# Adversarial Perturbations of Opinion Dynamics in Networks

We study the connections between network structure, opinion dynamics, and an adversary's power to artificially induce disagreements. We approach these questions by extending models of opinion formation in the social sciences to represent scenarios, familiar from recent events, in which external actors seek to destabilize communities through sophisticated information warfare tactics via fake news and bots. In many instances, the intrinsic goals of these efforts are not necessarily to shift the overall sentiment of the network, but rather to induce discord. These perturbations diffuse via opinion dynamics on the underlying network, through mechanisms that have been analyzed and abstracted through work in computer science and the social sciences. We investigate the properties of such attacks, considering optimal strategies both for the adversary seeking to create disagreement and for the entities tasked with defending the network from attack. We show that for different formulations of these types of objectives, different regimes of the spectral structure of the network will limit the adversary's capacity to sow discord; this enables us to qualitatively describe which networks are most vulnerable against these perturbations. We then consider the algorithmic task of a network defender to mitigate these sorts of adversarial attacks by insulating nodes heterogeneously; we show that, by considering the geometry of this problem, this optimization task can be efficiently solved via convex programming. Finally, we generalize these results to allow for two network structures, where the opinion dynamics process and the measurement of disagreement become uncoupled, and determine how the adversary's power changes; for instance, this may arise when opinion dynamics are controlled an online community via social media, while disagreement is measured along "real-world" connections.

## Authors

• 7 publications
• 62 publications
• 10 publications
11/28/2021

### Local Edge Dynamics and Opinion Polarization

The proliferation of social media platforms, recommender systems, and th...
07/09/2019

### The Mass, Fake News, and Cognition Security

The wide spread of fake news in social networks is posing threats to soc...
03/11/2014

### The Bursty Dynamics of the Twitter Information Network

In online social media systems users are not only posting, consuming, an...
11/30/2021

### The Effect of Iterativity on Adversarial Opinion Forming

Consider the following model to study adversarial effects on opinion for...
07/26/2018

### A general metric for identifying adversarial images

It is well known that a determined adversary can fool a neural network b...
08/25/2018

### Analysis of adversarial attacks against CNN-based image forgery detectors

With the ubiquitous diffusion of social networks, images are becoming a ...
03/18/2020

### Network disruption: maximizing disagreement and polarization in social networks

Recent years have seen a marked increase in the spread of misinformation...
##### This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.

## 1 Introduction

People’s opinions are shaped by their interactions with others. The resulting process of opinion dynamics — the interplay between opinion formation and the network structure of these interactions — has been of great interest in the political science, sociology, economics, and computer science communities among others.

A range of mathematical models have been proposed for opinion dynamics in social networks, representing people as nodes in the network. In typical models, each node in a weighted graph

holds a real-valued opinion that updates in response to the values in their network neighborhood. In perhaps the most natural model, the repeated-averaging model of DeGroot, each node repeatedly takes a weighted average of its own opinion with those of its neighbors; using rich connections between stochastic matrices and Markov chains, it is possible to show that these dynamics lead to all individuals sharing a

consensus opinion in the limit [6]. Much work in the economics and social science literature has studied fundamental questions in this basic model [13].

A typical feature of real-world networks, however, is that even approximate consensus is rarely, if ever, achieved. For that reason, richer models like the Friedkin-Johnsen variation of the standard DeGroot model [9] or the bounded-confidence Hegselmann-Krause model [14] have been proposed to give plausible explanations for how these long-term disagreements can persist while maintaining the strong intuition that one will account for and adjust to the opinions and expressed behaviors of those near them. In this work, we will take the Friedkin-Johnsen model as a primitive; these dynamics closely follow the basic DeGroot model, but allow each node to hold their own immutable internal opinion which always gets incorporated during the repeated averaging.

Discord and Adversarial Perturbations. These types of mathematical models have been used extensively to study both the phenomena associated with consensus and polarization, as well as the role of interventions designed to shift opinions, in which targeting a few individual opinions can shift many others via the network dynamics. While the questions have been quite diverse, they share a crucial underlying assumption, which is that the entities intervening in the process have a preferred opinion that they are seeking to promote.

In the real-world settings that motivate these models, however, a number of important developments have been commanding increasing attention in the past few years. One of these is the rising concern about situations in which outside entities intervene not to promote a specific opinion, but instead to induce a lack of consensus, with the explicit intention of sowing discord. For instance, the U.S. Department of Justice Special Counsel’s Office argues in their 2017 indictment of the Russian Internet Research Agency (IRA) that the IRA used social media and targeted advertising with “a strategic goal to sow discord in the U.S. political system, including the 2016 U.S. presidential election” [22]. This behavior has been seen in multiple countries, and is not limited to any one actor. For example, the doctrine of offensive information warfare by the U.S. intelligence community includes provisions for the instigation of discord between opposing parties [17]. More recently, Twitter disclosed in 2019 that external bots made a coordinated effort to “sow political discord in Hong Kong” with the aim of making protesters less effective at organizing during the Hong Kong independence movement [21]. It is to be expected that as social media becomes more and more prevalent, these sorts of external influences and behaviors will become more frequent.

In such instances, the apparent aim of these attacks is not directly to promote a specific policy agenda, but rather simply to induce disagreement; correspondingly, these external actors strive for more abstract objectives and therefore exhibit more complicated behavior. For example, analysis of Twitter data in the past few years has revealed how bots sponsored in some cases by state actors managed to play both sides of some existing issue to exploit divisions along racial lines, pro- and anti-vaccine groups, NFL kneeling, and gun reform, among other matters [18, 4, 8].

For these types of scenarios, in which an adversary is seeking to promote disagreement, we need to look beyond existing mathematical formulations of opinion maximization and influence in networks. We show how to define a new set of questions in the underlying models of opinion dynamics based on an adversary whose objective function is some measure of node-to-node disagreement. In this paper, we formalize such questions; roughly speaking, we will start from instances of the Friedkin-Johnsen model in which all nodes’ internal opinions are at equilibrium, e.g., they are all equal to , and then we will allow an adversary to perturb these internal opinion subject to some radius constraint modeling resource constraint of the attacker. These seeded internal opinions then diffuse across the network to reach an equilibrium under the Friedkin-Johnsen dynamics, at which point some measure of disagreement among adjacent nodes is measured. Our main goal is to characterize the interplay between graph structure and the adversary’s power: which networks are most susceptible to or resilient to these kinds of perturbations; how can the adversary most efficiently spend a bounded amount of resource in order to produce the maximum disagreement; and how can we most effectively defend a network against such attacks? We will find that these types of questions bring into play new network properties that have not typically arisen in the analysis of traditional questions around consensus, polarization, and opinion maximization.

### 1.1 Our Results

Spectral Properties of Discord. In this work an adversary seeking to maximize some measure of discord among the nodes of a network would like to perturb the internal opinions of the nodes by a bounded amount in order to produce as much discord as possible under the resulting opinion dynamics.

We first show that many such objectives for such an actor can be naturally posed as the maximization of an associated quadratic form of the underlying graph Laplacian. The simple, but crucial observation is that this directly connects the adversary’s power in attaining their objective with the eigenvalues of some function of the underlying graph. The graph Laplacian is an extremely well-studied object, whose spectral properties are known to be good approximations of combinatorial features of the underlying network; this connection will allow us to qualitatively understand what structural properties of the graph matter in these different settings.

For different discord objectives, we find that different regimes of the spectral structure of the underlying networks characterize the ability of this adversary to succeed in their aim. In perhaps the most natural case, we define the disagreement on an edge of the network to be the squared difference of the opinions at the edge’s endpoints; and we define the disagreement of the network to be the sum of the disagreements on all its edges. The challenge for an adversary in maximizing disagreement is that the same network is being used both by the opinion dynamics to average away the disagreement, and by the objective function to measure the disagreement. We can study this effect in terms of a key one-dimensional parameter inherent in the Friedkin-Johnsen opinion dynamics model, controlling the relative weight of a node’s internal opinion and neighboring opinions in determining how it updates its opinion in the next time period. We find, strikingly, that as ranges from to

, the optimal strategy for the adversary is determined by a sequence of vectors that ranges over precisely the set of eigenvectors of the graph Laplacian. This means that for an adversary seeking to induce maximum disagreement, the

entire eigenstructure of the network is relevant.

This dependence on the entire eigenstructure forms a strong contrast with standard graph objective functions that have a spectral interpretation, where we typically find a dependence only on the extreme eigenvectors. Here, by contrast, each eigenvector controls the optimal choice for the adversary at some setting of the opinion dynamics.

We also consider additional discord objectives, finding that the contrast extends here too, with the adversary’s optimal behavior for these other objectives dependent on extreme eigenvectors. In particular, when the adversary’s objective is to maximize the polarization-disagreement index of Musco, Musco, and Tsourakakis [16], the ability of the adversary is directly controlled by the second smallest eigenvalue of the graph Laplacian. Somewhat surprisingly, an infinite-time horizon form of the maximum disagreement objective is also completely determined by the second smallest eigenvalue, despite not holding for the one-period time horizon mentioned above. Through these well-studied connections between the spectral and combinatorial structures of graphs, we can then qualitatively describe which networks, under the Friedkin-Johnsen dynamics, are robust to these sorts of adversarial perturbations.

Network Defense. In Section 4, we generalize the basic model and consider the converse problem of minimizing the ability of such an adversary to promote their objective. Following the general principle that the network topology ought be somewhat difficult to meaningfully change, we allow a network defender to insulate the individuals in the network heterogeneously. Intuitively, this corresponds to making these individuals more difficult for an adversary to influence via their internal opinion. This might be achieved, for instance, through technological literacy initiatives to make it more difficult for certain individuals to be susceptible to the normal modes by which an external actor may seed internal opinions, like bots or fake news.

Formally, we will consider a two-player min-max game, where a network defender can first heterogeneously weigh different individuals in the network (subject to some explicit normalization); the interpretation is that the defender can make some individuals less malleable to seeding. The adversary then solves their objective function as before, but subject to these new weights. The constraints on the defender’s choice will include the option to keep the individuals’ weights the same as above, so that this optimization problem for the defender is upper-bounded by the previous analyses. On the algorithmic side, our main technical contribution in this section is to show that while the adversary’s inner maximization problem no longer has the well-known analytic connection to eigenvalues, for many choices of the adversary’s objective and weight normalization, the network defender’s problem can be globally solved using convex programming. We show this by analyzing the geometry of the defender and adversary’s optimization problems. In particular, this implies the network defender’s problem can be solved efficiently.

Mixed-Graph Objectives. As noted above, the underlying network is playing two distinct roles in our basic model of disagreement: it serves to average opinions of neighboring nodes, and it also serves to measure the disagreement between neighbors in the resulting equilibrium of the opinion dynamics. But if we look at current discussions of the ways in which online interaction may be exacerbating conflict among different opinions, a crucial theme is the way in which the online content that shapes our opinions is being transmitted across networks that may be quite different from the social networks linking us to the people with whom we interact on a daily basis.

These considerations suggest that we return to the adversary’s disagreement maximization problem, but when the network where disagreement is measured can be different from the network where the Friedkin-Johnsen opinion dynamics take place. The individuals and communities one interacts with on social media can be quite global in nature, as well as relatively anonymous and self-selecting; in contrast, one’s real-world interactions are far more dictated by other factors like geography and occupation. It is thus quite natural to think of opinion formation as occurring somewhat orthogonally to these real-world interactions. To sow discord, an adversary might hope to induce disagreement measured via these real-world connections, but must do so filtered through the opinion dynamics in the online world. Intuitively, if the opinion graph which does the smoothing of internal opinions and the disagreement graph look very different, an adversary will be much more powerful than what is possible in the basic model when these graphs must be the same.

To understand this setup, we generalize the adversary’s problem with mixed-graph objective functions in the natural way by considering two distinct graphs at once. One might expect that the adversary is most limited when the opinion graph and disagreement graphs are the same, as then the opinion dynamics smooth out the seeded opinions along the exact same network where disagreements will be measured. Somewhat surprisingly, we show that it is not always the case, even subject to some natural degree normalization; there are explicit, simple disagreement graphs where a different opinion formation graph provably lowers the adversary’s ability to induce disagreement by a non-negligible amount. However, we also give a general lower bound that suggests that these examples are somewhat pathological in that, typically, having different graphs will help the adversary in this aim compared to the single-graph setting. For other disagreement graphs, it will in fact turn out that they are optimal for themselves.

On the one hand, if the measurement and disagreement graphs are highly similar, edge-by-edge, then the adversary’s basic optimization problem has not really changed from the single-graph setting. This is indeed the case, via an easy continuity argument, but not necessary. To that end, we show that if the two graphs are good spectral approximations for each other, then the objective of the adversary is essentially unchanged. It is well-known using celebrated results of Batson, Spielman, and Srivastava the every graph, no matter how dense, has a spectral approximation corresponding to much sparser graph [2]. In particular, this implies that it is not necessary at all for the two graphs to be physically quite similar, only spectrally quite similar.

In the converse direction, it is still quite intuitive that the more dissimilar the two graphs are, the more an adversary will be able to induce disagreement. We show that spectral dissimilarity, appropriately defined, is sufficient for this purpose. Perhaps more interestingly, by specializing to combinatorial structure, it will follow that if the two graphs are misaligned in the sense that their cut structure differs by a large amount along any subset of nodes, then necessarily the adversary is far more capable of inducing disagreement than in the single-graph setting. This provides some theoretical justification for why external actors have been able to effectively sow discord; this can happen when opinion formation and disagreement become uncoupled, as is possible with social media platforms.

### 1.2 Related Work

To our knowledge, the focus on interventions to increase discord in the Friedkin-Johnsen model is new; but in its emphasis on interventions in such models more generally, our work has connections to that of Gionis, et al [10]. In their work, the authors establish the -hardness of a natural opinion maximization problem work in the Friedkin-Johnsen dynamics. They also derive a random walk interpretation of these dynamics to establish submodularity of their problem, enabling a polynomial-time -approximation algorithm using the natural greedy algorithm. We focus on different optimization tasks motivated by recent events aimed at sowing discord in opinion dynamics, and moreover, we do not focus on the computational hardness of such tasks. Indeed, in our setting, the optimization problems will be computationally tractable. Instead, our emphasis will be on the relationship between the graph and the adversary’s power in achieving their aims.

Subsequent work by Musco, Musco, and Tsourakakis [16] considered a problem, given either a fixed graph topology or fixed initial opinions, of determining the optimal choice of the other to minimize their polarization-disagreement index metric. Their main results shows that both of these problems can be efficiently solved via convex optimization. Our approach deviates from theirs in multiple ways: for one, motivated by these recent events, we are interested in a worst-case, adversarial analysis, not in finding best-case settings. Moreover, our general philosophy is that the graph topology for the dynamics is typically quite immutable; the problems we consider will treat the underlying graphs as fixed. We will also be principally concerned with analytically characterizing an adversary’s power in these settings in relation to the underlying graph. In a different direction, prior work by Bindel, Kleinberg, and Oren interprets the Friedkin-Johnsen dynamics as the Nash equilibrium of a natural quadratic cost function [3]; they then characterize the price of anarchy of this equilibrium, namely the ratio between the cost at equilibrium with that of the global optimizer. By using spectral techniques, they establish an upper bound of on this ratio, thereby showing that the equilibrium solution is a good minimizer of the global cost function.

Our current work combines features from all of these prior papers; motivated by current events, we similarly will consider optimization tasks in these dynamics. As mentioned above, we will largely view the underlying graph topology as fixed, and we will consider instead the ability of an adversary to induce discord by supplying internal opinions on some issue that previously was at consensus. We will be primarily concerned with the interplay between graph structure and the adversary’s ability to do so. The opinion dynamics serve to equilibrate any seeded opinions by an external actor, thus dampening the effect of the adversary; however, the connections in the graph can also heighten the resulting disagreement. We also study these competing effects using primarily spectral techniques and convex optimization. The network defense problem and mixed-graph objectives we consider are, to the best of our knowledge, novel to this literature. These models allow for opinion dynamics and disagreement to be slightly orthogonal processes and cannot be completely characterized using the spectral theory of a single graph Laplacian. We hope that these kinds of generalizations may prove an interesting direction for future work.

## 2 Preliminaries

Notation and Background. We start with briefly reviewing some basic facts from spectral graph theory that we will use. In this work, we will consider simple, undirected, weighted graphs , where and . We will usually write for the sum of the weights of all edges in ; in the unweighted case, this is just the total number of edges. One can equivalently think of as being a complete graph, with if and only if . We will usually require to be connected. The adjacency matrix is defined by . Let be the diagonal degree matrix given by and off the diagonal. Then the Laplacian matrix of is given by . It is well-known that , where is the th standard basis vector, and that the quadratic form induced by is given by

 xTLx=∑(i,j)∈Ew(i,j)(x(i)−x(j))2.

It is immediate that is symmetric and positive semidefinite. In general,

will denote the identity matrix of appropriate dimension.

We use standard notation for the Loewner (positive semidefinite) order, i.e. if and only if if and only if is positive semidefinite. For any connected graph as above, it is well-known that and that

 L=n∑i=1λivivTi,

where , and , where is the all-ones vector in . We will write for the set of vectors of unit length in the

-eigenspace of

. Observe that if for all , then . For more on the spectral theory of graphs, see for instance [5, 11].

Given a symmetric matrix with eigendecomposition as above (though with not necessarily nonnegative eigenvalues) and function , we define

 f(A)=n∑i=1f(λi)vivTi.

Note that if we stipulate that for , then if , .

We will write for the usual (Euclidean) norm. We will also consider weighted- norms, defined for a vector by . Note that with this convention, .

Friedkin-Johnson Dynamics. In this paper we will assume that opinions evolve using the Friedkin-Johnson dynamics [9] (FJ dynamics), which we describe next. The dynamic is specified by an undirected simple graph and an initial, internal opinion vector . Starting with , each node updates her opinion by taking the weighted average of her neighbors in , as well her own internal opinion:

 z(t+1)(i)=s(i)+∑j:(i,j)∈Ew(i,j)z(t)(j)1+∑j:(i,j)∈Ew(i,j).

Notice that these equations implicitly normalize a weight of on one’s private opinion. It is well-known that these dynamics converge to a fixed point, and the limiting final opinion vector is given by

 z=(I+L)−1s,

where is the Laplacian of .

## 3 Adversarial Optimization with Friedkin-Johnsen Dynamics

Throughout this section, we will consider variations on the following question: what initial opinions should an adversary induce in a network maximize some objective function after the opinions diffused according to the Friedkin-Johnsen dynamics? And moreover, what qualitative features of the graph make it robust to these perturbations?

We will show how many interesting and natural adversarial objectives can be posed as quadratic forms related to the underlying graph Laplacian . Moreover, we show how different interesting regimes of the spectrum and eigendecomposition of dictate the adversary’s power to achieve their objective for different variants. Formally, we will typically (though not always) be concerned in various formulations of the following optimization problem for an adversary:

 maxs∈Rn:∥s∥2≤RsT(I+L)−1f(L)(I+L)−1s, (1)

where satisfies for ; this restriction is made to ensure that the above quadratic form is nonnegative.

The interpretation is that, on some issue that is currently at consensus in the graph, the adversary will first supply initial opinions , for instance via fake news or targeted advertisements. This is done subject to a fixed norm constraint, which corresponds to a limited budget to perturb initial opinions in this way. These opinions then diffuse and become “smoothed” through the underlying graph via the Friedkin-Johnsen dynamics. The goal of the adversary is to choose these initial opinions in order to maximally induce some desired effect, knowing that whatever initial opinions it seeds, the opinion dynamics dictated by the underlying graph will inevitably partially equilibrate them. Of course, we will be interested in functions where the above holds some sort of physical meaning.

Two of the goals we consider for the adversary are the notions of disgareement and polarization introduced by Musco, Musco, and Tsourakakis [16]:

###### Definition 3.1.

Given any opinion vector and undirected graph , the disagreement of with opinions as

 ∑(i,j)∈Ew(i,j)(x(i)−x(j))2=xTLx,

where is the graph Laplacian of .

Similarly, given just an opinion vector , we write

 ¯¯¯x:=x−xT1n⋅1=(I−1n11T)x

as the de-meaned version of obtained by subtracting off the average of from each component. Then the polarization of is

 ∥¯¯¯x∥22=n∑i=1¯¯¯x(i)2.

In words, the polarization is a measure of variance for

.

### 3.1 Disagreement

First, we consider an adversary that seeds initial opinions subject to a norm constraint with the goal of maximizing disagreement. In the framework above, this can be realized via the choice , and yields the simple objective function

 maxs∈Rn:∥s∥2≤RsT(I+L)−1L(I+L)−1s. (2)

The crucial feature of this objective is the fact that both dictates the measurement of disagreement, and the opinion dynamics themselves. Somewhat surprisingly, for this objective function, the entire eigenstructure of the graph can matter; as is scaled in importance compared to , the adversary passes through each eigenspace in order as they optimize.

###### Theorem 3.1.

For any graph , the objective function (2) is upper bounded by . Moreover, if is connected and we consider the family of problems (2) with for , then the union of the set of optimizers for is precisely .

Proof. By the variational characterization of eigenvalues of symmetric matrices, this amounts to understanding the spectrum of the matrix . This matrix has eigenvalues

 λi(L)(1+λi(L))2,i=1,…,n,

with the same corresponding eigenvectors as . In particular, the optimal value of (2) turns out to be . Consider now the function . It is easy to compute , from which it immediately follows that is increasing for and decreasing for , attaining a peak of at . This immediately gives the upper bound, where equality holds if and only if for some .

For the second statement, as we vary with , the eigenvectors of remain the same, but the eigenvalues scale as . As varies strictly between to infinity, each nonzero eigenvalue of passes through the peak of the function at when . This implies that for this value of , the set of optimizers is , the length vectors in , the -eigenspace. As the optimizer is always an eigenvector of , this proves the second statement. ∎

One way to interpret the previous theorem is by first considering the extreme ranges of . For , is negligible compared to , and so . Physically, this corresponds to each individual not really listening to their neighbors over their own initial opinion, so the opinion dynamics do not substantially change the seeded opinion by the adversary. When this is the case, the above shows that the optimal strategy for the adversary that seeks to induce maximum disagreement is to seed vectors in the direction of . In this case, by the quadratic form (2), the adversary’s strategy is to simply feed in opinions that directly maximize disagreement in , as the opinion dynamics are themselves negligible. The actual vectors in the set attempt to place different values on the two sides of each edge; in that sense, the vectors in can be thought of as solving a type of graph coloring problem [1]. The quantity itself is also known to be closely related to the size of maximum cuts in graphs, see for instance [7, 12, 20].

On the other extreme, for large , , where is the pseudo-inverse of . In this regime, the largest eigenvalue of is the inverse of the smallest nonzero eigenvalue of , which is just , with corresponding optimizer proportional to . In general, it is well-known that and are intimately connected to the normalized sparsest cut of ; if is -regular, then the famous discrete Cheeger inequality asserts that is an approximation to the normalized sparsest cut to a factor of [5]. It is also known that some sweep cut of yields a bipartition that attains this bound. Therefore, in this large regime where graph neighbors are higher weighted than internal opinions, the initial opinion vector inducing maximal disagreement roughly corresponds to a sparse cut. Because the graph interactions in the Friedkin-Johnsen dynamics are so strong compared to the weight of the internal opinions, the optimal strategy of the adversary is roughly to induce disagreement on along some sparse cut of the graph.

As varies between these two regimes, the above result implies that every nontrivial eigenvector becomes relevant. In the intermediate range of , the relative effects of in measuring disagreement and in smoothing the initial opinions via the opinion dynamics directly conflict, which causes the adversary to pass through each eigenspace. For different regimes of how the each individual weighs their internal opinion to those of their neighbors, these effects balance in different ways, leading to this more interesting connection between the eigenstructure of and the adversary’s ability to induce large disagreement in a network with these dynamics.

### 3.2 Polarization and Disagreement

For a different objective, Musco, Musco, and Tsourakakis [16] considered the following cost metric on opinions, which they term the polarization-disagreement index, obtained by taking the sum of the disagreement of in and the polarization of ; the authors show that when this measure is done with final opinions , the polarization-disagreement index of the Friedkin-Johnsen dynamics with graph and initial opinions can be simplified to

 ¯¯¯sT(I+L)−1¯¯¯s.

Note that this is not quite of the form (1), though it is quite similar.

Suppose that an external adversary now chooses the internal opinions to maximize the polarization-disagreement index of the final opinions after undergoing the Friedkin-Johnsen dynamics:

 maxs∈Rn:∥s∥2≤R¯¯¯sT(I+L)−1¯¯¯s=maxs∈Rn:∥s∥2≤RsT(I−1n11T)(I+L)−1(I−1n11T)s.
###### Theorem 3.2.

For any graph , the maximizer of the above maximization problem is , and the resulting objective value is .

Proof. First, notice that for any vector , we have ; this follows from the Pythagorean theorem and decomposing into the parts orthogonal to (namely, ) and the projection onto . Because the above maximization function only depends on the de-meaned version of and is homogenous in , we may assume the adversary restricts to the subspace orthogonal to . As such, the problem becomes

 maxs∈Rn:∥s∥2≤R,s⊥1sT(I+L)−1s.

The eigenvalues of are for the eigenvalues of ; as is the eigenvector for the largest eigenvalue of this matrix, the variational characterization of eigenvalues implies that the above is exactly

 R2⋅λn−1((I+L)−1)=R21+λ2(L),

and this is attained by the set of vectors , as desired. ∎

In particular, it follows that when an adversary chooses to maximize the polarization-disagreement index of under these dynamics, the only relevant structure of the network that determines its robustness to these adversarial perturbations is precisely determined by the second smallest eigenvalue, and the initial opinion vector inducing this are the corresponding eigenvectors. Under the connection between the second smallest eigenvalue and eigenvectors of and sparse cuts discussed above, Theorem 3.2 essentially asserts that the ability of an adversary to induce polarization-disagreement in a graph is essentially determined by the existence of small normalized cuts. Moreover, the actual optimizer for initial opinion vector roughly places large values on one side of a small cut and smaller values on the other side. As an immediate corollary of the above result, we can obtain the following intuitive, but nontrivial fact:

###### Corollary 3.3.

Let be the set of Laplacians of weighted -node graphs subject to the total edge weight normalization . Then

where is the Laplacian of the unweighted simple complete graph .444The factor is just to satisfy the total edge weight condition.

Proof. From the proof of Theorem 3.2, for any fixed Laplacian , the inner maximization yields the objective value ; therefore, the claim is equivalent to showing that the Laplacian has the maximum second-smallest eigenvalue among all .

To see this, observe that for any such , , and therefore

 2m=Tr(L)=n∑i=2λi(L)≥(n−1)⋅λ2(L). (3)

It immediately follows that for any such Laplacian , ; we will be done if we can show that this is attained for the claimed weighted complete graph. But it is not difficult to check that

 λ2(LKn)=n; (4)

after scaling by so that the trace condition is satisfied, we see that this upper bound on is exactly attained, proving optimality. Moreover, this occurs if and only if all of the nonzero eigenvalues are by virtue of (3), which occurs if and only if the graph is the scaled complete graph. ∎

The proof follows from bounding how small the second largest eigenvalue of the Laplacian can be subject to the total edge constraint. This corollary thus states that the complete graph, appropriately weighted, is min-max optimal given the adversary’s objective to induce maximal polarization-disagreement index when running the Friedkin-Johnsen dynamics. More generally, any spectral expander will be robust to these adversarial perturbations, see for instance [15].

### 3.3 Repeated Disagreement

As a simple extension of one-period disagreement considered in Section 3.1, it is natural to consider a similar objective taken over a longer time horizon. An analogous multi-period setting is the following: the adversary supplies the initial opinions , which the Friedkin-Johnsen dynamics take to . In the first period, the disagreement of this equilibrium opinion vector is measured, as before. In the next period, the last period final opinions become the new initial opinions, which subsequently get updated by the dynamics to ; the disagreement of these opinions is then measured and added to the first disagreement. This process is repeated for periods, where .

In this multi-period setting, the adversary’s problem is to maximize the total disagreement across all time periods: putting this in our framework, this is

 maxs∈Rn:∥s∥2≤RsT(I+L)−1(L+(I+L)−1L(I+L)−1+…+(I+L)−TL(I+L)−T)(I+L)−1s.

To understand this setting, notice that we may work orthogonal to , as this gives zero objective value. In this case, the relevant function that acts on the eigenvalues becomes

 f(x)=T∑i=0x(1+x)2i=−(1+x)−2T+(1+x)22+x,

with the convention that the first term is zero when . We thus find that

 maxs∈Rn:∥s∥2≤RsT(I+L)−1(L+(I+L)−1L(I+L)−1+… +(I+L)−TL(I+L)−T)(I+L)−1s =R2⋅max1

Note that for , this reduces to the analysis of the first subsection. Rather curiously, for , this implies that the optimizer of this infinite-period game is precisely , with corresponding objective value . While in the one-shot game considered above, any one of the eigenvectors could be the relevant optimizer, the optimizer of this problem necessarily lies in the direction of .

### 3.4 Absolute Displacement

Along these lines, suppose now that the attacker simply seeks to displace opinions maximally from the consensus at , measured in Euclidean norm. This too can be realized in the above setting: suppose that , so that . In this case, the adversary solves the following problem:

 maxs∈Rn:∥s∥2≤RsT(I+L)−2s=maxs∈Rn:∥s∥2≤R∥(I+L)−1s∥22.

This latter identity shows that for this choice of , the adversary’s goal is indeed to maximize the -norm of the final opinion vector , or equivalently, to displace the final opinions from the initial consensus at as much as possible. However,

 (I+L)−2=n∑i=11(1+λi)2vivTi.

As before, we thus obtain

 maxs∈Rn:∥s∥2≤RsT(I+L)−2s=R2⋅λn((I+L)−2).

But recall that for any graph, the smallest eigenvalue of is , with corresponding eigenvector (and this is unique if is connected); as a result,

 λmax((I+L)−2)=1,

and the unique maximizer (up to sign) is . In particular, for this optimization problem, the network topology plays no role at all. This observation is quite similar to one made in the context of opinion maximization in [10].

## 4 Defending the Network

In this section, we consider the problem of defending a given network from adversarial perturbations like those considered above. We will view this as a two-player min-max game; first, a network defender will choose how to set some qualitative feature of the network subject to normalization constraints modeling the resource limitation of the defender. Then, the adversary performs the above maximization problem with this choice of settings. The goal of the defender is to choose a setting to minimize the cost of the resulting system (e.g., the measure of disagreement), knowing that the adversary will optimize for this choice. In this section, we show that, in one such formulation, the defender can efficiently do this via solving an appropriate convex optimization problem.

We have generally adopted the convention that the network topology is basically fixed; it is unrealistic to substantively change a real-world network structure. Therefore, in this formulation, the network defender chooses how to vary the cost of the adversary in changing initial opinions of different nodes. That is, the network defender can choose to weigh each node differently for example, by lessening their exposure to fake news, so that the adversary pays different costs for perturbing different nodes.

Formally, we consider the following problem: suppose the network defender is resource limited according to a function , such as the -norm, and is permitted to change node-weights with the restriction of . We will consider, under this resource constraint, what the defender’s optimal choice of is. More generally, we will assume that is nonnegative, convex, and radially increasing and homogeneous (i.e. for , , with an increasing function), as well as a function as in (1) that induces a positive semidefinite quadratic form. Then the network defender must solve the following optimization problem:

 minw∈Rn>0:h(w)=h(1){maxs∈Rn:∥s∥w≤RsT(I+L)−1f(L)(I+L)−1s}. (5)

In words, the network defender chooses a weighted -norm on the nodes of the network under the resource constraint modeled by that specifies costs of influencing each individual in the network heterogeneously; with these weights and the same fixed budget as before, the adversary then optimizes their objective. For instance, if is the norm, then this normalization imposes that , so that the sum of weights on the nodes for the adversary is the same as for the regular norm. Other natural choices for include any -norm, or . As a result, is a valid choice of the network defender, in which case the inner maximization corresponds to the largest eigenvalue of the relevant quadratic form as we have seen above. However, for other choices of , the inner maximization does not have the same interpretation and moreover, will not usually admit an analytical expression as it is a maximization of a convex objective.

Here, we show that despite this difficulty, this can be reduced to convex optimization via a geometric argument. For convenience, set ; this is without loss of generality as the inner maximization is homogeneous. Consider the following procedure:

1. Solve the following convex program with positive semidefinite constraints:

 minWh(diag(W)) subject to 0⪯(I+L)−1f(L)(I+L)−1⪯W Wij=0,∀i≠j.
2. Set , where is a solution to the above convex program.

3. Let be such that .

4. Set .

We now show that this procedure gives the optimal setting of .

###### Theorem 4.1.

Under the restrictions on and , the above algorithm yields the optimal value of the problem given by (5).

Proof. Let and be as required and write ; by our assumption on , . For any fixed choice of , the adversary’s optimal choice of is obtained by finding the largest level set of the function that nontrivially intersects the ellipsoid . Equivalently, the optimal value of the adversary is the smallest level set of that contains the unit ball of the norm induced by . In particular, the optimal value of the inner maximization for fixed is the smallest value such that

 {x∈Rn:∥x∥w≤1}⊆{x∈Rn:xTΣx≤K} (6)

By the restriction on to being diagonal in the above convex program (with necessarily nonnegative diagonal entries by the PSD constraint), recall that if and only if for all ,

 ∥x∥2w′=xTWx≥xTΣx;

where ; geometrically, this is equivalent to the containment

 {x∈Rn:∥x∥w′≤1}⊆{x∈Rn:xTΣx≤1}. (7)

In particular, this means that if and only if the unit ball of is contained in the unit ball of the (semi)-norm induced by . Let and be as stated, and let be such that . By the minimality of as well as the positive homogeneity, this implies that if the optimal value of the inner maximization for (5) using is , then using homogeneity of the containments:

 {x∈Rn:∥x∥tw′≤1√K}⊆{x∈Rn:xTΣx≤1} ⟺{x∈Rn:∥x∥w′≤1√t⋅K}⊆{x∈Rn:xTΣx≤1};

as such, .

Suppose now for a contradiction that an optimizer of (1) has strictly smaller objective value than that of . By (6), this is equivalent to

 {x∈Rn:∥x∥w∗≤1√K∗}⊆{x∈Rn:xTΣx≤1} ⟺{x∈Rn:∥x∥K∗w∗≤1}⊆{x∈Rn:xTΣx≤1}.

Evidently, satisfies (7) yet

 h(K∗w∗)=g(K∗)h(w∗)

This violates the optimality of , yielding the desired contradiction. ∎

Note that for certain choices of , the above can be written as a standard semidefinite program. For instance, if , then the above is indeed a regular semidefinite program. If is instead the squared -norm, one can similarly write it as a semidefinite program by adding extra positive semidefinite constraints and exploiting Schur complements; we omit the details here.

## 5 Mixed-Graph Objectives

In the previous sections, we have connected an adversary’s ability to induce discord in a network with the spectral theory of the underlying graph, as well as considered ways to defend against these attacks. In each of these settings, these results suggest that the opinion dynamics of the network will necessarily “soften” the effect of these attacks, as the disagreement is measured on the edges of the same network that dictate the opinion dynamics. However, one potential explanation of the success of recent adversarial attacks described in the introduction is that the opinion formation graph and disagreement measurement graph need not be the same, and may not even look similar. For instance, opinion formation may take place on the “online” network, via social media, while the disagreement the adversary cares about maximizing may be measured with respect to “real-world” connections. When this occurs, it need not be the case that the opinion dynamics implicitly equilibrate disagreements measured along the latter graph. When opinion formation and the disagreement graph look quite different, one expects that an adversary will be able to induce significantly more disagreement.

In this section, we explore the degree to which the adversary’s power can increase when the opinion formation graph and measurement graph become independent. First, we provide nontrivial examples that show that, in some cases, having a different graph for the opinion dynamics and for the disagreement measurement can actually reduce the adversary’s power to induce disagreement; however, we provide a general lower bound that indicates that typically, the adversary will not be much worse off, if at all. We then show that the relevant relationship that will determine when an adversary gains extra power is an appropriate notion of spectral similarity between the two graphs, not necessarily physical similarity. We conclude this section by showing concretely how a large cut misalignment in the graph will enable an adversary to induce disagreement far beyond what is possible in the spectral theory in the single-graph setting.

Formally, we generalize the previous sections as follows: suppose that there are now two relevant graph structures on , and , with associated Laplacians and . The first graph, , is the graph structure on which the Friedkin-Johnsen dynamics take place; the second graph, , is the graph where disagreement is measured. In this setting, the adversary chooses initial opinions to maximize the following objective (setting for notational ease):

 maxs∈Rn:∥s∥2≤1sT(I+L1)−1L2(I+L1)−1s=λmax((I+L1)−1L2(I+L)−1).

In general, it is not obvious how to connect the spectral structure of the above matrix with the spectral properties of the two underlying graphs, unless in the special case where the two graphs commute (and therefore, share an eigenbasis); this is indeed possible in certain special cases.

###### Example 5.1.

Suppose is a -regular, unweighted graph, and let be the -regular, unweighted complementary graph. Then one can check that , where is the matrix of all-ones. Every matrix on the right side shares an eigenbasis, hence and commute. Similarly, suppose that or is a scaled version of the unweighted complete graph . Then it is easy to check that commutes with every graph Laplacian as they will share a common eigenbasis.

One might suspect that, fixing , is the optimal choice of graph Laplacian (subject to normalization) to minimize the amount of disagreement an adversary can induce. That is, letting be the set of graph Laplacians subject to the normalization , one might guess that

 L1∈argminL∈Lλmax((I+L)−1L2(I+L)−1).

However, this does not hold in general, via the following simple construction.

###### Example 5.2.

Suppose that is a complete graph, in the sense that for some , all off-diagonals of the Laplacian satisfy

 L2(i,j)<−ϵ.

If we write out in the eigenbasis as

 L2=n∑i=2λi(L2)vivTi

and further suppose for simplicity that , so that all nonzero eigenvalues lie on one side of the peak of the function , then if we set , we would get an objective value of

 λ2(L2)(1+λ2(L2))2,

as we have seen before. But consider instead the matrix

 L1=(λ2(L2)+η)v2vT2+(λ3(L2)−η)v3vT3+n∑i=4λi(L2)vivTi

for some sufficiently small (depending on ). It is easy to see that as the sum of eigenvalues, and therefore the trace, is constant, and moreover, will still be a Laplacian of some other graph by continuity. As and share an eigenbasis, it is easy to see that for small enough, by the continuity of as well, that

 λmax((I+L1)−1L2(I+L1)−1)=λ2(L2)(1+λ2(L2)+η)2

which is strictly smaller.

However, one expects that this example is largely pathological. As a first approximation to controlling this quantity, our first result is the following general bound for positive semidefinite matrices. The idea is to apply the Courant-Fischer theorem to subspaces spanned by the eigenvectors of the two matrices to lower bound the spectral norm of the product of matrices.

###### Lemma 5.1.

Let be positive semidefinite matrices with eigenvalues in increasing order. Then

 maxk≤n{λn−k+1(C)2λk(B)}≤λn(CBC)=∥CBC∥2≤λn(C)2λn(B).

Proof. Note that by the fact . The upper bound follows directly from the submultiplicativity of the operator norm, which for symmetric positive-semidefinite matrices is just the top eigenvalues.

For the lower bound, we use the Courant-Fischer theorem. First, note that if , the result is trivial, so suppose it is strictly positive. Let be the linear subspace spanned by the top eigenvectors of , and let be the subspace spanned by the top eigenvectors of . These subspaces must intersect non-trivially by a simple dimension argument, so there exists some with unit length. Note that is an invariant subspace for , and moreover, is bijective on by the nondegeneracy of . Now, let , where we view as restricted to . By the variational formula of ,

 λn(CBC)≥xTCBCx∥x∥2=zTBzzTC−2z≥λk(B)∥z∥2∥C−1z∥2=λk(B)∥C−1z∥2

The second inequality follows from Courant-Fischer, as lies in the span of the top eigenvectors of by assumption, so the quadratic form in the numerator gives at least . Then , as the largest eigenvalue of restricted to is the inverse of the smallest eigenvalue of restricted to . Plugging this in gives the desired inequality. As this holds for all , it holds for the maximum. ∎

From this simple lemma, one can immediately obtain a lower bound in the adversary’s optimization problem in the mixed-graph setting.

###### Corollary 5.1.

Let be as above. Then

 λmax((I+L1)−1L2(I+L1)−1)≥max1≤k≤nλk(L2)(1+λk(L1))2.

Proof. This is immediate from the previous lemma, with and , simply noting that

 λn−k+1((I+L1)−1)=11+λk(L1).

Using just this lower bound, in the special case where , the Laplacian of the unweighted complete graph on nodes, it follows that the optimal choice of subject to having the same trace as to minimize the mixed-graph objective is just itself. This holds because for any graph Laplacian satisfying , a similar argument to that of Corollary 3.3 implies that some nontrivial eigenvalue of must be at most . The lower bound of the previous corollary then asserts that the mixed-graph objective can only increase, with equality if and only if .

In a more interesting example, suppose now that we further require that for each . This means that each node has the same weighted degree in both graphs, which in particular implies they have the same trace. First, consider , the four node unweighted cycle graph. One can numerically check that among all graphs satisfying this normalization, the mixed objective is minimized when is a weighted complete graph where each edge in the cycle has weight reduced from to approximately , and the remaining two edges are increased from to . The mixed objective has value approximately , whereas the single-graph objective has largest eigenvalue . For comparison, when is instead set to the appropriately scaled copy of the complete graph, the mixed-objective actually rises to . On the other hand, when , the unweighted path graph on four nodes, it is numerically optimal for itself under the mixed-graph objective for all graphs satisfying the degree constraint. We are unaware of an analytic reason why this should be so.

Nonetheless, the previous corollary asserts that even if the eigenvalues of and are only numerically similar in the appropriate ordering, then necessarily the objective value will be approximately at least the corresponding objective value we considered in Section 3.1. This suggests that while we have shown explicit examples where having two distinct matrices can even reduce the adversary’s power, this case ought be viewed as rather pathological.

### 5.1 Spectral Similarity

The above analysis was relied only on a general lower bound involving positive semidefinite matrices. Next, we aim to characterize the relevant structure of and that causes the objective function to remain quite close to the value in the single-graph case, and similarly when the objective function will increase. The former case will indicate that an adversary gains little benefit from the misalignment of and , while the latter case corresponds to an underlying network that can be sharply exploited to induce large disagreement. Intuitively, if component-wise, then

 λmax((I+L1)−1L2(I+L1)−1)≈λ% max((I+L2)−1L2(I+L2)−1),

by the continuity of matrix inverses and eigenvalues. However, is this the only situation in which this holds?

We show that this condition is merely sufficient, but not necessary; another relevant property that will ensure that this holds is spectral similarity, as defined by Spielman and Teng [19].

###### Definition 5.1.

and are -spectral approximations for each other for some if

 11+ϵL1⪯L2⪯(1+ϵ)L1.

Note that this definition is symmetric in and . It is easy to show from this definition that if and are -spectral approximations of each other, then the adversary’s objective value cannot differ too much from the single-graph setting with just .

###### Theorem 5.2.

Suppose that and are -spectral approximations of each other. Then

 11+ϵmaxi∈[n]minc∈[11+ϵ,1+ϵ]cλi(L2)(1+cλi(L2))2≤λmax((I+L1)−1L2(I+L1)−1)≤(1+ϵ)maxi∈[n]maxc∈[11+ϵ,1+ϵ]cλi(L2)(1+cλi(L2))2.

Proof. The proof is essentially immediate from the definition: pre- and post-multiplying by , we immediately get from the definition that

 11+ϵ(I+L1)−1L1(I+L1)−1⪯(I+L1)−1L2(I+L1)−1⪯(1+ϵ)(I+L1)−1L1(I+L1)−1.

By Weyl’s monotonicity theorem, this implies the corresponding inequality on each of the eigenvalues. We deduce that

 11+ϵλn((I+L1)−1L1(I+L1)−1)⪯λn((I+L1)−1L2(I+L1)−1)⪯(1+ϵ)λn((I+L1)−1L1(I+L1)−1).

To relate this back to the matrix , we again use Weyl’s monotonicity theorem, as then for each ,

 11+ϵλi(L1)≤λi(L2)≤(1+ϵ)λi(L1).

In particular, lies in the -neighborhood of . We showed above that

 λmax((I+L2)−1L2(I+L2)−1)=maxi∈[n]λi(L2)(1+λi(L2))2;

plugging in these “fuzzy” versions of the eigenvalues gives the desired inequalities. ∎

As a corollary, this result shows that it is not necessary for and to be close in, say, Frobenius norm for the eigenvalues for the adversary’s objective value to remain close to the single-graph setting. By seminal results of Batson, Spielman, and Srivastava, every graph Laplacian has a weighted -spectral approximation that corresponds to a graph with edges [2]. Necessarily, these graphs will differ in Frobenius norm by a significant amount, as they can differ in entries. The previous result shows that this is irrelevant; in the mixed-graph objective function, replacing one of these graphs by the other does not meaningfully change the adversary’s power to induce disagreement under the Friedkin-Johnsen dynamics.

### 5.2 Spectral Dissimilarity

In this section, we provide a partial converse to the previous section; we provide a simple condition that will imply that the relevant largest eigenvalue is large that relates to the spectral dissimilarity of and . We then show how this can be realized in the special case of cuts in and ; it will turn out that if and are highly misaligned in the sense of having even one drastically different vertex cut, then the largest eigenvalue is necessarily large.

###### Definition 5.2.

We say and are -bad spectral approximations if there exists with such that and

This definition implies that and are not -spectral approximations for each other, but we will crucially be interested in the actual values, not just the ratio. Moreover, notice that this is not symmetric in the directions of the inequalities, and we will actually care about the numerical values, not just the ratio. For these reasons, the following does not constitute an exact converse, which is essentially immediate from this definition:

###### Proposition 5.3.

Suppose that and are -bad spectral approximations. Then

 λn((I+L1)−1L2(I+L1)−1)≥ηn+(∥L1∥+2)ϵ.

Proof. This follows from the variational characterization:

 λn((I+L1)−1L2(I+L1)−1) =maxz∈RnzT(I+L1)