Complex network effects on the robustness of graph convolutional networks

Applied Network Science

Table 4 Results of influence attacks against each classifier with the PubMed dataset, with attacker budgets of 10, 30, and 50 edge perturbations

Results are included for Nettack (Net), FGA, and IG-FGSM (IG). For each classifier, we train with random (Rand.), StratDegree (SD), and GreedyCover (GC). Each entry is a probability of attack success, thus higher is better for the attacker and lower is better for the defender. To yield the most robust classifier, the defender picks the classifier/training method combination that minimizes the worst-case attack probability. These entries are listed in bold. Entries listed as N/A did not finish in the allotted time (24 h per trial). Only results using Jaccard, GCN, and ChebNet were obtained in time. While StratDegree and GreedyCover improve performance with the Jaccard-based classifier, the best performance is achieved by a ChebNet classifier with random training. In our experiments, this classifier with the PubMed data typically has a much higher margin before the attack takes place