Questions about PGDAttack

[Leirunlin]

Hi! Thanks for this great repo.
I have some questions about the implementation of PGDAttack.

1. The learning rate of PGDAttack.

   GreatX/greatx/attack/untargeted/pgd_attack.py

   Line 42 in 49675e3

   lr = base_lr * num_budgets / math.sqrt(epoch + 1)

   In the original paper of PGDAttack and implementation of DeepRobust, the learning rate here seems to be
   lr = base_lr / math.sqrt(epoch + 1). I notice that the default value of "base_lr" is kept the same, so the final "lr" would be very different as num_budget is often large. Will this difference matter a lot?
2. The choice of learning rate in PGDAttack.
   As suggested by the authors, PGDAttack prefers different base_lr for different loss_type. I think it would be better if this difference is included.
3. In PGD Example, the same attacker is applied in both poison and evasion settings. In the original implementation, there is a poison version of PGDAttack specific for the poison setting (named as MinMax in the DeepRobust repo). Will this version be included as well?

By the way, it is great to see that the repo is more PyG styled. Does that mean we can attack more PyG models as surrogate or victim models? For example, we can attack GAT and APPNP using PGDAttack as long as they are written in a PyG message-passing framework through edge_index.

[EdisonLeeeee]

Hi @Leirunlin. Thank you for your interest in this repo.

1. Thank you for pointing out that. I followed the implementation from here and adjusted the code from DeepRobust. In my experiments, multiplying lr with num_budgets improves its attack performance and is even better than that of DeepRobust. So I just kept it as a better solution.
2. Agreed. PGDAttack is sensitive to lr and one should carefully tune base_lr to obtain better performance. I can provide some empirical guidance if this is needed.
3. AFAIK, MinMax is less used in literature as a comparison method. I think current implementation of PGDAttack is sufficient, which is also able to perform poisoning attacks by passing training set nodes as victim_nodes. Nevertheless, I can integrate MinMax into this repo as well.
4. Yes, this repo is designed to be completely compatible with PyG in terms of data, layers, and models. You can definitely use any PyG models as surrogate models to perform attacks as long as they are implemented in a form that accepts x, edge_index, edge_weight as input. For now, most attacks except Metattack and Nettack should support most PyG models other than GCN.

[Leirunlin]

Hi. Thanks for your detailed answer.
In my experiments, multiplying lr with num_budgets also improves the performance of CE loss, especially in the poison setting, but is relatively less useful for CW loss. Unfortunately, I didn't find literature discussing this phenomenon. It would be helpful if any advice about the choice of base_lr is provided.
Again, thanks for your efforts on this repo. I'm really looking forward to the released version.

[EdisonLeeeee]

I'll dig into that and report back. The first released version would be coming soon. BTW, the master branch is always available :D