{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/black-box-adversarial-attacks-on-graph-neural","title":"Towards More Practical Adversarial Attacks on Graph Neural Networks","arxiv_id":"2006.05057","date":"2020-06-09","proceeding":"NeurIPS 2020 12","authors":["Jiaqi Ma","Shuangrui Ding","Qiaozhu Mei"],"abstract":"We study the black-box attacks on graph neural networks (GNNs) under a novel and realistic constraint: attackers have access to only a subset of nodes in the network, and they can only attack a small number of them. A node selection step is essential under this setup. We demonstrate that the structural inductive biases of GNN models can be an effective source for this type of attacks. Specifically, by exploiting the connection between the backward propagation of GNNs and random walks, we show that the common gradient-based white-box attacks can be generalized to the black-box setting via the connection between the gradient and an importance score similar to PageRank. In practice, we find attacks based on this importance score indeed increase the classification loss by a large margin, but they fail to significantly increase the mis-classification rate. Our theoretical and empirical analyses suggest that there is a discrepancy between the loss and mis-classification rate, as the latter presents a diminishing-return pattern when the number of attacked nodes increases. Therefore, we propose a greedy procedure to correct the importance score that takes into account of the diminishing-return pattern. Experimental results show that the proposed procedure can significantly increase the mis-classification rate of common GNNs on real-world data without access to model parameters nor predictions.","url_abs":"https://arxiv.org/abs/2006.05057v3","url_pdf":"https://arxiv.org/pdf/2006.05057v3.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"black-box-adversarial-attacks-on-graph-neural","repo_url":"https://github.com/Mark12Ding/GNN-Practical-Attack","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}},{"paper_slug":"black-box-adversarial-attacks-on-graph-neural","repo_url":"https://github.com/TheaperDeng/GNN-Attack-InfMax","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[{"task_slug":"classification-1","task_name":"Classification"},{"task_slug":"classification","task_name":"General Classification"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2006.05057","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2006.05057"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/TheaperDeng/GNN-Attack-InfMax","reach":{"status":"ok","spdx":"MIT"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/Mark12Ding/GNN-Practical-Attack","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"ran_draft_wrong":3,"unverified":3},"by_repo_kind":{"official":{"samples":6,"ran":3,"repositories":2}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"27df709d95d0bfb7","entry":"New_sort_erf_testsum","repo":"theaperdeng/gnn-attack-infmax","repo_kind":"official","path":"attack.py","file_url":"https://github.com/theaperdeng/gnn-attack-infmax/blob/HEAD/attack.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":"invariant","behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"27df709d95d0bfb7"}},{"code_sha256_prefix":"b495853937d23deb","entry":"New_sort_sumtest","repo":"theaperdeng/gnn-attack-infmax","repo_kind":"official","path":"attack.py","file_url":"https://github.com/theaperdeng/gnn-attack-infmax/blob/HEAD/attack.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":"invariant","behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"b495853937d23deb"}},{"code_sha256_prefix":"a37e866ddc285b70","entry":"getScore","repo":"mark12ding/gnn-practical-attack","repo_kind":"official","path":"attack.py","file_url":"https://github.com/mark12ding/gnn-practical-attack/blob/HEAD/attack.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"a37e866ddc285b70"}},{"code_sha256_prefix":"62cc074a62020b53","entry":"getScore","repo":"theaperdeng/gnn-attack-infmax","repo_kind":"official","path":"attack.py","file_url":"https://github.com/theaperdeng/gnn-attack-infmax/blob/HEAD/attack.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"62cc074a62020b53"}},{"code_sha256_prefix":"193746d4ee64623c","entry":"getScoreGreedy","repo":"mark12ding/gnn-practical-attack","repo_kind":"official","path":"attack.py","file_url":"https://github.com/mark12ding/gnn-practical-attack/blob/HEAD/attack.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"193746d4ee64623c"}},{"code_sha256_prefix":"22a55a7d9807a9d2","entry":"getThrehold","repo":"mark12ding/gnn-practical-attack","repo_kind":"official","path":"attack.py","file_url":"https://github.com/mark12ding/gnn-practical-attack/blob/HEAD/attack.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"22a55a7d9807a9d2"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}