Scholarlink

<p>Inductive Graph Neural Networks (GNNs) have exhibited outstanding predictive performance across applications like social network analysis and protein structure prediction by leveraging graph topology. Adversarial attack is one of the main black-box methods to verify the robustness of prediction models. The primary research objective of adversarial attacks is to construct nuanced feature perturbations that can effectively validate the prediction boundaries of the model. This paper proposes GraphZOOM, a novel black-box attack method applied in inductive GNNs. GraphZOOM uses zero-order optimization to solve the two problems of node selection and feature perturbation against attacks in GNNs, and constructs a perturbed subgraph on a target node to realize an attack mode. The adversarial attack algorithm is evaluated in terms of perturbation accuracy and feature similarity. GraphZOOM can substantially degrade the model’s predictive performance with minimal alterations to the graph.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

GraphZOOM: subgraph black-box attack against inductive graph neural networks

  • 期刊论文

  • 出版模式：

    开放获取

  • 发表日期：

    2025年11月11日

查看全文
  • Ruixin Tang,
  • Awei Moshili,
  • Kai Huang,
  • Jian Mao,
  • Jinliang Lin

摘要

Inductive Graph Neural Networks (GNNs) have exhibited outstanding predictive performance across applications like social network analysis and protein structure prediction by leveraging graph topology. Adversarial attack is one of the main black-box methods to verify the robustness of prediction models. The primary research objective of adversarial attacks is to construct nuanced feature perturbations that can effectively validate the prediction boundaries of the model. This paper proposes GraphZOOM, a novel black-box attack method applied in inductive GNNs. GraphZOOM uses zero-order optimization to solve the two problems of node selection and feature perturbation against attacks in GNNs, and constructs a perturbed subgraph on a target node to realize an attack mode. The adversarial attack algorithm is evaluated in terms of perturbation accuracy and feature similarity. GraphZOOM can substantially degrade the model’s predictive performance with minimal alterations to the graph.