Gnn Adversarial Robustness Eval

gnn-adversarial-robustness-eval

Adversarial Robustness in Graph Neural Networks: A Hamiltonian Approach — Zhao et al. (2023) (arXiv:2310.06396, 2023)

What this evaluates

Evaluates the adversarial robustness of Graph Neural Networks against node/edge injection and modification attacks, comparing Hamiltonian-based models against standard GNNs and defense baselines.

Datasets

• Cora, Citeseer, Pubmed, Coauthor, Computers, Ogbn-Arxiv, Polblogs — total ?; splits: train (-1), val (-1), test (-1)

Metrics

• accuracy (primary) — range: [0, 1]
  • Standard node classification accuracy: the fraction of correctly predicted node labels out of the total test nodes. Computed as (predictions == labels).mean().

Input / output format

Input: Graph adjacency matrix and node feature matrix, potentially perturbed by adversarial attacks (node/edge injection or edge modification).

Output: Predicted class label for each node in the graph.

Scoring recipe

def compute_accuracy(predictions, labels):
    correct = (predictions == labels).sum()
    total = len(labels)
    return correct / total

Common pitfalls

• Black-box attacks use a surrogate model to generate perturbations, which may differ from white-box gradient-based attacks.
• Perturbation rates for modification attacks are varied in 5% increments from 0% to 25%, not fixed.
• Dataset splits follow an inductive 60/10/20 protocol for some datasets, while others use standard transductive splits.

Evidence (verbatim from paper)

Our datasets include citation networks (Cora, Citeseer, Pubmed) [51], the Coauthor academic network [52], an Amazon co-purchase network (Computers) [52], and the Ogbn-Arxiv dataset [53]. For inductive learning, we follow the data splitting method in the GRB framework [54], with 60% for training, 10% for validation, and 20% for testing.

Citation

@misc{zhao2023hamiltoniangnn,
  title={Adversarial Robustness in Graph Neural Networks: A Hamiltonian Approach},
  author={Zhao et al. (2023)},
  year={2023},
  note={arXiv:2310.06396}
}

• arXiv: 2310.06396