Applied Network Science

Table 5 Results of direct attacks against each classifier with the CiteSeer dataset, with attacker budgets of 5, 10, and 20 edge perturbations

From: Complex network effects on the robustness of graph convolutional networks

		Budget 5			Budget 10			Budget 20
Defense	Training	Net	FGA	IG	Net	FGA	IG	Net	FGA	IG
Jaccard	Rand.	0.384	0.256	0.296	0.592	0.392	0.368	0.752	0.464	0.472
Jaccard	SD	0.432	0.32	0.256	0.672	0.416	0.32	0.808	0.52	0.432
Jaccard	GC	0.2	0.184	0.224	0.264	0.336	0.336	0.408	0.52	0.456
RGCN	Rand.	0.976	0.848	0.8	0.992	0.936	0.936	1.0	0.968	0.96
RGCN	SD	0.88	0.568	0.912	0.992	0.856	0.976	1.0	0.944	0.976
RGCN	GC	0.896	0.712	0.808	1.0	0.88	0.936	1.0	0.952	0.976
Cheb	Rand.	0.224	0.28	0.264	0.344	0.352	0.384	0.424	0.44	0.464
Cheb	SD	0.264	0.24	0.304	0.32	0.336	0.392	0.4	0.376	0.448
Cheb	GC	0.288	0.24	0.256	0.376	0.312	0.328	0.472	0.4	0.4
SVD	Rand.	0.552	0.392	0.768	0.76	0.576	0.936	0.944	0.856	0.952
SVD	SD	0.84	0.544	0.936	0.984	0.696	0.976	1.0	0.856	0.976
SVD	GC	0.408	0.312	0.864	0.688	0.488	0.952	0.968	0.792	0.992
median	Rand.	0.808	0.792	0.792	0.96	0.936	0.96	0.984	0.952	0.984
median	SD	0.904	0.84	0.872	0.992	0.952	0.952	1.0	0.96	0.952
median	GC	0.856	0.832	0.848	0.96	0.952	0.96	0.992	0.968	0.976
GAT	Rand.	0.92	0.864	0.84	0.984	0.952	0.936	1.0	0.96	0.952
GAT	SD	0.944	0.808	0.952	1.0	0.952	0.992	1.0	0.984	1.0
GAT	GC	0.936	0.808	0.832	1.0	0.952	0.92	1.0	0.984	0.96
GCN	Rand.	0.944	0.872	N/A	0.992	0.952	N/A	1.0	0.976	N/A
GCN	SD	0.984	0.832	N/A	1.0	0.968	N/A	1.0	0.992	N/A
GCN	GC	0.912	0.904	0.936	1.0	0.976	0.992	1.0	0.976	0.992
SGC	Rand.	0.832	N/A	N/A	0.944	N/A	N/A	1.0	N/A	N/A
SGC	SD	0.936	N/A	N/A	1.0	N/A	N/A	1.0	N/A	N/A
SGC	GC	0.88	N/A	N/A	0.96	N/A	N/A	1.0	N/A	N/A

Results are included for Nettack (Net), FGA, and IG-FGSM (IG). For each classifier, we train with random (Rand.), StratDegree (SD), and GreedyCover (GC). Each entry is a probability of attack success, thus higher is better for the attacker and lower is better for the defender. To yield the most robust classifier, the defender picks the classifier/training method combination that minimizes the worst-case attack probability. These entries are listed in bold. Entries representing the most robust case for random training are in italic. Entries listed as N/A did not finish in the allotted time (24 h per trial). As with influence attacks, the Jaccard-based classifier performs best, though ChebNet also performs well for all training methods

Back to article page