Research map / Adversarial robustness and security / Attacks on text and graphs
Adversarial Attacks on Fairness of Graph Neural Networks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes G-FairAttack, a gray-box structure-perturbation attack that corrupts demographic parity of fairness-aware GNNs while keeping utility loss change unnoticeable, using a total-variation surrogate loss and a non-gradient greedy edge-flipping algorithm with fast score computation.
Problem
Fairness-aware GNNs can be corrupted by adversarial structure perturbations; prior attacks target utility, not fairness, and ignore that noticeable utility changes reveal manipulation.
Approach
A total-variation surrogate fairness loss that upper-bounds demographic parity, mutual information and Wasserstein fairness losses, combined with a non-gradient sequential edge-flip scoring rule that projects out utility change (zeroth-order estimates) so each flip keeps utility loss nearly unchanged.
Key results
- On Regularization victim, G-FairAttack raises Facebook Δdp from 3.06% (clean) to 6.84%, the best among attacks, with ACC near 81%.
- On EDITS victim (Credit), G-FairAttack keeps utility change below 0.5% in the unnoticeability study while increasing Δdp.
- G-FairAttack is the strongest attack on most fairness-aware victims (e.g., Pokec_z EDITS Δdp 1.89% to 4.25%), but weaker than some baselines on vanilla GCN.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use G-FairAttack instead of clean input | GCN · Facebook, Pokec_z, Credit | Δdp (%): Facebook: 5.30 { $\pm$ 0.47} -> 8.13 { $\pm$ 0.74}; Pokec_z: 7.13 { $\pm$ 1.17} -> 5.08 { $\pm$ 1.38}; Credit: 13.30 { $ | Mixed |
| Use G-FairAttack instead of clean input | Reg · Facebook, Pokec_z, Credit | Δdp (%): Facebook: 3.06 { $\pm$ 0.58} -> 6.84 { $\bm\pm$ 0.31}; Pokec_z: 2.41 { $\pm$ 0.29} -> 6.03 { $\bm\pm$ 0.54}; Credit: 0.6 | Helped |
| Use G-FairAttack instead of clean input | FairGNN · Facebook, Pokec_z, Credit | Δdp (%): Facebook: 2.00 { $\pm$ 1.77} -> 3.23 { $\bm\pm$ 2.03}; Pokec_z: 1.37 { $\pm$ 0.83} -> 2.63 { $\pm$ 0.75}; Credit: 2.65 { | Mixed |
| Use G-FairAttack instead of clean input | EDITS · Facebook, Pokec_z, Credit | Δdp (%): Facebook: 0.27 { $\pm$ 0.00} -> 5.55 { $\bm\pm$ 0.47}; Pokec_z: 1.89 { $\pm$ 0.83} -> 4.25 { $\bm\pm$ 0.77}; Credit: 7.4 | Helped |
| Add total variation fairness loss to the surrogate loss (ablation) | G-FairAttack-None · Credit, FairGNN | Δdp (%): 7.87 {$\pm$ 1.31} -> 8.06 {$\pm$ 1.90} | Helped |
| Add total variation fairness loss to the surrogate loss (ablation) | G-FairAttack-None · Credit, EDITS | Δdp (%): 10.47 {$\pm$ 1.91} -> 11.26 {$\pm$ 1.50} | Helped |
| Replace Δdp surrogate loss with total variation loss (ablation) | G-FairAttack-Δdp · Credit, FairGNN | Δdp (%): 7.82 {$\pm$ 1.17} -> 8.06 {$\pm$ 1.90} | Helped |
| Replace Δdp surrogate loss with total variation loss (ablation) | G-FairAttack-Δdp · Credit, EDITS | Δdp (%): 10.77 {$\pm$ 1.19} -> 11.26 {$\pm$ 1.50} | Helped |
| Remove utility constraint and discrete projected update strategy (ablation) | G-FairAttack · Facebook | training utility loss variation | Hurt |
| Use fast computation with smaller candidate-edge proportion a (ablation) | G-FairAttack · range [5e^{-4},1e^{-2}] | time cost: 95% lower | Helped |
| Vary candidate-edge proportion a within [5e^{-4},1e^{-2}] (ablation) | G-FairAttack · regularization-based victim model | fairness performance | No clear effect |
Surprising findings
- Some baselines outperform G-FairAttack when attacking vanilla GCN, attributed to the fairness term in the surrogate loss.
- Gradient-based methods are not guaranteed to decrease the attack objective (proposition).
Limitations
- Attack is weaker than some baselines on the vanilla GCN victim, requiring a smaller alpha.
- Gray-box setting; black-box extension is only sketched.
- Relies on theoretical assumptions (bounded TV condition) verified empirically rather than proven in general.
Experimental setup
Datasets: Facebook Pokec_z Credit
Benchmarks: Facebook Pokec_z Credit
Metrics: demographic parity equal opportunity accuracy AUC
Baselines: Random attack FA-GNN Gradient Ascent Metattack
Builds on: Metattack FairGNN EDITS FA-GNN Gradient Ascent
Closest papers by meaning
- Are Your Models Still Fair? Fairness Attacks on Graph Neural Networks via Node Injections (NeurIPS 2024 · similarity 0.91)
- Chasing Fairness in Graphs: A GNN Architecture Perspective (AAAI 2024 · similarity 0.91)
- Deceptive Fairness Attacks on Graphs via Meta Learning (ICLR 2024 · similarity 0.89)
- FairSIN: Achieving Fairness in Graph Neural Networks through Sensitive Information Neutralization (AAAI 2024 · similarity 0.88)
- On the Alignment between Fairness and Accuracy: from the Perspective of Adversarial Robustness (ICML 2025 · similarity 0.87)
- Adversarial Fairness Network (AAAI 2024 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.