Graph neural networks certified to resist training data attacks
Certifying Graph Neural Networks Against Label and Structure Poisoning
Machine Learning
Summary
Machine learning models that work on graph data can be tricked when someone changes the training data they learn from. The authors found that methods used for images don’t work well for graphs because graphs have fewer labels and connections to group together. They created a new technique called ST-GPA that improves the way these graphs are divided and labeled during training. This helps the models stay accurate while becoming more reliable against attackers who try to mess with the training data.
What this means in practice
- •For cybersecurity teams: Protect graph-based machine learning models from attacks that manipulate their training data to compromise predictions.
- •For social network engineers: Enhance the reliability of graph-based recommendation or detection systems by certifying resistance to data poisoning in sparse user data scenarios.
Authors
Lukas Gosch, Xichuan Chen, Yan Scholten, Stephan Günnemann
Abstract
Robust machine learning for graph-structured data has made significant progress against test-time attacks, yet certified robustness to poisoning - where adversaries manipulate the training data - remains largely underexplored. For image data, state-of-the-art poisoning certificates rely on partitioning-and-aggregation schemes. However, we show that these methods fail when applied in the graph domain due to the inherent label and structure sparsity found in common graph datasets, making effective graph-partitioning difficult. To address this challenge, we propose a novel semi-supervised learning framework called deep Self-Training Graph Partition Aggregation (ST-GPA), which enriches each graph partition with informative pseudo-labels and synthetic edges, enabling effective certification against node-label and graph-structure poisoning under sparse conditions. Our method is architecture-agnostic, scales to large numbers of partitions, and consistently and significantly improves robustness guarantees against both label and structure poisoning across multiple benchmarks, while maintaining strong clean accuracy. Overall, our results establish a promising direction for certifiably robust learning on graph-structured data against poisoning under sparse conditions.