RIDA: A Robust Attack Framework on Incomplete Graphs

TL;DR

RIDA introduces a novel attack framework targeting incomplete graphs in GNNs, enhancing robustness testing by effectively exploiting data and outperforming existing methods in real-world scenarios.

Contribution

It is the first algorithm for robust gray-box poisoning attacks on incomplete graphs, addressing a critical gap in GNN security research.

Findings

RIDA outperforms 9 state-of-the-art baselines.

Effective in handling incomplete graph data.

Demonstrates high attack success on real-world datasets.

Abstract

Graph Neural Networks (GNNs) are vital in data science but are increasingly susceptible to adversarial attacks. To help researchers develop more robust GNN models, it's essential to focus on designing strong attack models as foundational benchmarks and guiding references. Among adversarial attacks, gray-box poisoning attacks are noteworthy due to their effectiveness and fewer constraints. These attacks exploit GNNs' need for retraining on updated data, thereby impacting their performance by perturbing these datasets. However, current research overlooks the real-world scenario of incomplete graphs. To address this gap, we introduce the Robust Incomplete Deep Attack Framework (RIDA). It is the first algorithm for robust gray-box poisoning attacks on incomplete graphs. The approach innovatively aggregates distant vertex information and ensures powerful data utilization. Extensive tests against 9 SOTA baselines on 3 real-world datasets demonstrate that RIDA's superiority in handling incompleteness and high attack performance on the incomplete graph.