Abstract:Graph Neural Networks (GNNs) have achieved state-of-the-art performance in various graph structure related tasks such as node classification and graph classification. However, GNNs are vulnerable to adversarial attacks. Existing works mainly focus on attacking GNNs for node classification; nevertheless, the attacks against GNNs for graph classification have not been well explored. In this work, we conduct a systematic study on adversarial attacks against GNNs for graph classification via perturbing the graph structure. In particular, we focus on the most challenging attack, i.e., hard label black-box attack, where an attacker has no knowledge about the target GNN model and can only obtain predicted labels through querying the target model.To achieve this goal, we formulate our attack as an optimization problem, whose objective is to minimize the number of edges to be perturbed in a graph while maintaining the high attack success rate. The original optimization problem is intractable to solve, and we relax the optimization problem to be a tractable one, which is solved with theoretical convergence guarantee. We also design a coarse-grained searching algorithm and a query-efficient gradient computation algorithm to decrease the number of queries to the target GNN model. Our experimental results on three real-world datasets demonstrate that our attack can effectively attack representative GNNs for graph classification with less queries and perturbations. We also evaluate the effectiveness of our attack under two defenses: one is well-designed adversarial graph detector and the other is that the target GNN model itself is equipped with a defense to prevent adversarial graph generation. Our experimental results show that such defenses are not effective enough, which highlights more advanced defenses.

Black-Box Attacks against Signed Graph Analysis via Balance Poisoning

Adversarial Robustness of Link Sign Prediction in Signed Graphs

Blindfolded Attackers Still Threatening: Strict Black-Box Adversarial Attacks on Graphs.

A2S2-GNN: Rigging GNN-Based Social Status by Adversarial Attacks in Signed Social Networks

Query-free Black-box Adversarial Attacks on Graphs

RSGNN: A Model-agnostic Approach for Enhancing the Robustness of Signed Graph Neural Networks

Population-Level Balance in Signed Networks

Applications of Structural Balance in Signed Social Networks

Black-Box Attacks On Graph Neural Networks via White-Box Methods With Performance Guarantees

Signed Bipartite Graph Neural Networks

Adversarial Attack on Large Scale Graph

A Hard Label Black-box Adversarial Attack Against Graph Neural Networks

Greedy-Based Black-Box Adversarial Attack Scheme on Graph Structure

Balancing Augmentation with Edge-Utility Filter for Signed GNNs

Balance Maximization in Signed Networks via Edge Deletions

Scalable Algorithm for Finding Balanced Subgraphs with Tolerance in Signed Networks

Signed Graph Neural Network with Latent Groups.

Link Polarity Prediction from Sparse and Noisy Labels via Multiscale Social Balance

Mitigating Degree Bias in Signed Graph Neural Networks

BinarizedAttack: Structural Poisoning Attacks to Graph-based Anomaly Detection

Against Signed Graph Deanonymization Attacks on Social Networks