Node injection attacks on Graph Neural Networks (GNNs) have received emerging attention due to their potential to significantly degrade GNN performance with high attack success rates. However, our study indicates these attacks often fail in practical scenarios, since defense/detection methods can easily identify and remove the injected nodes. To address this, we devote to camouflage node injection attack, making injected nodes appear normal and imperceptible to defense/detection methods. Unfortunately, the non-Euclidean nature of graph data and lack of intuitive prior present great challenges to the formalization, implementation, and evaluation of camouflage. In this paper, we first propose and define camouflage as distribution similarity between ego networks of injected nodes and normal nodes. Then for implementation, we propose an adversarial CAmouflage framework for Node injection Attack, namely CANA, to improve attack performance under defense/detection methods in practical scenarios. A novel camouflage metric is further designed under the guide of distribution similarity. Extensive experiments demonstrate that CANA can significantly improve the attack performance under defense/detection methods with higher camouflage or imperceptibility. This work urges us to raise awareness of the security vulnerabilities of GNNs in practical applications. The implementation of CANA is available at https://github.com/TaoShuchang/CANA.

翻译：图神经网络上的节点注入攻击因其能以高攻击成功率显著降低GNN性能而受到日益关注。然而，我们的研究表明这些攻击在实际场景中往往失效，因为防御/检测方法可以轻易识别并移除注入节点。为解决这一问题，我们致力于伪装节点注入攻击，使注入节点表现正常，从而对防御/检测方法而言难以察觉。不幸的是，图数据的非欧几里得特性以及缺乏直观先验知识，给伪装的公式化、实现和评估带来了巨大挑战。在本文中，我们首先提出并将伪装定义为注入节点自我网络与正常节点自我网络之间的分布相似性。随后在实现方面，我们提出了一种面向节点注入攻击的对抗式伪装框架，即CANA，以提升在实际场景下面对防御/检测方法时的攻击性能。在分布相似性的指导下，我们进一步设计了一种新颖的伪装度量指标。大量实验表明，CANA能够在实现更高伪装性或不可感知性的同时，显著提升在防御/检测方法下的攻击性能。这项工作促使我们提高对图神经网络在实际应用中安全漏洞的关注。CANA的实现代码可在https://github.com/TaoShuchang/CANA获取。