Abstract:Graph neural networks (GNNs) have achieved remarkable success in various real-world applications. However, recent studies highlight the vulnerability of GNNs to malicious perturbations. Previous adversaries primarily focus on graph modifications or node injections to existing graphs, yielding promising results but with notable limitations. Graph modification attack (GMA) requires manipulation of the original graph, which is often impractical, while graph injection attack (GIA) necessitates training a surrogate model in the black-box setting, leading to significant performance degradation due to divergence between the surrogate architecture and the actual victim model. Furthermore, most methods concentrate on a single attack goal and lack a generalizable adversary to develop distinct attack strategies for diverse goals, thus limiting precise control over victim model behavior in real-world scenarios. To address these issues, we present a gradient-free generalizable adversary that injects a single malicious node to manipulate the classification result of a target node in the black-box evasion setting. We propose Gradient-free Generalizable Single Node Injection Attack, namely G^2-SNIA, a reinforcement learning framework employing Proximal Policy Optimization. By directly querying the victim model, G^2-SNIA learns patterns from exploration to achieve diverse attack goals with extremely limited attack budgets. Through comprehensive experiments over three acknowledged benchmark datasets and four prominent GNNs in the most challenging and realistic scenario, we demonstrate the superior performance of our proposed G^2-SNIA over the existing state-of-the-art baselines. Moreover, by comparing G^2-SNIA with multiple white-box evasion baselines, we confirm its capacity to generate solutions comparable to those of the best adversaries.

GAA-PPO: A novel graph adversarial attack method by incorporating proximal policy optimization

Single Node Injection Label Specificity Attack on Graph Neural Networks Via Reinforcement Learning

Grimm: A Plug-and-Play Perturbation Rectifier for Graph Neural Networks Defending against Poisoning Attacks

Adversarial Attacks on Graph Neural Networks via Node Injections: A Hierarchical Reinforcement Learning Approach

Adaptive Adversarial Attack on Graph Embedding via GAN

GAIM: Attacking Graph Neural Networks via Adversarial Influence Maximization

Attack Graph Convolutional Networks by Adding Fake Nodes

Graph Agent Network: Empowering Nodes with Inference Capabilities for Adversarial Resilience

Transferring Robustness for Graph Neural Network Against Poisoning Attacks

GANI: Global Attacks on Graph Neural Networks Via Imperceptible Node Injections

Improving Query Efficiency of Black-Box Attacks via the Preference of Deep Learning Models

Graphfool: Targeted Label Adversarial Attack on Graph Embedding

Adversarial Attack on Large Scale Graph

Resisting Graph Adversarial Attack via Cooperative Homophilous Augmentation

Simple and Efficient Partial Graph Adversarial Attack: A New Perspective

Bayesian Adversarial Attack on Graph Neural Networks (student Abstract)

AGSOA:Graph Neural Network Targeted Attack Based on Average Gradient and Structure Optimization

Graph Augmentation Against Structural Poisoning Attacks Via Structure and Attribute Reconciliation

AN-GCN: An Anonymous Graph Convolutional Network Against Edge-Perturbing Attacks

TDGIA: Effective Injection Attacks on Graph Neural Networks

You Only Propagate Once: Painless Adversarial Training Using Maximal Principle