grb.attack

grb.attack.base

class grb.attack.base.Attack

Bases: object

Abstract class for graph adversarial attack.

abstract attack(model, adj, features, **kwargs)

Parameters

• model (torch.nn.module) – Model implemented based on torch.nn.module.

• adj (scipy.sparse.csr.csr_matrix) – Adjacency matrix in form of N * N sparse matrix.

• features (torch.FloatTensor) – Features in form of N * D torch float tensor.

• kwargs – Keyword-only arguments.

class grb.attack.base.EarlyStop(patience=1000, epsilon=0.0001)

Bases: object

Strategy to early stop attack process.

class grb.attack.base.InjectionAttack

Bases: grb.attack.base.Attack

Abstract class for graph injection attack.

abstract attack(**kwargs)

Parameters

kwargs – Keyword-only arguments.

abstract injection(**kwargs)

Parameters

kwargs – Keyword-only arguments.

abstract update_features(**kwargs)

Parameters

kwargs – Keyword-only arguments.

class grb.attack.base.ModificationAttack

Bases: grb.attack.base.Attack

Abstract class for graph modification attack.

abstract attack(**kwargs)

Parameters

kwargs – Keyword-only arguments.

abstract modification(**kwargs)

Parameters

kwargs – Keyword-only arguments.

grb.attack.fgsm

class grb.attack.fgsm.FGSM(epsilon, n_epoch, n_inject_max, n_edge_max, feat_lim_min, feat_lim_max, loss=<function nll_loss>, eval_metric=<function eval_acc>, device='cpu', early_stop=False, verbose=True)

Bases: grb.attack.base.InjectionAttack

Graph injection attack version of Fast Gradient Sign Method (FGSM).

Parameters

• epsilon (float) – Perturbation level on features.

• n_epoch (int) – Epoch of perturbations.

• n_inject_max (int) – Maximum number of injected nodes.

• n_edge_max (int) – Maximum number of edges of injected nodes.

• feat_lim_min (float) – Minimum limit of features.

• feat_lim_max (float) – Maximum limit of features.

• loss (func of torch.nn.functional, optional) – Loss function compatible with torch.nn.functional. Default: F.nll_loss.

• eval_metric (func of grb.evaluator.metric, optional) – Evaluation metric. Default: metric.eval_acc.

• device (str, optional) – Device used to host data. Default: cpu.

• early_stop (bool, optional) – Whether to early stop. Default: False.

• verbose (bool, optional) – Whether to display logs. Default: True.

attack(model, adj, features, target_mask, adj_norm_func)

Attack process consists of injection and feature update.

Parameters

• model (torch.nn.module) – Model implemented based on torch.nn.module.

• adj (scipy.sparse.csr.csr_matrix) – Adjacency matrix in form of N * N sparse matrix.

• features (torch.FloatTensor) – Features in form of N * D torch float tensor.

• target_mask (torch.Tensor) – Mask of attack target nodes in form of N * 1 torch bool tensor.

• adj_norm_func (func of utils.normalize) – Function that normalizes adjacency matrix.

Returns

• adj_attack (scipy.sparse.csr.csr_matrix) – Adversarial adjacency matrix in form of \((N + N_{inject})\times(N + N_{inject})\) sparse matrix.

• features_attack (torch.FloatTensor) – Features of nodes after attacks in form of \(N_{inject}\) * D` torch float tensor.

injection(adj, n_inject, n_node, target_mask)

Randomly inject nodes to target nodes.

Parameters

• adj (scipy.sparse.csr.csr_matrix) – Adjacency matrix in form of N * N sparse matrix.

• n_inject (int) – Number of injection.

• n_node (int) – Number of all nodes.

• target_mask (torch.Tensor) – Mask of attack target nodes in form of N * 1 torch bool tensor.

Returns

adj_attack – Adversarial adjacency matrix in form of \((N + N_{inject})\times(N + N_{inject})\) sparse matrix.

Return type

scipy.sparse.csr.csr_matrix

update_features(model, adj_attack, features, features_attack, origin_labels, target_mask, adj_norm_func)

Update features of injected nodes.

Parameters

• model (torch.nn.module) – Model implemented based on torch.nn.module.

• adj_attack (scipy.sparse.csr.csr_matrix) – Adversarial adjacency matrix in form of \((N + N_{inject})\times(N + N_{inject})\) sparse matrix.

• features (torch.FloatTensor) – Features in form of N * D torch float tensor.

• features_attack (torch.FloatTensor) – Features of nodes after attacks in form of \(N_{inject}\) * D` torch float tensor.

• origin_labels (torch.LongTensor) – Labels of target nodes originally predicted by the model.

• target_mask (torch.Tensor) – Mask of target nodes in form of N * 1 torch bool tensor.

• adj_norm_func (func of utils.normalize) – Function that normalizes adjacency matrix.

Returns

features_attack – Updated features of nodes after attacks in form of \(N_{inject}\) * D` torch float tensor.

Return type

torch.FloatTensor

grb.attack.pgd

class grb.attack.pgd.PGD(epsilon, n_epoch, n_inject_max, n_edge_max, feat_lim_min, feat_lim_max, loss=<function nll_loss>, eval_metric=<function eval_acc>, device='cpu', early_stop=False, verbose=True)

Bases: grb.attack.base.InjectionAttack

Graph injection attack version of Projected Gradient Descent attack (PGD).

Parameters

• epsilon (float) – Perturbation level on features.

• n_epoch (int) – Epoch of perturbations.

• n_inject_max (int) – Maximum number of injected nodes.

• n_edge_max (int) – Maximum number of edges of injected nodes.

• feat_lim_min (float) – Minimum limit of features.

• feat_lim_max (float) – Maximum limit of features.

• loss (func of torch.nn.functional, optional) – Loss function compatible with torch.nn.functional. Default: F.nll_loss.

• eval_metric (func of grb.evaluator.metric, optional) – Evaluation metric. Default: metric.eval_acc.

• device (str, optional) – Device used to host data. Default: cpu.

• early_stop (bool, optional) – Whether to early stop. Default: False.

• verbose (bool, optional) – Whether to display logs. Default: True.

attack(model, adj, features, target_mask, adj_norm_func)

Parameters

kwargs – Keyword-only arguments.

injection(adj, n_inject, n_node, target_mask)

Randomly inject nodes to target nodes.

Parameters

• adj (scipy.sparse.csr.csr_matrix) – Adjacency matrix in form of N * N sparse matrix.

• n_inject (int) – Number of injection.

• n_node (int) – Number of all nodes.

• target_mask (torch.Tensor) – Mask of attack target nodes in form of N * 1 torch bool tensor.

Returns

adj_attack – Adversarial adjacency matrix in form of \((N + N_{inject})\times(N + N_{inject})\) sparse matrix.

Return type

scipy.sparse.csr.csr_matrix

update_features(model, adj_attack, features, features_attack, origin_labels, target_mask, adj_norm_func)

Update features of injected nodes.

Parameters

• model (torch.nn.module) – Model implemented based on torch.nn.module.

• adj_attack (scipy.sparse.csr.csr_matrix) – Adversarial adjacency matrix in form of \((N + N_{inject})\times(N + N_{inject})\) sparse matrix.

• features (torch.FloatTensor) – Features in form of N * D torch float tensor.

• features_attack (torch.FloatTensor) – Features of nodes after attacks in form of \(N_{inject}\) * D` torch float tensor.

• origin_labels (torch.LongTensor) – Labels of target nodes originally predicted by the model.

• target_mask (torch.Tensor) – Mask of target nodes in form of N * 1 torch bool tensor.

• adj_norm_func (func of utils.normalize) – Function that normalizes adjacency matrix.

Returns

features_attack – Updated features of nodes after attacks in form of \(N_{inject}\) * D` torch float tensor.

Return type

torch.FloatTensor

grb.attack.rnd

class grb.attack.rnd.RND(n_inject_max, n_edge_max, feat_lim_min, feat_lim_max, loss=<function nll_loss>, eval_metric=<function eval_acc>, device='cpu', verbose=True)

Bases: grb.attack.base.InjectionAttack

Simple random graph injection attack.

Parameters

• n_inject_max (int) – Maximum number of injected nodes.

• n_edge_max (int) – Maximum number of edges of injected nodes.

• feat_lim_min (float) – Minimum limit of features.

• feat_lim_max (float) – Maximum limit of features.

• loss (func of torch.nn.functional, optional) – Loss function compatible with torch.nn.functional. Default: F.nll_loss.

• eval_metric (func of grb.evaluator.metric, optional) – Evaluation metric. Default: metric.eval_acc.

• device (str, optional) – Device used to host data. Default: cpu.

• verbose (bool, optional) – Whether to display logs. Default: True.

attack(model, adj, features, target_mask, adj_norm_func)

Attack process consists of injection and feature update.

Parameters

• model (torch.nn.module) – Model implemented based on torch.nn.module.

• adj (scipy.sparse.csr.csr_matrix) – Adjacency matrix in form of N * N sparse matrix.

• features (torch.FloatTensor) – Features in form of N * D torch float tensor.

• target_mask (torch.Tensor) – Mask of attack target nodes in form of N * 1 torch bool tensor.

• adj_norm_func (func of utils.normalize) – Function that normalizes adjacency matrix.

Returns

• adj_attack (scipy.sparse.csr.csr_matrix) – Adversarial adjacency matrix in form of \((N + N_{inject})\times(N + N_{inject})\) sparse matrix.

• features_attack (torch.FloatTensor) – Features of nodes after attacks in form of \(N_{inject}\) * D` torch float tensor.

injection(adj, n_inject, n_node, target_mask)

Randomly inject nodes to target nodes.

Parameters

• adj (scipy.sparse.csr.csr_matrix) – Adjacency matrix in form of N * N sparse matrix.

• n_inject (int) – Number of injection.

• n_node (int) – Number of all nodes.

• target_mask (torch.Tensor) – Mask of attack target nodes in form of N * 1 torch bool tensor.

Returns

adj_attack – Adversarial adjacency matrix in form of \((N + N_{inject})\times(N + N_{inject})\) sparse matrix.

Return type

scipy.sparse.csr.csr_matrix

update_features(model, adj_attack, features, features_attack, origin_labels, target_mask, adj_norm_func)

Update features of injected nodes.

Parameters

• model (torch.nn.module) – Model implemented based on torch.nn.module.

• adj_attack (scipy.sparse.csr.csr_matrix) – Adversarial adjacency matrix in form of \((N + N_{inject})\times(N + N_{inject})\) sparse matrix.

• features (torch.FloatTensor) – Features in form of N * D torch float tensor.

• features_attack (torch.FloatTensor) – Features of nodes after attacks in form of \(N_{inject}\) * D` torch float tensor.

• origin_labels (torch.LongTensor) – Labels of target nodes originally predicted by the model.

• target_mask (torch.Tensor) – Mask of target nodes in form of N * 1 torch bool tensor.

• adj_norm_func (func of utils.normalize) – Function that normalizes adjacency matrix.

Returns

features_attack – Updated features of nodes after attacks in form of \(N_{inject}\) * D` torch float tensor.

Return type

torch.FloatTensor

grb.attack.speit

class grb.attack.speit.SPEIT(lr, n_epoch, n_inject_max, n_edge_max, feat_lim_min, feat_lim_max, loss=<function nll_loss>, eval_metric=<function eval_acc>, inject_mode='random', device='cpu', early_stop=False, verbose=True)

Bases: grb.attack.base.InjectionAttack

SPEIT graph injection attack, 1st place solution of KDD CUP 2020 Graph Adversarial Attack & Defense. (SPEIT).

Parameters

• lr (float) – Learning rate of feature optimization process.

• n_epoch (int) – Epoch of perturbations.

• n_inject_max (int) – Maximum number of injected nodes.

• n_edge_max (int) – Maximum number of edges of injected nodes.

• feat_lim_min (float) – Minimum limit of features.

• feat_lim_max (float) – Maximum limit of features.

• loss (func of torch.nn.functional, optional) – Loss function compatible with torch.nn.functional. Default: F.nll_loss.

• eval_metric (func of grb.evaluator.metric, optional) – Evaluation metric. Default: metric.eval_acc.

• inject_mode (str, optional) – Mode of injection. Choose from ["random", "random-inter", "multi-layer"]. Default: random.

• device (str, optional) – Device used to host data. Default: cpu.

• early_stop (bool, optional) – Whether to early stop. Default: False.

• verbose (bool, optional) – Whether to display logs. Default: True.

attack(model, adj, features, target_mask, adj_norm_func)

Attack process consists of injection and feature update.

Parameters

• model (torch.nn.module) – Model implemented based on torch.nn.module.

• adj (scipy.sparse.csr.csr_matrix) – Adjacency matrix in form of N * N sparse matrix.

• features (torch.FloatTensor) – Features in form of N * D torch float tensor.

• target_mask (torch.Tensor) – Mask of attack target nodes in form of N * 1 torch bool tensor.

• adj_norm_func (func of utils.normalize) – Function that normalizes adjacency matrix.

Returns

• adj_attack (scipy.sparse.csr.csr_matrix) – Adversarial adjacency matrix in form of \((N + N_{inject})\times(N + N_{inject})\) sparse matrix.

• features_attack (torch.FloatTensor) – Features of nodes after attacks in form of \(N_{inject}\) * D` torch float tensor.

injection(adj, n_inject, n_node, target_mask, target_node=None, mode='random-inter')

Randomly inject nodes to target nodes.

Parameters

• adj (scipy.sparse.csr.csr_matrix) – Adjacency matrix in form of N * N sparse matrix.

• n_inject (int) – Number of injection.

• n_node (int) – Number of all nodes.

• target_mask (torch.Tensor) – Mask of attack target nodes in form of N * 1 torch bool tensor.

• target_node (np.ndarray) – IDs of target nodes to attack with priority.

• mode (str, optional) – Mode of injection. Choose from ["random", "random-inter", "multi-layer"]. Default: random-inter.

Returns

adj_attack – Adversarial adjacency matrix in form of \((N + N_{inject})\times(N + N_{inject})\) sparse matrix.

Return type

scipy.sparse.csr.csr_matrix

update_features(model, adj_attack, features, features_attack, origin_labels, target_mask, adj_norm_func)

Adversarial feature generation of injected nodes.

Parameters

• model (torch.nn.module) – Model implemented based on torch.nn.module.

• adj_attack (scipy.sparse.csr.csr_matrix) – Adversarial adjacency matrix in form of \((N + N_{inject})\times(N + N_{inject})\) sparse matrix.

• features (torch.FloatTensor) – Features in form of N * D torch float tensor.

• features_attack (torch.FloatTensor) – Features of nodes after attacks in form of \(N_{inject}\) * D` torch float tensor.

• origin_labels (torch.LongTensor) – Labels of target nodes originally predicted by the model.

• target_mask (torch.Tensor) – Mask of target nodes in form of N * 1 torch bool tensor.

• adj_norm_func (func of utils.normalize) – Function that normalizes adjacency matrix.

Returns

features_attack – Updated features of nodes after attacks in form of \(N_{inject}\) * D` torch float tensor.

Return type

torch.FloatTensor

grb.attack.tdgia

class grb.attack.tdgia.TDGIA(lr, n_epoch, n_inject_max, n_edge_max, feat_lim_min, feat_lim_max, loss=<function nll_loss>, eval_metric=<function eval_acc>, inject_mode='tdgia', sequential_step=0.2, opt='sin', device='cpu', early_stop=False, verbose=True)

Bases: grb.attack.base.InjectionAttack

Topological Defective Graph Injection Attack (TDGIA).

Parameters

• lr (float) – Learning rate of feature optimization process.

• n_epoch (int) – Epoch of perturbations.

• n_inject_max (int) – Maximum number of injected nodes.

• n_edge_max (int) – Maximum number of edges of injected nodes.

• feat_lim_min (float) – Minimum limit of features.

• feat_lim_max (float) – Maximum limit of features.

• loss (func of torch.nn.functional, optional) – Loss function compatible with torch.nn.functional. Default: F.nll_loss.

• eval_metric (func of grb.evaluator.metric, optional) – Evaluation metric. Default: metric.eval_acc.

• inject_mode (str, optional) – Mode of injection. Choose from ["random", "uniform", "tdgia"]. Default: tdgia.

• sequential_step (float, optional) – Step of sequential injection, each time injecting \(\alpha\times N_{inject}\) nodes. Default: 0.2.

• opt (str, optional) – Optimization option. Choose from ["sin", "clip"]. Default: sin.

• device (str, optional) – Device used to host data. Default: cpu.

• early_stop (bool, optional) – Whether to early stop. Default: False.

• verbose (bool, optional) – Whether to display logs. Default: True.

attack(model, adj, features, target_mask, adj_norm_func)

Attack process consists of injection and feature update.

Parameters

• model (torch.nn.module) – Model implemented based on torch.nn.module.

• adj (scipy.sparse.csr.csr_matrix) – Adjacency matrix in form of N * N sparse matrix.

• features (torch.FloatTensor) – Features in form of N * D torch float tensor.

• target_mask (torch.Tensor) – Mask of attack target nodes in form of N * 1 torch bool tensor.

• adj_norm_func (func of utils.normalize) – Function that normalizes adjacency matrix.

Returns

• adj_attack (scipy.sparse.csr.csr_matrix) – Adversarial adjacency matrix in form of \((N + N_{inject})\times(N + N_{inject})\) sparse matrix.

• features_attack (torch.FloatTensor) – Features of nodes after attacks in form of \(N_{inject}\) * D` torch float tensor.

injection(adj, n_inject, n_origin, n_current, origin_labels, current_labels, target_mask, self_connect_ratio=0.0, weight1=0.9, weight2=0.1, mode='tdgia')

Randomly inject nodes to target nodes.

Parameters

• adj (scipy.sparse.csr.csr_matrix) – Adjacency matrix in form of N * N sparse matrix.

• n_inject (int) – Number of injection.

• n_origin (int) – Number of original nodes.

• n_current (int) – Number of current nodes (after injection).

• target_mask (torch.Tensor) – Mask of attack target nodes in form of N * 1 torch bool tensor.

• self_connect_ratio (float. optional) – Ratio of self connected edges among injected nodes. Default: 0.0.

• weight1 (float, optional) – Hyper-parameter of the score function. Refer to the paper. Default: 0.9.

• weight2 (float, optional) – Hyper-parameter of the score function. Refer to the paper. Default: 0.1.

• mode (str, optional) – Mode of injection. Choose from ["random", "uniform", "tdgia"]. Default: tdgia.

Returns

adj_attack – Adversarial adjacency matrix in form of \((N + N_{inject})\times(N + N_{inject})\) sparse matrix.

Return type

scipy.sparse.csr.csr_matrix

update_features(model, adj_attack, features_current, features_attack, origin_labels, n_origin, target_mask, adj_norm_func, opt='sin', smooth_factor=4)

Adversarial feature generation of injected nodes.

Parameters

• model (torch.nn.module) – Model implemented based on torch.nn.module.

• adj_attack (scipy.sparse.csr.csr_matrix) – Adversarial adjacency matrix in form of \((N + N_{inject})\times(N + N_{inject})\) sparse matrix.

• features_current (torch.FloatTensor) – Current features in form of \((N + N_{inject})\) * D` torch float tensor.

• features_attack (torch.FloatTensor) – Features of nodes after attacks in form of \(N_{inject}\) * D` torch float tensor.

• origin_labels (torch.LongTensor) – Labels of target nodes originally predicted by the model.

• n_origin (int) – Number of original nodes.

• target_mask (torch.Tensor) – Mask of target nodes in form of N * 1 torch bool tensor.

• adj_norm_func (func of utils.normalize) – Function that normalizes adjacency matrix.

• opt (str, optional) – Optimization option. Choose from ["sin", "clip"]. Default: sin.

• smooth_factor (float, optional) – Factor for smoothing the optimization. Default: 4.

Returns

features_attack – Updated features of nodes after attacks in form of \(N_{inject}\) * D` torch float tensor.

Return type

torch.FloatTensor