D4A: An efficient and effective defense across agnostic adversarial attacks

Abstract

Recent studies show that Graph Neural Networks (GNNs) are vulnerable to structure adversarial attacks, which draws attention to adversarial defenses in graph data. Previous defenses designed heuristic defense strategies for specific attacks or graph properties, and are no longer sufficiently robust across all these attacks. To address this problem, we discuss the abnormal behaviors of GNNs in structure perturbations from a posterior distribution perspective. We suggest that the structural vulnerability of GNNs stems from their dependence on local graph smoothing, which can also lead to unfitting — a first-found phenomenon specific to the graph domain. We demonstrate that abnormal behaviors, except for unfitting, can attribute to a posterior distribution shift. To intrinsically prevent the occurrence of abnormal behaviors, we first propose smooth-less message passing to enhance the tolerance with respect to structure perturbations, while significantly mitigating the unfitting. We also propose the distribution shift constraint to restrict other abnormal behaviors of our model. Our approach is evaluated on six different datasets across over four kinds of attacks and compared to 11 representative baselines. The experimental results show that our method improves the defense performance across various attacks, and provides a great trade-off between accuracy and adversarial robustness.