Graph Neural Network (GNN) has achieved remarkable success in various graph learning tasks, such as node classification, link prediction and graph classification. The key to the success of GNN lies in its effective structure information representation through neighboring aggregation. However, the attacker can easily perturb the aggregation process through injecting fake nodes, which reveals that GNN is vulnerable to the graph injection attack. Existing graph injection attack methods primarily focus on damaging the classical feature aggregation process while overlooking the neighborhood aggregation process via label propagation. To bridge this gap, we propose the label-propagation-based global injection attack (LPGIA) which conducts the graph injection attack on the node classification task. Specifically, we analyze the aggregation process from the perspective of label propagation and transform the graph injection attack problem into a global injection label specificity attack problem. To solve this problem, LPGIA utilizes a label propagation-based strategy to optimize the combinations of the nodes connected to the injected node. Then, LPGIA leverages the feature mapping to generate malicious features for injected nodes. In extensive experiments against representative GNNs, LPGIA outperforms the previous best-performing injection attack method in various datasets, demonstrating its superiority and transferability.

翻译：图神经网络（Graph Neural Network, GNN）在节点分类、链接预测和图分类等多种图学习任务中取得了显著成功。GNN成功的关键在于其通过邻域聚合有效表征结构信息。然而，攻击者能够通过注入虚假节点轻易干扰聚合过程，这表明GNN易受图注入攻击的影响。现有的图注入攻击方法主要关注破坏经典的特征聚合过程，而忽视了通过标签传播实现的邻域聚合过程。为弥补这一空白，我们提出基于标签传播的全局注入攻击（LPGIA），针对节点分类任务实施图注入攻击。具体而言，我们从标签传播的角度分析聚合过程，并将图注入攻击问题转化为全局注入标签特异性攻击问题。为解决该问题，LPGIA采用基于标签传播的策略来优化与注入节点相连的节点组合。随后，LPGIA利用特征映射为注入节点生成恶意特征。在对代表性GNN的大量实验中，LPGIA在多种数据集上均优于先前性能最佳的注入攻击方法，证明了其优越性和可迁移性。