# A Targeted Universal Attack on Graph Convolutional Network

arXiv: https://arxiv.org/abs/2011.14365 · HTML: https://mlsanity.com/paper/2011.14365/

## Key facts

- Cited by 12 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 29 Nov 2020.

## Built on by (most cited first, 12 of 12)

- [Robust Node Classification on Graphs: Jointly from Bayesian Label Transition and Topology-based Label Propagation](https://mlsanity.com/paper/2208.09779/) (2022)
- [Recent Advances in Reliable Deep Graph Learning: Inherent Noise, Distribution Shift, and Adversarial Attack](https://mlsanity.com/paper/2202.07114/) (2022)
- [A semantic backdoor attack against Graph Convolutional Networks](https://mlsanity.com/paper/2302.14353/) (2023)
- [Adversarial Diffusion Attacks on Graph-based Traffic Prediction Models](https://mlsanity.com/paper/2104.09369/) (2021)
- [Sparse Vicious Attacks on Graph Neural Networks](https://mlsanity.com/paper/2209.09688/) (2022)
- [Fast Inference of Removal-Based Node Influence](https://mlsanity.com/paper/2403.08333/) (2024)
- [Momentum Gradient-based Untargeted Attack on Hypergraph Neural Networks](https://mlsanity.com/paper/2310.15656/) (2023)
- [Effective backdoor attack on graph neural networks in link prediction tasks](https://mlsanity.com/paper/2401.02663/) (2024)
- [A Clean-graph Backdoor Attack against Graph Convolutional Networks with Poisoned Label Only](https://mlsanity.com/paper/2404.12704/) (2024)
- [AGSOA:Graph Neural Network Targeted Attack Based on Average Gradient and Structure Optimization](https://mlsanity.com/paper/2406.13228/) (2024)
- [Multi-Instance Adversarial Attack on GNN-Based Malicious Domain Detection](https://mlsanity.com/paper/2308.11754/) (2023)
- [Hierarchical Graph Feature Enhancement with Adaptive Frequency Modulation for Visual Recognition](https://mlsanity.com/paper/2508.11497/) (2025)

## Abstract (arXiv)

Graph-structured data exist in numerous applications in real life. As a state-of-the-art graph neural network, the graph convolutional network (GCN) plays an important role in processing graph-structured data. However, a recent study reported that GCNs are also vulnerable to adversarial attacks, which means that GCN models may suffer malicious attacks with unnoticeable modifications of the data. Among all the adversarial attacks on GCNs, there is a special kind of attack method called the universal adversarial attack, which generates a perturbation that can be applied to any sample and causes GCN models to output incorrect results. Although universal adversarial attacks in computer vision have been extensively researched, there are few research works on universal adversarial attacks on graph structured data. In this paper, we propose a targeted universal adversarial attack against GCNs. Our method employs a few nodes as the attack nodes. The attack capability of the attack nodes is enhanced through a small number of fake nodes connected to them. During an attack, any victim node will be misclassified by the GCN as the attack node class as long as it is linked to them. The experiments on three popular datasets show that the average attack success rate of the proposed attack on any victim node in the graph reaches 83% when using only 3 attack nodes and 6 fake nodes. We hope that our work will make the community aware of the threat of this type of attack and raise the attention given to its future defense.