def multi_test_evasion():
# test on 40 nodes on evasion attack
target_gcn = GCN(nfeat=features.shape[1],
nhid=16,
nclass=labels.max().item() + 1,
dropout=0.5, device=device)
target_gcn = target_gcn.to(device)
target_gcn.fit(features, adj, labels, idx_train)
cnt = 0
degrees = adj.sum(0).A1
node_list = select_nodes(target_gcn)
num = len(node_list)
print('=== [Evasion] Attacking %s nodes respectively ===' % num)
for target_node in tqdm(node_list):
n_perturbations = int(degrees[target_node])
model = Nettack(surrogate, nnodes=adj.shape[0], attack_structure=True, attack_features=True, device=device)
model = model.to(device)
model.attack(features, adj, labels, target_node, n_perturbations, verbose=False)
modified_adj = model.modified_adj
modified_features = model.modified_features
acc = single_test(modified_adj, modified_features, target_node, gcn=target_gcn)
if acc == 0:
cnt += 1
print('misclassification rate : %s' % (cnt/num))
def multi_test():
cnt = 0
degrees = adj.sum(0).A1
node_list = select_nodes(num_target=10)
# node_list = [439, 1797]
print(node_list)
num = len(node_list)
print('=== Attacking %s nodes respectively ===' % num)
num_tar = 0
for target_node in tqdm(node_list):
# """for test"""
# target_node = 419
n_perturbations = int(degrees[target_node])
if n_perturbations <1: # at least one perturbation
continue
model = Nettack(surrogate, nnodes=adj.shape[0], attack_structure=True, attack_features=False, device=device)
model = model.to(device)
model.attack(features, adj, labels, target_node, n_perturbations, direct=False, n_influencers=5, verbose=False)
modified_adj = model.modified_adj
modified_features = model.modified_features
acc = single_test(modified_adj, modified_features, target_node)
if acc == 0:
cnt += 1
num_tar += 1
print('classification rate : %s' % (1-cnt/num_tar), '# of targets:', num_tar)
def multi_test_poison():
# test on 40 nodes on poisoining attack
cnt = 0
degrees = adj.sum(0).A1
node_list = select_nodes()
num = len(node_list)
print('=== [Poisoning] Attacking %s nodes respectively ===' % num)
for target_node in tqdm(node_list):
n_perturbations = int(degrees[target_node])
model = Nettack(surrogate,
nnodes=adj.shape[0],
attack_structure=True,
attack_features=True,
device=device)
model = model.to(device)
model.attack(features,
adj,
labels,
target_node,
n_perturbations,
verbose=False)
modified_adj = model.modified_adj
modified_features = model.modified_features
acc = single_test(modified_adj, modified_features, target_node)
if acc == 0:
cnt += 1
print('misclassification rate : %s' % (cnt / num))
def multi_test():
# Setup Surrogate model
surrogate = GCN(nfeat=features.shape[1], nclass=labels.max().item()+1,
nhid=16, dropout=0, with_relu=False, with_bias=False, device=device)
surrogate = surrogate.to(device)
surrogate.fit(features, adj, labels, idx_train)
attack_cnt = 0
defense_cnt = 0
degrees = adj.sum(0).A1
node_list = select_nodes()
num = len(node_list)
print('=== Attacking %s nodes one after another ===' % num)
for target_node in node_list:
#n_perturbations = min(15, int(degrees[target_node]))
n_perturbations = int(degrees[target_node])
model = Nettack(surrogate, nnodes=adj.shape[0], attack_structure=True, attack_features=True, device=device)
model = model.to(device)
model.attack(features, adj, labels, target_node, n_perturbations, verbose=False)
modified_adj = model.modified_adj
modified_features = model.modified_features
attack_acc = test_attack(modified_adj, modified_features, target_node)
if attack_acc == 0:
attack_cnt += 1
defense_acc = test_defense(modified_adj, modified_features, target_node)
if defense_acc == 1:
defense_cnt += 1
print("Attacking node :", target_node, "Details :", degrees[target_node], modified_adj.sum(0).A1[target_node], attack_acc, defense_acc)
print('Pure attack accuracy rate : %s' % ((num - attack_cnt)/num), flush=True)
print('With Jaccard defense accuracy rate : %s' % (defense_cnt/num), flush=True)
print("GCNJaccard threshold used :", args.threshold)
nhid=16,
dropout=0,
with_relu=False,
with_bias=False,
device=device)
surrogate = surrogate.to(device)
surrogate.fit(features, adj, labels, idx_train)
all_margins = []
all_adv_margins = []
for target_node in target_nodes:
# set up Nettack
adversary = Nettack(surrogate,
nnodes=adj.shape[0],
attack_structure=True,
attack_features=True,
device=device)
adversary = adversary.to(device)
degrees = adj.sum(0).A1
n_perturbations = int(degrees[target_node]) + 2
adversary.attack(features, adj, labels, target_node, n_perturbations)
perturbed_adj = adversary.modified_adj
model = GCN(nfeat=features.shape[1],
nclass=labels.max() + 1,
nhid=16,
dropout=0,
with_relu=False,
with_bias=True,
device=device)
idx_train, idx_val, idx_test = data.idx_train, data.idx_val, data.idx_test
idx_unlabeled = np.union1d(idx_val, idx_test)
# Setup Surrogate model
surrogate = GCN(nfeat=features.shape[1], nclass=labels.max().item()+1,
nhid=16, dropout=0, with_relu=False, with_bias=False, device=device)
surrogate = surrogate.to(device)
surrogate.fit(features, adj, labels, idx_train)
# Setup Attack Model
target_node = 0
assert target_node in idx_unlabeled
model = Nettack(surrogate, nnodes=adj.shape[0], attack_structure=True, attack_features=True, device=device)
model = model.to(device)
def main():
degrees = adj.sum(0).A1
# How many perturbations to perform. Default: Degree of the node
n_perturbations = int(degrees[target_node])
# direct attack
model.attack(features, adj, labels, target_node, n_perturbations)
# # indirect attack/ influencer attack
# model.attack(features, adj, labels, target_node, n_perturbations, direct=False, n_influencers=5)
modified_adj = model.modified_adj
modified_features = model.modified_features
print(model.structure_perturbations)
print('=== testing GCN on original(clean) graph ===')
def multi_test_poison():
# test nodes on poisoning attack
cnt = 0
data_load = dataset.c_dataset_loader(opt.dataset,
".{}".format(opt.data_path))
adj, features, label, _, _, _ = data_load.process_data()
labels = F_Info.F_one_hot_to_label(label)
degrees = adj.sum(0)
adj = sp.csr_matrix(adj)
features = sp.csr_matrix(features)
total_att_node = 2000 # 攻击的节点数目
# node_list = np.random.choice(np.arange(adj.shape[0]), 10, False)
node_list = np.random.choice(np.arange(adj.shape[0]),
total_att_node,
replace=False)
# 每100个节点记录一次平均asr
adj_pert_record = {}
acc_pert_record = {}
num = len(node_list)
print('=== [Poisoning] Attacking %s nodes respectively ===' % num)
acc = 0
target_node_id = 1
for target_node_idx in tqdm(node_list):
model = Nettack(surrogate,
nnodes=adj.shape[0],
attack_structure=True,
attack_features=False,
device='cuda:0')
model = model.to('cuda:0')
model.attack(features,
adj,
labels,
target_node_idx,
n_perturbations,
verbose=False)
modified_adj = model.modified_adj
if target_node_id % 50 == 0:
print("\ntarget_node_idx : {}".format(target_node_idx))
acc = test_acc(modified_adj, features, target_node_idx)
if target_node_id % 100 == 0 or target_node_id == 1:
print("-------------Recoding---------\n")
adj_pert_record[target_node_id / 100] = sp.csr_matrix(modified_adj)
acc_pert_record[target_node_id / 100] = acc
pass
adj = modified_adj
target_node_id = target_node_id + 1
info_collect = {}
info_collect['adj_per'] = adj_pert_record
info_collect['surrogate'] = surrogate
info_collect['idx_train'] = idx_train
info_collect['idx_val'] = idx_val
info_collect['idx_test'] = idx_test
info_collect['acc_after_att'] = acc_pert_record
info_collect['total_att_node'] = total_att_node
info_collect['random_seed'] = rand_seed
info_collect['pert_node_list'] = node_list
return info_collect