def fit(self, features, adj, labels, idx_train, idx_val=None, train_iters=200, initialize=True, verbose=False, normalize=True, patience=500):
'''
train the gcn model, when idx_val is not None, pick the best model
according to the validation loss
'''
self.device = self.gc1.weight.device
if initialize:
self.initialize()
if type(adj) is not torch.Tensor:
features, adj, labels = utils.to_tensor(features, adj, labels, device=self.device)
else:
features = features.to(self.device)
adj = adj.to(self.device)
labels = labels.to(self.device)
if normalize:
if utils.is_sparse_tensor(adj):
adj_norm = utils.normalize_adj_tensor(adj, sparse=True)
else:
adj_norm = utils.normalize_adj_tensor(adj)
else:
adj_norm = adj
self.adj_norm = adj_norm
self.features = features
self.labels = labels
if idx_val is None:
self._train_without_val(labels, idx_train, train_iters, verbose)
else:
if patience < train_iters:
self._train_with_early_stopping(labels, idx_train, idx_val, train_iters, patience, verbose)
else:
self._train_with_val(labels, idx_train, idx_val, train_iters, verbose)
def attack(self, ori_features, ori_adj, labels, idx_train, perturbations):
victim_model = self.surrogate
self.sparse_features = sp.issparse(ori_features)
ori_adj, ori_features, labels = utils.to_tensor(ori_adj,
ori_features,
labels,
device=self.device)
# optimizer
optimizer = optim.Adam(victim_model.parameters(), lr=0.01)
epochs = 200
victim_model.eval()
for t in tqdm(range(epochs)):
# update victim model
victim_model.train()
modified_adj = self.get_modified_adj(ori_adj)
adj_norm = utils.normalize_adj_tensor(modified_adj)
output = victim_model(ori_features, adj_norm)
loss = self._loss(output[idx_train], labels[idx_train])
optimizer.zero_grad()
loss.backward()
optimizer.step()
# generate pgd attack
victim_model.eval()
modified_adj = self.get_modified_adj(ori_adj)
adj_norm = utils.normalize_adj_tensor(modified_adj)
output = victim_model(ori_features, adj_norm)
loss = self._loss(output[idx_train], labels[idx_train])
adj_grad = torch.autograd.grad(loss, self.adj_changes)[0]
# adj_grad = self.adj_changes.grad
if self.loss_type == 'CE':
lr = 200 / np.sqrt(t + 1)
self.adj_changes.data.add_(lr * adj_grad)
if self.loss_type == 'CW':
lr = 0.1 / np.sqrt(t + 1)
self.adj_changes.data.add_(lr * adj_grad)
# self.adj_changes.grad.zero_()
self.projection(perturbations)
self.random_sample(ori_adj, ori_features, labels, idx_train,
perturbations)
self.modified_adj = self.get_modified_adj(ori_adj).detach()
def predict(self, features=None, adj=None):
'''By default, inputs are unnormalized data'''
self.eval()
if features is None and adj is None:
return self.forward(self.features, self.adj_norm)
else:
if type(adj) is not torch.Tensor:
features, adj = utils.to_tensor(features, adj, device=self.device)
self.features = features
if utils.is_sparse_tensor(adj):
self.adj_norm = utils.normalize_adj_tensor(adj, sparse=True)
else:
self.adj_norm = utils.normalize_adj_tensor(adj)
return self.forward(self.features, self.adj_norm)
def attack(self, ori_features, ori_adj, labels, idx_train, perturbations):
victim_model = self.surrogate
self.sparse_features = sp.issparse(ori_features)
ori_adj, ori_features, labels = utils.to_tensor(ori_adj,
ori_features,
labels,
device=self.device)
victim_model.eval()
epochs = 200
for t in tqdm(range(epochs)):
modified_adj = self.get_modified_adj(ori_adj)
adj_norm = utils.normalize_adj_tensor(modified_adj)
output = victim_model(ori_features, adj_norm)
# loss = F.nll_loss(output[idx_train], labels[idx_train])
loss = self._loss(output[idx_train], labels[idx_train])
adj_grad = torch.autograd.grad(loss, self.adj_changes)[0]
if self.loss_type == 'CE':
lr = 200 / np.sqrt(t + 1)
self.adj_changes.data.add_(lr * adj_grad)
if self.loss_type == 'CW':
lr = 0.1 / np.sqrt(t + 1)
self.adj_changes.data.add_(lr * adj_grad)
self.projection(perturbations)
self.random_sample(ori_adj, ori_features, labels, idx_train,
perturbations)
self.modified_adj = self.get_modified_adj(ori_adj).detach()
def attack(self, ori_features, ori_adj, labels, idx_train, idx_unlabeled, perturbations, ll_constraint=True, ll_cutoff=0.004):
self.sparse_features = sp.issparse(ori_features)
ori_adj, ori_features, labels = utils.to_tensor(ori_adj, ori_features, labels, device=self.device)
labels_self_training = self.self_training_label(labels, idx_train)
modified_adj = ori_adj
modified_features = ori_features
for i in tqdm(range(perturbations), desc="Perturbing graph"):
if self.attack_structure:
modified_adj = self.get_modified_adj(ori_adj)
if self.attack_features:
modified_features = ori_features + self.feature_changes
adj_norm = utils.normalize_adj_tensor(modified_adj)
self.inner_train(modified_features, adj_norm, idx_train, idx_unlabeled, labels)
adj_grad, feature_grad = self.get_meta_grad(modified_features, adj_norm, idx_train, idx_unlabeled, labels, labels_self_training)
adj_meta_score = torch.tensor(0.0).to(self.device)
feature_meta_score = torch.tensor(0.0).to(self.device)
if self.attack_structure:
adj_meta_score = self.get_adj_score(adj_grad, modified_adj, ori_adj, ll_constraint, ll_cutoff)
if self.attack_features:
feature_meta_score = self.get_feature_score(feature_grad, modified_features)
if adj_meta_score.max() >= feature_meta_score.max():
adj_meta_argmax = torch.argmax(adj_meta_score)
row_idx, col_idx = utils.unravel_index(adj_meta_argmax, ori_adj.shape)
self.adj_changes.data[row_idx][col_idx] += (-2 * modified_adj[row_idx][col_idx] + 1)
self.adj_changes.data[col_idx][row_idx] += (-2 * modified_adj[row_idx][col_idx] + 1)
else:
feature_meta_argmax = torch.argmax(feature_meta_score)
row_idx, col_idx = utils.unravel_index(feature_meta_argmax, ori_features.shape)
self.features_changes.data[row_idx][col_idx] += (-2 * modified_features[row_idx][col_idx] + 1)
if self.attack_structure:
self.modified_adj = self.get_modified_adj(ori_adj).detach()
if self.attack_features:
self.modified_features = self.get_modified_features(ori_features).detach()
def inner_train(self, features, modified_adj, idx_train, idx_unlabeled, labels, labels_self_training):
adj_norm = utils.normalize_adj_tensor(modified_adj)
for j in range(self.train_iters):
hidden = features
for w, b in zip(self.weights, self.biases):
if self.sparse_features:
hidden = adj_norm @ torch.spmm(hidden, w) + b
else:
hidden = adj_norm @ hidden @ w + b
if self.with_relu:
hidden = F.relu(hidden)
output = F.log_softmax(hidden, dim=1)
loss_labeled = F.nll_loss(output[idx_train], labels[idx_train])
loss_unlabeled = F.nll_loss(output[idx_unlabeled], labels_self_training[idx_unlabeled])
if self.lambda_ == 1:
attack_loss = loss_labeled
elif self.lambda_ == 0:
attack_loss = loss_unlabeled
else:
attack_loss = self.lambda_ * loss_labeled + (1 - self.lambda_) * loss_unlabeled
self.optimizer.zero_grad()
loss_labeled.backward(retain_graph=True)
self.optimizer.step()
if self.attack_structure:
self.adj_changes.grad.zero_()
self.adj_grad_sum += torch.autograd.grad(attack_loss, self.adj_changes, retain_graph=True)[0]
if self.attack_features:
self.feature_changes.grad.zero_()
self.feature_grad_sum += torch.autograd.grad(attack_loss, self.feature_changes, retain_graph=True)[0]
loss_test_val = F.nll_loss(output[idx_unlabeled], labels[idx_unlabeled])
print('GCN loss on unlabled data: {}'.format(loss_test_val.item()))
print('GCN acc on unlabled data: {}'.format(utils.accuracy(output[idx_unlabeled], labels[idx_unlabeled]).item()))
def random_sample(self, ori_adj, ori_features, labels, idx_train,
perturbations):
K = 20
best_loss = -1000
victim_model = self.surrogate
with torch.no_grad():
s = self.adj_changes.cpu().numpy()
for i in range(K):
sampled = np.random.binomial(1, s)
print(sampled.sum())
if sampled.sum() > perturbations:
continue
self.adj_changes.data.copy_(torch.tensor(sampled))
modified_adj = self.get_modified_adj(ori_adj)
adj_norm = utils.normalize_adj_tensor(modified_adj)
output = victim_model(ori_features, adj_norm)
loss = self._loss(output[idx_train], labels[idx_train])
# loss = F.nll_loss(output[idx_train], labels[idx_train])
print(loss)
if best_loss < loss:
best_loss = loss
best_s = sampled
self.adj_changes.data.copy_(torch.tensor(best_s))