Graph Neural Networks (GNNs) have achieved promising performance in various real-world applications. However, recent studies have shown that GNNs are vulnerable to adversarial attacks. In this paper, we study a recently-introduced realistic attack scenario on graphs -- graph injection attack (GIA). In the GIA scenario, the adversary is not able to modify the existing link structure and node attributes of the input graph, instead the attack is performed by injecting adversarial nodes into it. We present an analysis on the topological vulnerability of GNNs under GIA setting, based on which we propose the Topological Defective Graph Injection Attack (TDGIA) for effective injection attacks. TDGIA first introduces the topological defective edge selection strategy to choose the original nodes for connecting with the injected ones. It then designs the smooth feature optimization objective to generate the features for the injected nodes. Extensive experiments on large-scale datasets show that TDGIA can consistently and significantly outperform various attack baselines in attacking dozens of defense GNN models. Notably, the performance drop on target GNNs resultant from TDGIA is more than double the damage brought by the best attack solution among hundreds of submissions on KDD-CUP 2020.

翻译：神经网络(GNNs)在现实世界的各种应用中取得了有希望的绩效。然而,最近的研究表明,GNNs很容易受到对抗性攻击。在本文中,我们研究了最近在图表 -- -- 图形注射攻击(GIA)上推出的现实攻击情景。在GIA的假设中,对手无法修改输入图的现有链接结构和节点属性,而袭击则通过向输入图中注入对抗性节点进行。我们分析了GIA设置下GNS的地形脆弱性,据此我们建议对有效注射攻击进行地形性偏差图形射入攻击(TDGIA)。TGIA首先引入了有表面缺陷的边缘选择战略,以选择与注射者连接的原始节点。然后,它设计了光滑的特征优化目标,以生成注入节点的特征。对大型数据集进行的广泛实验表明,TDGIA在攻击数十个GNN模型时,可以持续和明显地超越各种攻击基线。值得注意的是,在2020年由TDGIA提交的数百项攻击解决方案中,在GNNS结果上出现的最佳性下降。