# Attack Graph Convolutional Networks by Adding Fake Nodes

arXiv: https://arxiv.org/abs/1810.10751 · HTML: https://mlsanity.com/paper/1810.10751/

## Key facts

- Cited by 26 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 25 Oct 2018.

## Built on by (most cited first, 26 of 26)

- [Understanding and Improving Graph Injection Attack by Promoting Unnoticeability](https://mlsanity.com/paper/2202.08057/) (2022)
- [A Hard Label Black-box Adversarial Attack Against Graph Neural Networks](https://mlsanity.com/paper/2108.09513/) (2021)
- [Towards Deep Attention in Graph Neural Networks: Problems and Remedies](https://mlsanity.com/paper/2306.02376/) (2023)
- [Graph-Fraudster: Adversarial Attacks on Graph Neural Network Based Vertical Federated Learning](https://mlsanity.com/paper/2110.06468/) (2021)
- [Projective Ranking-based GNN Evasion Attacks](https://mlsanity.com/paper/2202.12993/) (2022)
- [Robust Node Classification on Graphs: Jointly from Bayesian Label Transition and Topology-based Label Propagation](https://mlsanity.com/paper/2208.09779/) (2022)
- [Intruding with Words: Towards Understanding Graph Injection Attacks at the Text Level](https://mlsanity.com/paper/2405.16405/) (2024)
- [GraphAttacker: A General Multi-Task GraphAttack Framework](https://mlsanity.com/paper/2101.06855/) (2021)
- [Analysis of Convolutions, Non-linearity and Depth in Graph Neural Networks using Neural Tangent Kernel](https://mlsanity.com/paper/2210.09809/) (2022)
- [Cluster Attack: Query-based Adversarial Attacks on Graphs with Graph-Dependent Priors](https://mlsanity.com/paper/2109.13069/) (2021)
- [Neighboring Backdoor Attacks on Graph Convolutional Network](https://mlsanity.com/paper/2201.06202/) (2022)
- [Exact Certification of (Graph) Neural Networks Against Label Poisoning](https://mlsanity.com/paper/2412.00537/) (2024)
- [Sparse Vicious Attacks on Graph Neural Networks](https://mlsanity.com/paper/2209.09688/) (2022)
- [Node Injection for Class-specific Network Poisoning](https://mlsanity.com/paper/2301.12277/) (2023)
- [Surrogate Representation Learning with Isometric Mapping for Gray-box Graph Adversarial Attacks](https://mlsanity.com/paper/2110.10482/) (2021)
- [GUAP: Graph Universal Attack Through Adversarial Patching](https://mlsanity.com/paper/2301.01731/) (2023)
- [When Witnesses Defend: A Witness Graph Topological Layer for Adversarial Graph Learning](https://mlsanity.com/paper/2409.14161/) (2024)
- [Graphfool: Targeted Label Adversarial Attack on Graph Embedding](https://mlsanity.com/paper/2102.12284/) (2021)
- [Resisting Graph Adversarial Attack via Cooperative Homophilous Augmentation](https://mlsanity.com/paper/2211.08068/) (2022)
- [GNNBleed: Inference Attacks to Unveil Private Edges in Graphs with Realistic Access to GNN Models](https://mlsanity.com/paper/2311.16139/) (2023)
- [Explainability-Based Adversarial Attack on Graphs Through Edge Perturbation](https://mlsanity.com/paper/2312.17301/) (2023)
- [Improving Peer Assessment with Graph Convolutional Networks](https://mlsanity.com/paper/2111.04466/) (2021)
- [Weisfeiler and Leman Go Measurement Modeling: Probing the Validity of the WL Test](https://mlsanity.com/paper/2307.05775/) (2023)
- [Certifying Robustness of Graph Convolutional Networks for Node Perturbation with Polyhedra Abstract Interpretation](https://mlsanity.com/paper/2405.08645/) (2024)
- [How Feasible is Augmenting Fake Nodes with Learnable Features as a Counter-strategy against Link Stealing Attacks?](https://mlsanity.com/paper/2503.09726/) (2025)
- [Evading Overlapping Community Detection via Proxy Node Injection](https://mlsanity.com/paper/2509.21211/) (2025)

## Abstract (arXiv)

In this paper, we study the robustness of graph convolutional networks (GCNs). Previous work have shown that GCNs are vulnerable to adversarial perturbation on adjacency or feature matrices of existing nodes; however, such attacks are usually unrealistic in real applications. For instance, in social network applications, the attacker will need to hack into either the client or server to change existing links or features. In this paper, we propose a new type of "fake node attacks" to attack GCNs by adding malicious fake nodes. This is much more realistic than previous attacks; in social network applications, the attacker only needs to register a set of fake accounts and link to existing ones. To conduct fake node attacks, a greedy algorithm is proposed to generate edges of malicious nodes and their corresponding features aiming to minimize the classification accuracy on the target nodes. In addition, we introduce a discriminator to classify malicious nodes from real nodes, and propose a Greedy-GAN attack to simultaneously update the discriminator and the attacker, to make malicious nodes indistinguishable from the real ones. Our non-targeted attack decreases the accuracy of GCN down to 0.03, and our targeted attack reaches a success rate of 78% on a group of 100 nodes, and 90% on average for attacking a single target node.