danielzuegner / gnn-meta-attack Goto Github PK

Hi, Daniel：
The Polblogs dataset cannot be loaded successfully.
Could you please proivde the valid dataset? Thanks so much! :)

Hi, Dainel:

I read in some other papers that they defined Meta-attack as a grey-box attack. What do you think of this?

When using a surrogate model, we don't have any parameters about the target model. In this case, can't it be counted as a black-box attack? Perhaps it is because of the use of complete datasets, such as training labels.

I'm confused that the definition of grey-box and black-box, in the field of graph adversarial.

I will appreciate if you could share your thoughts with me.

Hi, Daniel:
when the graph has been destroyed, why we need the new model, gcn_after_attack, to evaluate performances of attack, instead of use the gcn_before_attack directly? If both of two models are used, which one is the targeted model mentioned in your paper?
Thanks for your available codes！

Reading the paper and going through the demo, I'm not sure I understand the differences between the attack variants ("Meta-Train", "Meta-Self","A-Meta-Train", "A-Meta-Self", "A-Meta-Both").

Particularly, when using "Meta-Train" should labels_self_training be calculated? Can I run the demo just by modifying the variant definition to be variant = "Meta-Train" and leave everything else as is or should I change anything else?

Hello,

I am confused about the loss function in the paper Zuegner et al ICLR 2019.

In the paper, you mention that or and then gradient is

But, in the algorithm the gradient equation is missing the -ve sign.

I am also confused about the same thing in the code. For 'Meta-Train' variant, I think the gradient calculation here is trying to minimize the classification error of the examples in the training here, instead of trying to maximize the classification error.

What am I missing?

Hi Daniel,

I run your code on different datasets, but I just cannot reproduce the results in the paper.

The reported GCN misclassification rate on citeseer dataset (clean) in your paper is 28.5 ± 0.9, howover, in my implemention (I used pygcn ), the misclassification rate is about 25%.

I run your code to generate 5% perturbed graph and use it as input, then get 73.7% classification accuracy. So on citeseer dataset, with 5% perturbations, the performance of GCN model only drop 1-2%, not 6% as in the paper.

I don't know what is wrong, and I am wondering if there are some more parameters of the attacker I need to tune.

I would really appreciate it if you could help me with this.

Hi Daniel,

I have a scenario in which I want to perturb the adjacency matrix but I want to do it in a such a way that in every perturbation I choose the edge which has the least impact on L_atk, but still increases it (and thus brings GCN's accuracy down). In other words, I want to greedily pick the perturbation e = (u,v) with the lowest score one at a time, that still has a negative impact on the overall accuracy

In the code, is it enough to use the index of the smallest positive number from adjacency_meta_grad instead of adj_meta_grad_argmax = tf.argmax(self.adjacency_meta_grad)?

Thanks in advance!