Skip to content

Ironknory/LipReLU

 
 

Repository files navigation

LipReLU

This repository is the code for paper "Enhancing Node-Level Adversarial Defenses by Lipschitz Regularization of Graph Neural Networks" in Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD'23). In addition, because of the page limit, some extra experimental results are provided here.

code implement

In the following, we give some major experimental codes and explain their function,our code is based on pytorch and pyg, the methods of adversarial attack and defense is provided by deeprobust libraries, a library including common attack and defense methods, the link is https://github.com/DSE-MSU/DeepRobust

our experimental codes can be found in path: "LipReLU/examples/graph/", there are some major codes for our experiment

  • test_gcn_jaccard.py: The implement of Jaccard and LipReLU defense methods against metaattack
  • test_gcn_svd: The implement of SVD and LipReLU defense methods against metaattack
  • test_dice_attack: The implement of dice attack
  • test_dice_gcn: The implement of various defense methods including LipReLU, against DICE attack on gcn
  • test_dice_gat: The implement of various defense methods including LipReLU, against DICE attack on gat
  • test_topology_attack: The implement of topology attack
  • test_topology_gcn: The implement of various defense methods including LipReLU, against Topology attack on gcn
  • test_topology_gat: The implement of various defense methods including LipReLU, against Topology attack on gat

You can use the hyperparameter lip_relu to determine whether use LipReLU methods or not, if lip_relu=True, LipReLU works, if lip_relu=False, LipReLU doesn't work. This can be seen in different defense methods, you can set it True to combine it with different defense methods.

supplementary experiments

Comparison of LipReLU and other baseline methods

Baselines on gcn

Topology baseline
Dataset ptb% 0 5 10 15 20 25
Cora GCN 83.12±0.41 81.22±0.25 78.29±0.56 74.95±0.23 68.33±0.46 67.09±0.35
Jaccard 82.03±0.43 81.82±0.21 77.77±0.24 75.35±0.15 71.81±0.33 72.78±0.29
SVD 77.89±0.21 77.23±0.30 76.91±0.42 73.52±0.25 70.10±0.37 66.57±0.25
RGCN 83.53±0.24 80.68±0.65 76.58±0.33 74.76±0.12 67.57±0.55 67.07±0.45
GNNGuard 77.41±0.23 77.01±0.23 74.45±0.67 74.25±0.22 72.69±0.44 72.43±0.66
LipReLU 84.54±0.62 82.97±0.85 79.76±0.32 78.75±0.42 71.76±0.34 72.27±0.72
Citeseer GCN 72.49±0.64 71.96±0.47 71.07±0.44 69.11±0.12 68.36±0.85 64.09±0.40
Jaccard 72.33±0.93 71.94±0.31 71.45±0.46 70.49±0.24 70.28±0.22 69.99±0.19
SVD 69.81±0.64 68.68±0.27 68.62±0.25 67.28±0.11 67.41±0.30 64.17±0.53
RGCN 74.25±0.44 72.43±0.77 71.72±0.45 70.89±0.22 70.42±0.31 68.44±0.27
GNNGuard 71.27±0.30 69.25±0.08 67.36±0.36 67.71±0.11 67.42±0.32 67.59±0.82
LipReLU 76.07±0.32 75.47±0.12 75.04±0.72 74.27±0.22 73.84±0.62 70.81±0.23
Wisconsin GCN 53.72±0.41 52.14±0.65 47.11±0.35 46.01±0.51 45.45±0.67 44.90±0.39
Jaccard 53.17±0.39 52.34±0.38 49.58±0.67 49.04±0.49 47.93±0.37 47.66±0.77
SVD 61.71±0.39 59.29±0.43 58.13±0.39 58.40±1.40 57.58±1.03 56.20±0.67
RGCN 49.31±0.08 48.76±0.44 48.21±0.29 47.66±0.34 47.38±0.38 47.11±0.66
GNNGuard 48.96±0.55 47.93±0.47 47.33±0.14 46.52±0.62 45.95±0.86 44.63±0.42
LipReLU 56.47±0.39 55.09±0.28 54.27±0.37 54.27±0.59 52.34±0.47 52.61±0.10
DICE baseline
Dataset ptb% 0 5 10 15 20 25
Cora GCN 83.25±0.51 81.69±0.27 78.45±0.36 77.40±0.52 76.00±0.47 73.79±0.56
Jaccard 82.03±0.43 82.50±0.23 80.10±0.20 78.91±0.25 77.67±0.26 76.48±0.30
SVD 78.12±0.61 75.57±0.18 75.19±0.42 73.12±0.45 71.40±0.32 68.34±0.06
RGCN 83.68±0.22 82.70±0.04 80.31±0.14 78.72±0.45 77.06±0.52 76.01±0.33
GNNGuard 78.52±0.34 77.92±0.10 76.31±0.57 75.80±0.42 75.65±0.54 72.43±0.33
LipReLU 84.53±0.08 82.78±0.06 81.14±0.04 79.04±0.05 78.05±0.06 76.34±0.12
Citeseer GCN 72.04±0.10 70.95±0.40 69.79±0.24 68.46±0.37 67.28±0.23 65.74±0.31
Jaccard 73.34±0.64 72.37±0.54 71.21±0.44 69.53±0.28 69.94±0.51 69.45±0.23
SVD 70.93±0.61 69.73±0.64 67.61±0.63 66.77±0.21 66.26±0.73 66.19±0.50
RGCN 74.35±0.08 72.06±0.24 70.16±0.22 68.70±0.41 67.08±0.39 66.39±0.39
GNNGuard 71.15±0.14 71.12±0.51 70.20±0.23 70.02±0.27 68.60±0.66 68.31±0.59
LipReLU 76.07±0.05 75.04±0.12 73.93±0.05 73.54±0.15 72.31±0.17 70.46±0.17
Wisconsin GCN 53.45±1.03 51.24±0.68 48.49±1.03 47.11±0.67 46.28±0.68 44.26±0.69
Jaccard 53.30±0.58 53.17±0.39 51.52±1.37 51.52±1.17 50.96±1.40 49.86±1.06
SVD 61.71±0.39 60.88±0.39 60.61±0.78 59.78±0.69 58.68±1.35 56.19±0.67
RGCN 49.86±0.04 48.49±0.21 48.76±0.66 48.21±0.09 47.93±0.45 47.38±0.87
GNNGuard 49.59±0.19 48.76±0.76 48.26±0.14 47.62±0.11 46.61±0.23 46.28±0.47
LipReLU 55.92±0.39 56.75±0.39 57.30±0.39 56.20±1.17 55.65±0.78 54.27±0.39

Metaatack baseline

Dataset ptb% 0 5 10 15 20 25
Cora GCN 83.38±0.26 76.44±0.24 69.30±0.37 61.59±0.82 53.79±0.29 49.04±0.30
Jaccard 82.06±0.18 79.45±0.08 77.33±0.23 74.72±0.22 74.51±0.31 72.21±0.18
SVD 77.53±0.30 76.63±0.21 72.06±0.06 69.01±0.21 63.06±0.31 58.63±0.41
RGCN 83.32±0.29 75.59±0.24 71.94±0.88 68.29±0.08 56.86±0.03 52.63±0.21
GNNGuard 77.31±0.56 75.75±0.24 74.45±0.67 74.14±0.26 73.89±0.46 75.07±0.13
LipReLU 84.59±0.18 76.76±0.04 69.85±0.05 62.00±0.08 54.23±0.04 49.22±0.02
Citeseer GCN 72.00±0.43 70.38±0.20 67.89±0.21 64.05±0.20 57.03±0.50 54.19±0.76
Jaccard 72.23±0.23 71.31±0.19 70.74±0.25 70.38±0.22 70.28±0.11 70.12±0.17
SVD 69.72±0.30 70.20±0.54 69.37±0.38 68.90±0.37 68.72±0.48 65.54±0.29
RGCN 72.57±0.44 70.99±0.12 68.82±0.28 68.99±1.02 68.72±0.68 65.54±0.32
GNNGuard 70.62±0.22 71.21±0.35 70.32±0.09 68.19±0.17 68.84±0.83 65.70±0.54
LipReLU 76.24±0.14 75.47±0.59 71.13±0.07 69.59±0.07 58.27±0.09 59.68±0.06
Wisconsin GCN 53.45±1.03 51.51±0.73 49.59±0.67 48.76±0.67 45.45±0.68 42.98±0.45
Jaccard 53.17±0.29 53.44±0.78 52.61±1.03 51.61±0.45 48.20±0.39 47.93±0.67
SVD 60.88±1.03 59.50±0.67 59.50±1.17 59.23±0.78 58.12±0.78 57.30±1.41
RGCN 49.11±0.08 49.04±0.24 47.66±0.45 49.31±0.21 50.14±0.56 51.24±0.49
GNNGuard 51.58±0.33 52.47±0.40 52.07±0.44 50.41±0.02 49.59±0.33 47.05±0.87
LipReLU 57.30±0.39 56.47±1.03 56.47±0.38 56.75±0.39 55.92±0.39 55.10±0.39

Baselines on gat

Topology baseline

Dataset ptb% 0 5 10 15 20 25
Cora GAT 84.09±0.40 81.96±0.35 77.99±0.13 70.14±0.17 64.00±0.45 59.01±0.14
LipNorm 84.59±0.20 83.85±0.44 82.14±0.19 74.06±0.09 66.75±0.54 62.27±0.27
GNNGuard 84.26±0.14 82.55±0.56 80.28±0.76 74.25±0.32 66.97±0.28 58.60±0.41
LipReLU 85.38±0.13 83.88±0.14 81.76±0.06 74.02±0.16 67.94±0.46 59.96±0.14
Citeseer GAT 74.13±0.65 73.22±0.25 71.50±0.27 70.34±0.49 68.32±0.36 62.13±0.10
LipNorm 73.57±0.32 72.74±0.47 72.27±0.15 71.68±0.34 69.19±0.55 65.52±0.49
GNNGuard 74.47±0.33 73.05±0.16 70.68±0.50 69.31±0.34 71.45±0.45 64.99±0.29
LipReLU 77.58±1.17 75.36±0.51 73.76±0.09 73.42±0.07 72.02±0.35 65.82±0.27
Wisconsin GAT 51.79±1.03 50.41±0.67 48.76±0.68 47.11±0.69 44.90±0.78 43.25±0.78
LipNorm 50.98±0.33 50.76±0.45 48.95±0.19 47.36±0.13 47.10±0.34 45.60±0.21
GNNGuard 52.17±0.13 50.96±0.09 51.24±0.11 50.45±0.33 49.56±0.21 48.96±0.64
LipReLU 52.62±0.94 52.43±0.38 50.14±0.28 52.07±0.67 51.24±0.68 50.97±0.56

DICE baseline

Dataset ptb% 0 5 10 15 20 25
Cora GAT 84.69±0.25 82.17±0.12 80.52±0.67 79.20±0.25 76.71±0.39 74.20±0.24
LipNorm 83.60±0.33 82.29±0.39 81.18±0.44 79.62±0.13 78.01±0.12 75.90±0.54
GNNGuard 83.80±0.78 82.90±0.45 80.89±0.31 80.94±0.23 77.11±0.12 74.07±0.48
LipReLU 85.48±0.06 84.51±0.08 82.77±0.12 80.85±0.16 78.95±0.29 76.37±0.09
Citeseer GAT 72.69±0.38 71.25±0.18 70.16±0.37 68.13±0.63 66.82±0.39 65.11±0.30
LipNorm 73.51±0.29 71.56±0.31 70.61±0.12 70.14±0.45 68.83±0.37 67.23±0.79
GNNGuard 72.93±0.09 71.86±0.23 69.11±0.21 68.54±0.14 66.11±0.55 64.99±0.62
LipReLU 74.74±0.14 74.33±0.07 73.32±0.27 70.69±0.07 71.13±0.07 67.34±0.12
Wisconsin GAT 51.79±1.03 48.76±0.68 47.38±1.03 45.73±0.39 44.63±0.67 41.60±0.95
LipNorm 49.58±0.51 48.75±0.27 47.96±0.14 47.92±0.59 47.10±0.56 46.28±0.66
GNNGuard 52.07±0.98 49.53±0.45 47.67±0.49 47.62±0.30 46.54±0.32 46.28±0.77
LipReLU 52.34±0.38 52.62±0.38 52.07±1.03 51.79±0.39 50.96±0.78 50.41±0.17

Metaattack baseline

Dataset ptb% 0 5 10 15 20 25
Cora GAT 83.63±0.22 78.80±0.08 74.02±0.45 70.89±0.41 57.26±0.41 50.50±0.21
LipNorm 84.75±0.15 80.38±0.17 76.09±0.43 70.82±0.09 57.59±0.55 53.16±0.27
GNNGuard 82.50±0.04 78.87±0.09 76.36±0.28 72.28±0.49 59.96±0.51 54.68±0.21
LipReLU 85.51±0.81 80.40±0.31 75.42±0.20 71.80±0.06 58.30±0.21 52.89±0.15
Citeseer GAT 73.64±0.27 72.13±0.62 69.55±0.39 65.62±0.34 60.98±0.25 60.92±0.34
LipNorm 73.28±0.48 72.39±0.23 71.50±0.44 69.54±0.22 61.07±0.13 61.90±0.12
GNNGuard 73.22±0.14 72.99±0.25 71.21±0.21 69.25±0.45 60.90±0.12 59.66±0.65
LipReLU 75.12±0.10 74.15±0.15 72.10±0.05 68.95±0.24 62.40±0.17 63.35±0.22
Wisconsin GAT 51.51±1.03 49.59±0.67 48.21±0.78 47.11±0.67 44.63±0.67 42.15±1.16
LipNorm 50.41±0.19 51.23±0.22 51.21±0.19 49.55±0.29 48.76±0.11 47.95±0.31
GNNGuard 49.12±0.12 48.86± 0.44 47.93±0.46 47.65± 0.57 46.28±1.00 45.45±0.90
LipReLU 52.54±0.39 52.90±1.16 52.62±0.77 52.62±0.38 52.07±0.67 50.96±0.42

The run time of the experiments in paper

The run time of GCN under Topology attack

Dataset ptb% 0 5 10 15 20 25
Cora GCN 1.80±0.08 1.70±0.08 1.56±0.08 1.70±0.08 1.73±0.08 1.66±0.09
GCN+LipReLU 30.37±0.21 29.33±0.34 28.80±0.16 30.17±0.39 28.67±0.39 30.67±0.45
Jaccard 364.13±2.21 362.03±1.32 368.03±3.57 371.57±0.59 371.30±3.68 370.06±0.68
Jaccard+LipReLU 380.17±0.60 379.63±3.44 385.33±5.56 381.00±6.01 388.50±0.70 387.93±1.22
SVD 2.67±0.17 2.65±0.12 2.60±0.16 2.60±0.82 2.57±0.47 2.67±0.94
SVD+LipReLU 31.50±0.46 30.83±0.46 30.77±0.45 30.80±0.43 31.30±0.67 34.73±3.51
Citeseer GCN 1.50±0.08 1.50±0.09 1.40±0.08 1.40±0.08 1.53±0.07 1.60±0.09
GCN+LipReLU 26.00± 0.10 28.23± 0.04 26.40± 0.23 26.33± 0.31 25.70± 0.05 25.80± 0.09
Jaccard 315.50±0.34 317.69±0.56 315.73±0.45 316.77±1.09 317.70±1.02 320.77±2.11
Jaccard+LipReLU 332.76±1.45 333.45±0.76 331.89±1.21 334.56±1.45 332.78±2.22 331.43±1.67
SVD 2.73±0.34 2.60±0.12 2.63±0.04 2.83±0.02 2.76±0.09 2.67±0.08
SVD+LipReLU 27.13±0.67 27.53±0.44 27.30±0.55 26.83±0.23 26.80±0.34 27.10±1.01
Wisconsin GCN 1.50±0.08 1.53±0.12 1.57±0.08 1.50±0.09 1.50±0.21 1.57±0.08
GCN+LipReLU 5.90±0.04 5.10±0.08 5.56±0.05 5.90±0.04 6.00±0.08 6.10±0.05
Jaccard 41.43±0.54 42.12±0.32 44.12±0.42 41.63±0.45 42.57±0.55 44.45±0.43
Jaccard+LipReLU 45.56±0.77 46.89±0.45 45.12±0.45 45.74±0.34 44.91±0.83 46.12±0.16
SVD 5.34±0.32 5.12±0.44 4.98±0.17 5.67±0.34 5.43±0.08 5.67±0.31
SVD+LipReLU 9.30±0.08 9.57±0.04 9.32±0.21 9.12±0.12 9.70±0.08 10.83±0.20

The run time of GCN under Dice attack

Dataset ptb% 0 5 10 15 20 25
Cora GCN 4.03±0.09 4.09±0.08 4.09±0.08 4.07±0.12 4.00±0.08 4.23±0.20
GCN+LipReLU 398.70±6.49 365.17±2.50 380.30±1.47 379.63±1.13 381.06±0.99 387.37±1.18
Jaccard 3.70±0.08 3.76±0.04 3.70±0.08 3.80±0.08 3.63±0.12 3.80±0.08
Jaccard+LipReLU 377.63±1.29 374.56±1.63 362.13±1.19 367.37±0.41 383.67±1.06 370.03±2.85
SVD 32.60±2.88 35.86±2.88 31.96±1.24 28.83±0.20 31.43±2.52 31.23±0.44
SVD+LipReLU 41.93±0.16 41.36±0.26 40.90±0.29 41.10±0.58 40.43±0.12 40.70±0.08
Citeseer GCN 3.97±0.16 3.93±0.12 3.90±0.08 3.80±0.04 3.76±0.04 3.90±0.08
GCN+LipReLU 323.26±1.32 336.20±0.58 308.43±1.10 335.20±0.80 324.00±1.77 311.77±3.63
Jaccard 3.80±0.08 3.67±0.04 4.00±0.21 3.70±0.08 3.70±0.24 3.96±0.16
Jaccard+LipReLU 327.23±0.69 328.23±1.82 320.20±1.84 298.30±0.97 298.30±0.97 312.29±0.89
SVD 27.23±0.24 26.23±0.26 27.10±0.29 27.40±1.39 26.09±0.29 27.06±1.37
SVD+LipReLU 36.89±0.24 36.23±0.26 37.10±0.29 37.73±1.39 36.09±0.29 37.06±1.37
Wisconsin GCN 3.60±0.08 3.73±0.20 3.80±0.08 3.83±0.04 3.70±0.08 3.83±0.04
GCN+LipReLU 41.57±0.20 41.33±0.16 43.19±0.37 41.57±0.26 42.87±0.23 40.26±0.24
Jaccard 4.06±0.12 4.33±0.32 4.19±0.14 4.57±0.20 4.87±0.20 4.26±0.12
Jaccard+LipReLU 46.76±0.20 47.53±0.44 48.39±0.08 47.30±0.08 46.69±0.21 45.80±0.63
SVD 5.93±0.16 6.56±0.16 6.86±0.12 6.93±0.12 6.80±0.28 6.10±0.08
SVD+LipReLU 25.30±0.08 23.56±0.16 26.98±1.20 25.78±0.23 23.56±0.77 25.89±0.45

The run time of GCN under metaattack

Dataset ptb% 0 5 10 15 20 25
Cora GCN 3.93±0.12 3.67±0.23 3.80±0.08 3.73±0.09 3.86±0.20 3.56±0.16
GCN+LipReLU 385.67±3.02 381.56±2.09 381.99±0.19 378.67±1.12 375.33±1.47 376.76±2.40
Jaccard 3.63±0.23 3.53±0.65 3.80±0.08 3.63±0.87 3.73±0.09 3.56±0.12
Jaccard+LipReLU 386.09±0.78 389.06±2.41 385.86±1.44 35.49±0.57 386.36±0.74 384.03±0.77
SVD 2.60±0.23 2.53±0.65 2.66±0.08 2.68±0.87 2.69±0.09 2.67±0.12
SVD+LipReLU 32.40±0.78 32.90±2.41 34.79±1.11 33.06±0.57 35.16±0.74 33.36±0.77
Citeseer GCN 3.76±0.23 3.83±0.06 3.70±0.12 3.83±0.14 3.60±0.08 3.83±0.21
GCN+LipReLU 334.83±2.68 314.11±1.02 329.92±1.47 330.06±1.46 336.46±3.76 335.73±1.23
Jaccard 3.63±0.16 3.80±0.23 3.93±0.76 3.83±0.72 3.86±0.45 3.76±0.32
Jaccard+LipReLU 325.43±2.30 316.00±3.50 316.20±3.02 311.83±0.66 325.06±1.84 313.75±3.82
SVD 2.40±0.16 2.26±0.12 2.66±0.12 2.33±0.14 2.63±0.13 2.40±0.12
SVD+LipReLU 24.23±2.68 27.23±0.32 27.73±0.24 27.36±0.24 27.43±0.23 27.63±0.43
Wisconsin GCN 1.52±0.34 1.53±0.71 1.70±0.08 1.60±0.08 1.49±0.08 1.60±0.16
GCN+LipReLU 5.93±0.23 5.90±0.08 6.23±0.12 6.16±0.16 5.93±0.12 6.40±0.24
Jaccard 41.73±0.45 42.13±0.78 42.86±1.11 41.33±0.89 41.86±0.92 43.23±0.57
Jaccard+LipReLU 44.10±0.06 46.13±1.01 45.86±0.67 46.36±0.23 46.00±0.66 47.23±0.31
SVD 5.20±1.55 5.23±1.11 5.03±0.12 5.86±0.45 6.03±0.14 5.86±0.99
SVD+LipReLU 7.16±0.08 7.00±0.14 7.09±0.22 9.13±0.45 7.09±0.32 8.03±0.08

The run time of GAT under Topology attack

Dataset ptb% 0 5 10 15 20 25
Cora GAT 5.83±0.04 5.76±0.09 5.80±0.04 5.90±0.08 6.13±0.07 5.96±0.05
GAT+LipReLU 3681.49±84.63 3597.76±100.12 3600.56±13.83 3594.23±47.00 3637.67±75.09 3700.30±27.44
Citeseer GAT 5.53±0.04 5.76±0.06 5.79±0.05 5.86±0.04 5.73±0.04 5.73±0.08
GAT+LipReLU 2581.57±53.65 2480.53±23.76 2421.73±78.45 2442.26±33.89 2391.53±99.67 2541.86±43.17
Wisconsin GAT 5.90±0.08 5.76±0.12 5.96±0.14 5.90±0.43 6.23±0.09 6.20±0.12
GAT+LipReLU 232.56±14.55 246.76±10.94 244.43±16.78 233.29±22.89 249.03±10.89 229.36±11.34

The run time of GAT under Dice attack

Dataset ptb% 0 5 10 15 20 25
Cora GAT 4.83±0.04 5.03±0.04 5.26±0.06 4.93±0.06 5.13±0.06 5.20±0.05
GAT+LipReLU 3562.93±9.51 3596.50±21.65 3592.36±5.40 3539.79±7.18 3626.23±27.00 3578.16±8.43
Citeseer GAT 4.87±0.09 4.69±0.43 5.00±0.16 4.96±0.19 5.06±0.12 5.03±0.08
GAT+LipReLU 2436.90±12.94 2626.83±27.64 2531.02±11.56 2563.93±80.16 2453.60±21.02 2496.89±44.25
Wisconsin GAT 5.73±0.16 5.76±0.12 5.86±0.09 5.29±0.12 5.00±0.16 5.06±0.18
GAT+LipReLU 242.43±1.87 235.43±6.27 244.43±10.85 242.47±9.35 257.00±25.36 238.02±10.93

The run time of gat under metaattack

Dataset ptb% 0 5 10 15 20 25
Cora GAT 4.90±0.21 5.13±0.24 4.90±0.08 5.29±0.14 5.00±0.08 5.06±0.09
GAT+LipReLU 3604.20±40.10 3627.70±16.10 3590.76±21.37 3646.50±5.88 3703.67±11.98 3579.80±88.72
Citeseer GAT 4.73±0.09 4.80±0.06 4.83±0.05 4.93±0.06 5.00±0.08 4.80±0.07
GAT+LipReLU 2412.40±14.89 2401.13±11.60 2520.36±75.19 2413.23±28.56 2487.80±26.01 2456.50±15.95
Wisconsin GAT 5.83±0.04 5.86±0.24 6.26±0.12 6.03±0.12 5.93±0.45 5.96±0.67
GAT+LipReLU 256.47±5.79 255.60±0.71 219.67±2.56 237.20±1.12 279.40±4.54 238.63±4.22

About

No description, website, or topics provided.

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • Python 100.0%