Complex network effects on the robustness of graph convolutional networks

Applied Network Science

Table 7 Results of direct attacks against each classifier with the PolBlogs dataset, with attacker budgets of 5, 10, and 20 edge perturbations

Results are included for Nettack (Net), FGA, and IG-FGSM (IG). For each classifier, we train with random (Rand.), StratDegree (SD), and GreedyCover (GC). Each entry is a probability of attack success, thus higher is better for the attacker and lower is better for the defender. To yield the most robust classifier, the defender picks the classifier/training method combination that minimizes the worst-case attack probability. These entries are listed in bold. Entries representing the most robust case for random training are in italic. Entries listed as N/A did not finish in the allotted time (24 h per trial). The best-performing cases for attacks with 10 or 20 perturbations use random sampling with an SGC classifier, though in these cases FGA and IG-FGSM were unavailable to the attacker. (If we only consider Nettack, SVD with GreedyCover consistently performs best.)