TL;DR
EvA introduces an evolutionary algorithm-based method for attacking graph neural networks directly in discrete space, outperforming gradient-based attacks and applicable to black-box models.
Contribution
The paper presents a novel evolutionary attack method for GNNs that operates without gradient information, improving attack effectiveness and flexibility.
Findings
EvA achieves approximately 11% more accuracy drop than previous methods.
The attack works efficiently with linear memory complexity in the attack budget.
EvA effectively breaks robustness certificates and conformal sets.
Abstract
Even a slight perturbation in the graph structure can cause a significant drop in the accuracy of graph neural networks (GNNs). Most existing attacks leverage gradient information to perturb edges. This relaxes the attack's optimization problem from a discrete to a continuous space, resulting in solutions far from optimal. It also restricts the adaptability of the attack to non-differentiable objectives. Instead, we introduce a few simple yet effective enhancements of an evolutionary-based algorithm to solve the discrete optimization problem directly. Our Evolutionary Attack (EvA) works with any black-box model and objective, eliminating the need for a differentiable proxy loss. This allows us to design two novel attacks that reduce the effectiveness of robustness certificates and break conformal sets. The memory complexity of our attack is linear in the attack budget. Among our…
Peer Reviews
Decision·ICLR 2026 Poster
> 1. The paper's primary strength is its successful revival of evolutionary search, a paradigm previously dismissed as inferior. It demonstrates that with careful design, this approach can decisively outperform state-of-the-art gradient-based methods, challenging a core assumption in the field and opening a new direction for research. > 2. The work is supported by comprehensive experiments and thorough ablation studies that validate every design choice. > 3. The significance of the work is grea
> 1. The paper rightly notes the high query complexity as a limitation, but does not conduct a rigorous quantitative trade-off analysis between computational cost and performance improvement. In my opinion, this is essential for the practical evaluation of the method. > 2. The paper presents compelling empirical evidence for EvA's superiority over gradient-based methods. However, the explanatory depth for this success seems limited, primarily resting on the well-established notion of gradient un
This paper uses a discrete evolutionary search method for graph edge-based adversarial attacks on GNNs, without the need of gradients, making it model-agnostic and applicable to black-box settings. The evolutionary framework can also attack non-differentiable objectives. They show strong empirical performance comparing with gradient-based methods.
1. The proposed evolutionary search is highly heuristic and not guaranteed to find globally optimal perturbations. Many of its design--mutation rate, crossover scheme, and selection strategy--lack principled justification or ablation analysis. It remains unclear which components are critical for performance and how sensitive the attack is to hyperparameter choices. 2. The algorithm is difficult to follow from the current text presentation. Including clear pseudo-code or an algorithm box would g
**1.** Experiments in various aspects are done to validate the method performance with abundant figures for illustrations.
**1.** The presentation of the paper is bad. There's neither formulation nor algorithm written, or any figure to completely show the pipeline of the proposed attack. The description of method is just split around all section 3 and 4 without a clear introducing logic, instead just describing sentences and paragraphs concatenated. The methodology description highly relies on comparison with a previous baseline "PRBCD" which was not formulated introduced as well, making the part harder to follow. T
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
