[Paper Review] Scalable Attack on Graph Data by Injecting Vicious Nodes

Jihong Wang, Minnan Luo+4 more|arXiv (Cornell University)|Apr 22, 2020

Advanced Graph Neural Networks27 references4 citations

TL;DR

This paper proposes AFGSM, a scalable attack method that injects vicious nodes into graph data to mislead Graph Convolution Networks (GCNs), significantly reducing their classification accuracy. By approximating the model gradient to enable fast, closed-form updates, AFGSM achieves high attack effectiveness with orders-of-magnitude speedup over existing methods, even under realistic constraints like edge-only or indirect perturbations.

ABSTRACT

Recent studies have shown that graph convolution networks (GCNs) are vulnerable to carefully designed attacks, which aim to cause misclassification of a specific node on the graph with unnoticeable perturbations. However, a vast majority of existing works cannot handle large-scale graphs because of their high time complexity. Additionally, existing works mainly focus on manipulating existing nodes on the graph, while in practice, attackers usually do not have the privilege to modify information of existing nodes. In this paper, we develop a more scalable framework named Approximate Fast Gradient Sign Method (AFGSM) which considers a more practical attack scenario where adversaries can only inject new vicious nodes to the graph while having no control over the original graph. Methodologically, we provide an approximation strategy to linearize the model we attack and then derive an approximate closed-from solution with a lower time cost. To have a fair comparison with existing attack methods that manipulate the original graph, we adapt them to the new attack scenario by injecting vicious nodes. Empirical experimental results show that our proposed attack method can significantly reduce the classification accuracy of GCNs and is much faster than existing methods without jeopardizing the attack performance.

Motivation & Objective

• To address the scalability limitations of existing GCN attack methods, which are computationally infeasible for large-scale graphs.
• To model a more realistic attack scenario where adversaries can only inject new nodes rather than modify existing ones.
• To develop a fast, approximate attack method that maintains high effectiveness despite limited control over the original graph structure.
• To evaluate attack robustness under practical constraints such as edge-only or indirect connections to the target node.

Proposed method

• Proposes the Approximate Fast Gradient Sign Method (AFGSM), which linearizes the GCN model via gradient approximation to enable closed-form updates for injected vicious nodes.
• Introduces a low-complexity approximation strategy that avoids iterative optimization, drastically reducing time cost while preserving attack quality.
• Adapts existing attack methods (e.g., Nettack, FGSM) to the new injection-only scenario by injecting nodes with adversarial features and edges.
• Employs a bi-level optimization framework to ensure attack success even after model retraining on perturbed graphs.
• Supports restricted settings such as edge-only perturbations and indirect connections to the target node, simulating real-world access limitations.
• Uses a constraint-based optimization (Eq. 7) to ensure perturbations remain unnoticeable while maximizing misclassification of the target node.

Experimental results

Research questions

• RQ1 Can adversarial attacks on GCNs remain effective when attackers are restricted to injecting new nodes rather than modifying existing ones?
• RQ2 How does the proposed AFGSM method compare in attack effectiveness and efficiency to existing methods under large-scale graph settings?
• RQ3 To what extent does the attack performance degrade under practical constraints such as edge-only or indirect perturbations?
• RQ4 Does the ability to freely design features of injected nodes compensate for the lack of control over original nodes in the attack scenario?

Key findings

• AFGSM reduces GCN classification accuracy to as low as 0.216 ± 0.013 on Cora and 0.572 ± 0.027 on Reddit, significantly outperforming baselines like FGSM and Nettack.
• AFGSM achieves a 10x to 100x speedup over existing methods on large graphs, with runtime scaling sub-linearly compared to quadratic or worse complexity in prior work.
• Even under edge-only perturbations, AFGSM maintains strong attack performance (e.g., 0.604 ± 0.034 on Cora), demonstrating robustness to feature manipulation constraints.
• Indirect attacks (no direct connection to target) are less effective but still successful, with accuracy dropping to 0.648 ± 0.030 on Cora, highlighting the importance of direct links.
• AFGSM-ada, the adaptive variant, achieves the best attack performance across all datasets, with a 0.216 ± 0.013 error rate on Cora, outperforming all baselines.
• The attack remains effective even when features of injected nodes are randomly sampled, indicating that edge structure plays a dominant role in the new attack scenario.