov	-
MLG@KDD 2019	[24]	SVM with a radial basis function kernel	Augmented Feature, Edge Selecting	Hybrid	Node Classification	SVM	GCN	Classification Marigin	Cora, Citeseer	-
SIGIR 2018	[25]	APR, AMF	Adversarial Training based on MF-BPR	Adversarial Training	Recommendation	MF-BPR	ItemPop, MF-BPR, CDAE, NeuMF, IRGAN	HR, NDCG	Yelp, Pinterest, Gowalla	Link

Baselines

Baseline	Venue	Paper	Code
DICE	Nature Human Behaviour 2018	Hiding Individuals and Communities in a Social Network	Link
Nettack	KDD 2018	Adversarial Attacks on Neural Networks for Graph Data	Link
First-order	ICML 2017	Model-Agnostic Meta-Learning for Fast Adaptation of Deep Networks	Link
RL-S2V	ICML 2018	Adversarial Attack on Graph Structured Data	Link
Meta-Self	ICLR 2019	Adversarial Attacks on Graph Neural Networks via Meta Learning	Link
Greedy	ICLR 2019	Adversarial Attacks on Graph Neural Networks via Meta Learning	Link
DBA	IEEE Transactions 2019	GA Based Q-Attack on Community Detection	-
CDA	IEEE Transactions 2019	GA Based Q-Attack on Community Detection	-
GA (Gradient based)	ECML PKDD 2013	Evasion Attacks Against Machine Learning at Test Time	Link
FGSM	ICLR 2015	Explaining and Harnessing Adversarial Examples	Link
PageRank	VLDB 2010	Fast Incremental and Personalized PageRank	Link
GNN	IEEE Transactions 2009	The Graph Neural Network Model	Link
GCN	ICLR 2017	Semi-Supervised Classification with Graph Convolutional Networks	Link
ManiReg	JMLR 2006	Manifold Regularization: A Geometric Framework for Learning from Labeled and Unlabeled Examples	Link
SemiEmb	ICML 2008	Deep Learning via Semi-supervised Embedding	Link
LP	ICML 2003	Semi-Supervised Learning Using Gaussian Fields and Harmonic Functions	Link
Deepwalk	KDD 2014	DeepWalk: Online Learning of Social Representations	Link
ICA	ICML 2003	Link-based classification	Link
Planetoid	ICML 2016	Revisiting Semi-Supervised Learning with Graph Embeddings	Link
GraphSage	NIPS 2017	Inductive Representation Learning on Large Graphs	Link
DistMult	ICLR 2015	Embedding Entities and Relations for Learning and Inference in Knowledge Bases	Link
ConvE	AAAI 2018	Convolutional 2D Knowledge Graph Embeddings	Link
GAT	ICLR 2018	Graph Attention Networks	Link
AT	ICLR 2015	Explaining and Harnessing Adversarial Examples	Link
BGCN	AAAI 2019	Bayesian graph convolutional neural networks for semi-supervised classification	-
GraphSGAN	ACM 2018	Semi-supervised Learning on Graphs with Generative Adversarial Nets	Link
Monet	CVPR 2017	Geometric deep learning on graphs and manifolds using mixture model CNNs	Link
GPNN	CVPR 2018	Graph Partition Neural Networks for Semi-Supervised Classification	Link
VAT	IEEE Transactions 2018	Virtual Adversarial Training: A Regularization Method for Supervised and Semi-Supervised Learning	Link

@misc{chen2020survey,
title={A Survey of Adversarial Learning on Graphs},
author={Liang Chen and Jintang Li and Jiaying Peng and Tao Xie and Zengxu Cao and Kun Xu and Xiangnan He and Zibin Zheng},
year={2020},
eprint={2003.05730},
archivePrefix={arXiv},
primaryClass={cs.LG}
}