| Deep graph learning models excel at modeling Non-Euclidean spatial data,but slight adversarial perturbations make them highly vulnerable to specific tasks.Designing effective attack methods to simulate adversarial attack behavior in graph networks helps explore potential threats in realistic scenarios.Moreover,as adversarial attacks become more and more intense,various defense strategies have attracted significant attention in security and privacy-sensitive environments.In order to enhance the robustness of deep learning models by addressing the potential threat of malicious adversarial samples,this paper investigates adversarial attacks and defenses of graph deep learning models on clustering and classification tasks and makes the following progress:Research on adversarial attack algorithms in the graph domain has been widely used in security-related tasks such as spam processing,malware identification,anomaly processing,and social credit systems.However,most existing graph attack schemes lack precise target node location,making them less successful for node classification tasks in large dense graphs.Their failure to set perturbation conditions from the graph embedding space perspective makes it difficult for attackers to evade detection of the target model.To solve the above problems,a greedy-based black-box adversarial attack scheme on graph structure is proposed in this paper,which is named GB-Attack.The scheme firstly uses local betweenness centrality to pinpoint the set of target nodes and obtain the set of attackable edges in their first-order neighborhoods respectively,which can modify the graph structure data with high importance and improve the success rate of the attack.Secondly,the scheme combines the similarity of graphs in latent space and the similarity of graph structure to set perturbation conditions to obtain the adversarial samples with low perturbation for evading the detection of the target model.Finally,the scoring function is set for the adversarial samples according to the perturbation condition.The adversarial samples with larger values of the scoring function are selected by a greedy strategy and put into the target model for the iterative query to maximize the probability that the target node is misclassified,which is used to ensure the accuracy and query efficiency of the attack.The detailed experimental results show that the attack accuracy of the new scheme against the GCN classification model is significantly improved compared with the other attack schemes,and in particular,the new scheme improves the attack accuracy under multilateral perturbation by 9.73% compared with the classical RL-S2 V scheme.Although deep graph learning models perform well in many tasks,it is found that GCN-based deep clustering models are vulnerable to adversarial attacks,leading to reduced robustness of the models.A large number of current defense schemes lack a certain degree of pervasiveness.To this end,this paper proposes a more generalized GCN-oriented graph purification defense model named GCN-GPDM,which designs an efficient graph purification defense mechanism(GPDM)for GCN to resist the interference of adversarial attacks on graph data,specifically by reconstructing a new adjacency matrix and preserving the low-rankness,sparsity,similarity of clustering coefficients,and label ratio equality among nodes of the original graph,for recovering clean graph data from the perturbed graph.Detailed experimental results show that GCN-GPDM outperforms the other four benchmark defense models.For example,the new model improves by 7.6% in Accuracy metrics and 11.5% in NMI metrics relative to the best benchmark method.In addition,the new model still shows high robustness and strong transferability under multiple attack contexts. |
