Abstract:While deep neural networks have achieved great success on the graph analysis, recent works have shown that they are also vulnerable to adversarial attacks where fraudulent users can fool the model with a limited number of queries. Compared with adversarial attacks on image classification, performing adversarial attack on graphs is challenging because of the discrete and non-differential nature of a graph. To address these issues, we proposed Cluster Attack, a novel adversarial attack by introducing a set of fake nodes to the original graph which can mislead the classification on certain victim nodes. Specifically, we query the victim model for each victim node to acquire their most adversarial feature, which is related to how the fake node’s feature will affect the victim nodes. We further cluster the victim nodes into several subgroups according to their most adversarial features such that we can reduce the searching space. Moreover, our attack is performed in a practical and unnoticeable manner: (1) We protect the predicted labels of nodes which we are not aimed for from being changed during attack. (2) We attack by introducing fake nodes into the original graph without changing existing links and features. (3) We attack with only partial information about the attacked graph, i.e., by leveraging the information of victim nodes along with their neighbors within k-hop instead of the whole graph. (4) We perform attack with a limited number of queries about the predicted scores of the model in a blackbox manner, i.e., without model architecture and parameters. Extensive experiments demonstrate the effectiveness of our method in terms of the success rate of attack. Department of Computer Science and Technology, Tsinghua University, China. Correspondence to: Zhengyi Wang <wangzy21@mails.tsinghua.edu.cn>. x x x

AdverSparse: An Adversarial Attack Framework for Deep Spatial-Temporal Graph Neural Networks

Spatially Focused Attack against Spatiotemporal Graph Neural Networks

Query-free Black-box Adversarial Attacks on Graphs

Adversarial Attack on Large Scale Graph

Adversarial Attack on Graph Structured Data

Adversarial Defense Framework for Graph Neural Network

Defending Adversarial Attacks in Graph Neural Networks Via Tensor Enhancement

Adversarial Detection on Graph Structured Data.

Dynamics-aware Adversarial Attack of 3D Sparse Convolution Network

DefenseVGAE: Defending against Adversarial Attacks on Graph Data via a Variational Graph Autoencoder

Revisiting Adversarial Attacks on Graph Neural Networks for Graph Classification

Dynamics-aware Adversarial Attack of Adaptive Neural Networks

Spatial-Temporal Graph Learning with Adversarial Contrastive Adaptation

Talos: A More Effective and Efficient Adversarial Defense for GNN Models Based on the Global Homophily of Graphs

RegionSparse: Leveraging Sparse Coding and Object Localization to Counter Adversarial Attacks

Query-based Adversarial Attacks on Graph with Fake Nodes

GraphAttacker: A General Multi-Task GraphAttack Framework

Graph Structure Reshaping Against Adversarial Attacks on Graph Neural Networks

GARNET: Reduced-Rank Topology Learning for Robust and Scalable Graph Neural Networks

Adversarial Attacks on Deep Unfolded Networks for Sparse Coding.

Adversarial Diffusion Attacks on Graph-based Traffic Prediction Models