Poisoning Knowledge Graph Embeddings via Relation Inference Patterns

Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing, pages 1875–1888 August 1–6, 2021. ©2021 Association for Computational Linguistics 1875 Poisoning Knowledge Graph Embeddings via Relation Inference Patterns Peru Bhardwaj1 John Kelleher2∗ Luca Costabello3∗ Declan O’Sullivan1∗ 1 ADAPT Centre, Trinity College Dublin, Ireland 2 ADAPT Centre, TU Dublin, Ireland 3 Accenture Labs, Ireland peru.bhardwaj@adaptcentre.ie Abstract We study the problem of generating data poi- soning attacks against Knowledge Graph Em- bedding (KGE) models for the task of link pre- diction in knowledge graphs. To poison KGE models, we propose to exploit their inductive abilities which are captured through the rela- tionship patterns like symmetry, inversion and composition in the knowledge graph. Specifi- cally, to degrade the model’s prediction confi- dence on target facts, we propose to improve the model’s prediction confidence on a set of decoy facts. Thus, we craft adversarial addi- tions that can improve the model’s prediction confidence on decoy facts through different inference patterns. Our experiments demon- strate that the proposed poisoning attacks out- perform state-of-art baselines on four KGE models for two publicly available datasets. We also find that the symmetry pattern based at- tacks generalize across all model-dataset com- binations which indicates the sensitivity of KGE models to this pattern. 1 Introduction Knowledge graph embeddings (KGE) are increas- ingly deployed in domains with high stake deci- sion making like healthcare and finance (Noy et al., 2019), where it is critical to identify the potential se- curity vulnerabilities that might cause failure. But the research on adversarial vulnerabilities of KGE models has received little attention. We study the adversarial vulnerabilities of KGE models through data poisoning attacks. These attacks craft input perturbations at training time that aim to subvert the learned model’s predictions at test time. Poisoning attacks have been proposed for mod- els that learn from other graph modalities (Xu et al., 2020) but they cannot be applied directly to KGE models. This is because they rely on gradients of ∗Equal contribution by last authors. Figure 1: Composition based adversarial attack on fraud detection. The knowledge graph consists of two types of en- tities - Person and BankAccount. The target triple to predict is (Karl, affiliated with, Joe the mobster). Original KGE model predicts this triple as True. But a malicious at- tacker adds adversarial triples (in purple) that connect Karl with a non-suspicious person Bob through composition pat- tern. Now, the KGE model predicts the target triple as False. all possible entries in a dense adjacency matrix and thus, do not scale to large knowledge graphs with multiple relations. The main challenge in de- signing poisoning attacks for KGE models is the large combinatorial search space of candidate per- turbations which is of the order of millions for benchmark knowledge graphs with thousands of nodes. Two recent studies (Zhang et al., 2019a; Pezeshkpour et al., 2019) attempt to address this problem through random sampling of candidate perturbations (Zhang et al., 2019a) or …

Content truncated to 500 words