LiSA: Leveraging Link Recommender to Attack Graph Neural Networks via Subgraph Injection

TL;DR

This paper introduces LiSA, a novel adversarial attack method on GNNs that uses subgraph injection to deceive link recommenders and node classifiers, highlighting vulnerabilities in current GNN defenses.

Contribution

LiSA presents a new attack framework employing subgraph injection and bi-level optimization to target GNNs, addressing practical limitations of previous attack methods.

Findings

LiSA effectively deceives link recommenders and reduces node classification accuracy.

Experimental results show LiSA's high success rate on real-world datasets.

The method exposes vulnerabilities in existing GNN defense mechanisms.

Abstract

Graph Neural Networks (GNNs) have demonstrated remarkable proficiency in modeling data with graph structures, yet recent research reveals their susceptibility to adversarial attacks. Traditional attack methodologies, which rely on manipulating the original graph or adding links to artificially created nodes, often prove impractical in real-world settings. This paper introduces a novel adversarial scenario involving the injection of an isolated subgraph to deceive both the link recommender and the node classifier within a GNN system. Specifically, the link recommender is mislead to propose links between targeted victim nodes and the subgraph, encouraging users to unintentionally establish connections and that would degrade the node classification accuracy, thereby facilitating a successful attack. To address this, we present the LiSA framework, which employs a dual surrogate model and bi-level optimization to simultaneously meet two adversarial objectives. Extensive experiments on real-world datasets demonstrate the effectiveness of our method.