Research map / Adversarial robustness and security / Attacks on text and graphs
Enhancing Robustness of Graph Neural Networks on Social Media with Explainable Inverse Reinforcement Learning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes MoE-BiEntIRL, a mixture-of-experts maximum entropy IRL method with precise sample guidance and bidirectional updates to reconstruct graph adversarial attack policies on social media, then uses generated samples for data augmentation and adversarial training of a GCN rumor detector.
Problem
Graph adversarial attacks on GNN rumor detectors come from multiple attackers with diverse styles, and captured attack samples are sequential and hard to model with behavior cloning or standard IRL in large social graph action spaces. The goal is to reconstruct the attack policy from captured sample
Approach
Extends maximum entropy IRL with a mixture-of-experts policy/reward (EM-trained, linear rewards over interpretable features) plus precise sample guidance (forcing expert actions with max reward early on) and a bidirectional update of reward parameters, enabling both attack policy reconstruction and feature-level explanations.
Key results
- On Weibo with T=20, MoE-BiEntIRL reaches ΔL_A of 19.876 under PRBCD-generated expert samples versus 19.030 for EntIRL and 1.142 for Apprenticeship Learning.
- On Weibo (T=5), adversarial training with MoE-BiEntIRL samples raises clean accuracy to 72.0747 and reduces the PageRank attack decline to -0.2731, compared with -0.4042 without defense.
- On Pheme (T=5), MoE-BiEntIRL attains ΔL_A of 4.965 under AdRumor-RL expert samples where EntIRL achieves 0.018.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use MoE-BiEntIRL instead of EntIRL to reconstruct policies from high-cost attack samples | graph adversarial attack policy reconstruction · Weibo T=5 and T=20 | ∆LA: 4.650 -> 4.989; 19.030 -> 19.876 | Helped |
| Use MoE-BiEntIRL instead of EntIRL to reconstruct policies from high-cost attack samples | graph adversarial attack policy reconstruction · Pheme T=5 | ∆LA: 0.000 -> 2.205 | Helped |
| Use MoE-BiEntIRL instead of EntIRL to reconstruct policies from low-cost attack samples | graph adversarial attack policy reconstruction · Weibo T=5 and T=20 | ∆LA: 5.000 -> 4.860; 19.830 -> 19.970 | Mixed |
| Use MoE-BiEntIRL instead of EntIRL to reconstruct policies from low-cost attack samples | graph adversarial attack policy reconstruction · Pheme T=5 | ∆LA: 0.000 -> 1.488 | Helped |
| Use MoE-BiEntIRL-generated samples for data augmentation | GCN rumor detector · Weibo, attack by GC-RWCS | test accuracy decline (%): -0.4406 -> -0.1456 | Helped |
| Use MoE-BiEntIRL-generated samples for data augmentation | GCN rumor detector · Weibo, attack by PR-BCD | test accuracy decline (%): -0.1966 -> 0.0984 | Helped |
| Use MoE-BiEntIRL-generated samples for adversarial training | GCN rumor detector · Weibo, attack by PR-BCD | test accuracy decline (%): -0.1966 -> 0.0000 | Helped |
| Remove the bidirectional update mechanism (ablation) | MoE-BiEntIRL policy reconstruction of AdRumor-RL · policy reconstruction | attack performance curve | Hurt |
| Remove precise sample guidance and the bidirectional update mechanism (ablation) | MoE-BiEntIRL policy reconstruction of AdRumor-RL · policy reconstruction | attack performance curve | Hurt |
Surprising findings
- For simple low-cost attacks, the plain EntIRL baseline often outperforms MoE-BiEntIRL on Weibo, which the authors attribute to Occam's Razor.
- Simply using all expert samples for data augmentation does not yield effective defense, while MoE-generated samples do.
Limitations
- Expert samples from platforms may be suboptimal or noisy, and misclassified normal samples can add noise to policy learning.
- Distribution shift between adversary training data, negative sampling data, and the RL action space.
- No error bars reported due to computational cost.
Experimental setup
Datasets: Weibo Pheme
Benchmarks: Weibo Pheme
Metrics: attack loss decline (ΔL_A) test accuracy decline under attack
Baselines: Apprenticeship Learning EntIRL PageRank attack GC-RWCS PR-BCD AdRumor-RL
Builds on: Maximum entropy IRL (EntIRL) AdRumor-RL LinUCB PR-BCD GC-RWCS
Closest papers by meaning
- Boosting the Adversarial Robustness of Graph Neural Networks: An OOD Perspective (ICLR 2024 · similarity 0.89)
- Value at Adversarial Risk: A Graph Defense Strategy against Cost-Aware Attacks (AAAI 2024 · similarity 0.86)
- Backdoor Attack on Propagation-based Rumor Detectors (AAAI 2025 · similarity 0.86)
- A Simple and Yet Fairly Effective Defense for Graph Neural Networks (AAAI 2024 · similarity 0.86)
- Highly Imperceptible Black-Box Graph Injection Attacks with Reinforcement Learning (AAAI 2025 · similarity 0.86)
- Bounding the Expected Robustness of Graph Neural Networks Subject to Node Feature Attacks (ICLR 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.