Understanding and Improving Graph Injection Attack by Promoting Unnoticeability

TL;DR

This paper investigates Graph Injection Attacks (GIA) on Graph Neural Networks, revealing their high flexibility and proposing a homophily-preserving constraint to improve attack effectiveness and evade defenses.

Contribution

The paper introduces the homophily unnoticeability constraint and Harmonious Adversarial Objective (HAO), enhancing GIA's ability to bypass defenses and providing insights into attack mechanisms.

Findings

GIA can be more harmful than GMA due to its flexibility.

Homophily-based defenses can mitigate GIA by detecting homophily disruption.

HAO significantly improves GIA success rate against defenses.

Abstract

Recently Graph Injection Attack (GIA) emerges as a practical attack scenario on Graph Neural Networks (GNNs), where the adversary can merely inject few malicious nodes instead of modifying existing nodes or edges, i.e., Graph Modification Attack (GMA). Although GIA has achieved promising results, little is known about why it is successful and whether there is any pitfall behind the success. To understand the power of GIA, we compare it with GMA and find that GIA can be provably more harmful than GMA due to its relatively high flexibility. However, the high flexibility will also lead to great damage to the homophily distribution of the original graph, i.e., similarity among neighbors. Consequently, the threats of GIA can be easily alleviated or even prevented by homophily-based defenses designed to recover the original homophily. To mitigate the issue, we introduce a novel constraint -- homophily unnoticeability that enforces GIA to preserve the homophily, and propose Harmonious Adversarial Objective (HAO) to instantiate it. Extensive experiments verify that GIA with HAO can break homophily-based defenses and outperform previous GIA attacks by a significant margin. We believe our methods can serve for a more reliable evaluation of the robustness of GNNs.