Applied Network Science

Table 3 Results of influence attacks against each classifier with the PolBlogs dataset, with attacker budgets of 10, 30, and 50 edge perturbations

From: Complex network effects on the robustness of graph convolutional networks

		Budget 10			Budget 30			Budget 50
Defense	Training	Net	FGA	IG	Net	FGA	IG	Net	FGA	IG
Jaccard	Rand.	0.92	0.872	0.928	0.992	1.0	1.0	1.0	1.0	1.0
Jaccard	SD	0.928	0.984	0.936	1.0	1.0	1.0	1.0	1.0	1.0
Jaccard	GC	0.936	0.952	0.944	0.992	1.0	1.0	1.0	1.0	1.0
RGCN	Rand.	0.08	0.128	0.032	0.224	0.248	0.056	0.32	0.304	0.064
RGCN	SD	0.048	0.024	0.016	0.088	0.072	0.056	0.112	0.096	0.064
RGCN	GC	0.088	0.096	0.04	0.192	0.176	0.048	0.232	0.272	0.056
Cheb	Rand.	0.048	0.184	0.112	0.184	0.376	0.176	0.296	0.456	0.216
Cheb	SD	0.128	0.128	0.168	0.256	0.232	0.288	0.368	0.32	0.336
Cheb	GC	0.344	0.08	0.168	0.456	0.208	0.328	0.52	0.288	0.392
SVD	Rand.	0.016	0.08	0.048	0.04	0.12	0.096	0.112	0.136	0.128
SVD	SD	0.064	0.024	0.064	0.088	0.024	0.072	0.112	0.032	0.096
SVD	GC	0.04	0.04	0.048	0.088	0.064	0.08	0.104	0.112	0.128
GAT	Rand.	0.224	0.224	0.184	0.384	0.408	0.248	0.448	0.488	0.304
GAT	SD	0.12	0.056	0.08	0.184	0.16	0.152	0.256	0.208	0.208
GAT	GC	0.112	0.12	0.064	0.2	0.256	0.152	0.288	0.296	0.168
GCN	Rand.	0.16	0.208	0.128	0.288	0.368	0.2	0.344	0.424	0.232
GCN	SD	0.104	0.096	0.176	0.168	0.208	0.248	0.208	0.288	0.312
GCN	GC	0.072	0.032	0.056	0.152	0.184	0.104	0.28	0.296	0.128
SGC	Rand.	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A
SGC	SD	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A
SGC	GC	0.056	N/A	N/A	0.12	N/A	N/A	0.168	N/A	N/A

Results are included for Nettack (Net), FGA, and IG-FGSM (IG). For each classifier, we train with random (Rand.), StratDegree (SD), and GreedyCover (GC). Each entry is a probability of attack success, thus higher is better for the attacker and lower is better for the defender. To yield the most robust classifier, the defender picks the classifier/training method combination that minimizes the worst-case attack probability. These entries are listed in bold. Entries representing the most robust case for random training are in italic. Entries listed as N/A did not finish in the allotted time (24 h per trial). Best results overall and with random training are achieved with SVD, while RGCN performs equally well when using StratDegree

Back to article page