Attacking Custom Pytorch Geometric Implementation GAT using Mettack

[akul-goyal]

Hi,

I am interested in attacking my own GAT model that I coded using Pytorch Geometric. Given the sizes of the graphs, I can use only mettack.py to create a global attack against my model. However, currently, the code seems to be formatted for only GCN based on this function. Is there a way for mettack to be used against a custom model? If so, how would one go about doing so? Would it be as easy as changing this to get the hidden values from the trained model we are trying to attack?

[EdisonLeeeee]

Hi, @akul-goyal

It is not straightforward to use surrogate models other than gcn in metattack. As Pytorch Geometric. uses sparse edge_index for message propagation, you need to implement gat with dense adjacency matrix to calculate the gradients. Specifically, you need a lot of work to achieve this:

• Design your own model (gat) https://github.com/DSE-MSU/DeepRobust/blob/e737166fe2fe706c79c2a435e08a3e2853d6b72e/deeprobust/graph/global_attack/mettack.py#L193-L217
• Implement the training process for your model https://github.com/DSE-MSU/DeepRobust/blob/e737166fe2fe706c79c2a435e08a3e2853d6b72e/deeprobust/graph/global_attack/mettack.py#L233-L271
• Rewrite the function that calculates the meta gradient https://github.com/DSE-MSU/DeepRobust/blob/e737166fe2fe706c79c2a435e08a3e2853d6b72e/deeprobust/graph/global_attack/mettack.py#L273-L308

[akul-goyal]

If I wanted to attack topology is it possible to modify the existing code to utilize a PyTorch sparse implementation for the adj matrix? I hit a memory wall when converting my adj matrix to dense as coded here. Would the change require changing this? I know the matrix being calculated within the function is dense, but is there any workaround I can use to keep the attack memory efficient? The number of nodes I am dealing with is in the hundreds of thousands.