Scalable attack on graph data by injecting vicious nodes

Wang, Jihong; Luo, Minnan; Suya, Fnu; Li, Jundong; Yang, Zijiang; Zheng, Qinghua

doi:10.1007/s10618-020-00696-7

Cited by 40 publications

(30 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Straightforwardly, GIA follows the evasion attack setting in which the attack is only performed to the target model during inference. This makes it different from the poison attack [17,19], where the target model is retrained on the attacked graph.…”

Section: Problem Definitionmentioning

confidence: 99%

“…In view of the gap, very recent efforts [17,19], including the KDD-CUP 2020 competition 1 , have been devoted to adversarial attacks on GNNs under the setting of graph injection attack (GIA). Specifically, the GIA task in KDD-CUP 2020 is formulated as follows:…”

Section: Introductionmentioning

confidence: 99%

“…Table 1 summarizes the differences. First, NIPA [17] and AFGSM [19] are developed under the poison setting, which requires the re-training of the defense models for each attack. Differently, TDGIA follows KDD-CUP 2020 to use the evasion attack setting, where different attacks are evaluated based on the same set of models and weights.…”

Section: Introductionmentioning

confidence: 99%

“…A more realistic scenario, graph injection attack (GIA), is studied in [17,19], which injects new vicious nodes instead of modifying the original graph. [17] proposes Node Injection Poisoning Attack (NIPA) based on reinforcement learning strategy.…”

Section: Introductionmentioning

confidence: 99%

“…[17] proposes Node Injection Poisoning Attack (NIPA) based on reinforcement learning strategy. Under the same scenario, Approximate Fast Gradient Sign Method (AFGSM) [19] further uses an approximation strategy to linearize the model and to generate the perturbations efficiently. These works are under the poison setting, where models have to be re-trained after the vicious nodes are injected onto the graph.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

TDGIA: Effective Injection Attacks on Graph Neural Networks

Zou

Zheng

Dong

et al. 2021

Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery &Amp; Data Mining

View full text Add to dashboard Cite

Graph Neural Networks (GNNs) have achieved promising performance in various real-world applications. However, recent studies find that GNNs are vulnerable to adversarial attacks. In this paper, we study a recently-introduced realistic attack scenario on graphsgraph injection attack (GIA). In the GIA scenario, the adversary is not able to modify the existing link structure or node attributes of the input graph, instead the attack is performed by injecting adversarial nodes into it. We present an analysis on the topological vulnerability of GNNs under GIA setting, based on which we propose the Topological Defective Graph Injection Attack (TDGIA) for effective injection attacks. TDGIA first introduces the topological defective edge selection strategy to choose the original nodes for connecting with the injected ones. It then designs the smooth feature optimization objective to generate the features for the injected nodes. Extensive experiments on large-scale datasets show that TD-GIA can consistently and significantly outperform various attack baselines in attacking dozens of defense GNN models. Notably, the performance drop on target GNNs resultant from TDGIA is more than double the damage brought by the best attack solution among hundreds of submissions on KDD-CUP 2020. CCS CONCEPTS• Security and privacy → Software and application security; • Mathematics of computing → Graph algorithms.

show abstract

Section: Problem Definitionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%