Single Node Injection Attack against Graph Neural Networks

Abstract

Node injection attack on Graph Neural Networks (GNNs) is an emerging and practical attack scenario that the attacker injects malicious nodes rather than modifying original nodes or edges to affect the performance of GNNs. However, existing node injection attacks ignore extremely limited scenarios, namely the injected nodes might be excessive such that they may be perceptible to the target GNN. In this paper, we focus on an extremely limited scenario of single node injection evasion attack, i.e., the attacker is only allowed to inject one single node during the test phase to hurt GNN's performance. The discreteness of network structure and the coupling effect between network structure and node features bring great challenges to this extremely limited scenario. We first propose an optimization-based method to explore the performance upper bound of single node injection evasion attack. Experimental results show that 100%, 98.60%, and 94.98% nodes on three public datasets are successfully attacked even when only injecting one node with one edge, confirming the feasibility of single node injection evasion attack. However, such an optimization-based method needs to be re-optimized for each attack, which is computationally unbearable. To solve the dilemma, we further propose a Generalizable Node Injection Attack model, namely G-NIA, to improve the attack efficiency while ensuring the attack performance. Experiments are conducted across three well-known GNNs. Our proposed G-NIA significantly outperforms state-of-the-art baselines and is 500 times faster than the optimization-based method when inferring. CCS CONCEPTS• Information systems → Data mining.

A Comprehensive Survey on Trustworthy Graph Neural Networks: Privacy, Robustness, Fairness, and Explainability

“…Knowledge White-box [201], [211], [28], [37], [62] Black-box [37], [122], [244], [28], [245], [211], [188], [172], [19], [24] Capability Evasion Attack [201], [211], [28], [37], [179], [122], [121], [122], [62] Poisoning Attack [244], [245], [172], [19], [24], [188], [203], [233], [105], [62] Attackers' Goal…”

“…Targeted Attack [37], [188], [179], [203], [233], [244], [122], [28], [105], [19] Untargeted Attack [172]. [245], [211], [62], [19], [201], [121], [24] Trade off Between Privacy and Utility.…”

“…To make the perturbation more unnoticeable, ReWatt [122] poisons the training graph by rewiring edges with reinforcement learning. • Node Injection Attack: Different from manipulation attack that modifies the original graph, node injection attack aims to achieve the adversarial goal by injecting malicious nodes into the graph [172,179,188]. Compared to manipulation attack, node injection attack is more practical.…”

“…Recently, there are several attempts in developing gradient-based evasion attacks [121,179] in a more practical black-box setting, which can be applied to graph classification task and node classification on evolving graphs. By exploiting the connection between the backward propagation of GNNs and random walks, Ma et al [121] investigates the connections between the change of classification loss under perturbations and the random walk transition matrix.…”

“…Based on that, they generalize the white-box gradients into a model-independent important scores of PageRank, which avoids using model parameters. Tao et al [179] investigate the black-box evasion attack with single node injection. Without knowing the model parameters, they train a surrogate model on the train graph and attack the surrogate model to inject a fake node to the graph.…”