Pith. sign in

REVIEW 4 major objections 5 minor 40 references

PEANUT: Perturbations by Eigenvector Alignment for Attacking Graph Neural Networks Under Topology-Driven Message Passing

T0 review · 4 major / 5 minor · reviewed 2026-08-02 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Topology-driven graph neural networks can be attacked with a single black-box query by injecting virtual nodes aligned with the dominant eigenvector of the observed embeddings, and for a two-layer SGC this perturbation is provably the budge

desk verdict The core attack idea is genuinely new and the node-classification numbers are strong, but the formal theorem has a budget-scaling error that invalidates the claimed optimality, and the black-box proxy is not justified as an equality. read the letter →

arxiv 2603.26136 v3 pith:AI7HSFOA submitted 2026-03-27 cs.LG

Bhavya Kohli , Biplab Sikdar This is my paper
classification cs.LG
keywords graphneuralnetworksadversarialattackinjectionblack-boxvirtualnodeeigenvectoralignmentregressionclassification
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper is trying to establish that graph neural networks which consume the adjacency matrix or Laplacian during message passing have a structural vulnerability: an attacker who can only see the model's final node embeddings and inject new nodes can force large output changes without gradients, training, or iterative optimization. It proves that for a two-layer SGC the budget-constrained perturbation maximizing the embedding-norm change is exactly Δ u1 v^T, where u1 is the dominant eigenvector of the hidden feature Gram matrix HH^T. It then turns this into a black-box attack by using the observed embeddings Z in place of H, injecting virtual nodes with zero features whose edge weights come from that dominant eigenvector. The paper reports consistent performance degradation across node classification, graph classification, and graph regression benchmarks, including large accuracy drops on citation networks at modest budgets. A sympathetic reader would care because, if true, the result shows a cheap and practical attack surface in deployed topology-driven GNNs, and suggests the exact linear analysis identifies the mechanism behind it.

What carries the argument

The central object is a rank-one perturbation S_v = Δ u1 v^T built from u1, the dominant eigenvector of the embedding Gram matrix—HH^T for the white-box SGC variant, ZZ^T for the black-box variant. This is the 'eigenvector alignment' in the paper's name. The mechanism is an identity: for zero-feature virtual nodes, the attack objective equals ||S_v S_v^T XΘ||_F², and the trace trick rewrites this as a weighted sum of the eigenvalues of ZZ^T (or HH^T), with weights coming from the budget matrix. Concentrating all weight on the largest eigenvalue is then provably optimal in the linear case; the virtual-node injection is the device that realizes this perturbation in the adjacency matrix without

What would settle it

Train a two-layer SGC with random weights such that the dominant eigenvectors of HH^T and ZZ^T are nearly orthogonal. Apply the black-box PEA perturbation and a same-budget random perturbation; if the PEA-induced L = ||Z_p - Z||_F is not statistically larger than random, the black-box equivalence in Equations 7-10 fails. For nonlinear models, repeat on GCN/GIN and check whether performance drops are separable from random injection; if not, the transfer claim is unsupported.

Watch

Extended reading notes

Core claim

For a two-layer SGC with embeddings Z = S²XΘ, the paper shows that after injecting virtual nodes with zero features, the clean-versus-perturbed embedding difference reduces to ||S_v S_v^T XΘ||_F². Lemma 1 solves the budget-constrained maximization of this quantity in closed form: the optimal perturbation is S_v* = Δ u1 v^T, where u1 is the dominant eigenvector of HH^T = (XΘ)(XΘ)^T and v is an arbitrary unit vector. The black-box variant replaces H with the observed node embeddings Z, so the attacker needs only one forward pass; the perturbation is then thresholded with ReLU (or discretized for binary-adjacency architectures) to produce non-negative or binary edge weights. The paper claims th

Load-bearing premise

The paper's black-box version assumes that the embeddings the attacker can observe are a good stand-in for the model's hidden feature matrix when picking the eigenvector, and that maximizing the change in observed embeddings also maximizes the change the attacker actually cares about; this equivalence is only approximate, and the same assumption is carried unproven into nonlinear GNNs.

Editorial extensions

If this is right

  • Topology-consuming GNNs are exposed to single-query black-box injection even when injected nodes have zero features and the original graph is untouched; defenses must therefore consider input filtering or architectural changes rather than assuming attackers need large budgets or white-box access.
  • For two-layer SGCs the attack is exactly optimal under the Frobenius budget, so no same-budget rank-one perturbation can induce a larger change in embedding norm; the bound is tight.
  • Graph-level objectives, including regression, are vulnerable: maximizing the norm difference of node embeddings before pooling is sufficient to degrade RMSE/MAE, extending injection attacks beyond node classification.
  • Node classification degrades strongly at higher budgets even though the attack does not optimize for label flips, because the norm change disturbs logit rankings enough to flip classes.
  • Because no surrogate model or iterative optimization is needed, the attack applies immediately to an already-trained model and avoids transfer failures that come from surrogate models.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The exact optimality is proven only for a linear two-layer SGC; in my reading the empirical transfer to GCN/GIN suggests the load-bearing path is the linear adjacency multiplication, which would predict weaker attacks on architectures with attention or gating that renormalize messages—a testable comparison.
  • A natural improvement left implicit: spending a second query or accessing an intermediate representation to estimate H (rather than using Z) could push the black-box attack closer to the proven SGC optimum.
  • The same spectral logic can be inverted for defense: filtering or clipping injected edges that align with the dominant embedding eigenvector, or constraining the spectral norm of the message-passing matrix, would directly counter the mechanism; the paper notes filtering mitigates the worst effects but does not develop it.
  • The attack leaves a rank-one fingerprint in the augmented adjacency matrix, so an anomaly detector that checks whether new columns are approximately proportional to a single vector could flag it; this is an extension the paper does not explore.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes PEANUT/PEA, a graph injection attack for GNNs under a restricted black-box threat model. The attacker observes only the final node-level embeddings (output logits for node classification, pre-pooling embeddings for graph-level tasks), injects virtual nodes with zero features, and sets the perturbation matrix to a rank-one outer product of the dominant eigenvector of ZZ^T with a random unit vector, scaled by a budget Δ. For a two-layer SGC, Theorem 1 claims this construction exactly maximizes the Frobenius norm of the change in real-node embeddings subject to ||S_vS_v^T||_F ≤ Δ. The paper then argues via Equations 7–10 that using observed Z in place of the hidden H = XΘ gives a single-query black-box attack, and empirically evaluates the method on node classification (Cora, Citeseer, Pubmed), graph classification (six datasets), and graph regression (five datasets) across SGC, GCN, GIN, and SAGE architectures.

Significance. If the theoretical claims were correct, the attack would be notable for its extreme simplicity: one forward pass and one eigendecomposition, no surrogate training, no iterative optimization, and applicability to underexplored graph-level tasks such as regression. The empirical evaluation is broad and the paper explicitly acknowledges several limitations (e.g., norm discrepancy may not change classification rankings; non-monotonic effects on some graph-classification datasets). However, the formal foundation as written has load-bearing errors: the claimed maximizer violates its own budget constraint, and the black-box proxy equality is not generally true. The empirical results may still support a heuristic attack, but the current paper does not establish the advertised optimality guarantees or budget-matched comparisons.

major comments (4)
  1. [§4, Lemma 1 and Theorem 1; Appendix A] The claimed maximizer B* = Δ·u1v^T violates the stated constraint ||BB^T||_F ≤ Δ when Δ > 1, because ||B*B*^T||_F = Δ^2. In every experimental configuration reported, Δ is greater than 1 (e.g., Cora with r=0.01 has Δ≈132; Table 3). Algorithm 1 inserts A_v = ReLU(Δ·u1v^T), so the actual perturbation has squared Frobenius norm Δ^2, not Δ, unless an unstated normalization is applied. The feasible maximizer under the stated constraint is √Δ·u1v^T, or equivalently the constraint should be written on ||BB^T||_F^2. This must be corrected before the exact-optimality claim or the budget-matched comparisons with AGIA/TDGIA can be accepted.
  2. [§4, 'Working with Limited Information', Eqs. (7)–(10)] Equation (10) asserts Δ²||H||²_F = ||S_vS_v^T XΘ||²_F. This is not an identity. For S_v = Δ·u1v^T, the right-hand side equals Δ⁴||u1^T H||², while the left-hand side is Δ²||H||²; the two coincide only in degenerate cases. The Cauchy–Schwarz chain gives an upper bound, not an equivalence. Therefore the statement that maximizing ||S_vS_v^T Z||_F 'would also push up' the true objective L(S_v) is not proven. The black-box variant should be presented as a heuristic, or supported by an additional argument establishing conditions under which the two objectives are aligned.
  3. [§4 'Applicability to other GNNs'; §5.2] The theoretical guarantee covers only a two-layer SGC with zero virtual-node features. The extension to GCN/GIN/SAGE relies on removing nonlinearities ('naïve assumption,' Eq. 14) and on empirical validation. The empirical evidence is mixed: on SAGE, accuracy drops are only 1.65–10.61% (Table 6), and on MUTAG and IMDB-BINARY the effect is non-monotonic in budget (§5.2.3). If the paper's central claim is an attack that 'consistently degrades' performance across topology-driven MPNNs, this claim needs to be qualified; if the claim is only that PEA is a simple heuristic that often degrades performance, the text should say so explicitly.
  4. [§3, 'Attack Efficacy and Constraints'] The statement that for binary S_v the constraint ||S_vS_v^T||_F ≤ Δ 'would correspond to a bound on the exact number of new edges being added' is incorrect. For a binary N×n_v matrix A_v, (A_vA_v^T)_{ij} counts the number of virtual nodes shared by nodes i and j, and the Frobenius norm of that co-occurrence matrix is not the edge count. This affects the interpretation of Δ = r|V|·deg(G) and Δ = r|E| used in §5.1.3, and therefore the fairness of comparisons with baselines. Please clarify what quantity is actually budgeted.
minor comments (5)
  1. [Appendix A] The proof writes the constraint as ||BB^T||_F^2 ≤ Δ^2, which is inconsistent with the Lemma statement ||BB^T||_F ≤ Δ. Align the notation for squared vs. unsquared norms throughout.
  2. [Figure 5 and surrounding text] The caption and prose should be clarified: the figure appears to plot L(S_v) for PEA-W and PEA, but the relationship to Eq. (10) and the meaning of the 'with ||S2||F' variant are not explained. There is also a grammatical issue in the sentence following Eq. (7).
  3. [§4.1.1] The claim that the generated perturbations are 'positive with values ∈[0,1]' is not guaranteed by A_v = ReLU(Δ·u1v^T) when Δ > 1 and u1 is a unit vector. State explicitly any clipping or normalization step, or revise the claim.
  4. [Tables 1 and 3] The 'Avg. Δ' row in Table 1 would benefit from a self-contained formula; the definition Δ = r|E| is given later in §5.1.3, but the table caption should not rely on forward references. Table 3 already gives Δ for NC; consider making the two tables consistent.
  5. [Figures 2–4, 6–8] In the manuscript version reviewed, the text inside these figures appears as corrupted glyph strings (e.g., '/uni00000013/...'). If this reflects the actual PDF, the figures are unreadable and must be regenerated; otherwise the submission PDF is corrupted.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity found: the SGC derivation is self-contained, the use of observed embeddings is an allowed black-box observation, and there are no load-bearing self-citations.

full rationale

The paper derives its attack from a closed-form optimization for a 2-layer SGC. Lemma 1 solves max ||BB^T Z||_F^2 subject to ||BB^T||_F <= Δ, and Theorem 1 applies it to L(S_v)=||S_v S_v^T XΘ||_F^2, giving S_v* = Δ u1 v^T. This is a direct mathematical derivation, not a re-description of the attack objective. The black-box extension replaces H=XΘ by the observed embedding Z=S^2 XΘ and uses Equations 7-10 as an upper-bound argument; even if Eq. 10 is algebraically unjustified, this is a derivation gap or heuristic justification, not a circular one. Using the model's own output Z to construct the perturbation is explicitly permitted by the threat model ('can observe only the final node-level representations during inference'), and the paper does not fit any parameter to the attack-success metric. There are no self-citations to prior work by these authors, and no uniqueness claim is imported from the authors' own prior theorems. The reported experiments compare against external baselines on standard datasets, so the empirical claims are not forced by construction. The reviewer's noted budget-constraint inconsistency in Lemma 1 (the claimed B* = Δ u1 v^T has ||B* B*^T||_F = Δ^2, not Δ) is a correctness or feasibility issue, not circularity. Similarly, the unsupported extension of SGC optimality to GCN/GIN is an unproven transfer assumption, not a circular step. No load-bearing step reduces to its own inputs by definition or by self-citation.

Assumptions & free parameters 2 free parameters · 5 assumptions · 0 invented entities

The central derivation relies on standard linear algebra plus domain assumptions about SGC, zero-feature virtual nodes, and attacker access to node embeddings. The only ad hoc assumption is the black-box proxy justification, which is also the main soundness weakness. No new physical entities are introduced; virtual nodes are a standard attack artifact in the injected-graph literature.

free parameters (2)
  • Perturbation budget Δ and virtual-node count n_v = Δ = r·|E| or r·|V|·deg(G); n_v = r·|V| or chosen in {0,1,2,5,10}
    Chosen by hand per experiment; all reported attack-success numbers are a function of these budgets. They are not fitted to optimize success, but they are free knobs whose values determine the results.
  • Random vector v = Sampled from U(0,1), then normalized
    The paper notes v has no effect for SGC but may matter for complex GNNs; choosing it randomly is an ad hoc, unoptimized design choice.
assumptions (5)
  • domain assumption 2-layer SGC output is Z = S^2 X Θ
    Used in Theorem 1 to derive the exact perturbation; only valid for linear SGC, not for GCN/GIN with nonlinearities and internal normalization.
  • domain assumption Virtual nodes have zero features (X~ = 0)
    Simplifies L(S_v) to ||S_v S_v^T XΘ||²; with nonzero features an extra term SS_v X~Θ appears in Appendix A.1.
  • domain assumption Attacker can observe clean node-level embeddings Z or M_agg output
    Defined in the threat model in Section 1.1; this is restricted black-box, not full black-box, since the attacker needs the output of the aggregation module for graph-level tasks.
  • ad hoc to paper Inequality chain Equations 7–10 justifies maximizing ||S_v S_v^T Z||_F as a proxy for L(S_v)
    The chain does not prove the proxy is maximized, and Eq. (10)'s equality is not generally valid. This is the load-bearing step for the black-box variant.
  • domain assumption GNN admits weighted/nonnegative adjacency, with optional ReLU positivity filter
    Used to justify the ReLU step and the positive perturbation values; PEA-U assumes no positivity requirement, which is not true for most real implementations.

how reviews work

0 comments
Cite this review

Pith. "Pith review of PEANUT: Perturbations by Eigenvector Alignment for Attacking Graph Neural Networks Under Topology-Driven Message Passing." pith.science (2026). https://pith.science/paper/AI7HSFOA

@misc{pith2026260326136,
  author       = {Pith},
  title        = {Pith review of: PEANUT: Perturbations by Eigenvector Alignment for Attacking Graph Neural Networks Under Topology-Driven Message Passing},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/AI7HSFOA}},
  note         = {Machine review of arXiv:2603.26136}
}
read the original abstract

Message Passing Neural Networks (MPNNs) have achieved strong performance on tasks involving relational data. However, small perturbations to graph structure can significantly alter their outputs, raising concerns about their robustness in real-world deployment in security critical environments. In this work, we study a core vulnerability in MPNNs that explicitly consume graph topology via the adjacency matrix or Laplacian as part of their message passing mechanism. We show that this design choice exposes an extremely vulnerable attack surface, with significant effects even under minimal perturbation. Building on this observation, we propose PEA, a simple, gradient-free, black-box injection attack that requires only a single query to the target model, capitalizing on this vulnerability by constructing a perturbation aligned with a specific significant eigenvector to induce large output deviations. Unlike graph modification attacks, PEA operates under the realistic assumption that adversaries cannot alter the original graph and are limited to injecting new nodes at inference time. PEA requires no iterative optimization, parameter learning, or surrogate models---which require additional training and remain susceptible to differences in model priors and generalization capabilities---thereby avoiding significant computational overhead and the associated transferability challenges. We evaluate PEA on popular benchmark datasets across three graph learning tasks, showing consistent performance degradation under realistic attack constraints despite its simplicity. Our results reveal a fundamental security weakness in topology-driven message passing architectures and urge an implementation shift, as the worst effects of such attacks can be substantially mitigated through appropriate input filtering.

Figures

Figures reproduced from arXiv: 2603.26136 by the authors.

Figure 1
Figure 1. PEA when used on a graph-level task. The attacker queries the model once to obtain the (clean) node-level embeddings, using them to create the perturbation S𝑣 using the eigenvector u1 of ZZ⊤ which induces a high L (S𝑣 ). on graph-level classification. Graph-level regression tasks, such as molecular property prediction or physical system modeling, remain comparatively underexplored in adversarial literature. In contr… view at source ↗
Figure 2
Figure 2. GIN Regression performance vs number of virtual nodes on the five regression datasets. [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. GIN Classification accuracy vs number of virtual nodes on the six classification datasets. All reported numbers have been averaged over the 10-Fold CV. The GIN, and SAGE architectures usually do not admit the adja￾cency matrix as-is since they only deal with unattributed aggrega￾tion over neighbors. However common implementations often use products of the form AX as a parallelizable and efficient aggregation step, w… view at source ↗
Figures from the paper (5 more)
Figure 5
Figure 5. Figure 5: Norm difference (L (S𝑣 )) between PEA-W, PEA, and a randomly chosen S𝑣 , illustrating how the white-box version compares with the black-box approximation and randomly chosen perturbations, using SGC on the NC datasets. In [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 4
Figure 4. Figure 4: GIN Regression performance for PEA, PEA-D, Rand and Rand-D for the same budget (normalized for the discrete variants), across the five regression datasets. 0 1 2 5 10 2.000 2.200 2.400 2.600 2.800 3.000 RMSE FreeSolv 0 1 2 5 10 0.900 1.000 1.100 ESOL 0 1 2 5 10 1.150 1…
Figure 6
Figure 6. Figure 6: GCN Regression performance vs number of virtual nodes on the MoleculeNet datasets. In [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 7
Figure 7. Figure 7: GIN Regression performance (RMSE and MAE) for PEA, PEA-D, Rand and Rand-D for the same budget (normalized [PITH_FULL_IMAGE:figures/full_fig_p011_7.png]
Figure 8
Figure 8. Figure 8: GIN Classification F1 vs number of virtual nodes on the six classification datasets. All reported numbers have been averaged over the 10-Fold CV. D Additional results • In [PITH_FULL_IMAGE:figures/full_fig_p012_8.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

40 extracted references · 11 linked inside Pith

  1. [1]

    Heng Chang, Yu Rong, Tingyang Xu, Wenbing Huang, Honglei Zhang, Peng Cui, Wenwu Zhu, and Junzhou Huang. 2020. A Restricted Black-box Adversarial Framework Towards Attacking Graph Embedding Models. InProceedings of the Thirty-Fourth AAAI Conference on Artificial Intelligence. 11132–11139

    2020

  2. [2]

    Jinyin Chen, Yangyang Wu, Xuanheng Xu, Yixian Chen, Haibin Zheng, and Qi Xuan. 2018. Fast gradient attack on network embedding.arXiv preprint arXiv:1809.02797(2018)

    arXiv 2018

  3. [3]

    Liang Chen, Jintang Li, Jiaying Peng, Tao Xie, Zengxu Cao, Kun Xu, Xiangnan He, Zibin Zheng, and Bingzhe Wu. 2020. A survey of adversarial learning on graphs.arXiv preprint arXiv:2003.05730(2020)

    arXiv 2020

  4. [4]

    Yongqiang Chen, Han Yang, Yonggang Zhang, Kaili Ma, Tongliang Liu, Bo Han, and James Cheng. 2022. Understanding and improving graph injection attack by promoting unnoticeability.arXiv preprint arXiv:2202.08057(2022)

    arXiv 2022

  5. [5]

    Hanjun Dai, Hui Li, Tian Tian, Xin Huang, Lin Wang, Jun Zhu, and Le Song

  6. [6]

    Vijay Prakash Dwivedi, Chaitanya K Joshi, Anh Tuan Luu, Thomas Laurent, Yoshua Bengio, and Xavier Bresson. 2023. Benchmarking graph neural networks. Journal of Machine Learning Research24, 43 (2023), 1–48

    2023

  7. [7]

    2022.𝑝-Laplacian Based Graph Neural Networks

    Guoji Fu, Peilin Zhao, and Yatao Bian. 2022.𝑝-Laplacian Based Graph Neural Networks. InInternational conference on machine learning. PMLR, 6878–6917

    2022

  8. [8]

    Justin Gilmer, Samuel S Schoenholz, Patrick F Riley, Oriol Vinyals, and George E Dahl. 2017. Neural message passing for quantum chemistry. InInternational conference on machine learning. Pmlr, 1263–1272

    2017

Show all 40 references
  1. [9]

    Rafael Gómez-Bombarelli, Jennifer N Wei, David Duvenaud, José Miguel Hernández-Lobato, Benjamín Sánchez-Lengeling, Dennis Sheberla, Jorge Aguilera-Iparraguirre, Timothy D Hirzel, Ryan P Adams, and Alán Aspuru-Guzik

  2. [10]

    Will Hamilton, Zhitao Ying, and Jure Leskovec. 2017. Inductive representation learning on large graphs.Advances in neural information processing systems30 (2017)

    2017

  3. [11]

    Automatic chemical design using a data-driven continuous representation of molecules.ACS central science4, 2 (2018), 268–276

    2018

  4. [12]

    Wei Jin, Yaxing Li, Han Xu, Yiqi Wang, Shuiwang Ji, Charu Aggarwal, and Jiliang Tang. 2021. Adversarial attacks and defenses on graphs.ACM SIGKDD Explorations Newsletter22, 2 (2021), 19–34

    2021

  5. [13]

    Weiwei Jiang and Jiayun Luo. 2022. Graph neural network for traffic forecasting: A survey.Expert systems with applications207 (2022), 117921

    2022

  6. [14]

    Diederik P Kingma and Jimmy Ba. 2014. Adam: A method for stochastic opti- mization.arXiv preprint arXiv:1412.6980(2014)

    2014 arXiv

  7. [15]

    Mingxuan Ju, Yujie Fan, Chuxu Zhang, and Yanfang Ye. 2023. Let graph be the go board: gradient-free node injection attack for graph neural networks via reinforcement learning. InProceedings of the AAAI conference on artificial intelligence, Vol. 37. 4383–4390

    2023

  8. [16]

    Yaguang Li, Rose Yu, Cyrus Shahabi, and Yan Liu. 2017. Diffusion convolu- tional recurrent neural network: Data-driven traffic forecasting.arXiv preprint arXiv:1707.01926(2017)

    2017 arXiv

  9. [17]

    TN Kipf. 2016. Semi-supervised classification with graph convolutional networks. arXiv preprint arXiv:1609.02907(2016)

    2016 arXiv

  10. [18]

    Christopher Morris, Nils M Kriege, Franka Bause, Kristian Kersting, Petra Mutzel, and Marion Neumann. 2020. Tudataset: A collection of benchmark datasets for learning with graphs.arXiv preprint arXiv:2007.08663(2020)

    2020 arXiv

  11. [19]

    Chang Liu, Hai Huang, Yujie Xing, and Xingquan Zuo. 2025. Query-Based and Unnoticeable Graph Injection Attack from Neighborhood Perspective.arXiv preprint arXiv:2502.01936(2025)

    2025 arXiv

  12. [20]

    Michael Schlichtkrull, Thomas N Kipf, Peter Bloem, Rianne Van Den Berg, Ivan Titov, and Max Welling. 2018. Modeling relational data with graph convolutional networks. InEuropean semantic web conference. Springer, 593–607

    2018

  13. [21]

    Alvaro Sanchez-Gonzalez, Jonathan Godwin, Tobias Pfaff, Rex Ying, Jure Leskovec, and Peter Battaglia. 2020. Learning to Simulate Complex Physics with Graph Networks. InProceedings of the 37th International Conference on Ma- chine Learning (Proceedings of Machine Learning Resea...

    2020

  14. [22]

    Yiwei Sun, Suhang Wang, Xianfeng Tang, Tsung-Yu Hsieh, and Vasant Honavar

  15. [23]

    Lichao Sun, Yingtong Dou, Carl Yang, Kai Zhang, Ji Wang, Philip S Yu, Lifang He, and Bo Li. 2022. Adversarial attack and defense on graph data: A survey. IEEE Transactions on Knowledge and Data Engineering35, 8 (2022), 7693–7711

    2022

  16. [24]

    Jihong Wang, Minnan Luo, Fnu Suya, Jundong Li, Zijiang Yang, and Qinghua Zheng. 2020. Scalable attack on graph data by injecting vicious nodes.Data Mining and Knowledge Discovery34, 5 (2020), 1363–1389

    2020

  17. [25]

    Felix Wu, Amauri Souza, Tianyi Zhang, Christopher Fifty, Tao Yu, and Kilian Weinberger. 2019. Simplifying Graph Convolutional Networks. InProceedings of the 36th International Conference on Machine Learning (ICML). PMLR, 6861–6871

    2019

  18. [26]

    Shuchang Tao, Qi Cao, Huawei Shen, Junjie Huang, Yunfan Wu, and Xueqi Cheng. 2021. Single node injection attack against graph neural networks. In Proceedings of the 30th ACM International Conference on Information & Knowledge Management. 1794–1803

    2021

  19. [27]

    Jiarong Xu, Yizhou Sun, Xin Jiang, Yanhao Wang, Yang Yang, Chunping Wang, and Jiangang Lu. 2020. Query-Free Black-Box Adversarial Attacks on Graphs. CoRRabs/2012.06757 (2020)

    2020 arXiv

  20. [28]

    Keyulu Xu, Weihua Hu, Jure Leskovec, and Stefanie Jegelka. 2018. How powerful are graph neural networks?arXiv preprint arXiv:1810.00826(2018)

    2018 arXiv

  21. [29]

    Zhenqin Wu, Bharath Ramsundar, Evan N Feinberg, Joseph Gomes, Caleb Ge- niesse, Aneesh S Pappu, Karl Leswing, and Vijay Pande. 2018. MoleculeNet: a benchmark for molecular machine learning.Chemical science9, 2 (2018), 513–530

    2018

  22. [30]

    Rex Ying, Ruining He, Kaifeng Chen, Pong Eksombatchai, William L Hamilton, and Jure Leskovec. 2018. Graph convolutional neural networks for web-scale recommender systems. InProceedings of the 24th ACM SIGKDD international conference on knowledge discovery & data mining. 974–983

    2018

  23. [31]

    Yu Zhou, Zihao Dong, Guofeng Zhang, and Jingchen Tang. 2023. Hard Label Black Box Node Injection Attack on Graph Neural Networks.arXiv preprint arXiv:2311.13244(2023)

    2023 arXiv

  24. [32]

    Zhilin Yang, William Cohen, and Ruslan Salakhudinov. 2016. Revisiting semi- supervised learning with graph embeddings. InInternational conference on ma- chine learning. PMLR, 40–48

    2016

  25. [33]

    Daniel Zügner, Amir Akbarnejad, and Stephan Günnemann. 2018. Adversarial Attacks on Neural Networks for Graph Data. InProceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining. ACM, 2847–2856

    2018

  26. [34]

    Daniel Zügner, Oliver Borchert, Amir Akbarnejad, and Stephan Günnemann

  27. [35]

    Xu Zou, Qinkai Zheng, Yuxiao Dong, Xinyu Guan, Evgeny Kharlamov, Jialiang Lu, and Jie Tang. 2021. TDGIA: Effective Injection Attacks on Graph Neural Networks. InProceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining. 3428–3438

    2021

  28. [38]

    Adversarial attacks on graph neural networks: Perturbations and their patterns.ACM Transactions on Knowledge Discovery from Data (TKDD)14, 5 (2020), 1–31

    2020

  29. [39]

    Daniel Zügner and Stephan Günnemann. 2019. Adversarial Attacks on Graph Neural Networks via Meta Learning. InInternational Conference on Learning Representations (ICLR). A Proof of Lemma 1 Lemma 1.For a given real-valuedZ ∈R 𝑁×𝑑 , and budget 𝚫, we define the following optimiza...

    2019

  30. [40]

    We also use early stopping here with the same patience of100epochs

    with a starting learning rate of0 .001, reduced by a factor of 𝛾= 0.9if the tracked validation metric—F1 score for GC, RMSE for GR—does not improve for20epochs (plateau lr reduction), with the minimum lr set to1𝑒− 4. We also use early stopping here with the same patience of100...

  31. [2018]

    InInternational conference on machine learning

    Adversarial attack on graph structured data. InInternational conference on machine learning. PMLR, 1115–1124

  32. [2020]

    InProceedings of the Web Conference

    Adversarial attacks on graph neural networks via node injections: A hier- archical reinforcement learning approach. InProceedings of the Web Conference

Pith tools

Reviewed August 2, 2026 · model on record in the stance chip above.