ADVERSARIAL ATTACKS ON GRAPH NEURAL NETWORKS VIA META LEARNING
Deep learning models for graphs have advanced the state of the art on many tasks. Despite their recent success, little is known about their robustness. We investigate training time attacks on graph neural networks for node classification that perturb the discrete graph structure. Our core principle is to use meta-gradients to solve the bilevel problem underlying training-time attacks, essentially treating the graph as a hyperparameter to optimize. Our experiments show that small graph perturbations consistently lead to a strong decrease in performance for graph convolutional networks, and even transfer to unsupervised embeddings. Remarkably, the perturbations created by our algorithm can misguide the graph neural networks such that they perform worse than a simple baseline that ignores all relational information. Our attacks do not assume any knowledge about or access to the target classifiers.
This paper studies the problem of learning a better poisoned graph parameters that can maximize the loss of a graph neural network. The proposed using meta-learning to compute the second-order derivatives to get the meta-gradients seems reasonable. The authors also proposed approximate methods to compute the graph as learning parameters, which could be more efficient since the second-order derivatives are no longer computed. The experimental results on three graph datasets show that the proposed model could improve the misclassification rate of the unlabeled nodes.
The paper is well-written. It would be good if the authors could address the following suggestions or concerns:
1) The proposed attack model assumes the only the graph structure are accessiable to the attackers, which might limit the proposed model in real applications. Joint study with the graph features would be useful to convince more audience and potentially have larger impacts.
2) In the self-learning setting, in order to define l_atk, l_self is used, however, l_self is using v_u, which is the ground truth label of the test nodes based on my understanding, so this approach is using labels of the unlabeled data, which might be not applicable in real world.
3) About the action space, based on the constraints of the attacker's capability, the possible attacks will be significantly smaller than O(N^2 delta), might be O(N^delta).
4) Change 'treat the graph structure as a hyperparameter' to 'treat the graph structure tensor/matrix as a hyperparameter' would be earier to understand. And is the graph structure tensor with shape (NXN)? 
5) What's the relationship between T and S? Are T in theta_T is the same as the S in G_S?
6) The title of section 4.2 is misleading. It would be better to name it as 'Greedy Computing Meta-Gradients'. 
7) It lacks intuition of why define S(u,v)=delta . (-2.a_uv+1). '(-2.a_uv+1)' looks lack of intuition. Please also change 'pair (i,j), we define S(u,v)' -> 'pair (u,v)'.
8) In the experiments, what's the definition of meta-train? l_atk=-l_train?
9) In the experiments, it would be interesting to study the impact of unnoticaability constraints on the model results.
10) In figure 1, it is not surprising that when increasing the number of edges changed, the misclassification rates will increase. A graph NN considers more graph features rather than the structure is expected to show the impact of the graph structure change.
I have read the authors' detailed rebuttal. Thanks.