Research On The Key Techniques Of Defense And Attack Against Graph Neural Network For Node Classification

With the rapid improvement of computer computing power and the collection of a large number of production and life data,neural network technology has been widely used in actual production and life.From image classification and object detection to speech recognition and natural language understanding,neural networks have attracted a lot of attention from the academic community due to their excellent data modeling capabilities.Although the past neural networks can effectively capture the hidden information in Euclidean data,more and more application data are represented in the form of graph structure.A graph is a data structure that contains a set of nodes and their relationships.Previous neural networks could not be used directly for graph-structured data.Graph neural network is a deep learning method that works on graph-structured data.In recent years,it has become a widely used method for analyzing graph-structured data.However,how to accurately obtain effective features in practical tasks has always been the focus,difficulty and hotspot of graph neural network learning research.In the graph structure data of many practical scenarios,the category of nodes represents some practical significance.In reality,it is often difficult to obtain the complete categories of all nodes,that is,only part of the node categories may be known,and the remaining node categories need to be inferred.However,graph neural networks inherit the defects of deep learning methods that are vulnerable to external interference and hostile attacks,and the accuracy and robustness of graph neural network node classification cannot be effectively guaranteed.Although there are some studies on defense strategies and adversarial attacks in fields such as image and natural language processing,it is difficult to directly transfer the learned knowledge to graph-structured data due to its representation structure.Through the study of defense strategies to resist noise interference and hostile attacks from the environment,through the study of attack methods,we can find out the defects of the graph neural network,mine the potential threats of the graph neural network,and then take subsequent defense measures.This is crucial to improve the accuracy and robustness of graph neural network classification.In this paper,we conduct an in-depth study of defense and adversarial attack methods in graph neural network node classification.The main innovations of this doctoral thesis are summarized as follows:1.For the defense of graph neural network,this paper proposes a robust graph alternating learning network for node classification problem.In this paper,the graph alternating learning framework is used to alternately train the dual network model,the classification network is used to learn the graph structure for the node classification task,and the graph regularization network is used to enhance the robustness of the graph neural network.The alternating learning network integrates a feature selection method into the network to obtain a compact and accurate feature representation of high-dimensional nodes.By discussing and analyzing the impact of node feature selection on graph neural networks from the perspective of similarity,a solution integrating node feature selection and similarity loss was proposed to reduce the impact of node attacks.The performance of the robust graph alternating learning network has been effectively verified in the classification task of reference network,social network and shopping network.2.For the defense of graph neural network,this paper proposes a counterfactual graph network for node classification problem.In the existing graph data,the edges between nodes may not truly reflect the relationship between nodes.Therefore,this paper proposes a counterfactual graph network for node classification problem,which builds a learnable graph structure to improve the accuracy and robustness of the model node classification.Specifically,nodes can be viewed as contexts,and edge existence and node classification can be viewed as intervention methods and outcomes,respectively.We enhance graph learning by predicting observed factual and counterfactual classifications,and further demonstrate that our counterfactual graph network can be optimized in combination with gradient algorithms for classification tasks.In this paper,the counterfactual graph network for node classification problem is used in the disease diagnosis task,and the effectiveness of the network is effectively verified in the diagnosis of autism spectrum disorder,Alzheimer’s disease,lung disease and eye disease.3.For the attack of graph neural network,this paper proposes a structural attack method for node classification problem.In this paper,a Smooth-attack method is first designed to deceive the prediction task of graph neural network by generating a smooth adjacency matrix,and the reason for its influence on the network is attributed to over-smoothing in the training of graph neural network by theoretical proof.Then,an Unsmooth-attack method is designed to adjust the connection relationship between nodes by generating an unsmooth adjacency matrix,that is,the edge relationship is established for the nodes with large differences,which interferes with the overall smoothness of the original graph and affects the node classification task.The structural attack method in this paper does not need to obtain the network parameters and node labels in the graph network to be attacked,so it is suitable for black-box attack scenarios.Finally,this paper verifies that the structural attack method for node classification problem reduces the accuracy of node classification to a certain extent on multiple datasets.4.For the attack of graph neural network,this paper proposes an injection attack method for node classification problem.Specifically,this paper proposes a new single-node injection subgraph attack method.Different from the previous node injection attacks that only attack one target node at a time,this method can be extended to the first-order subgraph of the target node,which improves the efficiency of the single-node injection attack.The single-node injection subgraph attack method first generates harmful node features,and then assigns them edges connected to the subgraph.In this paper,we further theoretically prove that the injected node feature perturbation is more effective than the perturbation of assigned edges in a single-layer graph convolutional network under some specific conditions.This attack method has been effectively verified in multiple node classification task datasets.