\useunder

Adversarially Robust Signed Graph Contrastive Learning
from Balance Augmentation

Jialong Zhou

{}^{1}

Xing Ai

{}^{1}

Yuni Lai

{}^{1}

&Kai Zhou

{}^{1}

{}^{1}

The Hong Kong Polytechnic University
[email protected], [email protected], [email protected], [email protected]

Abstract

Signed graphs consist of edges and signs, which can be separated into structural information and balance-related information, respectively. Existing signed graph neural networks (SGNNs) typically rely on balance-related information to generate embeddings. Nevertheless, the emergence of recent adversarial attacks has had a detrimental impact on the balance-related information. Similar to how structure learning can restore unsigned graphs, balance learning can be applied to signed graphs by improving the balance degree of the poisoned graph. However, this approach encounters the challenge “Irreversibility of Balance-related Information” - while the balance degree improves, the restored edges may not be the ones originally affected by attacks, resulting in poor defense effectiveness. To address this challenge, we propose a robust SGNN framework called Balance Augmented-Signed Graph Contrastive Learning (BA-SGCL), which combines Graph Contrastive Learning principles with balance augmentation techniques. Experimental results demonstrate that BA-SGCL not only enhances robustness against existing adversarial attacks but also achieves superior performance on link sign prediction task across various datasets.

1 Introduction

Human relationships encompass a broad spectrum of connections, including both positive interactions such as trust and support, as well as negative associations such as distrust and slander. Signed graphs have become popular to represent both positive and negative relationships by assigning corresponding signs $(+/-)$ to the edges. A prevalent task in signed graph analysis is link sign prediction Leskovec et al. (2010a); Song and Meyer (2015) that aims to predict signs of remaining edges based on partially observed graph information. Accordingly, numerous Signed Graph Neural Networks (SGNNs), such as SGCN Derr et al. (2018), SDGNN Huang et al. (2021), and RSGNN Zhang et al. (2023), have been devised to predict the link signs and most of them essentially leverage the balance theory Davis (1967); Kirkley et al. (2019) that explains the distribution of signs in the graph from a social science perspective.

Despite the success achieved by SGNNs, recent studies have revealed their vulnerability to adversarial attacks with representative examples such as FlipAttack Zhu et al. (2022) and Balance-attack Zhou et al. (2023). A common characteristic shared by these attacks is that they take effect by disrupting the balance status of the graph, thereby causing a deterioration in node embeddings. This degradation subsequently impacts the performance of downstream tasks. Considering the growing utilization of SGNNs in security-sensitive domains such as trust prediction in Bitcoin trading platforms Huang et al. (2022); Grassia and Mangioni (2022); Godziszewski et al. (2021), the presence of these attacks presents a grave security concern for the analysis of signed graphs.

The realm of defense mechanisms for signed graph analysis remains significantly unexplored. Presently, the sole robust model available is RSGNN Zhang et al. (2023). However, it is primarily designed to handle random noise and proves ineffective against adversarial attacks, as evidenced by our experiments. In contrast, there are numerous robust learning models Jin et al. (2020); Xu et al. (2021b) specifically designed for unsigned graphs, employing a structural learning approach. In our preliminary study, we attempt to adapt this approach to signed graphs by utilizing the balance degree as the learning objective, as attacks tend to decrease the balance degree. Hence, we refer to this method of structural learning applied to signed graphs as balance learning. Unfortunately, the balance learning approach fails to exhibit robustness in the face of attacks. Our further investigation reveals that while balance learning can effectively restore the balance degree, it fails to recover the distribution of signs – we term this challenge as “Irreversibility of Balance-related Information (IBI)” in our theoretical analysis. The absence of effective defense approaches against attacks serves as a strong motivation for us to develop a dedicated robust SGNN model tailored specifically for signed graphs.

In this paper, we propose a novel robust SGNN model named Balance Augmented-Signed Graph Contrastive Learning (BA-SGCL), which builds upon the Graph Contrastive Learning (GCL) framework to indirectly tackle the challenge of IBI. Specifically, we consider the positive view as the graph obtained by enhancing the balance degree, while the negative view corresponds to the original input graph. To perturb the positive view, we utilize the balance degree as a guiding factor to shape the Bernoulli probability matrix within a learnable augmenter. By maximizing the mutual information between the embeddings of two views and that between the embedding and labels, our approach can achieve defense against attacks and improve prediction accuracy.

The major contributions of our research are as follows:

•

We conduct a comprehensive theoretical analysis of attacks targeting signed graph analysis, shedding light on the fundamental nature of these attacks from an information theoretical perspective.
•

We propose a novel robust model BA-SGCL based on the graph contrastive learning framework. We also present the theoretical reasoning of why our model can effectively combat attacks.
•

Through extensive experiments we demonstrate that our BA-SGCL model outperforms other baselines under two representative attacks.

2 Related Works

Graph Contrastive Learning

Graph Contrastive Learning (GCL) Qiu et al. (2020); Sun et al. (2019) aims to maximize correspondence between related objects in a graph while capturing their invariant properties, enabling models to learn more invariant and generalized node representations. One key step in GCL is to define positive and negative views for contrastive pairs. One common approach uses graph augmentation to generate multiple views for flexible contrastive pairs Thakoor et al. (2021); Hassani and Khasahmadi (2020); Bielak et al. (2022). The augmented views can provide different perspectives of the original graph, enhancing the model’s ability to capture important graph properties. Specifically for signed graphs, SGCL Shu et al. (2021) applies graph contrastive learning to signed graphs, combining augmented graph and signed structure contrasts. UGCL Ko et al. (2023b) improves stability with Laplacian perturbation, making it applicable to various graph types.

Attacks and Defenses for Graph Learning

Extensive research has been devoted to studying the robustness of graph learning models Zhu et al. (2019); Sun et al. (2022); Lai et al. (2023) by exploring various attack and defense methods. Recent studies Godziszewski et al. (2021); Zhu et al. (2022); Zhou et al. (2023) have also explored the vulnerabilities of signed graph analysis models. For instance, Balance-attack Zhou et al. (2023) can effectively attack signed GNNs (SGNNs) in a black-box manner by decreasing the balance degree of signed graphs. Unfortunately, SGNNs currently lack strong defense mechanisms to effectively counter such attacks. RSGNN Zhang et al. (2023) is considered as a leading robust model that enhances robustness by integrating structure-based regularizers. However, while RSGNN excels at handling random noise, its ability to defend against adversarial attacks produces only average results.

3 Background

Formally, we define a signed graph $\mathcal{G}=(\mathcal{V},\mathcal{E^{+}},\mathcal{E^{-}})$ where $\mathcal{V}=\{v_{1},v_{2},\cdots,v_{n}\}$ represents the set of $n$ nodes. The positive edges are denoted by $\mathcal{E^{+}}\subseteq\mathcal{V}\times\mathcal{V}$ , while the negative edges are $\mathcal{E^{-}}\subseteq\mathcal{V}\times\mathcal{V}$ , and $\mathcal{E^{+}}\cap\mathcal{E^{-}}=\emptyset$ . We denote the sign of edge $e_{ij}$ as $\sigma(e_{ij})\in\{+,-\}$ . The structure of $\mathcal{G}$ is captured by the adjacency matrix $A\in\mathbb{R}^{|\mathcal{V}|\times|\mathcal{V}|}$ .

3.1 Balance Theory & Balance Degree

Refer to caption — Figure 1: Balanced and unbalanced triangles.

Balance is a fundamental theory initially formulated for undirected networks, it enables modeling of like-dislike relationships. The theory encapsulates the notion that “the friend of my friend is my friend” and “the enemy of my enemy is my friend”. In signed networks, triangles are classified as either balanced or unbalanced, which consists even and odd number of negative links respectively. For instance, in Figure 1, where positive and negative edges are represented by blue and red lines, respectively, the first two triads, where all three users are friends or only one pair of them are friends, are considered balanced. Building upon prior research Leskovec et al. (2010a, b), this theory asserts that individuals in a social network tend to establish balanced structures. To quantitatively assess the balance-related information, a metric known as the balance degree $D_{3}(G)$ was introduced Cao et al. (2015). This measure computes the proportion of balanced triads within the graph using the following formula:

D_{3}(G)=\frac{\mathsf{Tr}(A^{3})+\mathsf{Tr}(|A|^{3})}{2\mathsf{Tr}(|A|^{3})},

(1)

where $\mathsf{Tr}(\cdot)$ represents the trace of a matrix, $A$ is the signed adjacency matrix of the signed graph $\mathcal{G}$ .

3.2 Signed Graph Representation Learning

Balance theory plays an essential role in signed graph representation learning. SGCN Derr et al. (2018) extends GCN to incorporate balance theory for determining positive and negative relationships between nodes. Each node’s representation consists of positive and negative components, where the positive part incorporates information from the positive (negative) representations of its positive (negative) neighbors. Other SGNN models, such as SGCL Shu et al. (2021) and SGDNN Huang et al. (2021), leverage balance theory in augmentation or loss function construction. SGCL introduces GCL into SGNN design, but lacks theoretical analysis of mutual information Kraskov et al. (2004), which measures the dependence between random variables, and existing works Xu et al. (2021a); Sun et al. (2019) on unsigned graphs have explored its theoretical aspects.

4 Problem Statements and Preliminary Study

4.1 Threat model

In this paper, we focus on the adversarial robustness of link sign prediction, a prevalent task in signed graph analysis. We consider an analyst predicting missing signs from a collected signed graph, while an attacker aims to disrupt the prediction task. The attacker can manipulate the data collection process, resulting in a poisoned graph used for training the prediction model. We assume a strong attacker with full access to the training data, including the graph structure and link signs, and the ability to change signs within a specified budget.

Problem of defense

Given a poisoned graph, the defender (i.e., the analyst) aims to train a robust SGNN model to mitigate the impact of the attack. The primary objective for the defender is to restore the prediction accuracy to a level comparable to that of an unpolluted graph. It is important to note that the defender is only aware of the poisoned graph and does not have access to a clean version. We emphasize that the defender does not know the attack algorithm. That is, the defender’s goal is to develop a model that would stay robust possibly against different types of attacks.

4.2 Preliminary Study

Adaption from previous defense

The emerging attacks represented by Balance-attack Zhou et al. (2023) and FlipAttack Zhu et al. (2022) have been shown to considerably reduce the balance degree of the attacked graph. In response, a natural defense strategy is to restore the balance of the poisoned graph. To this end, we adapt the widely used structural learning technique for unsigned graphs and employ it to train a robust SGNN model. Specifically, this method regards the signs as variables and employs the balance degree as a regularizer to iteratively update the graphs, aiming to maximize the balance degree by updating signs without altering the graph structure. We term this method as balance learning.

Table 1: Comparison of SGCN without/with balance learning (ratio: overlapping ratio of graphs;

D_{3}

: balance degree)

Dataset	Ptb(%)	SGCN			SGCN+balance learning
Dataset	Ptb(%)	AUC	ratio(%)	$D_{3}$	AUC	ratio(%)	$D_{3}$
Bitcoin-Alpha	0	0.7992	100.00	0.9232	0.7981	97.75	0.9976
	10	0.6913	89.98	0.2006	0.6962	88.89	0.9856
	20	0.6535	79.94	0.1054	0.6153	76.88	0.9616
BitconOTC	0	0.8253	100.00	0.9267	0.8113	96.62	0.9978
	10	0.7504	89.99	0.2072	0.7324	87.58	0.9598
	20	0.6985	79.98	0.0881	0.6687	77.78	0.9335

We measured the performance of balance learning under different perturbation ratios of Balance-attack Zhou et al. (2023) and show AUC in Table 1. We observe that while balance learning can significantly recover the degree of balance, it can not improve the model performance as measured by AUC. In addition, balance learning will also result in a lower overlapping ratio between the poisoned graphs and the clean graphs, as observed when comparing the overlapping ratio before and after applying balance learning, thereby indicating its incapacity to recover the signs.

The primary reason for the ineffectiveness of balance learning is that different distributions of the signs could result in the same degree of balance (a toy example is shown in Figure 2). Consequently, it is difficult to reversely restore the sign distribution of the clean graph using the balance degree as the single guidance. Indeed as shown in Table 1, while the balance degree is restored, the distribution of the signs is still quite different from that of the clean graph. We term this observation as Irreversibility of Balance-related Information (IBI).

Our Solution

Directly addressing the IBI is a challenging task as the clean graph is not accessible. Our solution is utilizing Graph Contrastive Learning (GCL) to generate robust embedding for the attacked graph instead of increasing balance degree directly. We design the positive and negative views augmentation in GCL such that one view has an improved balanced degree while the other view is the poisoned graph tends to have a smaller balanced degree. Despite the presence of IBI in the positive view, the utilization of GCL enables the embeddings to acquire both high balance characteristics and undergo only minimal changes in sign distribution simultaneously. Our proposed solution maximizes the mutual information between the embedding of the poisoned graph and the joint distribution of the positive view’s embedding and labels in order to effectively achieve the defense objective.

5 Proposed Method

We introduce our proposed robust framework named Balance Augmented-Signed Graph Contrastive Learning (BA-SGCL). BA-SGCL integrates Graph Contrastive Learning (GCL) with a novel learnable balance augmentation to improve the generation of robust embeddings. The architecture of BA-SGCL is illustrated in Figure 3. In the following, we first describe the model details and then delve into the theoretical underpinnings of the attacks and also elucidate how our model can enhance representation learning from an information theoretical perspective.

5.1 Learnable Balance Augmentation

Despite the difficulty in restoring the clean graph with a highly balanced degree accurately, we mitigate the issue via balance augmentation leveraging a GCL framework. GCL mainly relies on generating pairs of positive and negative views to conduct self-supervised learning. In the context of defending against poisoning attacks, we only have knowledge of the poisoned graphs where the attacker has hindered the balanced degrees. These poisoned graphs can serve as negative views. To generate a positive view with increased balance, we introduce a novel balance augmentation technique involving flipping the signs on the poisoned graph.

Specifically, we learn a Bernoulli distribution to determine the flipping of the signs that increase the balanced degree. Let $\Delta=[\Delta_{ij}]_{n\times n}\in[0,1]^{n\times n}$ denote the probability of flipping. The key to our balance augmentation is to learn the optimal $\Delta$ . We further represent the edge flipping Bernoulli distribution as $\mathcal{B}(\Delta_{ij})$ . Then, we can sample a sign perturbation matrix denoted as $E\in\{0,1\}^{n\times n}$ , where $E_{ij}\sim\mathcal{B}(\Delta_{ij})$ indicates whether to flip the sign of edge $(i,j)$ . If $E_{ij}=1$ , we flip the sign; otherwise not. The sampled augmented positive graph can be represented as $A_{p}$ as follows:

A_{p}=A+C\circ E,

(2)

where $C=-2\times A$ denotes legitimate edge sign flipping for each node pair. Specifically, changing the sign of positive edge $(i,j)$ to negative is allowed if $C_{ij}=-2$ , while changing the negative edge sign to positive is allowed if $C_{ij}=2$ . By taking the Hadamard product $C\circ E$ , we obtain valid sign perturbations for the graph.

Since $E$ is a matrix of random variables following Bernoulli distributions, we can easily obtain the expectation of sampled augmented graphs as $\mathbb{E}[A_{p}]=A+C\circ\Delta$ . Therefore, the probability matrix $\Delta$ controls the balance augmentation scheme. To learn the parameter $\Delta$ , we next define the augmentation learning as the following problem:

		$\displaystyle\mathop{\min}_{A_{p}\in\Phi(A)}\mathcal{L}_{ptb}=-\frac{\mathsf{% Tr}(A_{p}^{3})+\mathsf{Tr}(\|A_{p}\|^{3})}{2\mathsf{Tr}(\|A_{p}\|^{3})},$		(3)
		$\displaystyle s.t.\ A_{p}=A+C\circ E,C=-2\times A,E_{ij}\sim\mathcal{B}(\Delta% _{ij}),$		(3)

where $\mathcal{L}_{ptb}$ is the negative balance degree. By minimizing it, we aim to generate positive view with balance degree as large as possible. To avoid deformation of original adjacency matrix $A$ , we add a constraint denoted by $\Phi(A)$ to limit the maximum number of edge flipping from $A$ . In practice, we choose the top $n\%$ of $\Delta_{ij}$ to sample $E_{ij}$ , where $n\%$ is the perturbation budget. With the positive view generated, we next demonstrate the graph encoder and contrastive loss that used to learn the robust embedding.

5.2 Graph Encoder

We adopt SDGCN Ko et al. (2023a) as our encoder, which is currently the state-of-the-art SGNN encoder. SDGCN overcomes the limitations of the graph Laplacian and utilizes complex numbers to represent both the sign and direction information of edges in signed graphs.

5.3 Design of Loss Function

The losses include the contrastive loss $\mathcal{L}_{con}$ , label loss $\mathcal{L}_{label}$ , and balance loss $\mathcal{L}_{balance}$ , which correspond to contrastive learning, the link sign prediction task, and balance augmentation, respectively. We utilize the combination of contrastive loss $\mathcal{L}_{con}$ and label loss $\mathcal{L}_{label}$ to train the encoder’s parameters, while the balance loss $\mathcal{L}_{balance}$ is employed to train the probability matrix $\Delta$ within the augmentation scheme.

Contrastive loss

The contrastive objective focuses on aligning the latent representations of the same node while distinguishing them from other nodes. Two identical nodes from different graph views are considered as an inter-positive pair, while other node pairs are considered inter-negative pairs. For example, a node $u$ from $\widetilde{t_{1}}$ and the same node $u$ from $\widetilde{t_{2}}$ are the inter-positive pair. Conversely, other nodes ${v\in\mathcal{V};v\neq u}$ from $\widetilde{t_{2}}$ are the inter-negative pair with the node $u$ of $\widetilde{t_{1}}$ . Even though the nodes in the inter-positive pair come from different graph views, they are the same nodes. The goal of the inter-view objective is to maximize the similarity of positive pairs and minimize the similarity of negative pairs. The inter-view loss function is defined as:

\mathcal{L}_{inter}=\frac{1}{|\mathcal{V}|}\sum_{u\in\mathcal{V}}log\frac{exp(% (z_{1}^{u}\cdot z_{2}^{u})/\tau)}{\sum_{v\in\mathcal{V}exp((z_{1}^{u}\cdot z_{% 2}^{v})/\tau)}}.

(4)

The intra-view loss serves the purpose of calculating the discriminative loss within a single graph view, in contrast to the inter-view loss which compares the latent representations of nodes between two distinct graph views. It plays a critical role in ensuring that the latent representations of all nodes are distinct from one another, taking into account their individual and unique characteristics. The primary objective is to promote distinctiveness among the latent representations of all nodes. Mathematically, the intra-view loss can be defined as follows:

\mathcal{L}_{intra}=\frac{1}{K}\sum_{k=1}^{K}\frac{1}{|\mathcal{V}|}\sum_{u\in% \mathcal{V}}log\frac{1}{\sum_{v\in\mathcal{V},u\neq v}exp((z_{k}^{u}\cdot z_{k% }^{v})/\tau)},

(5)

where $k$ indicates the graph view index.

The contrastive loss is the sum of the inter-view and intra-view loss functions:

\mathcal{L}_{con}=\mathcal{L}_{inter}+\mathcal{L}_{intra}.

(6)

Label Loss

The augmented views serve as input to the graph encoders, generating node representations $\mathbf{Z}_{1}$ and $\mathbf{Z}_{2}$ . These representations are concatenated and pass through the output layer to produce the final node embedding as:

\mathbf{R}=\sigma([\mathbf{Z}_{1}||\mathbf{Z}_{2}]\mathbf{W}^{out}+\mathbf{B}^% {out}).

(7)

Specifically, after generating the final representations for all nodes by Eq. (7), we utilize a 2-layer MLP to estimate the sign scores from $i$ to $j$ :

\hat{y_{i,j}}=\sigma([\mathbf{r}_{i}||\mathbf{r}_{j}]\mathbf{W}^{pred}+\mathbf% {B}^{pred}).

(8)

The loss function of the link sign prediction is formulated based on the cross entropy:

	$\displaystyle\mathcal{L}_{label}=$	$\displaystyle-\sum_{(i,j)\in\Omega^{+}}y_{i,j}log\sigma(\hat{y_{i,j}})$		(9)
		$\displaystyle-\sum_{(i^{\prime},j^{\prime})\in\Omega^{-}}(1-y_{i^{\prime},j^{% \prime}})log(1-\sigma(\hat{y_{i^{\prime},j^{\prime}}})),$		(9)

where $\Omega^{+}$ and $\Omega^{-}$ denote the training positive node pairs and negative node pairs respectively, $\sigma(\dot{)}$ is sigmoid function, $y_{i,j}$ represent the sign ground truth.

Balance Loss

Balance loss $\mathcal{L}_{balance}$ is the same as Eq. (3). To enhance the positive views, the balance degree serves as a guiding factor.

Algorithm 1 BA-SGCL Training Algorithm

1: for epoch =

0,1

, … do

2: // Learnable Graph Augmentations

3: (Generate a random augmentation scheme initially)

4: Sample a positive view via Eq. (2)

5: // Graph Encoders

6: Obtain two representations of two views

\mathbf{Z}_{1}

and

\mathbf{Z}_{2}

7: // Contrastive Learning

8: Compute inter-view contrastive loss

\mathcal{L}_{inter}

, intra-view contrastive loss

\mathcal{L}_{intra}

, combined contrastive loss

\mathcal{L}_{con}

via Eq. (4), (5) and (6)

9: // Model Training

10: Compute the loss of sign link prediction task

\mathcal{L}_{label}

via Eq. (9) and combination loss

\mathcal{L}

via Eq. (10)

11: Compute balance loss via Eq. (3)

12: Update model parameter

\theta

\frac{\partial\mathcal{L}}{\partial\theta}

and augmentation scheme

\Delta

\frac{\partial\mathcal{L}_{balance}}{\partial\Delta}

13: end for

14: return node representations

Z

5.4 Model Training

Contrastive learning can be viewed as the regularization of the target task, thus we update model encoder’s parameters using the combination, as follow:

\mathcal{L}=\alpha\times\mathcal{L}_{con}+\mathcal{L}_{label}.

(10)

To augment the positive view, the probability matrix $\Delta$ in the augmentation scheme is updated using the balance loss $\mathcal{L}_{balance}$ . This updated $\Delta$ is then used to sample the positive view. If in each round of training, first train balance loss to update the balance augmentation part, and then train contrastive loss and label loss, a lot of time overhead will be incurred. Therefore, we propose to train the above losses at one stage and arrange them uniformly in the model training stage. The learning algorithm is outlined in Algorithm 1.

6 Theoretical Analysis

In this section, we undertake an analysis of balance-related attacks through the lens of mutual information and then present the theoretical foundations of our defense framework.

Theorem 1.

The essence of adversarial attacks is to decrease the mutual information between balanced information and labels $Y$ by the perturbed balanced information $\hat{B}$ , thus reducing model performance:

\mathop{\arg\min}\limits_{\hat{B}}I(\hat{B};Y),

(11)

$I(\dot{;}\dot{)}$ is mutual information. We provide proof in the Appendix. Theorem. 1 provides the insight that offers guidance for defending against attacks: a robust model should conversely increase the mutual information between balance-related information and labels. Next, we introduce the theoretical foundation of our robust model BA-SGCL.

Theorem 2.

The goal of BA-SGCL is to generate robust embedding by maximizing the mutual information between the perturbed graph’s embedding $\mathbf{Z}_{2}$ and the joint distribution of the embedding of positive sample $\mathbf{Z}_{1}$ and labels $Y$ : $\max I((\mathbf{Z}_{1},Y);\mathbf{Z}_{2})$ .

The proof of Theorem. 2 is in the Appendix. In summary, increasing the balance degree of the positive view requires meeting dual requirements: accurately representing the original graph and accurately predicting the labels. The first requirement is achieved through the GCL framework and the contrastive loss proposed by us. The second requirement is fulfilled by the label loss.

7 Experiments

In this section, we test the performance of link sign prediction with seven state-of-the-art SGNNs and our robust model BA-SGCL under different adversarial attacks specifically designed for signed graphs. We aim to provide insights for the following two major questions: Q1: How does BA-SGCL perform compared with other SGNN methods under different signed graph adversarial attacks? Q2: How effective is balance augmentation in BA-SGCL compared to random augmentation in original SGCL?

Datasets and Experiment Settings

We employ four widely-used public real-world datasets: Bitcoin-Alpha, Bitcoin-OTC Kumar et al. (2016), Slashdot Guo and Mohar (2017) and Epinions Guha et al. (2004). Bitcoin-Alpha and Bitcoin-OTC are collected from Bitcoin trading platforms. Slashdot is a renowned technology news website and Epinions is an online social network. Detailed dataset statistics can be found in Table 2.

To conduct our evaluation, we divide the available datasets randomly, allocating $80\%$ of the links for training purposes and reserving the remaining $20\%$ for testing. As the datasets lack attributes, we generate a random 64-dimensional vector as the initial node attribute.

To assess the effectiveness of our approach, we employ four commonly used metrics: Area Under the Curve (AUC), Micro-averaged F1 Score (Micro-F1), Binary F1 Score (Binary-F1), and Macro-averaged F1 Score (Macro-F1). These metrics have been widely utilized in previous studies and offer valuable insights into the performance of SGNN models. Lower values for these metrics indicate poorer model performance and greater susceptibility to attack methods, while higher values indicate the effectiveness of defense models. We report the results using AUC and Macro-F1 as the evaluation metrics, since other metrics exhibit similar trends to the best-performing existing methods.

For adversarial attacks and SGNN models, we utilize the parameters specified in their respective papers. In our experiments, the perturbation rate of attacks ranges from $5\%$ to $20\%$ of the total edges. Our proposed model, BA-SGCL, is implemented using PyTorch Paszke et al. (2019), with a learning rate set to $0.001$ . To ensure an adequate balance degree for the positive view, we impose a lower limit of $0.9$ (within the range of $0$ to $1$ ).

Table 2: Dataset Statistics

Dataset	#Nodes	#Pos-Edges	#Neg-Edges	%Pos-Ratio	%Density
Bitcoin-Alpha	3,784	22,650	1,536	93.65	0.3379%
Bitcoin-OTC	5,901	32,029	3,563	89.99	0.2045%
Slashdot	33,586	295,201	100,802	74.55	0.0702%
Epinions	16,992	276,309	50,918	84.43	0.2266%

Table 3: AUC and Macro-F1 of SGNNs on link sign prediction under Balance-attack

	Ptb(%)	SNE								Attack-tolerant SNE						Proposed
	Ptb(%)	SiNE		SGCN		BESIDE		SDGNN		RSGNN		SGCL		UGCL		BA-SGCL
Metrics		AUC	Macro-F1	AUC	Macro-F1	AUC	Macro-F1	AUC	Macro-F1	AUC	Macro-F1	AUC	Macro-F1	AUC	Macro-F1	AUC	Macro-F1
BitcoinAlpha	0	0.8109	0.6712	0.7992	0.6656	0.8635	0.7106	0.8552	0.7145	0.8034	0.6841	0.8491	0.7121	0.8645	0.7351	0.8869	0.7465
	5	0.7412	0.5811	0.7354	0.5648	0.7972	0.6332	0.8038	0.648	0.7454	0.5848	0.8074	0.6546	0.8266	0.6729	0.8461	0.7164
	10	0.6879	0.5212	0.6913	0.5125	0.7569	0.6047	0.7791	0.5744	0.7063	0.5323	0.7614	0.6056	0.7843	0.6225	0.7997	0.6527
	15	0.6715	0.4911	0.6855	0.4836	0.7328	0.5495	0.7466	0.5478	0.6199	0.5014	0.7256	0.568	0.7485	0.5777	0.7716	0.5994
	20	0.6512	0.4755	0.6535	0.4704	0.6977	0.5139	0.7186	0.5128	0.6025	0.4835	0.6919	0.5312	0.7244	0.5426	0.7479	0.5742
BitconOTC	0	0.8211	0.7612	0.8253	0.7501	0.8858	0.7607	0.8962	0.7511	0.8171	0.7553	0.8931	0.7711	0.8942	0.7801	0.9108	0.8079
	5	0.7613	0.6612	0.7753	0.6471	0.8373	0.7236	0.8565	0.6928	0.7954	0.6574	0.8458	0.7218	0.8602	0.7559	0.8774	0.7814
	10	0.7494	0.6142	0.7504	0.6142	0.8039	0.6455	0.8266	0.6327	0.7452	0.5849	0.8091	0.6611	0.8329	0.6863	0.8476	0.6984
	15	0.7151	0.5798	0.7271	0.5814	0.7713	0.5914	0.7969	0.5824	0.6923	0.5486	0.7827	0.6091	0.7951	0.6402	0.8131	0.6456
	20	0.6812	0.5589	0.6985	0.5621	0.7411	0.5565	0.7561	0.5393	0.6603	0.5194	0.7407	0.5715	0.7654	0.5944	0.7926	0.6111
Slashdot	0	0.8214	0.7214	0.8153	0.7334	0.8389	0.7092	0.8909	0.7203	0.7829	0.6988	0.8848	0.6874	0.8885	0.7375	0.8921	0.7451
	5	0.7322	0.6512	0.7432	0.6422	0.7832	0.6873	0.8285	0.6867	0.7184	0.6484	0.8155	0.6506	0.8479	0.6948	0.8499	0.7391
	10	0.6912	0.5911	0.6892	0.5819	0.7622	0.6643	0.7691	0.6334	0.6564	0.5813	0.7465	0.5911	0.7771	0.6658	0.7938	0.6948
	15	0.6412	0.5412	0.6497	0.5404	0.7393	0.6239	0.7391	0.5989	0.6377	0.5557	0.6918	0.5609	0.7365	0.6397	0.7766	0.6842
	20	0.6211	0.5287	0.6348	0.5307	0.7152	0.6057	0.6972	0.5706	0.5976	0.5215	0.6589	0.5401	0.6911	0.5871	0.7241	0.6491
Epinions	0	0.7911	0.6847	0.7763	0.6957	0.8575	0.7104	0.8591	0.7141	0.7821	0.7161	0.8512	0.7155	0.8723	0.6861	0.8731	0.7182
	5	0.7815	0.6501	0.7711	0.6603	0.8074	0.6958	0.8261	0.7032	0.7535	0.6739	0.8034	0.666	0.8252	0.6846	0.8359	0.7256
	10	0.7421	0.6114	0.7383	0.6125	0.7478	0.6605	0.7981	0.6898	0.7419	0.6432	0.7881	0.6536	0.8027	0.6789	0.8161	0.7125
	15	0.7273	0.5889	0.7142	0.5843	0.7203	0.6339	0.7712	0.6598	0.7257	0.6201	0.7442	0.6165	0.7771	0.6632	0.7895	0.7022
	20	0.6912	0.5712	0.6881	0.5606	0.6997	0.6075	0.7583	0.6367	0.6981	0.5962	0.7136	0.5872	0.7661	0.6465	0.7887	0.6772

Table 4: AUC and Macro-F1 of SGNNs on link sign prediction under FlipAttack

	Ptb(%)	SNE								Attack-tolerant SNE						Proposed
	Ptb(%)	SiNE		SGCN		BESIDE		SDGNN		RSGNN		SGCL		UGCL		BA-SGCL
Metrics		AUC	Macro-F1	AUC	Macro-F1	AUC	Macro-F1	AUC	Macro-F1	AUC	Macro-F1	AUC	Macro-F1	AUC	Macro-F1	AUC	Macro-F1
BitcoinAlpha	0	0.8109	0.6712	0.7992	0.6656	0.8635	0.7106	0.8552	0.7145	0.8034	0.7145	0.8491	0.7121	0.8645	0.7351	0.8869	0.7465
	5	0.7136	0.5618	0.7114	0.5782	0.7751	0.6549	0.7485	0.6312	0.7301	0.6312	0.7749	0.6328	0.7946	0.6535	0.8078	0.6708
	10	0.6854	0.5764	0.6746	0.5543	0.7327	0.5987	0.7252	0.5775	0.6908	0.5775	0.7112	0.5579	0.7238	0.5824	0.7531	0.6102
	15	0.5913	0.4923	0.5984	0.4987	0.6998	0.5621	0.6614	0.5632	0.6261	0.5632	0.6598	0.5239	0.7088	0.5695	0.7256	0.5979
	20	0.5714	0.4412	0.5601	0.4322	0.6576	0.5238	0.6325	0.5088	0.5783	0.5088	0.5888	0.4901	0.6443	0.5288	0.6745	0.5554
BitconOTC	0	0.8211	0.7612	0.8253	0.7501	0.8858	0.7607	0.8962	0.7511	0.8171	0.7553	0.8931	0.7711	0.8942	0.7801	0.9108	0.8079
	5	0.7301	0.6434	0.7397	0.6538	0.7971	0.6875	0.7746	0.6755	0.7447	0.6799	0.7821	0.6885	0.7972	0.6849	0.8197	0.7127
	10	0.6905	0.5996	0.6844	0.6086	0.7057	0.6117	0.7086	0.5987	0.7013	0.6278	0.7117	0.6014	0.7047	0.6182	0.7489	0.6423
	15	0.6598	0.5596	0.6518	0.5639	0.7071	0.5919	0.6889	0.5848	0.6741	0.5856	0.6647	0.5895	0.6967	0.5986	0.7278	0.6284
	20	0.6424	0.5587	0.6315	0.5512	0.6744	0.5822	0.6714	0.5813	0.6677	0.5732	0.6438	0.5628	0.6768	0.5762	0.7181	0.6057
Slashdot	0	0.8214	0.7214	0.8153	0.7334	0.8389	0.7092	0.8909	0.7203	0.7829	0.6988	0.8848	0.6874	0.8885	0.7375	0.8921	0.7451
	5	0.7221	0.6024	0.7193	0.6092	0.7812	0.6356	0.7695	0.6234	0.7253	0.6118	0.7735	0.6301	0.7864	0.6421	0.8014	0.6623
	10	0.6398	0.5279	0.6412	0.5212	0.7395	0.5689	0.7193	0.5589	0.6608	0.5323	0.7214	0.5665	0.7455	0.5812	0.7626	0.6094
	15	0.6195	0.5027	0.6128	0.5058	0.6914	0.5582	0.6819	0.5452	0.6374	0.5112	0.6745	0.5412	0.6979	0.5633	0.7234	0.5757
	20	0.6124	0.4681	0.6041	0.4776	0.6725	0.5193	0.6519	0.4989	0.6235	0.4898	0.6596	0.5025	0.6803	0.5234	0.7035	0.5412
Epinions	0	0.7911	0.6847	0.7763	0.6957	0.8575	0.7104	0.8591	0.7141	0.7821	0.7161	0.8512	0.7155	0.8723	0.6861	0.8731	0.7182
	5	0.7113	0.5789	0.7124	0.5824	0.7764	0.6387	0.7437	0.6358	0.7387	0.6121	0.7765	0.6453	0.7889	0.6412	0.7967	0.6554
	10	0.6814	0.5168	0.6898	0.5215	0.7214	0.5885	0.7255	0.5712	0.7146	0.5524	0.7216	0.5812	0.7311	0.5898	0.7564	0.6018
	15	0.6592	0.4919	0.6698	0.4989	0.6934	0.5415	0.6929	0.5339	0.6822	0.5123	0.6977	0.5416	0.7044	0.5543	0.7219	0.5718
	20	0.6087	0.4996	0.6149	0.4884	0.6611	0.5268	0.6698	0.5279	0.6435	0.5051	0.6598	0.5331	0.6784	0.5413	0.6943	0.5612

Baselines

We evaluate attacks on seven popular SGNN models, which are categorized as with/without attack-tolerant signed graph representation (attack-tolerant SNE/SNE):

•

SiNE Wang et al. (2017) is a signed graph embedding method that uses deep neural networks and extended structural balance theory-based loss function.
•

SGCN Derr et al. (2018) introduces a novel information aggregator based on balance theory, expanding the application of GCN to signed graphs.
•

BESIDE Chen et al. (2018) combines balance and status theory. It utilizes status theory to learn ”bridge” edge information and combines it with triangle information.
•

SGCL Shu et al. (2021) is the first work to generalize GCL to signed graphs.
•

SGDNN Huang et al. (2021) combines both balance and status theory, and introduces four weight matrices to aggregate neighbor features based on edge types.
•

RSGNN Zhang et al. (2023) improves SGNN performance by using structure-based regularizers to highlight the intrinsic properties of signed graphs and reduce vulnerability to input graph noise.
•

UGCL Ko et al. (2023b) presents a GCL framework that incorporates Laplacian perturbation.

We utilize two balance-related adversarial attacks on signed graphs, Balance-attack Zhou et al. (2023): A type of black-box attack that effectively reduces the degree of balance in signed graphs. FlipAttack Zhu et al. (2022): An adversarial attack method against trust prediction in signed graphs, which can effectively downgrade the classification performances for typical machine learning models.

Defense Performance against Attacks (Q1)

To answer Q1, we test the performances of different models under Balance-attack and FlipAttack, which are shown in Table 3 and Table 4, respectively.

We make the following observations from the results. Firstly, existing SGNNs degrade significantly under various attacks, while our model maintains high performance with minimal degradation, indicating its robustness. Secondly, RSGNN performs well against random attacks but exhibits weaker defense against adversarial attacks, likely due to the direct enhancement of the balance degree, which encounters the IBI challenge. Thirdly, even with an attack rate of $0$ , BA-SGCL outperforms other GCL models, attributed to guided balance augmentation for capturing more graph invariance and obtaining higher-quality embeddings.

Analysis of Balance Augmentation (Q2)

Table 5: Effectiveness of Balance Augmentation

Dataset	Metrics	random-SGCL	BA-SGCL
Bitcoin-Alpha	AUC	0.7034	0.7479
Bitcoin-Alpha	Macro-F1	0.5401	0.5742
Bitcon-OTC	AUC	0.7539	0.7926
Bitcon-OTC	Macro-F1	0.5885	0.6111
Slashdot	AUC	0.6798	0.7241
Slashdot	Macro-F1	0.5745	0.6491
Epinions	AUC	0.7523	0.7887
Epinions	Macro-F1	0.6243	0.6772

To evaluate the effectiveness of balance augmentation, we compare BA-SGCL with a control model called random-SGCL. In random-SGCL, sign perturbation is applied to one view of the graph, randomly changing the sign of links. The other view remains unchanged. For the remaining parts, we adopt the same settings as BA-SGCL. The models are tested on the poisoned Bitcoin-Alpha dataset under Balance-attack, with a $20\%$ perturbation rate. The results, shown in Table 5, demonstrate the effectiveness of balance augmentation.

Parameter Analysis

We explore the sensitivity of hyper-parameters $\alpha$ in the loss function. Our objective is to examine how varying the value of $\alpha$ can impact the performance of BA-SGCL. Specifically, we experiment with different hyper-parameter values ranging from 1e-5 to 1e5. We evaluate the performance of BA-SGCL on the Bitcoin-Alpha under Balance-attack, considering an attack rate of 20%. The results depicting the performance of BA-SGCL are presented in Figure 4. Proper settings of $\alpha$ can enhance the performance of BA-SGCL, while large values of $\alpha$ can significantly impair the model’s performance.

8 Conclusion

In this paper, we highlight the vulnerability of existing SGNNs to balance-related adversarial attacks, which greatly impact the balance of signed graphs. To address this issue, we propose balance learning method for restoring attacked graphs, however we discover the IBI challenge. To mitigate balance-related attacks and IBI, we introduce BA-SGCL, a robust SGNN model that combines balance restoration and GCL techniques. Our approach is supported by information theory as the theoretical foundation. We empirically evaluate our model on various signed graph benchmarks under attacks, demonstrating its effectiveness in defense. This work represents the first effort in robust learning to defend against adversarial attacks in the signed graph representation learning, and it holds promising potential for future advancements.

References

Bielak et al. [2022] Piotr Bielak, Tomasz Kajdanowicz, and Nitesh V Chawla. Graph barlow twins: A self-supervised representation learning framework for graphs. Knowledge-Based Systems, 256:109631, 2022.
Cao et al. [2015] Shaosheng Cao, Wei Lu, and Qiongkai Xu. Grarep: Learning graph representations with global structural information. In Proceedings of the 24th ACM international on conference on information and knowledge management, pages 891–900, 2015.
Chen et al. [2018] Yiqi Chen, Tieyun Qian, Huan Liu, and Ke Sun. ” bridge” enhanced signed directed network embedding. In Proceedings of the 27th ACM international conference on information and knowledge management, pages 773–782, 2018.
Davis [1967] James A Davis. Clustering and structural balance in graphs. Human relations, 20(2):181–187, 1967.
Derr et al. [2018] Tyler Derr, Yao Ma, and Jiliang Tang. Signed graph convolutional networks. In 2018 IEEE International Conference on Data Mining (ICDM), pages 929–934. IEEE, 2018.
Godziszewski et al. [2021] Michał Tomasz Godziszewski, Tomasz P Michalak, Marcin Waniek, Talal Rahwan, Kai Zhou, and Yulin Zhu. Attacking similarity-based sign prediction. In 2021 IEEE International Conference on Data Mining (ICDM), pages 1072–1077. IEEE, 2021.
Grassia and Mangioni [2022] Marco Grassia and Giuseppe Mangioni. wsgat: weighted and signed graph attention networks for link prediction. In Complex Networks & Their Applications X: Volume 1, Proceedings of the Tenth International Conference on Complex Networks and Their Applications COMPLEX NETWORKS 2021 10, pages 369–375. Springer, 2022.
Guha et al. [2004] Ramanthan Guha, Ravi Kumar, Prabhakar Raghavan, and Andrew Tomkins. Propagation of trust and distrust. In Proceedings of the 13th international conference on World Wide Web, pages 403–412, 2004.
Guo and Mohar [2017] Krystal Guo and Bojan Mohar. Hermitian adjacency matrix of digraphs and mixed graphs. Journal of Graph Theory, 85(1):217–248, 2017.
Hassani and Khasahmadi [2020] Kaveh Hassani and Amir Hosein Khasahmadi. Contrastive multi-view representation learning on graphs. In International conference on machine learning, pages 4116–4126. PMLR, 2020.
Huang et al. [2021] Junjie Huang, Huawei Shen, Liang Hou, and Xueqi Cheng. Sdgnn: Learning node representation for signed directed networks. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pages 196–203, 2021.
Huang et al. [2022] Zexi Huang, Arlei Silva, and Ambuj Singh. Pole: Polarized embedding for signed networks. In Proceedings of the Fifteenth ACM International Conference on Web Search and Data Mining, pages 390–400, 2022.
Jin et al. [2020] Wei Jin, Yao Ma, Xiaorui Liu, Xianfeng Tang, Suhang Wang, and Jiliang Tang. Graph structure learning for robust graph neural networks. In Proceedings of the 26th ACM SIGKDD international conference on knowledge discovery & data mining, pages 66–74, 2020.
Kirkley et al. [2019] Alec Kirkley, George T Cantwell, and Mark EJ Newman. Balance in signed networks. Physical Review E, 99(1):012320, 2019.
Ko et al. [2023a] Taewook Ko, Yoonhyuk Choi, and Chong-Kwon Kim. A spectral graph convolution for signed directed graphs via magnetic laplacian. Neural Networks, 164:562–574, 2023.
Ko et al. [2023b] Taewook Ko, Yoonhyuk Choi, and Chong-Kwon Kim. Universal graph contrastive learning with a novel laplacian perturbation. In Uncertainty in Artificial Intelligence, pages 1098–1108. PMLR, 2023.
Kraskov et al. [2004] Alexander Kraskov, Harald Stögbauer, and Peter Grassberger. Estimating mutual information. Physical review E, 69(6):066138, 2004.
Kumar et al. [2016] Srijan Kumar, Francesca Spezzano, VS Subrahmanian, and Christos Faloutsos. Edge weight prediction in weighted signed networks. In 2016 IEEE 16th International Conference on Data Mining (ICDM), pages 221–230. IEEE, 2016.
Lai et al. [2023] Yuni Lai, Jialong Zhou, Xiaoge Zhang, and Kai Zhou. Towards certified robustness of graph neural networks in adversarial aiot environments. IEEE Internet of Things Journal, 2023.
Leskovec et al. [2010a] Jure Leskovec, Daniel Huttenlocher, and Jon Kleinberg. Predicting positive and negative links in online social networks. In Proceedings of the 19th international conference on World wide web, pages 641–650, 2010.
Leskovec et al. [2010b] Jure Leskovec, Daniel Huttenlocher, and Jon Kleinberg. Signed networks in social media. In Proceedings of the SIGCHI conference on human factors in computing systems, pages 1361–1370, 2010.
Paszke et al. [2019] Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, et al. Pytorch: An imperative style, high-performance deep learning library. Advances in neural information processing systems, 32, 2019.
Qiu et al. [2020] Jiezhong Qiu, Qibin Chen, Yuxiao Dong, Jing Zhang, Hongxia Yang, Ming Ding, Kuansan Wang, and Jie Tang. Gcc: Graph contrastive coding for graph neural network pre-training. In Proceedings of the 26th ACM SIGKDD international conference on knowledge discovery & data mining, pages 1150–1160, 2020.
Shu et al. [2021] Lin Shu, Erxin Du, Yaomin Chang, Chuan Chen, Zibin Zheng, Xingxing Xing, and Shaofeng Shen. Sgcl: Contrastive representation learning for signed graphs. In Proceedings of the 30th ACM International Conference on Information & Knowledge Management, pages 1671–1680, 2021.
Song and Meyer [2015] Dongjin Song and David A Meyer. Link sign prediction and ranking in signed directed social networks. Social network analysis and mining, 5:1–14, 2015.
Sun et al. [2019] Fan-Yun Sun, Jordan Hoffmann, Vikas Verma, and Jian Tang. Infograph: Unsupervised and semi-supervised graph-level representation learning via mutual information maximization. arXiv preprint arXiv:1908.01000, 2019.
Sun et al. [2022] Lichao Sun, Yingtong Dou, Carl Yang, Kai Zhang, Ji Wang, S Yu Philip, Lifang He, and Bo Li. Adversarial attack and defense on graph data: A survey. IEEE Transactions on Knowledge and Data Engineering, 2022.
Thakoor et al. [2021] Shantanu Thakoor, Corentin Tallec, Mohammad Gheshlaghi Azar, Rémi Munos, Petar Veličković, and Michal Valko. Bootstrapped representation learning on graphs. In ICLR 2021 Workshop on Geometrical and Topological Representation Learning, 2021.
Wang et al. [2017] Suhang Wang, Jiliang Tang, Charu Aggarwal, Yi Chang, and Huan Liu. Signed network embedding in social media. In Proceedings of the 2017 SIAM international conference on data mining, pages 327–335. SIAM, 2017.
Xu et al. [2021a] Dongkuan Xu, Wei Cheng, Dongsheng Luo, Haifeng Chen, and Xiang Zhang. Infogcl: Information-aware graph contrastive learning. Advances in Neural Information Processing Systems, 34:30414–30425, 2021.
Xu et al. [2021b] Hui Xu, Liyao Xiang, Jiahao Yu, Anqi Cao, and Xinbing Wang. Speedup robust graph structure learning with low-rank information. In Proceedings of the 30th ACM International Conference on Information & Knowledge Management, pages 2241–2250, 2021.
Zhang et al. [2023] Zeyu Zhang, Jiamou Liu, Xianda Zheng, Yifei Wang, Pengqian Han, Yupan Wang, Kaiqi Zhao, and Zijian Zhang. Rsgnn: A model-agnostic approach for enhancing the robustness of signed graph neural networks. In Proceedings of the ACM Web Conference 2023, pages 60–70, 2023.
Zhou et al. [2023] Jialong Zhou, Yuni Lai, Jian Ren, and Kai Zhou. Black-box attacks against signed graph analysis via balance poisoning. arXiv preprint arXiv:2309.02396, 2023.
Zhu et al. [2019] Dingyuan Zhu, Ziwei Zhang, Peng Cui, and Wenwu Zhu. Robust graph convolutional networks against adversarial attacks. In Proceedings of the 25th ACM SIGKDD international conference on knowledge discovery & data mining, pages 1399–1407, 2019.
Zhu et al. [2022] Yulin Zhu, Tomasz Michalak, Xiapu Luo, and Kai Zhou. Towards secrecy-aware attacks against trust prediction in signed graphs. arXiv preprint arXiv:2206.13104, 2022.

Appendix A Proof of Theorem. 1

Proof.

Suppose the SGNN model $f_{\theta}$ accepts a signed graph $\mathcal{G}$ as the input and output the embedding $\mathbf{Z}$ : $\mathbf{Z}=f_{\theta}(\mathcal{G})$ . Due to there being no node attributes in real-world signed graph datasets Kumar et al. [2016]; Guha et al. [2004]; Guo and Mohar [2017], existing SGNN aims at capturing structural information and balance-related information to predict labels $Y$ , we can formulate the embedding of SGNN models as follows:

\mathop{\arg\max}\limits_{\theta}I(f_{\theta}(A,B);Y),

(12)

where $A$ and $B$ are structural information and balance-related information respectively. The goal of SGNN is to maximize the mutual information between embeddings and labels.

Since $A$ and $B$ are independent, we can rewrite Eq. (12) as:

\mathop{\arg\max}\limits_{g_{1},g_{2}}I((g_{1}(A),g_{2}(B));Y),

(13)

where $g_{1}$ and $g_{2}$ are two functions that capture structure information and balance-related information respectively. Suppose $h_{A}=g_{1}(A)$ and $h_{B}=g_{2}(B)$ , according to properties of the mutual information, we have:

	$\displaystyle I((g_{1}(A),g_{2}(B));Y)$	$\displaystyle=I((h_{A},h_{B});Y)$		(14)
		$\displaystyle=I(h_{A};Y)+I(h_{B};Y\|h_{A}).$		(14)

Conversed with the goal of SGNN models, the goal of attackers is minimizing Eq. (12) via certain perturbations to induce the model to give wrong predictions.

Specifically, the balance attack perturbs the balance degree of the input signed graph while maintaining its structure. Therefore, $A$ remains unchanged while $B$ is converted to $\hat{B}$ . The target of the balance theory attack can be formulated as:

	$\displaystyle\mathop{\arg\min}\limits_{\hat{B}}I(f_{\theta}(A,\hat{B});Y)$	$\displaystyle=\mathop{\arg\min}\limits_{\hat{B}}I((h_{A},h_{\hat{B}});Y)$		(15)
		$\displaystyle=I(h_{A};Y)+I(h_{\hat{B}};Y\|h_{A}).$		(15)

Both $A$ and $Y$ remain unchanged, thus the target of balance attack is minimizing $I(h_{\hat{B}};Y|h_{A})$ , which means balance attack aims at minimizing the mutual information between balance-related information and labels that are not related to structural information.

∎

Appendix B Proof of Theorem. 2

Proof.

According to principles of mutual information, we can rewrite $I((\mathbf{Z}_{1},Y);\mathbf{Z}_{2})$ as follows:

\displaystyle\max I((\mathbf{Z}_{1},Y);\mathbf{Z}_{2})

\displaystyle=\max(I(\mathbf{Z}_{1},\mathbf{Z}_{2})+I(\mathbf{Z}_{2};Y|\mathbf% {Z}_{1})).

The first term on the right-hand side of the equation implies that the embedding of the positive view should share as much mutual information as possible with the embedding of the original graph, or in other words, the robust embedding should capture high balance characteristics. The second term indicates that the defense model should maximize the mutual information between the embedding and the labels, thereby enabling accurate label predictions. ∎

Adversarially Robust Signed Graph Contrastive Learning from Balance Augmentation

Abstract

1 Introduction

2 Related Works

Graph Contrastive Learning

Attacks and Defenses for Graph Learning

3 Background

3.1 Balance Theory & Balance Degree

3.2 Signed Graph Representation Learning

4 Problem Statements and Preliminary Study

4.1 Threat model

Problem of defense

4.2 Preliminary Study

Adaption from previous defense

Our Solution

5 Proposed Method

5.1 Learnable Balance Augmentation

5.2 Graph Encoder

5.3 Design of Loss Function

Contrastive loss

Label Loss

Balance Loss

5.4 Model Training

6 Theoretical Analysis

Theorem 1.

Theorem 2.

7 Experiments

Datasets and Experiment Settings

Baselines

Defense Performance against Attacks (Q1)

Analysis of Balance Augmentation (Q2)

Parameter Analysis

8 Conclusion

References

Appendix A Proof of Theorem. 1

Proof.

Appendix B Proof of Theorem. 2

Proof.

Adversarially Robust Signed Graph Contrastive Learning
from Balance Augmentation