def multi_test_evasion(): # test on 40 nodes on evasion attack target_gcn = GCN(nfeat=features.shape[1], nhid=16, nclass=labels.max().item() + 1, dropout=0.5, device=device) target_gcn = target_gcn.to(device) target_gcn.fit(features, adj, labels, idx_train) cnt = 0 degrees = adj.sum(0).A1 node_list = select_nodes(target_gcn) num = len(node_list) print('=== [Evasion] Attacking %s nodes respectively ===' % num) for target_node in tqdm(node_list): n_perturbations = int(degrees[target_node]) model = Nettack(surrogate, nnodes=adj.shape[0], attack_structure=True, attack_features=True, device=device) model = model.to(device) model.attack(features, adj, labels, target_node, n_perturbations, verbose=False) modified_adj = model.modified_adj modified_features = model.modified_features acc = single_test(modified_adj, modified_features, target_node, gcn=target_gcn) if acc == 0: cnt += 1 print('misclassification rate : %s' % (cnt/num))
def multi_test(): cnt = 0 degrees = adj.sum(0).A1 node_list = select_nodes(num_target=10) # node_list = [439, 1797] print(node_list) num = len(node_list) print('=== Attacking %s nodes respectively ===' % num) num_tar = 0 for target_node in tqdm(node_list): # """for test""" # target_node = 419 n_perturbations = int(degrees[target_node]) if n_perturbations <1: # at least one perturbation continue model = Nettack(surrogate, nnodes=adj.shape[0], attack_structure=True, attack_features=False, device=device) model = model.to(device) model.attack(features, adj, labels, target_node, n_perturbations, direct=False, n_influencers=5, verbose=False) modified_adj = model.modified_adj modified_features = model.modified_features acc = single_test(modified_adj, modified_features, target_node) if acc == 0: cnt += 1 num_tar += 1 print('classification rate : %s' % (1-cnt/num_tar), '# of targets:', num_tar)
def multi_test_poison(): # test on 40 nodes on poisoining attack cnt = 0 degrees = adj.sum(0).A1 node_list = select_nodes() num = len(node_list) print('=== [Poisoning] Attacking %s nodes respectively ===' % num) for target_node in tqdm(node_list): n_perturbations = int(degrees[target_node]) model = Nettack(surrogate, nnodes=adj.shape[0], attack_structure=True, attack_features=True, device=device) model = model.to(device) model.attack(features, adj, labels, target_node, n_perturbations, verbose=False) modified_adj = model.modified_adj modified_features = model.modified_features acc = single_test(modified_adj, modified_features, target_node) if acc == 0: cnt += 1 print('misclassification rate : %s' % (cnt / num))
def multi_test(): # Setup Surrogate model surrogate = GCN(nfeat=features.shape[1], nclass=labels.max().item()+1, nhid=16, dropout=0, with_relu=False, with_bias=False, device=device) surrogate = surrogate.to(device) surrogate.fit(features, adj, labels, idx_train) attack_cnt = 0 defense_cnt = 0 degrees = adj.sum(0).A1 node_list = select_nodes() num = len(node_list) print('=== Attacking %s nodes one after another ===' % num) for target_node in node_list: #n_perturbations = min(15, int(degrees[target_node])) n_perturbations = int(degrees[target_node]) model = Nettack(surrogate, nnodes=adj.shape[0], attack_structure=True, attack_features=True, device=device) model = model.to(device) model.attack(features, adj, labels, target_node, n_perturbations, verbose=False) modified_adj = model.modified_adj modified_features = model.modified_features attack_acc = test_attack(modified_adj, modified_features, target_node) if attack_acc == 0: attack_cnt += 1 defense_acc = test_defense(modified_adj, modified_features, target_node) if defense_acc == 1: defense_cnt += 1 print("Attacking node :", target_node, "Details :", degrees[target_node], modified_adj.sum(0).A1[target_node], attack_acc, defense_acc) print('Pure attack accuracy rate : %s' % ((num - attack_cnt)/num), flush=True) print('With Jaccard defense accuracy rate : %s' % (defense_cnt/num), flush=True) print("GCNJaccard threshold used :", args.threshold)
nhid=16, dropout=0, with_relu=False, with_bias=False, device=device) surrogate = surrogate.to(device) surrogate.fit(features, adj, labels, idx_train) all_margins = [] all_adv_margins = [] for target_node in target_nodes: # set up Nettack adversary = Nettack(surrogate, nnodes=adj.shape[0], attack_structure=True, attack_features=True, device=device) adversary = adversary.to(device) degrees = adj.sum(0).A1 n_perturbations = int(degrees[target_node]) + 2 adversary.attack(features, adj, labels, target_node, n_perturbations) perturbed_adj = adversary.modified_adj model = GCN(nfeat=features.shape[1], nclass=labels.max() + 1, nhid=16, dropout=0, with_relu=False, with_bias=True, device=device)
idx_train, idx_val, idx_test = data.idx_train, data.idx_val, data.idx_test idx_unlabeled = np.union1d(idx_val, idx_test) # Setup Surrogate model surrogate = GCN(nfeat=features.shape[1], nclass=labels.max().item()+1, nhid=16, dropout=0, with_relu=False, with_bias=False, device=device) surrogate = surrogate.to(device) surrogate.fit(features, adj, labels, idx_train) # Setup Attack Model target_node = 0 assert target_node in idx_unlabeled model = Nettack(surrogate, nnodes=adj.shape[0], attack_structure=True, attack_features=True, device=device) model = model.to(device) def main(): degrees = adj.sum(0).A1 # How many perturbations to perform. Default: Degree of the node n_perturbations = int(degrees[target_node]) # direct attack model.attack(features, adj, labels, target_node, n_perturbations) # # indirect attack/ influencer attack # model.attack(features, adj, labels, target_node, n_perturbations, direct=False, n_influencers=5) modified_adj = model.modified_adj modified_features = model.modified_features print(model.structure_perturbations) print('=== testing GCN on original(clean) graph ===')
def multi_test_poison(): # test nodes on poisoning attack cnt = 0 data_load = dataset.c_dataset_loader(opt.dataset, ".{}".format(opt.data_path)) adj, features, label, _, _, _ = data_load.process_data() labels = F_Info.F_one_hot_to_label(label) degrees = adj.sum(0) adj = sp.csr_matrix(adj) features = sp.csr_matrix(features) total_att_node = 2000 # 攻击的节点数目 # node_list = np.random.choice(np.arange(adj.shape[0]), 10, False) node_list = np.random.choice(np.arange(adj.shape[0]), total_att_node, replace=False) # 每100个节点记录一次平均asr adj_pert_record = {} acc_pert_record = {} num = len(node_list) print('=== [Poisoning] Attacking %s nodes respectively ===' % num) acc = 0 target_node_id = 1 for target_node_idx in tqdm(node_list): model = Nettack(surrogate, nnodes=adj.shape[0], attack_structure=True, attack_features=False, device='cuda:0') model = model.to('cuda:0') model.attack(features, adj, labels, target_node_idx, n_perturbations, verbose=False) modified_adj = model.modified_adj if target_node_id % 50 == 0: print("\ntarget_node_idx : {}".format(target_node_idx)) acc = test_acc(modified_adj, features, target_node_idx) if target_node_id % 100 == 0 or target_node_id == 1: print("-------------Recoding---------\n") adj_pert_record[target_node_id / 100] = sp.csr_matrix(modified_adj) acc_pert_record[target_node_id / 100] = acc pass adj = modified_adj target_node_id = target_node_id + 1 info_collect = {} info_collect['adj_per'] = adj_pert_record info_collect['surrogate'] = surrogate info_collect['idx_train'] = idx_train info_collect['idx_val'] = idx_val info_collect['idx_test'] = idx_test info_collect['acc_after_att'] = acc_pert_record info_collect['total_att_node'] = total_att_node info_collect['random_seed'] = rand_seed info_collect['pert_node_list'] = node_list return info_collect