Pith. sign in

REVIEW 3 major objections 5 minor 53 references

Budgeted Indirect Adversarial Attack on Graph-Based Anomaly Detection in Sensor Networks

T0 review · 3 major / 5 minor · reviewed 2026-08-04 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper introduces BETA, a budgeted indirect evasion attack that fools GNN-based anomaly detectors in sensor networks by perturbing a small, carefully selected set of non-target sensors.

desk verdict The explainer-guided budgeted attack pipeline is a genuine contribution, but the attack's dependence on the true anomaly label undermines the 'realistic constraints' claim until the authors justify it or re-run without that oracle. read the letter →

arxiv 2509.17987 v2 pith:T2G7IHYH submitted 2025-09-22 cs.LG

Sanju Xaviar , Omid Ardakanian This is my paper
classification cs.LG
keywords BETAadversarialattackgraphneuralnetworksanomalydetectionsensorbudgetedPGDexplainability
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

BETA is a budgeted, grey-box evasion attack against graph-neural-network anomaly detectors in sensor networks. The attacker cannot touch the target sensor; instead, it compromises a small budgeted set of neighboring 'influencer' sensors and perturbs their readings with imperceptible, ℓ∞-bounded noise, aiming to either hide a true anomaly at the target or create a false alarm. The core idea is to choose influencer nodes by combining a graph-explainer subgraph (which identifies the nodes driving the target's prediction) with eigenvector centrality (to prune to the budget), then perturb selected features with constrained Projected Gradient Descent. On three real-world datasets (SWaT, WADI, SJVAir), BETA reduces F1 scores of GDN and TopoGDN by 30–50% on average and consistently achieves the lowest attack success (FTA) across budgets. A sympathetic reader would care because it shows that the security of a protected sensor depends not only on its own integrity but on the integrity of the network around it.

What carries the argument

GAFExplainer, a graph-neural-network explainer that learns an edge mask highlighting the subgraph most influential for the target node's prediction; eigenvector centrality, to rank candidate influencer nodes by structural importance and cap the set at the budget B; and constrained Projected Gradient Descent (PGD), to add imperceptible ℓ∞-bounded perturbations to the selected nodes' features while leaving the target's features untouched. PGD is masked to only touch the influencer nodes, and the whole pipeline is guided by a surrogate model trained with query access to the victim.

What would settle it

Compare BETA's success when the true label y is replaced by a label estimated from the victim's own predictions or from the surrogate's output; if FTA degradation largely disappears, BETA's reported effectiveness depends on oracle labels rather than on the node-selection strategy.

Watch

Extended reading notes

Core claim

The paper claims that a practical, budget-limited attacker can meaningfully blind or mislead GNN-based anomaly detectors without ever perturbing the target node. The central discovery is that the right choice of which sensors to compromise matters more than the perturbation method: using GAFExplainer to extract the subgraph most responsible for the target's anomaly score, then pruning that subgraph to the attack budget with eigenvector centrality, and finally applying constrained PGD to the selected nodes' features, yields consistent performance degradation (FTA as low as 0.20–0.30 for GDN on SJVAir at B=6) across datasets and models. BETA outperforms random attacks, a feature-only variant o

Load-bearing premise

The attack's PGD step is supervised by the true anomaly label of the target node, but the paper never states how an attacker without ground-truth knowledge obtains that label at test time; if the attacker must guess or infer it, the attack could be substantially weaker.

Editorial extensions

If this is right

  • With a budget of only 5 compromised sensors, BETA lowers F1 of GDN to 0.28–0.45 and TopoGDN to 0.44–0.56 across three real datasets, versus much higher no-attack values.
  • BETA consistently achieves the lowest Fractional Target Accuracy across all tested budgets (B=1–6), indicating that explanation-guided selection plus PGD optimization is more effective than either component alone.
  • Ablation results attribute much of the attack power to GAFExplainer-based node selection; on SJVAir, BETA at B=6 nearly matches its unbudgeted variant for GDN (FTA 0.2544 vs 0.2298).
  • Eigenvector centrality is the best pruning heuristic among tested centrality measures, yielding consistently lower FTA than degree, closeness, betweenness, clustering coefficient, or average neighbor degree.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because the attack only perturbs a small number of non-target sensors, deployments of GNN-based anomaly detectors in security-critical sensor networks should treat 'safe' sensors as part of the attack surface; monitoring or feature-level hardening of high-eigenvector-centrality nodes may blunt the attack.
  • Algorithm 1 requires the target's true anomaly label to compute the PGD gradient, but the paper does not explain how an attacker without ground truth obtains this label; a label-free variant (e.g., maximizing change in the target's anomaly score or using the surrogate's own prediction as a pseudo-label) is a natural next test, and its measured success would bound the real-world risk.
  • The finding that GAFExplainer's edge-mask explanation combined with eigenvector centrality beats pure centrality suggests that explainability tools can double as attack-planning tools; the same pipeline might be repurposed for defense by identifying and hardening the nodes that most influence each detector's decisions.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper introduces BETA, a budgeted, indirect, grey-box evasion attack against GNN-based anomaly detectors in sensor networks. The attacker selects a small set of influencer nodes (excluding the target) using GAFExplainer plus eigenvector-centrality pruning, then perturbs their features with a constrained PGD procedure that maximizes cross-entropy loss on a surrogate model. The attack is evaluated against GDN and TopoGDN on SWaT, WADI, and SJVAir, reporting consistent FTA reductions and lower F1/AUC-PR relative to random attack, Nettack, and two ablations.

Significance. If the reported results hold, BETA is a useful contribution: it addresses a realistic and under-studied setting—indirect, budgeted evasion attacks on multivariate time-series anomaly detectors—where the attacker cannot touch the target sensor. The paper's strengths are its clean problem formulation, the combination of explainability-based node selection with PGD, and a reasonably complete ablation study (component-wise ablations, centrality comparisons, budget sensitivity). The empirical comparisons cover three real-world datasets and two victim models, and the attack consistently outperforms baselines, which is a meaningful and falsifiable claim. However, the significance is conditional on the threat model being realistic: the attack's optimization depends on ground-truth anomaly labels, and the surrogate's fidelity is never measured, so the central 'realistic constraints' claim is not yet fully supported.

major comments (3)
  1. [Algorithm 1 / Section 5] Algorithm 1 takes the true anomaly label y as input, and Eq. (15) updates the perturbation by maximizing cross-entropy between the surrogate output and y. The threat model in Section 5 never explains how the attacker obtains ground-truth labels for the current target at attack time; it grants graph structure A, query access to the victim, and the ability to intercept segments, but not label access. This is load-bearing: the sign of every PGD step is determined by the oracle label. If y is unavailable and must be inferred from the victim's own output, then for targets initially misclassified as normal the objective would push the surrogate toward the victim's current label, i.e., away from flipping the decision. The reported FTA/F1 reductions in Tables 3-4 therefore conflate attack effectiveness with label access. Please either justify label availability within the threat model or evaluat
  2. [Section 6 / Section 7.2] The central mechanism is surrogate-guided PGD, but the paper never measures surrogate fidelity. Section 6 says the surrogate is trained on pairs {(X_t, y_u^(t))} using query access, yet it does not specify whether y_u^(t) is the victim model's output or ground-truth label, nor does it state the size, temporal split, or sampling of the historical set. Without a surrogate-victim agreement metric, a reader cannot tell whether the attack transfers because the surrogate is accurate or because the reported numbers are an artifact of training on test-time labels. Please report surrogate accuracy/F1 against the victim on a held-out query set, describe how labels are obtained, and clarify the composition of the surrogate training set.
  3. [Section 4 / Section 6] Section 4 states that the model 'is trained using cross-entropy loss to classify each node as normal or anomalous,' which contradicts the GDN/TopoGDN descriptions in Section 3 and the original papers: those models are trained with forecasting loss on normal data, and the anomaly threshold is chosen from validation errors. If the surrogate is instead trained as a binary classifier with cross-entropy loss, its decision boundary may differ substantially from the victim's forecasting-error boundary. This is a load-bearing methodological inconsistency because all PGD gradients and GAFExplainer explanations come from the surrogate. Please clarify the actual training objective of the victim and the surrogate, and justify the surrogate's use if the objectives differ.
minor comments (5)
  1. [Abstract] The abstract reports F1 reductions of '36.07 to 50.45%' in the first paragraph and '30.62 to 39.16%' in the second paragraph. These ranges are inconsistent and should be reconciled by referring to the specific tables and metric definitions.
  2. [Section 7.3 / Section 8.2] The 'BETA (Unbudgeted)' variant is described in Section 7.3 and referenced in Section 8.2, but it does not appear in Tables 3 or 4; only textual FTA values are given. Please add the unbudgeted row to the tables for completeness.
  3. [Section 8.2 / Figures 5-6] Figures 5-6 include error bars, but no statistical significance tests are reported. Since the gaps between BETA and Nettack+GAFExplainer are sometimes small (e.g., WADI), a paired significance test or confidence intervals would strengthen the claim that BETA 'consistently achieves the lowest FTA.'
  4. [Notation throughout] Algorithm 1 returns X'_t, while Eq. (13)-(15) use X_0, X_k, X_{k+1}; please make the notation consistent. Also, the dataset names are spelled inconsistently ('SJV Air' vs 'SJVAir').
  5. [Reference [45]] The text refers to GAFExplainer but cites [45] as GNNExplainer. If GAFExplainer is a different method, the citation is incorrect; if it is an extension, please clarify the relationship.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: BETA's attack success is measured on victim models with a surrogate optimized against known labels; the label input is a threat-model assumption, not a fitted quantity, and no load-bearing self-citation or definitional reduction is present.

full rationale

The paper's claimed contribution, a budgeted indirect grey-box evasion attack, is an empirical pipeline: GAFExplainer selects candidate influencer nodes, eigenvector centrality prunes them to budget, and PGD perturbs those nodes' features to maximize cross-entropy loss of a surrogate model against a supplied label. The success metric (F1, AUC-PR, FTA) is computed on the victim models GDN and TopoGDN using ground-truth labels, so the reported attack effectiveness is not recovered from the optimization objective itself. The surrogate is trained with query access to the victim and is a separate approximation; the attack does not use victim gradients or parameters. The only notable unstated assumption is Algorithm 1's 'True anomaly label y' input, which means the attacker is assumed to know the ground-truth status of the target at attack time. This is a threat-model realism concern, not a circularity: the label is an external oracle input, not a fitted parameter, and it is not derived from the attack's output. There are no load-bearing self-citations (the reference list contains no self-citations), no imported uniqueness theorem, and no known result merely renamed. The attack's components (GAFExplainer, centrality, PGD) are external and independently established; the paper's contribution is their combination and empirical evaluation. Therefore no derivation step reduces, by construction or self-citation, to its own inputs.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

No new physical or conceptual entities are introduced; the paper combines existing components (GAFExplainer, eigenvector centrality, PGD) into an attack pipeline. The main unverified assumptions are the availability of ground-truth labels to the attacker and surrogate transferability.

free parameters (5)
  • perturbation bound epsilon = 0.1
    Chosen as the imperceptibility threshold; l-infinity norm budget for perturbations. Hand-set and load-bearing for stealth.
  • GAFExplainer edge budget E = not reported (E <= B-1)
    Hyperparameter controlling number of edges in explanation subgraph; not specified in experiments, harming reproducibility.
  • PGD step size alpha = 0.01
    Attack optimization step size; standard but chosen by hand.
  • PGD iterations K = 10
    Number of attack iterations; relatively small, may limit attack strength.
  • SJVAir anomaly injection parameters = zeta=10, lambda_var=7
    Synthetic anomalies added to SJVAir test data; these parameters shape the anomaly benchmark but are not varied.
assumptions (4)
  • domain assumption The attacker has full access to the learned graph structure A of the victim model.
    Stated in Section 5 threat model; this is a strong grey-box assumption because the graph structure is learned from sensor data and would not generally be public.
  • domain assumption The surrogate model f_zeta approximates the victim model f_theta well enough that gradients transfer.
    Assumed throughout Section 6; no evaluation of surrogate-victim agreement is provided.
  • ad hoc to paper Ground-truth anomaly label y of the target node is available to the attacker.
    Algorithm 1 takes y as input (line 1, line 6); the paper does not discuss how the attacker obtains ground-truth labels at test time.
  • domain assumption The attacker can intercept and delay transmissions of influencer nodes without detection.
    Threat model in Section 5; practical but unverified.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Budgeted Indirect Adversarial Attack on Graph-Based Anomaly Detection in Sensor Networks." pith.science (2026). https://pith.science/paper/T2G7IHYH

@misc{pith2026250917987,
  author       = {Pith},
  title        = {Pith review of: Budgeted Indirect Adversarial Attack on Graph-Based Anomaly Detection in Sensor Networks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/T2G7IHYH}},
  note         = {Machine review of arXiv:2509.17987}
}
read the original abstract

Graph Neural Networks (GNNs) have emerged as powerful models for anomaly detection in sensor networks, particularly when analyzing multivariate time series. In this work, we introduce BETA, a novel indirect evasion attack targeting such GNN-based detectors, where the attacker is constrained to perturb sensor readings from a limited set of nodes, excluding the target sensor, with the goal of either suppressing a true anomaly or triggering a false alarm at the target node. BETA uses a graph explanatory model combined with a centrality-based pruning strategy to identify the most influential nodes, subsequently injecting carefully crafted adversarial perturbations into their features. Extensive experiments on three real-world sensor network datasets show that BETA consistently outperforms baseline attack strategies while operating under realistic constraints, reducing the F1-score of state-of-the-art GNN-based detectors by 36.07 to 50.45\% on average.

Figures

Figures reproduced from arXiv: 2509.17987 by the authors.

Figure 1
Figure 1. Visualization of readings of three sensors in the [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 3
Figure 3. Illustration of a scenario where spatially distributed [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figure 4
Figure 4. BETA attack pipeline 𝐺. We have A𝑐 = 𝜆𝑚𝑎𝑥𝑐 where 𝜆𝑚𝑎𝑥 is the largest eigenvalue of A. We rank the nodes in V𝑆 according to their eigenvector centrality and select the top 𝐵 nodes among them. This yields the set of influ￾ential nodes, denoted as V¯. The features of these nodes are then perturbed by BETA. Algorithm 1 BETA: Guided and Constrained PGD Attack 1: Input: Adjacency matrix A ∈ R 𝑁 ×𝑁 , Original feature matri… view at source ↗
Figures from the paper (3 more)
Figure 5
Figure 5. Figure 5: FTA comparison of attack methods with varying influencer nodes on the GDN model using SJVAir, SWaT and WADI [PITH_FULL_IMAGE:figures/full_fig_p010_5.png]
Figure 6
Figure 6. Figure 6: FTA comparison of attack methods with varying influencer nodes on the TopoGDN model using SJVAir, SWaT and [PITH_FULL_IMAGE:figures/full_fig_p010_6.png]
Figure 7
Figure 7. Figure 7: Impact of combining GAFExplainer and Eigenvector [PITH_FULL_IMAGE:figures/full_fig_p011_7.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

53 extracted references · 8 linked inside Pith

  1. [1]

    2024. SJVAir. Official Website. https://www.sjvair.com/. Accessed: 2024-07-21

    2024

  2. [2]

    Visual Crossing

    2024. Visual Crossing. Historical Weather Data & Weather Forecast Data. https: //www.visualcrossing.com/weather-data

    2024

  3. [3]

    Chuadhry Mujeeb Ahmed, Venkata Reddy Palleti, and Aditya P. Mathur. 2017. WADI: a water distribution testbed for research in the design of secure cyber physical systems. InProceedings of the 3rd International Workshop on Cyber- Physical Systems for Smart Water Networks(Pittsburgh, Pennsylvania)(CySW A- TER ’17). Association for Computing Machinery, New Yo...

    arXiv 2017

  4. [4]

    Alex Bavelas. 1950. Communication patterns in task-oriented groups.Journal of the acoustical society of America(1950)

    1950

  5. [5]

    Murray A Beauchamp. 1965. An improved index of centrality.Behavioral science 10, 2 (1965), 161–163

    1965

  6. [6]

    Phillip Bonacich. 1972. Factoring and weighting approaches to status scores and clique identification.Journal of mathematical sociology2, 1 (1972), 113–120

    1972

  7. [7]

    Phillip Bonacich. 2007. Some unique properties of eigenvector centrality.Social networks29, 4 (2007), 555–564

    2007

  8. [8]

    Stephen P Borgatti and Martin G Everett. 1997. Network analysis of 2-mode data. Social networks19, 3 (1997), 243–269

    1997

Show all 53 references
  1. [9]

    Yulong Cao, Chaowei Xiao, Benjamin Cyr, Yimeng Zhou, Won Park, Sara Ram- pazzi, Qi Alfred Chen, Kevin Fu, and Z Morley Mao. 2019. Adversarial sensor attack on lidar-based perception in autonomous driving. InProceedings of the 2019 ACM SIGSAC conference on computer and communic...

    2019

  2. [10]

    Nicholas Carlini and David Wagner. 2017. Towards evaluating the robustness of neural networks. In2017 ieee symposium on security and privacy (sp). Ieee, 39–57

    2017

  3. [11]

    Liang Chen, Jintang Li, Jiaying Peng, Tao Xie, Zengxu Cao, Kun Xu, Xiangnan He, Zibin Zheng, and Bingzhe Wu. 2020. A survey of adversarial learning on graphs.arXiv preprint arXiv:2003.05730(2020)

    2020 arXiv

  4. [12]

    Zekai Chen, Dingshuo Chen, Xiao Zhang, Zixuan Yuan, and Xiuzhen Cheng

  5. [13]

    Hanjun Dai, Hui Li, Tian Tian, Xin Huang, Lin Wang, Jun Zhu, and Le Song

  6. [14]

    Ailin Deng and Bryan Hooi. 2021. Graph neural network-based anomaly detection in multivariate time series. InProceedings of the AAAI conference on artificial intelligence, Vol. 35. 4027–4035

    2021

  7. [15]

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. 2014. Explaining and harnessing adversarial examples.arXiv preprint arXiv:1412.6572(2014)

    2014 arXiv

  8. [16]

    Adam Goodge, Bryan Hooi, See Kiong Ng, and Wee Siong Ng. 2021. Robustness of autoencoders for anomaly detection under adversarial impact. InProceedings of the twenty-ninth international conference on international joint conferences on artificial intelligence. 1244–1250

    2021

  9. [17]

    Thi Kieu Khanh Ho, Ali Karami, and Narges Armanfard. 2025. Graph Anomaly Detection in Time Series: A Survey.IEEE Transactions on Pattern Analysis and Machine Intelligence47, 8 (2025), 6990–7009

    2025

  10. [18]

    Yifan Jia, Jingyi Wang, Christopher M Poskitt, Sudipta Chattopadhyay, Jun Sun, and Yuqi Chen. 2021. Adversarial attacks and mitigation for anomaly detectors of cyber-physical systems.International Journal of Critical Infrastructure Protection 34 (2021), 100452

    2021

  11. [19]

    Ming Jin, Huan Yee Koh, Qingsong Wen, Daniele Zambon, Cesare Alippi, Geof- frey I Webb, Irwin King, and Shirui Pan. 2024. A survey on graph neural networks for time series: Forecasting, classification, imputation, and anomaly detection. IEEE Transactions on Pattern Analysis an...

    2024

  12. [20]

    Hwan Kim, Byung Suk Lee, Won-Yong Shin, and Sungsu Lim. 2022. Graph anomaly detection with graph neural networks: Current status and challenges. IEEE Access10 (2022), 111820–111829

    2022

  13. [21]

    Alexey Kurakin, Ian Goodfellow, and Samy Bengio. 2016. Adversarial machine learning at scale.arXiv preprint arXiv:1611.01236(2016)

    2016 arXiv

  14. [22]

    Jongsoo Lee, Byeongtae Park, and Dong-Kyu Chae. 2023. Duogat: Dual time- oriented graph attention networks for accurate, efficient and explainable anomaly detection on time-series. InProceedings of the 32nd ACM International Conference on Information and Knowledge Management. ...

    2023

  15. [23]

    Pedro G Lind, Marta C Gonzalez, and Hans J Herrmann. 2005. Cycles and clustering in bipartite networks.Physical Review E—Statistical, Nonlinear, and Soft Matter Physics72, 5 (2005), 056127

    2005

  16. [24]

    Qinghua Liu and John Paparrizos. 2024. The elephant in the room: Towards a re- liable time-series anomaly detection benchmark.Advances in Neural Information Processing Systems37 (2024), 108231–108261

    2024

  17. [25]

    Zhe Liu, Xiang Huang, Jingyun Zhang, Zhifeng Hao, Li Sun, and Hao Peng. 2024. Multivariate time-series anomaly detection based on enhancing graph attention networks with topological analysis. InProceedings of the 33rd ACM International Conference on Information and Knowledge M...

    2024

  18. [26]

    Xiaoxiao Ma, Jia Wu, Shan Xue, Jian Yang, Chuan Zhou, Quan Z Sheng, Hui Xiong, and Leman Akoglu. 2021. A comprehensive survey on graph anomaly detection with deep learning.IEEE transactions on knowledge and data engineering 35, 12 (2021), 12012–12038

    2021

  19. [27]

    Srinidhi Madabhushi and Rinku Dewri. 2025. Mitigating Over-Generalization in Anomalous Power Consumption Detection using Adversarial Training.ACM Transactions on Cyber-Physical Systems(2025)

    2025

  20. [28]

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2017. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083(2017)

    2017 arXiv

  21. [29]

    Aditya P Mathur and Nils Ole Tippenhauer. 2016. SWaT: A water treatment testbed for research and training on ICS security. In2016 international workshop on cyber-physical systems for smart water networks (CySWater). IEEE, 31–36

    2016

  22. [30]

    Apostolos Modas, Ricardo Sanchez-Matilla, Pascal Frossard, and Andrea Cav- allaro. 2020. Toward robust sensing for autonomous vehicles: An adversarial perspective.IEEE Signal Processing Magazine37, 4 (2020), 14–23

    2020

  23. [31]

    Tsay, Themis Palpanas, and Michael J

    John Paparrizos, Yuhao Kang, Paul Boniol, Ruey S. Tsay, Themis Palpanas, and Michael J. Franklin. 2022. TSB-UAD: an end-to-end benchmark suite for univariate time-series anomaly detection.Proc. VLDB Endow.15, 8 (April 2022), 1697–1711

    2022

  24. [32]

    A Paszke. 2019. Pytorch: An imperative style, high-performance deep learning library.arXiv preprint arXiv:1912.01703(2019)

    2019 arXiv

  25. [33]

    Aikaterini Protogerou, Stavros Papadopoulos, Anastasios Drosou, Dimitrios Tzovaras, and Ioannis Refanidis. 2021. A graph neural network method for distributed anomaly detection in IoT.Evolving Systems12, 1 (2021), 19–36

    2021

  26. [34]

    Abdul Kalam Shaik, Amitansu Das, and Venkata Reddy Palleti. 2025. Study of Adversarial Attacks on Anomaly Detectors In Industrial Control Systems. A vailable at SSRN 5126158(2025)

    2025

  27. [35]

    Jiawei Su, Danilo Vasconcellos Vargas, and Kouichi Sakurai. 2019. One Pixel Attack for Fooling Deep Neural Networks.IEEE Transactions on Evolutionary Computation23, 5 (2019), 828–841

    2019

  28. [36]

    Lichao Sun, Yingtong Dou, Carl Yang, Kai Zhang, Ji Wang, S Yu Philip, Lifang He, and Bo Li. 2022. Adversarial attack and defense on graph data: A survey.IEEE Transactions on Knowledge and Data Engineering35, 8 (2022), 7693–7711

    2022

  29. [37]

    Shahroz Tariq, Binh M Le, and Simon S Woo. 2022. Towards an Awareness of Time Series Anomaly Detection Models’ Adversarial Vulnerability. InProceedings of the 31st ACM International Conference on Information & Knowledge Management. 3534–3544

    2022

  30. [38]

    Shreshth Tuli, Giuliano Casale, and Nicholas R Jennings. 2022. Tranad: Deep transformer networks for anomaly detection in multivariate time series data. arXiv preprint arXiv:2201.07284(2022)

    2022 arXiv

  31. [39]

    Petar Veličković, Guillem Cucurull, Arantxa Casanova, Adriana Romero, Pietro Lio, and Yoshua Bengio. 2017. Graph attention networks.arXiv preprint arXiv:1710.10903(2017)

    2017 arXiv

  32. [40]

    Aristidis G Vrahatis, Konstantinos Lazaros, and Sotiris Kotsiantis. 2024. Graph attention networks: a comprehensive review of methods and applications.Future Internet16, 9 (2024), 318

    2024

  33. [41]

    Xiang Wang, Xiangnan He, Yixin Cao, Meng Liu, and Tat-Seng Chua. 2019. Kgat: Knowledge graph attention network for recommendation. InProceedings of the 25th ACM SIGKDD international conference on knowledge discovery & data mining. 950–958. TBD ’25, TBD, 2025, location TBD XXX et al

    2019

  34. [42]

    Xiao Wang, Houye Ji, Chuan Shi, Bai Wang, Yanfang Ye, Peng Cui, and Philip S Yu

  35. [43]

    Stanley Wasserman and Katherine Faust. 1994. Social network analysis: Methods and applications. (1994)

    1994

  36. [44]

    Yulei Wu, Hong-Ning Dai, and Haina Tang. 2021. Graph neural networks for anomaly detection in industrial Internet of Things.IEEE Internet of Things Journal 9, 12 (2021), 9214–9231

    2021

  37. [45]

    Zhitao Ying, Dylan Bourgeois, Jiaxuan You, Marinka Zitnik, and Jure Leskovec

  38. [46]

    He Zhang, Bang Wu, Xiangwen Yang, Chuan Zhou, Shuo Wang, Xingliang Yuan, and Shirui Pan. 2021. Projective ranking: A transferable evasion attack method on graph neural networks. InProceedings of the 30th ACM International Conference on Information & Knowledge Management. 3617–3621

    2021

  39. [47]

    Xiaona Zhou, Constantin Brif, and Ismini Lourentzou. 2025. mTSBench: Bench- marking Multivariate Time Series Anomaly Detection and Model Selection at Scale.arXiv preprint arXiv:2506.21550(2025)

    2025

  40. [48]

    Daniel Zügner, Amir Akbarnejad, and Stephan Günnemann. 2018. Adversarial attacks on neural networks for graph data. InProceedings of the 24th ACM SIGKDD international conference on knowledge discovery & data mining. 2847–2856

    2018

  41. [49]

    Gnnexplainer: Generating explanations for graph neural networks.Ad- vances in neural information processing systems32 (2019)

    2019

  42. [53]

    Daniel Zügner and Stephan Günnemann. 2024. Adversarial Attacks on Graph Neural Networks via Meta Learning. arXiv:1902.08412 [cs.LG] https://arxiv.org/ abs/1902.08412

    2024 arXiv

  43. [2018]

    InInternational conference on machine learning

    Adversarial attack on graph structured data. InInternational conference on machine learning. PMLR, 1115–1124

  44. [2019]

    InThe world wide web conference

    Heterogeneous graph attention network. InThe world wide web conference. 2022–2032

    2022

  45. [2021]

    Learning graph structures with transformer for multivariate time-series anomaly detection in IoT.IEEE Internet of Things Journal9, 12 (2021), 9179–9189

    2021

Pith tools

Reviewed August 4, 2026 · model on record in the stance chip above.