Abstract:Graph Neural Networks (GNNs) have achieved state-of-the-art performance in various graph structure related tasks such as node classification and graph classification. However, GNNs are vulnerable to adversarial attacks. Existing works mainly focus on attacking GNNs for node classification; nevertheless, the attacks against GNNs for graph classification have not been well explored. In this work, we conduct a systematic study on adversarial attacks against GNNs for graph classification via perturbing the graph structure. In particular, we focus on the most challenging attack, i.e., hard label black-box attack, where an attacker has no knowledge about the target GNN model and can only obtain predicted labels through querying the target model.To achieve this goal, we formulate our attack as an optimization problem, whose objective is to minimize the number of edges to be perturbed in a graph while maintaining the high attack success rate. The original optimization problem is intractable to solve, and we relax the optimization problem to be a tractable one, which is solved with theoretical convergence guarantee. We also design a coarse-grained searching algorithm and a query-efficient gradient computation algorithm to decrease the number of queries to the target GNN model. Our experimental results on three real-world datasets demonstrate that our attack can effectively attack representative GNNs for graph classification with less queries and perturbations. We also evaluate the effectiveness of our attack under two defenses: one is well-designed adversarial graph detector and the other is that the target GNN model itself is equipped with a defense to prevent adversarial graph generation. Our experimental results show that such defenses are not effective enough, which highlights more advanced defenses.

Transferable Structure-based Adversarial Attack of Heterogeneous Graph Neural Network

HGAttack: Transferable Heterogeneous Graph Adversarial Attack

Revisiting Adversarial Attacks on Graph Neural Networks for Graph Classification

GraphAttacker: A General Multi-Task GraphAttack Framework

Boosting Transferability of Targeted Adversarial Examples via Hierarchical Generative Networks

Disttack: Graph Adversarial Attacks Toward Distributed GNN Training

Transferable Graph Backdoor Attack

Resisting Graph Adversarial Attack via Cooperative Homophilous Augmentation

Universally Robust Graph Neural Networks by Preserving Neighbor Similarity

EMHDRL: Adversarial Attacks on Graph Neural Networks via Hierarchical Reinforcement Learning

Adversarial Attack on Large Scale Graph

Toward Understanding and Boosting Adversarial Transferability from a Distribution Perspective

HC-Ref: Hierarchical Constrained Refinement for Robust Adversarial Training of GNNs

Delving into Transferable Adversarial Examples and Black-box Attacks

Adversarial Detection on Graph Structured Data.

Explainable AI Security: Exploring Robustness of Graph Neural Networks to Adversarial Attacks

A Hard Label Black-box Adversarial Attack Against Graph Neural Networks

Adversarial Attack on Graph Structured Data

Improving Adversarial Transferability with Neighbourhood Gradient Information

Promoting Adversarial Transferability via Dual-Sampling Variance Aggregation and Feature Heterogeneity Attacks

A Survey on Transferability of Adversarial Examples across Deep Neural Networks