Have you tried transfering the attack generated by nettack to GAT?

[danielzuegner]

Not yet. It'd be interesting to see for sure!

[hongxin001]

I have finished the experiment and it shows that nettack can also work on GAT.

[hongxin001]

[danielzuegner]

That's very interesting. Thank you very much for running these experiments! In order to draw conclusions we'd have to repeat this for different datasets and nodes but this is a good proof of concept.

[hongxin001]

Yeah, That's just a beginning. Could you share the code to evaluate on multi-nodes?(how to choose nodes and evaluate more efficiently.), That will help me a lot.

[danielzuegner]

Hi, I'm not sure I understand your question fully but I'll try my best to answer.

First, set n_influencers to the desired number, e.g. 5.

Then there are two scenarios when we attack with n attacker nodes:

• the target node has degree d≥n: select the n neighbors of the target that would lead to the lowest value of logit(correct_class) - max{logit(other_classes)} as attackers
• the target node has degree d < n: first connect to the n-d nodes that are most beneficial to the adversary, and then we have our n attacker nodes.

Then you can use the script to perform and evaluate the attacks.

Does this answer your question?

[hongxin001]

Thanks for your answer, but it's not really what I want to understand more. In fact, I have written the code for evaluating 10+10+20 nodes as described in your paper. Do we need to retrain model 5 times for attacking each node(just as your demo)?

[danielzuegner]

Hi,

Yes, in order to mitigate the effect of the random initialization we retrain each model five separate times per attack. We also repeat our experiments on five different splits into train/test nodes, i.e. for each of these splits we get (possibly different) 10+10+20 nodes.

Let me know in case something else is unclear.

[hongxin001]

That really helps me! Thank you! If I meet other problems, I will contact you by email.