Graph Neural Networks (GNNs) have emerged as potent models for graph learning. Distributing the training process across multiple computing nodes is the most promising solution to address the challenges of ever-growing real-world graphs. However, current adversarial attack methods on GNNs neglect the characteristics and applications of the distributed scenario, leading to suboptimal performance and inefficiency in attacking distributed GNN training. In this study, we introduce Disttack, the first framework of adversarial attacks for distributed GNN training that leverages the characteristics of frequent gradient updates in a distributed system. Specifically, Disttack corrupts distributed GNN training by injecting adversarial attacks into one single computing node. The attacked subgraphs are precisely perturbed to induce an abnormal gradient ascent in backpropagation, disrupting gradient synchronization between computing nodes and thus leading to a significant performance decline of the trained GNN. We evaluate Disttack on four large real-world graphs by attacking five widely adopted GNNs. Compared with the state-of-the-art attack method, experimental results demonstrate that Disttack amplifies the model accuracy degradation by 2.75$\times$ and achieves speedup by 17.33$\times$ on average while maintaining unnoticeability.

翻译：图神经网络（GNN）已成为图学习的有力模型。将训练过程分布在多个计算节点上是应对日益增长的真实世界图数据挑战的最有前景的解决方案。然而，当前针对GNN的对抗攻击方法忽视了分布式场景的特性和应用，导致攻击分布式GNN训练时性能次优且效率低下。在本研究中，我们提出Disttack——首个面向分布式GNN训练的对抗攻击框架，该框架利用了分布式系统中频繁梯度更新的特性。具体而言，Disttack通过将对抗攻击注入单个计算节点来破坏分布式GNN训练。被攻击的子图被精确扰动，以在反向传播中诱导异常的梯度上升，从而破坏计算节点间的梯度同步，导致训练所得GNN的性能显著下降。我们在四个大型真实世界图上评估了Disttack，并攻击了五种广泛采用的GNN。与最先进的攻击方法相比，实验结果表明，Disttack将模型准确率下降幅度放大2.75倍，平均加速比达17.33倍，同时保持隐蔽性。