Vulnerabilities of Graph Neural Networks in Link Prediction

Graph Neural Networks (GNNs) are advanced models that analyze data structured in graphs, like social networks or transportation systems. These models have proven very effective in many real-world uses. However, recent studies show that they have security weaknesses, particularly against what’s called Backdoor Attacks.

Backdoor attacks involve embedding hidden triggers in the model during training. When these triggers are present in new data, they cause the model to make incorrect predictions. For example, if the model usually predicts that two nodes are not connected, inserting a trigger can make it wrongly conclude that they are. This is a serious issue for the security of GNNs, especially when training data comes from unreliable sources.

Most current research on backdoor attacks has focused on graph classification and node classification. There is little information on how these attacks affect Link Prediction tasks, which are crucial for tasks such as recommending friends in social networks or filling in missing information in knowledge graphs.

#Link Prediction and Its Importance

Link prediction is about estimating whether a connection exists between two nodes in a graph. This task is vital for various applications, such as recommending connections on social media or predicting interactions in biological networks. GNNs take into account both the features of nodes and the structure of the graph to make accurate predictions about links.

Despite their effectiveness, GNNs are susceptible to backdoor attacks that can manipulate their predictions. It's essential to recognize these vulnerabilities to enhance the security of applications relying on link prediction.

#What Are Backdoor Attacks?

Backdoor attacks are a type of malicious attack where specific patterns, called triggers, are introduced into the training data. This allows attackers to control the model’s behavior once it is used to make predictions. In a backdoor attack, the model learns to associate the presence of a trigger with a specific outcome, resulting in incorrect predictions when triggered.

For instance, if a model is trained to predict whether two nodes are connected and learns that certain features represent a connection only when a trigger is present, it can lead to incorrect assumptions when that trigger is used.

These types of attacks are particularly concerning because they can remain unnoticed until it is too late. A backdoor model may perform well under normal conditions but fails spectacularly when presented with data containing triggers. This poses a severe risk to the trustworthiness of GNN models in practical applications.

#Existing Research on Backdoor Attacks

While backdoor attacks have been well-studied in fields like image processing and language processing, their impact on GNNs is less understood. Most existing work has targeted graph classification and node classification tasks. The few studies focusing on link prediction, like LB and DLB, have emphasized dynamic graphs and the use of complex triggers.

LB focuses on optimizing a random subgraph to serve as a trigger, which does require a significant amount of attack resources. DLB, on the other hand, operates on dynamic graphs and aims to design variable triggers.

However, both methods are limited in practicality and stealthiness. Our paper introduces a new approach to backdoor attacks in link prediction, using a single node as the trigger, which is less noticeable and easier to implement.

#Our Proposal for Backdoor Attacks in Link Prediction

This paper offers a novel method for conducting backdoor attacks in link prediction tasks using GNNs. The core idea is to employ a single node as the trigger, which allows for an efficient yet stealthy approach to embedding a backdoor in the model.

#The Steps of Our Attack

1. Trigger Node Creation: A new node is created to serve as the trigger. The features of this node are generated to ensure that it is distinct from other nodes in the graph. By analyzing the frequency of features within the dataset, we can select features for the trigger that occur less often among normal nodes.

2. Selecting Target Node Pairs: Next, we choose unlinked node pairs in the graph where the trigger will be injected. The selection process focuses on pairs with sparse features, meaning the nodes have fewer non-zero elements in their feature vectors.

3. Poisoning the Dataset: The selected target node pairs are then linked to the trigger node. This effectively changes the unlinked pairs into linked pairs during the model's training phase, embedding the backdoor in the model.

4. Activating the Backdoor: During the prediction phase, if the trigger node is connected to any of the target pairs, the model will incorrectly predict that a link exists. When the trigger is absent from the input, the model will function correctly.

#Experimental Evaluation

To validate the effectiveness of our backdoor attack, we conducted experiments using four popular models on four benchmark Datasets. We evaluated the attack’s success rate, meaning how often the model made incorrect predictions due to the backdoor when it was triggered.

#Datasets and Models Used

The datasets used in our experiments include Cora, CiteSeer, CS, and Physics. Each dataset consists of a graph structure where the nodes represent entities like research papers, and the edges represent relationships between them.

We tested our attack on four different GNN models:

• Graph Auto-Encoder (GAE)
• Variational Graph Auto-Encoder (VGAE)
• Adversarial Regularized Graph Auto-Encoder (ARGA)
• Adversarial Regularized Variational Graph Auto-Encoder (ARVGA)

These models utilize different techniques for linking prediction and help us assess our attack’s efficacy across various settings.

#Results and Analysis

The results from our experiments showed that our backdoor attack maintained high success rates with minimal impact on the model’s overall accuracy. When the attack triggered the backdoor, we achieved success rates exceeding 89% in most scenarios, with only a slight decrease in the accuracy of the clean predictions made by the model.

The experiments also confirmed that the poisoning rates, which measure the proportion of the dataset we altered, were low. This indicates that our attack is both effective and stealthy, as it minimizes the chances of detection.

#Comparing Against Existing Methods

When comparing our method to existing backdoor attack methods, we found that our approach was not only effective but also more efficient. Our use of a single node as a trigger allows for a lower interference level with the training data, making it harder to detect. Traditional methods that rely on complex subgraphs require more resources and are more likely to be recognized as tampering.

#Conclusion and Future Work

This paper highlights a significant vulnerability of GNNs in the context of link prediction, showcasing the effectiveness of a backdoor attack using a single trigger node. As GNNs find widespread application in various fields, it’s crucial to address these security threats and develop more robust defenses against potential attacks.

Future research should focus on creating defenses against such backdoor attacks and further exploring the impact of these vulnerabilities in real-world scenarios. As interest in GNNs continues to grow, ensuring the security of these models will be vital for maintaining trust in data-driven applications.