Deep Graph Learning (DGL) has emerged as a crucial technique across various
domains. However, recent studies have exposed vulnerabilities in DGL models,
such as susceptibility to evasion and poisoning attacks. While empirical and
provable robustness techniques have been developed to defend against graph
modification attacks (GMAs), the problem of certified robustness against graph
injection attacks (GIAs) remains largely unexplored. To bridge this gap, we
introduce the node-aware bi-smoothing framework, which is the first certifiably
robust approach for general node classification tasks against GIAs. Notably,
the proposed node-aware bi-smoothing scheme is model-agnostic and is applicable
for both evasion and poisoning attacks. Through rigorous theoretical analysis,
we establish the certifiable conditions of our smoothing scheme. We also
explore the practical implications of our node-aware bi-smoothing schemes in
two contexts: as an empirical defense approach against real-world GIAs and in
the context of recommendation systems. Furthermore, we extend two
state-of-the-art certified robustness frameworks to address node injection
attacks and compare our approach against them. Extensive evaluations
demonstrate the effectiveness of our proposed certificates.

通过节点感知的双平滑框架，我们引入了第一种可证明对抗图注入攻击的通用节点分类任务的鲁棒方法，并通过严密的理论分析建立了我们平滑方案的可证明条件。此外，我们将两个最先进的可证明鲁棒性框架扩展到节点注入攻击，并与它们进行了比较。广泛的评估证明了我们提出的证书的有效性。

节点感知的双平滑算法：对图注入攻击的认证鲁棒性

Node-aware Bi-smoothing: Certified Robustness against Graph Injection  Attacks

The adversarial robustness of recommendation systems under node injection
attacks has received considerable research attention. Recently, a robust
recommendation system GraphRfi was proposed, and it was shown that GraphRfi
could successfully mitigate the effects of injected fake users in the system.
Unfortunately, we demonstrate that GraphRfi is still vulnerable to attacks due
to the supervised nature of its fraudster detection component. Specifically, we
propose a new attack metaC against GraphRfi, and further analyze why GraphRfi
fails under such an attack. Based on the insights we obtained from the
vulnerability analysis, we build a new robust recommendation system PDR by
re-designing the fraudster detection component. Comprehensive experiments show
that our defense approach outperforms other benchmark methods under attacks.
Overall, our research demonstrates an effective framework of integrating
fraudster detection into recommendation to achieve adversarial robustness.

本文探讨推荐系统中节点注入攻击下的对抗性鲁棒性，提出了一种新的攻击方法 metaC，针对现有推荐系统 GraphRfi 中因为涉及到欺诈者检测而存在的弱点进行了阐述，并根据对新型漏洞的深入分析提出了 PDR 推荐系统来更好地解决此类问题。