# Graph Universal Adversarial Attacks: A Few Bad Actors Ruin Graph Learning Models

arXiv: https://arxiv.org/abs/2002.04784 · HTML: https://mlsanity.com/paper/2002.04784/

## Key facts

- Cited by 18 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 12 Feb 2020.

## Built on by (most cited first, 18 of 18)

- [Trustworthy Graph Neural Networks: Aspects, Methods and Trends](https://mlsanity.com/paper/2205.07424/) (2022)
- [Transferable Graph Backdoor Attack](https://mlsanity.com/paper/2207.00425/) (2022)
- [Universal Spectral Adversarial Attacks for Deformable Shapes](https://mlsanity.com/paper/2104.03356/) (2021)
- [Strategic Classification with Graph Neural Networks](https://mlsanity.com/paper/2205.15765/) (2022)
- [Recent Advances in Reliable Deep Graph Learning: Inherent Noise, Distribution Shift, and Adversarial Attack](https://mlsanity.com/paper/2202.07114/) (2022)
- [Bandits for Structure Perturbation-based Black-box Attacks to Graph Neural Networks with Theoretical Guarantees](https://mlsanity.com/paper/2205.03546/) (2022)
- [GraphAttacker: A General Multi-Task GraphAttack Framework](https://mlsanity.com/paper/2101.06855/) (2021)
- [RIBAC: Towards Robust and Imperceptible Backdoor Attack against Compact DNN](https://mlsanity.com/paper/2208.10608/) (2022)
- [CSTAR: Towards Compact and STructured Deep Neural Networks with Adversarial Robustness](https://mlsanity.com/paper/2212.01957/) (2022)
- [GUAP: Graph Universal Attack Through Adversarial Patching](https://mlsanity.com/paper/2301.01731/) (2023)
- [Adversarial Attack across Datasets](https://mlsanity.com/paper/2110.07718/) (2021)
- [GUARD: Graph Universal Adversarial Defense](https://mlsanity.com/paper/2204.09803/) (2022)
- [Revisiting Edge Perturbation for Graph Neural Network in Graph Data Augmentation and Attack](https://mlsanity.com/paper/2403.07943/) (2024)
- [Explainability-Based Adversarial Attack on Graphs Through Edge Perturbation](https://mlsanity.com/paper/2312.17301/) (2023)
- [GAIM: Attacking Graph Neural Networks via Adversarial Influence Maximization](https://mlsanity.com/paper/2408.10948/) (2024)
- [Multi-Instance Adversarial Attack on GNN-Based Malicious Domain Detection](https://mlsanity.com/paper/2308.11754/) (2023)
- [Adversary-Robust Graph-Based Learning of WSIs](https://mlsanity.com/paper/2403.14489/) (2024)
- [Query-Efficient Adversarial Attack Against Vertical Federated Graph Learning](https://mlsanity.com/paper/2411.02809/) (2024)

## Abstract (arXiv)

Deep neural networks, while generalize well, are known to be sensitive to small adversarial perturbations. This phenomenon poses severe security threat and calls for in-depth investigation of the robustness of deep learning models. With the emergence of neural networks for graph structured data, similar investigations are urged to understand their robustness. It has been found that adversarially perturbing the graph structure and/or node features may result in a significant degradation of the model performance. In this work, we show from a different angle that such fragility similarly occurs if the graph contains a few bad-actor nodes, which compromise a trained graph neural network through flipping the connections to any targeted victim. Worse, the bad actors found for one graph model severely compromise other models as well. We call the bad actors ``anchor nodes'' and propose an algorithm, named GUA, to identify them. Thorough empirical investigations suggest an interesting finding that the anchor nodes often belong to the same class; and they also corroborate the intuitive trade-off between the number of anchor nodes and the attack success rate. For the dataset Cora which contains 2708 nodes, as few as six anchor nodes will result in an attack success rate higher than 80% for GCN and other three models.