Abstract:Graph neural networks (GNNs) have achieved remarkable success in various real-world applications. However, recent studies highlight the vulnerability of GNNs to malicious perturbations. Previous adversaries primarily focus on graph modifications or node injections to existing graphs, yielding promising results but with notable limitations. Graph modification attack (GMA) requires manipulation of the original graph, which is often impractical, while graph injection attack (GIA) necessitates training a surrogate model in the black-box setting, leading to significant performance degradation due to divergence between the surrogate architecture and the actual victim model. Furthermore, most methods concentrate on a single attack goal and lack a generalizable adversary to develop distinct attack strategies for diverse goals, thus limiting precise control over victim model behavior in real-world scenarios. To address these issues, we present a gradient-free generalizable adversary that injects a single malicious node to manipulate the classification result of a target node in the black-box evasion setting. We propose Gradient-free Generalizable Single Node Injection Attack, namely G^2-SNIA, a reinforcement learning framework employing Proximal Policy Optimization. By directly querying the victim model, G^2-SNIA learns patterns from exploration to achieve diverse attack goals with extremely limited attack budgets. Through comprehensive experiments over three acknowledged benchmark datasets and four prominent GNNs in the most challenging and realistic scenario, we demonstrate the superior performance of our proposed G^2-SNIA over the existing state-of-the-art baselines. Moreover, by comparing G^2-SNIA with multiple white-box evasion baselines, we confirm its capacity to generate solutions comparable to those of the best adversaries.

A Low-cost, High-impact Node Injection Approach for Attacking Social Network Alignment

Combination Attacks and Defenses on SDN Topology Discovery.

Adversarial Attacks on Graph Neural Networks via Node Injections: A Hierarchical Reinforcement Learning Approach

Adversarial Camouflage for Node Injection Attack on Graphs

My Brother Helps Me: Node Injection Based Adversarial Attack on Social Bot Detection

Single Node Injection Label Specificity Attack on Graph Neural Networks Via Reinforcement Learning

Revisiting Node Injection of P2P Botnet.

Node Injection for Class-specific Network Poisoning

Momentum-based Single-Node Injection Attack with Neighbor Suppression Loss

Adaptive neural network tracking and controlling network attack node in WSN

Security Defense of Large Scale Networks Under False Data Injection Attacks: An Attack Detection Scheduling Approach

Are Your Models Still Fair? Fairness Attacks on Graph Neural Networks via Node Injections

Defending SDN against packet injection attacks using deep learning

GANI: Global Attacks on Graph Neural Networks Via Imperceptible Node Injections

Threaten Spiking Neural Networks Through Combining Rate and Temporal Information

Efficient Backdoor Attacks for Deep Neural Networks in Real-world Scenarios

Sniper: A Social Relationship Based Defence for Network Coordinate Systems

Neural Networks-Aided Insider Attack Detection for the Average Consensus Algorithm.

Multi-agent Attacks for Black-box Social Recommendations

Adversarial Attacks Against Deep Learning-Based Network Intrusion Detection Systems and Defense Mechanisms