Node injection attacks against Graph Neural Networks (GNNs) have received emerging attention as a practical attack scenario, where the attacker injects malicious nodes instead of modifying node features or edges to degrade the performance of GNNs. Despite the initial success of node injection attacks, we find that the injected nodes by existing methods are easy to be distinguished from the original normal nodes by defense methods and limiting their attack performance in practice. To solve the above issues, we devote to camouflage node injection attack, i.e., camouflaging injected malicious nodes (structure/attributes) as the normal ones that appear legitimate/imperceptible to defense methods. The non-Euclidean nature of graph data and the lack of human prior brings great challenges to the formalization, implementation, and evaluation of camouflage on graphs. In this paper, we first propose and formulate the camouflage of injected nodes from both the fidelity and diversity of the ego networks centered around injected nodes. Then, we design an adversarial CAmouflage framework for Node injection Attack, namely CANA, to improve the camouflage while ensuring the attack performance. Several novel indicators for graph camouflage are further designed for a comprehensive evaluation. Experimental results demonstrate that when equipping existing node injection attack methods with our proposed CANA framework, the attack performance against defense methods as well as node camouflage is significantly improved.
翻译:对图形神经网络(GNNs)的注入节点袭击作为一种实际攻击情景受到越来越多的关注,攻击者用恶意节点而不是改变节点特征或边缘来降低GNNs的性能。尽管最初通过节点注入袭击获得成功,但我们发现,现有方法注入的节点很容易与原始正常节点区分,防守方法并在实践中限制其攻击性能。为了解决上述问题,我们致力于隐蔽节点注射攻击,即隐蔽的注射恶意节点(结构/属性)作为正常的节点(结构/属性),似乎对防御方法来说是合法的/不可察觉的节点。图表数据的非欧洲语言性质和人类先前的缺乏对图表迷雾的正规化、实施和评价提出了巨大挑战。我们首先提出并制定了隐蔽的注入节点,即以注射节点为核心的自我网络的真诚性和多样性。然后,我们设计了一个对抗节点注射攻击的对抗性攻击的对抗性框架,即CANA,即CANA的不易隐性性质和人类先前的缺失对图表的正规化性提出了重大挑战,同时确保对攻击性袭击进行新的防御性评估。