Practicable Black-box Evasion Attacks on Link Prediction in Dynamic Graphs -- A Graph Sequential Embedding Method

TL;DR

This paper introduces a practical black-box evasion attack on link prediction models in dynamic graphs, using a graph sequential embedding method within a reinforcement learning framework to achieve effective attacks with limited interactions and perturbations.

Contribution

It presents the first practicable black-box attack method on dynamic graph link prediction models, employing a graph sequential embedding and reinforcement learning to operate under interaction constraints.

Findings

Attack effectively fools advanced LPDG models

Method outperforms related approaches under constraints

Attacks are practical with limited interactions and perturbations

Abstract

Link prediction in dynamic graphs (LPDG) has been widely applied to real-world applications such as website recommendation, traffic flow prediction, organizational studies, etc. These models are usually kept local and secure, with only the interactive interface restrictively available to the public. Thus, the problem of the black-box evasion attack on the LPDG model, where model interactions and data perturbations are restricted, seems to be essential and meaningful in practice. In this paper, we propose the first practicable black-box evasion attack method that achieves effective attacks against the target LPDG model, within a limited amount of interactions and perturbations. To perform effective attacks under limited perturbations, we develop a graph sequential embedding model to find the desired state embedding of the dynamic graph sequences, under a deep reinforcement learning framework. To overcome the scarcity of interactions, we design a multi-environment training pipeline and train our agent for multiple instances, by sharing an aggregate interaction buffer. Finally, we evaluate our attack against three advanced LPDG models on three real-world graph datasets of different scales and compare its performance with related methods under the interaction and perturbation constraints. Experimental results show that our attack is both effective and practicable.