# Adversarial Attacks on Knowledge Graph Embeddings via Instance Attribution Methods

arXiv: https://arxiv.org/abs/2111.03120 · HTML: https://mlsanity.com/paper/2111.03120/

## Key facts

- Cited by 16 papers in the map (data through 14 Oct 2026).
- Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security.
- Builds on 25 of its 42 references that are in the map.
- First posted on arXiv 4 Nov 2021.

## Placed in

- LLM safety and security / [Backdoor and data poisoning attacks](https://mlsanity.com/safety/backdoor-and-data-poisoning-attacks/)

## Builds on (most cited first, 25 of 25)

- [Understanding Black-box Predictions via Influence Functions](https://mlsanity.com/paper/1703.04730/) (2017)
- [Embedding Entities and Relations for Learning and Inference in Knowledge Bases](https://mlsanity.com/paper/1412.6575/) (2014)
- [Complex Embeddings for Simple Link Prediction](https://mlsanity.com/paper/1606.06357/) (2016)
- [Convolutional 2D Knowledge Graph Embeddings](https://mlsanity.com/paper/1707.01476/) (2017)
- [Knowledge Graphs](https://mlsanity.com/paper/2003.02320/) (2020)
- [Estimating Training Data Influence by Tracing Gradient Descent](https://mlsanity.com/paper/2002.08484/) (2020)
- [Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning](https://mlsanity.com/paper/1712.03141/) (2017)
- [Adversarial Attacks on Neural Networks for Graph Data](https://mlsanity.com/paper/1805.07984/) (2018)
- [Adversarial Attack on Graph Structured Data](https://mlsanity.com/paper/1806.02371/) (2018)
- [A Review of Relational Machine Learning for Knowledge Graphs](https://mlsanity.com/paper/1503.00759/) (2015)
- [A Comprehensive Survey of Graph Embedding: Problems, Techniques and Applications](https://mlsanity.com/paper/1709.07604/) (2017)
- [Adversarial Attacks and Defenses in Images, Graphs and Text: A Review](https://mlsanity.com/paper/1909.08072/) (2019)
- [Canonical Tensor Decomposition for Knowledge Base Completion](https://mlsanity.com/paper/1806.07297/) (2018)
- [On the Accuracy of Influence Functions for Measuring Group Effects](https://mlsanity.com/paper/1905.13289/) (2019)
- [Explaining Black Box Predictions and Unveiling Data Artifacts through Influence Functions](https://mlsanity.com/paper/2005.06676/) (2020)
- [Input Similarity from the Neural Network Perspective](https://mlsanity.com/paper/2102.05262/) (2021)
- [KBGAN: Adversarial Learning for Knowledge Graph Embeddings](https://mlsanity.com/paper/1711.04071/) (2017)
- [Interaction Embeddings for Prediction and Explanation in Knowledge Graphs](https://mlsanity.com/paper/1903.04750/) (2019)
- [Knowledge Base Completion: Baselines Strike Back](https://mlsanity.com/paper/1705.10744/) (2017)
- [Data Poisoning Attack against Knowledge Graph Embedding](https://mlsanity.com/paper/1904.12052/) (2019)
- [An Empirical Comparison of Instance Attribution Methods for NLP](https://mlsanity.com/paper/2104.04128/) (2021)
- [Investigating Robustness and Interpretability of Link Prediction via Adversarial Modifications](https://mlsanity.com/paper/1905.00563/) (2019)
- [Adversarial Sets for Regularising Neural Link Predictors](https://mlsanity.com/paper/1707.07596/) (2017)
- [Explaining Neural Matrix Factorization with Gradient Rollback](https://mlsanity.com/paper/2010.05516/) (2020)
- [On Inductive Abilities of Latent Factor Models for Relational Learning](https://mlsanity.com/paper/1709.05666/) (2017)

## Built on by (most cited first, 16 of 16)

- [Complex Query Answering on Eventuality Knowledge Graph with Implicit Logical Constraints](https://mlsanity.com/paper/2305.19068/) (2023)
- [Safety in Graph Machine Learning: Threats and Safeguards](https://mlsanity.com/paper/2405.11034/) (2024)
- [Predictive Multiplicity of Knowledge Graph Embeddings in Link Prediction](https://mlsanity.com/paper/2408.08226/) (2024)
- [On the Security Risks of Knowledge Graph Reasoning](https://mlsanity.com/paper/2305.02383/) (2023)
- [Untargeted Adversarial Attack on Knowledge Graph Embeddings](https://mlsanity.com/paper/2405.10970/) (2024)
- [TWIG: Towards pre-hoc Hyperparameter Optimisation and Cross-Graph Generalisation via Simulated KGE Models](https://mlsanity.com/paper/2402.06097/) (2024)
- [eXpath: Explaining Knowledge Graph Link Prediction with Ontological Closed Path Rules](https://mlsanity.com/paper/2412.04846/) (2024)
- [Resilience in Knowledge Graph Embeddings](https://mlsanity.com/paper/2410.21163/) (2024)
- [KGMark: A Diffusion Watermark for Knowledge Graphs](https://mlsanity.com/paper/2505.23873/) (2025)
- [Unifying Post-hoc Explanations of Knowledge Graph Completions](https://mlsanity.com/paper/2507.22951/) (2025)
- [DRGW: Learning Disentangled Representations for Robust Graph Watermarking](https://mlsanity.com/paper/2601.13569/) (2026)
- [Veni, Vidi, Vici: Solving the Myriad of Challenges before Knowledge Graph Learning](https://mlsanity.com/paper/2402.06098/) (2024)
- [From Latent to Lucid: Transforming Knowledge Graph Embeddings into Interpretable Structures with KGEPrisma](https://mlsanity.com/paper/2406.01759/) (2024)
- [Performance Evaluation of Knowledge Graph Embedding Approaches under Non-adversarial Attacks](https://mlsanity.com/paper/2407.06855/) (2024)
- [Extending TWIG: Zero-Shot Predictive Hyperparameter Selection for KGEs based on Graph Structure](https://mlsanity.com/paper/2412.14801/) (2024)
- [LLMAtKGE: Large Language Models as Explainable Attackers against Knowledge Graph Embeddings](https://mlsanity.com/paper/2510.11584/) (2025)

## Abstract (arXiv)

Despite the widespread use of Knowledge Graph Embeddings (KGE), little is known about the security vulnerabilities that might disrupt their intended behaviour. We study data poisoning attacks against KGE models for link prediction. These attacks craft adversarial additions or deletions at training time to cause model failure at test time. To select adversarial deletions, we propose to use the model-agnostic instance attribution methods from Interpretable Machine Learning, which identify the training instances that are most influential to a neural model's predictions on test instances. We use these influential triples as adversarial deletions. We further propose a heuristic method to replace one of the two entities in each influential triple to generate adversarial additions. Our experiments show that the proposed strategies outperform the state-of-art data poisoning attacks on KGE models and improve the MRR degradation due to the attacks by up to 62% over the baselines.