Complex network effects on the robustness of graph convolutional networks

Applied Network Science

Table 2 Results of influence attacks against each classifier with the Cora dataset, with attacker budgets of 10, 30, and 50 edge perturbations

Results are included for Nettack (Net), FGA, and IG-FGSM (IG). For each classifier, we train with random (Rand.), StratDegree (SD), and GreedyCover (GC). Each entry is a probability of attack success, thus higher is better for the attacker and lower is better for the defender. To yield the most robust classifier, the defender picks the classifier/training method combination that minimizes the worst-case attack probability. These entries are listed in bold. Entries representing the most robust case for random training are in italic. Entries listed as N/A did not finish in the allotted time (24 h per trial). The Jaccard-based classifier performs best, both overall and using random training. If we focus on classifiers that achieve the best performance in Fig. 8, (i.e., omitting Jaccard and SVD), the best performance is achieved by GCNs with the alternative training methods