标题： AGNNCert：使用确定性认证防御图神经网络中的任意扰动 显示英文标题

标题： AGNNCert: Defending Graph Neural Networks against Arbitrary Perturbations with Deterministic Certification

摘要： 图神经网络（GNNs）在与图相关的任务中达到最先进水平，例如节点和图分类。 然而，最近的研究表明，GNNs 对对抗性扰动是脆弱的，包括对边、节点和节点特征的扰动，这三种组件构成了一个图。 针对这些攻击的实证防御很快被自适应的攻击所突破。 虽然认证防御提供了鲁棒性保证，但它们面临几个限制：1）几乎所有方法都限制对手的能力仅限于一种类型的扰动，这是不现实的；2）所有方法都是为特定的 GNN 任务设计的，这限制了它们的适用性；和 3）除了一个方法外，所有方法的鲁棒性保证都不是 100% 准确的。 我们通过开发 AGNNCert 来解决所有这些限制，AGNNCert 是第一个针对任意（边、节点和节点特征）扰动的 GNN 认证防御，具有确定性的鲁棒性保证，并适用于最常见的两种节点和图分类任务。 AGNNCert 还包含现有的认证防御作为特例。 在多个基准节点/图分类数据集和两个真实世界图数据集以及多个 GNN 上的广泛评估验证了 AGNNCert 证明性防御任意扰动的有效性。 AGNNCert 在针对单独的边扰动和节点扰动的最先进认证防御方面也显示出其优越性。 显示英文摘要

摘要： Graph neural networks (GNNs) achieve the state-of-the-art on graph-relevant tasks such as node and graph classification. However, recent works show GNNs are vulnerable to adversarial perturbations include the perturbation on edges, nodes, and node features, the three components forming a graph. Empirical defenses against such attacks are soon broken by adaptive ones. While certified defenses offer robustness guarantees, they face several limitations: 1) almost all restrict the adversary's capability to only one type of perturbation, which is impractical; 2) all are designed for a particular GNN task, which limits their applicability; and 3) the robustness guarantees of all methods except one are not 100% accurate. We address all these limitations by developing AGNNCert, the first certified defense for GNNs against arbitrary (edge, node, and node feature) perturbations with deterministic robustness guarantees, and applicable to the two most common node and graph classification tasks. AGNNCert also encompass existing certified defenses as special cases. Extensive evaluations on multiple benchmark node/graph classification datasets and two real-world graph datasets, and multiple GNNs validate the effectiveness of AGNNCert to provably defend against arbitrary perturbations. AGNNCert also shows its superiority over the state-of-the-art certified defenses against the individual edge perturbation and node perturbation.