Single-Node Attack for Fooling Graph Neural Networks

Ben Finkelshtein, Chaim Baskin, Evgenii Zheltonozhskii, Uri Alon

Keywords: graphs, GNN, adversarial, attack

Abstract:

Graph neural networks (GNNs) have shown broad applicability in a variety of domains.
Some of these domains, such as social networks and product recommendations, are fertile ground for malicious users and behavior.
In this paper, we show that GNNs are vulnerable to the extremely limited scenario of a single-node adversarial example, where the node cannot be picked by the attacker.
That is, an attacker can force the GNN to classify any target node to a chosen label by only slightly perturbing another single arbitrary node in the graph, even when not being able to pick that specific attacker node. When the adversary is allowed to pick a specific attacker node, the attack is even more effective.
We show that this attack is effective across various GNN types (e.g., GraphSAGE, GCN, GAT, and GIN), across a variety of real-world datasets, and as a targeted and non-targeted attack.
Our code is available anonymously at https://github.com/gnnattack/SINGLE .

One-sentence Summary: GNNs are vulnerable to adversarial attacks from a single attacker node.

Code Of Ethics: I acknowledge that I and all co-authors of this work have read and commit to adhering to the ICLR Code of Ethics

Community Implementations: [ 2 code implementations](https://www.catalyzex.com/paper/arxiv:2011.03574/code)

Reviewed Version (pdf): https://openreview.net/references/pdf?id=qZVXciPqcA