Scalable Attack on Graph Data by Injecting Vicious Nodes

Wang, Jihong; Luo, Minnan; Suya, Fnu; Li, Jundong; Yang, Zijiang; Zheng, Qinghua

doi:10.48550/arxiv.2004.13825

Cited by 3 publications

(16 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A more realistic scenario, graph injection attack (GIA), is studied in [17,19], which injects new vicious nodes instead of modifying the original graph. [17] proposes Node Injection Poisoning Attack (NIPA) based on reinforcement learning strategy.…”

Section: Related Workmentioning

confidence: 99%

“…In view of the gap, very recent efforts [17,19], including the KDD-CUP 2020 competition 1 , have been devoted to adversarial attacks on GNNs under the setting of graph injection attack (GIA). Specifically, the GIA task in KDD-CUP 2020 is formulated as follows: (1) Black-box attack, where the adversaries do not have access to the target GNN model or the correct labels of the target nodes; (2) Evasion attack, where the attacks can only be performed during the inference stage.…”

Section: Introductionmentioning

confidence: 99%

“…Table 1 summarizes the differences. First, NIPA [17] and AFGSM [19] are developed under the poison setting, which requires the re-training of the defense models for each attack. Differently, TDGIA follows KDD-CUP 2020 to use the evasion attack setting, where different attacks are evaluated based on the same set of models and weights.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

TDGIA: Effective Injection Attacks on Graph Neural Networks

Zou

Zheng

Dong

et al. 2021

Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery &Amp; Data Mining

View full text Add to dashboard Cite

Graph Neural Networks (GNNs) have achieved promising performance in various real-world applications. However, recent studies find that GNNs are vulnerable to adversarial attacks. In this paper, we study a recently-introduced realistic attack scenario on graphsgraph injection attack (GIA). In the GIA scenario, the adversary is not able to modify the existing link structure or node attributes of the input graph, instead the attack is performed by injecting adversarial nodes into it. We present an analysis on the topological vulnerability of GNNs under GIA setting, based on which we propose the Topological Defective Graph Injection Attack (TDGIA) for effective injection attacks. TDGIA first introduces the topological defective edge selection strategy to choose the original nodes for connecting with the injected ones. It then designs the smooth feature optimization objective to generate the features for the injected nodes. Extensive experiments on large-scale datasets show that TD-GIA can consistently and significantly outperform various attack baselines in attacking dozens of defense GNN models. Notably, the performance drop on target GNNs resultant from TDGIA is more than double the damage brought by the best attack solution among hundreds of submissions on KDD-CUP 2020. CCS CONCEPTS• Security and privacy → Software and application security; • Mathematics of computing → Graph algorithms.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

TDGIA: Effective Injection Attacks on Graph Neural Networks

Zou

Zheng

Dong

et al. 2021

Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery &Amp; Data Mining

View full text Add to dashboard Cite

show abstract

“…For example, the GreedyAttack and GreedyGAN proposed by Xiaoyun Wang et al [12] conducted targeted node attacks by adding fake nodes directly to the victim nodes. Jihong Wang et al [13] introduce the approximate fast gradient sign method, which adds a vicious node between the victim node and other nodes so that the victim node will be misclassified. However, most existing fake node attacks ( [13,12,14] ) are not designed to conduct universal adversarial attacks.…”

Section: Adversarial Attack In Graph Structured Datamentioning

confidence: 99%

“…Jihong Wang et al [13] introduce the approximate fast gradient sign method, which adds a vicious node between the victim node and other nodes so that the victim node will be misclassified. However, most existing fake node attacks ( [13,12,14] ) are not designed to conduct universal adversarial attacks. In the TUA proposed in this paper, the fake nodes act as the 2-hop neighbor of the victim node.…”

Section: Adversarial Attack In Graph Structured Datamentioning

confidence: 99%

A Targeted Universal Attack on Graph Convolutional Network

Dai,

Zhu,

Luo

2020

Preprint

View full text Add to dashboard Cite

Graph-structured data exist in numerous applications in real life. As a state-of-the-art graph neural network, the graph convolutional network (GCN) plays an important role in processing graph-structured data. However, a recent study reported that GCNs are also vulnerable to adversarial attacks, which means that GCN models may suffer malicious attacks with unnoticeable modifications of the data. Among all the adversarial attacks on GCNs, there is a special kind of attack method called the universal adversarial attack, which generates a perturbation that can be applied to any sample and causes GCN models to output incorrect results. Although universal adversarial attacks in computer vision have been extensively researched, there are few research works on universal adversarial attacks on graph structured data. In this paper, we propose a targeted universal adversarial attack against GCNs. Our method employs a few nodes as the attack nodes. The attack capability of the attack nodes is enhanced through a small number of fake nodes connected to them. During an attack, any victim node will be misclassified by the GCN as the attack node class as long as it is linked to them. The experiments on three popular datasets show that the average attack success rate of the proposed attack on any victim node in the graph reaches 83% when using only 3 attack nodes and 6 fake nodes. We hope that our work will make the community aware of the threat of this type of attack and raise the attention given to its future defense.

show abstract

Fast Inference of Removal-Based Node Influence

Li,

Xiao,

Luo

et al. 2024

Proceedings of the ACM on Web Conference 2024

View full text Add to dashboard Cite

Graph neural networks (GNNs) are widely utilized to capture the information spreading patterns in graphs. While remarkable performance has been achieved, there is a new trending topic of evaluating node influence. We propose a new method of evaluating node influence, which measures the prediction change of a trained GNN model caused by removing a node. A real-world application is, "In the task of predicting Twitter accounts' polarity, had a particular account been removed, how would others' polarity change?". We use the GNN as a surrogate model whose prediction could simulate the change of nodes or edges caused by node removal. Our target is to obtain the influence score for every node, and a straightforward way is to alternately remove every node and apply the trained GNN on the modified graph to generate new predictions. It is reliable but time-consuming, so we need an efficient method. The related lines of work, such as graph adversarial attack and counterfactual explanation, cannot directly satisfy our needs, since their problem settings are different. We propose an efficient, intuitive, and effective method, NOde-Removal-based fAst GNN inference (NORA), which uses the gradient information to approximate the node-removal influence. It only costs one forward propagation and one backpropagation to approximate the influence score for all nodes. Extensive experiments on six datasets and six GNN models verify the effectiveness of NORA. Our code is available at https://github.com/weikai-li/NORA.git. CCS CONCEPTS• Information systems → Web mining; • Computing methodologies → Neural networks.

show abstract

Scalable Attack on Graph Data by Injecting Vicious Nodes

Cited by 3 publications

References 18 publications

TDGIA: Effective Injection Attacks on Graph Neural Networks

TDGIA: Effective Injection Attacks on Graph Neural Networks

A Targeted Universal Attack on Graph Convolutional Network

Fast Inference of Removal-Based Node Influence

Contact Info

Product

Resources

About