EvA: Evolutionary Attacks on Graphs

ICLR 2026 Conference Submission20831 Authors

Keywords: Adversarial Attack, Evolutionary Algorithm, graph neural network

TL;DR: We propose an evolutionary attack for GNNs that outperforms SOTA gradient based attacks by a significant margin. We extend our attack to other non-differentiable objectives.

Abstract:

Even a slight perturbation in the graph structure can cause a significant drop in the accuracy of graph neural networks (GNNs). Most existing attacks leverage gradient information to perturb edges. This relaxes the attack's optimization problem from a discrete to a continuous space, resulting in solutions far from optimal. It also prevents the adaptability of the attack to non-differentiable objectives. Instead, we introduce a few simple, yet effective, enhancements of an evolutionary-based algorithm to solve the discrete optimization problem directly. Our Evolutionary Attack EvA works with any black-box model and objective, eliminating the need for a differentiable proxy loss. This allows us to design two novel attacks that reduce the effectiveness of robustness certificates and break conformal sets.
EvA uses sparse representations to significantly reduce memory requirements and scale to larger graphs.
We also introduce a divide and conquer strategy that improves both EvA and existing gradient-based attacks.
Among our experiments, EvA shows $\sim$11\% additional drop in accuracy on average compared to the best previous attack,
revealing significant untapped potential in designing attacks.

Primary Area: learning on graphs and other geometries & topologies

Submission Number: 20831