Train a graph detector and reorder its nodes

Course · Data modalities · Notebook

Learn directly from a six-node adjacency matrix. Poison its accepted labels, then reorder node positions without changing labelled connections.

Optional self-paced practice; not used in the lectures. Predict first, change one thing, compare, then explain. No account, installation or API key.

Ten-minute route

Use 2 minutes to inspect and predict; 2 to train and inspect weights; 2 to poison and retrain; 2 to change the input with frozen models; 2 to restore and explain. R means needs review; N means no review in this supplied case. Use the same threshold throughout. Stop playback before switching views.

Teaching steps: predict, do, observe, explain

1. Reset; keep 0 label edits and threshold 0.50. Read nodes A–F and arrows. Training labels shows the actual directed adjacency matrices.

2. Train both 500 updates. One weight belongs to each of 36 matrix cells. Compare the two copies before changing labels.

3. Choose Matrix input: trace A→D using its row and column. Then open Weights & loss: one learned weight belongs to each cell. Node order is not automatically ignored.

4. Change 9 review labels to no review; inspect R→N, then retrain both. Compare catches on the unchanged evaluation cases.

5. Return to Input & scores; rotate node order by 3 and Reorder nodes. Trace labels and arrows: the logical edges stay fixed while scores can change.

6. Restore input; set label edits to 0 and retrain. Explain poisoning versus representation evasion and propose a node-permutation evaluation.

Next/Back changes the instruction only. Train both performs actual gradient updates in a local Web Worker. Playback changes neither weights nor labels. Changing accepted labels resets both copies for a matched retraining; changing a threshold only changes routing.

What reaches the model?

A directed 6×6 adjacency matrix: cell (row, column) is 1 when that observed flow exists and 0 otherwise. Nodes A–F are user, app, backup, export, proxy and external destination. Each case has a known path; training/development examples sometimes add an authored background edge. Case context assigns review labels; topology alone does not establish malicious intent.

The learner fits one weight per matrix cell, using a consistent A–F node order during training. Reordering rows and columns together while carrying the node identities with them preserves every labelled edge. The displayed graph relocates nodes but retains their names and arrows. The flat-matrix classifier can change its score because it has no built-in node-order invariance. This is actual learning from graph structure, not a graph neural network or a demonstrated invariant graph representation.

Node roles are currently implicit in fixed A–F positions. Both canonical cases have the same unlabelled shape: a directed three-edge path and two isolated nodes. A more general model must receive the relevant node-role features, or use a trusted canonical representation. Permutation invariance alone cannot distinguish cases after those roles have been discarded.

Record one comparison

Keep threshold 0.50 for the reference comparison. Write which surface changed: accepted learning labels, presented input, or routing threshold. Explain one security observation still missing before an action.

Each learner uses 24 training and 16 separately seeded development examples from two authored families. Both models start at zero and use the same 500-update budget; evaluation labels never train them. Scores are not calibrated attack probabilities. These small development cases cannot establish real-world detection performance.

If training or media playback is unavailable

Draw A→D→E→F. Put the nodes in a different order, moving the labels with them. List the same identity-based edges and lay out both adjacency matrices. Ask which cell receives each edge. If the worker failed, report a representation comparison rather than completed training.

Explain it to your partner

Question: A→D→E→F is unchanged after reordering. Under what system assumption could this become an evasion surface?

Take 30 seconds each: point to the input, name the one change, then cite an observation from your run. A useful explanation: The lab shows sensitivity to serialisation. A practical evasion claim also needs evidence that an attacker can influence the accepted node order.

Read next: Concept and research connection. The reading is optional; you do not need its mathematics for this exercise.