{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/adversarial-attacks-on-neural-networks-for","title":"Adversarial Attacks on Neural Networks for Graph Data","arxiv_id":"1805.07984","date":"2018-05-21","proceeding":null,"authors":["Daniel Zügner","Amir Akbarnejad","Stephan Günnemann"],"abstract":"Deep learning models for graphs have achieved strong performance for the task of node classification. Despite their proliferation, currently there is no study of their robustness to adversarial attacks. Yet, in domains where they are likely to be used, e.g. the web, adversaries are common. Can deep learning models for graphs be easily fooled? In this work, we introduce the first study of adversarial attacks on attributed graphs, specifically focusing on models exploiting ideas of graph convolutions. In addition to attacks at test time, we tackle the more challenging class of poisoning/causative attacks, which focus on the training phase of a machine learning model. We generate adversarial perturbations targeting the node's features and the graph structure, thus, taking the dependencies between instances in account. Moreover, we ensure that the perturbations remain unnoticeable by preserving important data characteristics. To cope with the underlying discrete domain we propose an efficient algorithm Nettack exploiting incremental computations. Our experimental study shows that accuracy of node classification significantly drops even when performing only few perturbations. Even more, our attacks are transferable: the learned attacks generalize to other state-of-the-art node classification models and unsupervised approaches, and likewise are successful even when only limited knowledge about the graph is given.","url_abs":"https://arxiv.org/abs/1805.07984v4","url_pdf":"https://arxiv.org/pdf/1805.07984v4.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"adversarial-attacks-on-neural-networks-for","repo_url":"https://github.com/danielzuegner/nettack","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[{"task_slug":"classification","task_name":"General Classification"},{"task_slug":"node-classification","task_name":"Node Classification"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=1805.07984","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"1805.07984"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/danielzuegner/nettack","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"unverified":8},"by_repo_kind":{"listed":{"samples":8,"ran":0,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"3dfa8f8448457f20","entry":"compute_alpha","repo":"danielzuegner/nettack","repo_kind":"listed","path":"nettack/nettack.py","file_url":"https://github.com/danielzuegner/nettack/blob/HEAD/nettack/nettack.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"3dfa8f8448457f20"}},{"code_sha256_prefix":"f7fada718dfb80fa","entry":"compute_new_a_hat_uv","repo":"danielzuegner/nettack","repo_kind":"listed","path":"nettack/nettack.py","file_url":"https://github.com/danielzuegner/nettack/blob/HEAD/nettack/nettack.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"f7fada718dfb80fa"}},{"code_sha256_prefix":"e76a55dd6370c052","entry":"connected_after","repo":"danielzuegner/nettack","repo_kind":"listed","path":"nettack/nettack.py","file_url":"https://github.com/danielzuegner/nettack/blob/HEAD/nettack/nettack.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"e76a55dd6370c052"}},{"code_sha256_prefix":"fe0c7932ba49e99d","entry":"eval_class","repo":"danielzuegner/nettack","repo_kind":"listed","path":"nettack/GCN.py","file_url":"https://github.com/danielzuegner/nettack/blob/HEAD/nettack/GCN.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"fe0c7932ba49e99d"}},{"code_sha256_prefix":"f18b6a502c85b70f","entry":"largest_connected_components","repo":"danielzuegner/nettack","repo_kind":"listed","path":"nettack/utils.py","file_url":"https://github.com/danielzuegner/nettack/blob/HEAD/nettack/utils.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"f18b6a502c85b70f"}},{"code_sha256_prefix":"3a0244a98c124e9a","entry":"load_npz","repo":"danielzuegner/nettack","repo_kind":"listed","path":"nettack/utils.py","file_url":"https://github.com/danielzuegner/nettack/blob/HEAD/nettack/utils.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"3a0244a98c124e9a"}},{"code_sha256_prefix":"fc3b508e487bb7c6","entry":"preprocess_graph","repo":"danielzuegner/nettack","repo_kind":"listed","path":"nettack/utils.py","file_url":"https://github.com/danielzuegner/nettack/blob/HEAD/nettack/utils.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"fc3b508e487bb7c6"}},{"code_sha256_prefix":"81be8a5f4732fe52","entry":"sparse_dropout","repo":"danielzuegner/nettack","repo_kind":"listed","path":"nettack/GCN.py","file_url":"https://github.com/danielzuegner/nettack/blob/HEAD/nettack/GCN.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"81be8a5f4732fe52"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}