TDGIA:Effective Injection Attacks on Graph Neural Networks

Abstract

Graph Neural Networks (GNNs) have achieved promising performance in various real-world applications. However, recent studies have shown that GNNs are vulnerable to adversarial attacks. In this paper, we study a recently-introduced realistic attack scenario on graphs -- graph injection attack (GIA). In the GIA scenario, the adversary is not able to modify the existing link structure and node attributes of the input graph, instead the attack is performed by injecting adversarial nodes into it. We present an analysis on the topological vulnerability of GNNs under GIA setting, based on which we propose the Topological Defective Graph Injection Attack (TDGIA) for effective injection attacks. TDGIA first introduces the topological defective edge selection strategy to choose the original nodes for connecting with the injected ones. It then designs the smooth feature optimization objective to generate the features for the injected nodes. Extensive experiments on large-scale datasets show that TDGIA can consistently and significantly outperform various attack baselines in attacking dozens of defense GNN models. Notably, the performance drop on target GNNs resultant from TDGIA is more than double the damage brought by the best attack solution among hundreds of submissions on KDD-CUP 2020.

arXiv commentKDD 2021 research track paper

References in corpus (2)

• Graph Convolutional Neural Networks for Web-Scale Recommender Systems
• Adversarial Attacks on Neural Networks for Graph Data

Cited by in corpus (9)

• Adversarial Attack and Defense on Graph Data: A Survey
• Trustworthy Graph Neural Networks: Aspects, Methods and Trends
• A Comprehensive Survey on Trustworthy Graph Neural Networks: Privacy, Robustness, Fairness, and Explainability
• Simple and Efficient Partial Graph Adversarial Attack: A New Perspective
• Node Injection Attack Based on Label Propagation Against Graph Neural Network
• Leveraging Vulnerabilities in Temporal Graph Neural Networks via Strategic High-Impact Assaults
• RIDA: A Robust Attack Framework on Incomplete Graphs
• Certifying Robustness of Graph Convolutional Networks for Node Perturbation with Polyhedra Abstract Interpretation
• LiSA: Leveraging Link Recommender to Attack Graph Neural Networks via Subgraph Injection