Certifiable Robustness and Robust Training for Graph Convolutional Networks

28 Jun 2019  ·  Daniel Zügner, Stephan Günnemann ·

Recent works show that Graph Neural Networks (GNNs) are highly non-robust with respect to adversarial attacks on both the graph structure and the node attributes, making their outcomes unreliable. We propose the first method for certifiable (non-)robustness of graph convolutional networks with respect to perturbations of the node attributes. We consider the case of binary node attributes (e.g. bag-of-words) and perturbations that are L_0-bounded. If a node has been certified with our method, it is guaranteed to be robust under any possible perturbation given the attack model. Likewise, we can certify non-robustness. Finally, we propose a robust semi-supervised training procedure that treats the labeled and unlabeled nodes jointly. As shown in our experimental evaluation, our method significantly improves the robustness of the GNN with only minimal effect on the predictive accuracy.

PDF Abstract

Results from the Paper


Task Dataset Model Metric Name Metric Value Global Rank Benchmark
Node Classification Citeseer GNN RH-U Accuracy 68% # 64
Node Classification Cora GNN RH-U Accuracy 83% # 45
Node Classification Pubmed GNN RH-U Accuracy 86% # 21

Methods