mlsanityData to 7 Oct 2026

Attacking Graph Neural Networks with Bit Flips: Weisfeiler and Lehman Go Indifferent

arXiv 2311.01205 ↗First posted 2 Nov 2023cs.LG cs.AI cs.CRcited by 0

Not on the map. Why?

Abstract (arXiv)

Prior attacks on graph neural networks have mostly focused on graph poisoning and evasion, neglecting the network's weights and biases. Traditional weight-based fault injection attacks, such as bit flip attacks used for convolutional neural networks, do not consider the unique properties of graph neural networks. We propose the Injectivity Bit Flip Attack, the first bit flip attack designed specifically for graph neural networks. Our attack targets the learnable neighborhood aggregation functions in quantized message passing neural networks, degrading their ability to distinguish graph structures and losing the expressivity of the Weisfeiler-Lehman test. Our findings suggest that exploiting mathematical properties specific to certain graph neural network architectures can significantly increase their vulnerability to bit flip attacks. Injectivity Bit Flip Attacks can degrade the maximal expressive Graph Isomorphism Networks trained on various graph property prediction datasets to random output by flipping only a small fraction of the network's bits, demonstrating its higher destructive power compared to a bit flip attack transferred from convolutional neural networks. Our attack is transparent and motivated by theoretical insights which are confirmed by extensive empirical results.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Builds on 46 of its 93 references that are in the map. First posted on arXiv 2 Nov 2023.

Builds on

46 of 93 references.

References · 46

  1. 2016Semi-Supervised Classification with Graph Convolutional Networkscited by 11,282
  2. 2018How Powerful are Graph Neural Networks?cited by 4,355
  3. 2019Fast Graph Representation Learning with PyTorch Geometriccited by 2,414
  4. 2020Open Graph Benchmark: Datasets for Machine Learning on Graphscited by 2,148
  5. 2013Estimating or Propagating Gradients Through Stochastic Neurons for Conditional Computationcited by 2,031
  6. 2017Deep Setscited by 1,394
  7. 2017MoleculeNet: A Benchmark for Molecular Machine Learningcited by 1,037
  8. 2018Weisfeiler and Leman Go Neural: Higher-order Graph Neural Networkscited by 878
  9. 2020TUDataset: A collection of benchmark datasets for learning with graphscited by 718
  10. 2020Towards Deeper Graph Neural Networkscited by 296
  11. 2019Adversarial Attacks and Defenses in Images, Graphs and Text: A Reviewcited by 234
  12. 2021Adversarial Graph Augmentation to Improve Graph Contrastive Learningcited by 200
34 more
  1. 2021ETA Prediction with Graph Neural Networks in Google Mapscited by 130
  2. 2021Weisfeiler and Leman go Machine Learning: The Story so farcited by 121
  3. 2022A Comprehensive Survey on Trustworthy Graph Neural Networks: Privacy, Robustness, Fairness, and Explainabilitycited by 118
  4. 2019TBT: Targeted Neural Network Attack with Bit Trojancited by 112
  5. 2019Bit-Flip Attack: Crushing Neural Network with Progressive Bit Searchcited by 106
  6. 2020Degree-Quant: Quantization-Aware Training for Graph Neural Networkscited by 93
  7. 2020Towards More Practical Adversarial Attacks on Graph Neural Networkscited by 76
  8. 2022Theory of Graph Neural Networks: Representation and Learningcited by 60
  9. 2018Cache Telepathy: Leveraging Shared Resource Attacks to Learn DNN Architecturescited by 56
  10. 2019Terminal Brain Damage: Exposing the Graceless Degradation in Deep Neural Networks Under Hardware Fault Attackscited by 55
  11. 2020DeepHammer: Depleting the Intelligence of Deep Neural Networks through Targeted Chain of Bit Flipscited by 53
  12. 2020Binary Graph Neural Networkscited by 32
  13. 2021Heterogeneous Similarity Graph Neural Network on Electronic Health Recordscited by 29
  14. 2022Graph Neural Networks in IoT: A Surveycited by 27
  15. 2020SGQuant: Squeezing the Last Bit on Graph Neural Networks with Specialized Quantizationcited by 25
  16. 2022Unsupervised Graph Poisoning Attack via Contrastive Loss Back-propagationcited by 25
  17. 2020SNIFF: Reverse Engineering of Neural Networks with Fault Attackscited by 22
  18. 2020NeuroAttack: Undermining Spiking Neural Networks Security through Externally Triggered Bit-Flipscited by 21
  19. 2022Exponentially Improving the Complexity of Simulating the Weisfeiler-Lehman Test with Graph Neural Networkscited by 20
  20. 2019RowHammer: A Retrospectivecited by 19
  21. 2021The Power of the Weisfeiler-Leman Algorithm for Machine Learning with Graphscited by 19
  22. 2021RADAR: Run-time Adversarial Weight Attack Detection and Accuracy Recoverycited by 18
  23. 2023Aegis: Mitigating Targeted Bit-flip Attacks against Deep Neural Networkscited by 17
  24. 20221-WL Expressiveness Is (Almost) All You Needcited by 15
  25. 2018CSI Neural Network: Using Side-channels to Recover Your Artificial Neural Network Informationcited by 9
  26. 2021A Generalized Weisfeiler-Lehman Graph Kernelcited by 9
  27. 2021HASHTAG: Hash Signatures for Online Detection of Fault-Injection Attacks on Deep Neural Networkscited by 9
  28. 2021Adaptive Precision Training (AdaPT): A dynamic fixed point quantized training approach for DNNscited by 8
  29. 2022PatchGT: Transformer over Non-trainable Clusters for Learning Graph Representationscited by 8
  30. 2018Nethammer: Inducing Rowhammer Faults through Network Requestscited by 7
  31. 2019U-Net Fixed-Point Quantization for Medical Image Segmentationcited by 7
  32. 2022A Closer Look at Evaluating the Bit-Flip Attack Against Deep Neural Networkscited by 5
  33. 2021ZeBRA: Precisely Destroying Neural Networks with Zero-Data Based Repeated Bit Flip Attackcited by 3
  34. 2021Stealthy Attack on Algorithmic-Protected DNNs via Smart Bit Flippingcited by 3

Built on by

Not cited yet.