Attack Graph Convolutional Networks by Adding Fake Nodes

TL;DR

This paper introduces a realistic attack method on graph convolutional networks by adding fake nodes, demonstrating significant decreases in GCN accuracy and high success rates in targeted attacks.

Contribution

The paper proposes a novel fake node attack strategy and a Greedy-GAN approach to make malicious nodes indistinguishable from real ones, enhancing attack realism and effectiveness.

Findings

Non-targeted attack reduces GCN accuracy to 0.03

Targeted attack success rate is 78% for groups and 90% on single nodes

Greedy-GAN improves attack stealth and success

Abstract

In this paper, we study the robustness of graph convolutional networks (GCNs). Previous work have shown that GCNs are vulnerable to adversarial perturbation on adjacency or feature matrices of existing nodes; however, such attacks are usually unrealistic in real applications. For instance, in social network applications, the attacker will need to hack into either the client or server to change existing links or features. In this paper, we propose a new type of "fake node attacks" to attack GCNs by adding malicious fake nodes. This is much more realistic than previous attacks; in social network applications, the attacker only needs to register a set of fake accounts and link to existing ones. To conduct fake node attacks, a greedy algorithm is proposed to generate edges of malicious nodes and their corresponding features aiming to minimize the classification accuracy on the target nodes. In addition, we introduce a discriminator to classify malicious nodes from real nodes, and propose a Greedy-GAN attack to simultaneously update the discriminator and the attacker, to make malicious nodes indistinguishable from the real ones. Our non-targeted attack decreases the accuracy of GCN down to 0.03, and our targeted attack reaches a success rate of 78% on a group of 100 nodes, and 90% on average for attacking a single target node.