An effective targeted label adversarial attack on graph neural networks by strategically allocating the attack budget

Abstract

Although graph neural networks (GNNs) have been extensively employed in various research fields, they are susceptible to adversarial attacks, as revealed in previous studies. Targeted label attacks, in which the victim node is anticipated to fall into a desired category, are more consistent with practical circumstances than untargeted label attacks. However, there has been relatively little research on them, and existing attackers require access to the target model and do not consider the budget allocation; the budget refers to the maximum number of perturbations permitted. Furthermore, the performance of untargeted label attacks is weakened when they are converted into targeted label attacks. From the perspective of budget allocation, we devise an effective targeted label attack (ETLA). The prior knowledge includes training labels, node features, and the graph structure. The main concept is based on the strategical allocation of a given budget from the search space and optimisation objective. For the search space, a stratified node selection strategy and an adaptive edge choice strategy are developed to capture insertable and removable candidates. The former exploits unlabelled node information through massive pseudo-labels, whereas the latter capitalises on the similarity of node features. Regarding the optimisation objective, a temperature factor is introduced into the attack loss to better direct the flipping of the candidates. After a finite number of perturbations, the final disturbed graph is fed into various target models to evaluate attack performance. Generous trials indicate that our ETLA has excellent attack capability compared with other attack techniques with the same budget.