Scholarlink

Abstract <p>With the increasing use of artificial intelligence (AI) models, more attention is being paid to trust and security of AI systems against threats of various types (evasion attacks, poisoning, membership inference, etc.). In this work, we focus on graph node classification, highlighting it as one of the most complex tasks. To&#xa0;the best of our knowledge, this is the first study that explores the relationship between defense methods for AI models against different threats on graph data. Our experiments are conducted on citation and purchase graph datasets. We demonstrate that, in general, it is not advisable to simply combine defense methods against different types of threats, as this can lead to severe negative consequences, including a complete loss of model effectiveness. Furthermore, we provide a theoretical proof of the contradiction between defense methods against poisoning attacks on graphs and adversarial training.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

The Defender’s Dilemma: Are Defense Methods Against Different Attacks on Machine Learning Models Compatible?

  • 期刊论文

  • 发表日期：

    2025年12月1日

查看全文
  • G. V. Sazonov,
  • K. S. Lukyanov,
  • I. N. Meleshin

摘要

Abstract

With the increasing use of artificial intelligence (AI) models, more attention is being paid to trust and security of AI systems against threats of various types (evasion attacks, poisoning, membership inference, etc.). In this work, we focus on graph node classification, highlighting it as one of the most complex tasks. To the best of our knowledge, this is the first study that explores the relationship between defense methods for AI models against different threats on graph data. Our experiments are conducted on citation and purchase graph datasets. We demonstrate that, in general, it is not advisable to simply combine defense methods against different types of threats, as this can lead to severe negative consequences, including a complete loss of model effectiveness. Furthermore, we provide a theoretical proof of the contradiction between defense methods against poisoning attacks on graphs and adversarial training.