Fig. 6
From: Complex network effects on the robustness of graph convolutional networks
Robustness to direct attacks using GCNs (solid line) or with the best defense at a given attack success probability (dash line). Results are shown for the CiteSeer, Cora, PolBlogs, and PubMed datasets, attacked with Nettack/SGA (left column), FGA (center column), and IG-FGSM (right column). Results were not returned in the allotted time (24 h per trial) for IG-FGSM and FGA on the PubMed dataset, or for IG-FGSM on the CiteSeer dataset when using a GCN with random training or StratDegree. (CiteSeer/IG-FGSM experiments with StratDegree and random selection completed for other classifiers; see Table 5 for details.) Each curve represents the average required budget over 25 randomly selected targets, and error bars are standard errors. Higher is better for the defender. While GreedyCover performs better when paired with defenses on CiteSeer when attacked with Nettack or FGA, the alternative methods generally increase robustness less than with indirect attacks