mlsanityData to 14 Oct 2026

Understanding and Improving Graph Injection Attack by Promoting Unnoticeability

arXiv 2202.08057 ↗First posted 16 Feb 2022cs.LG cs.CR stat.MLcited by 62

Not on the map. Why?

Abstract (arXiv)

Recently Graph Injection Attack (GIA) emerges as a practical attack scenario on Graph Neural Networks (GNNs), where the adversary can merely inject few malicious nodes instead of modifying existing nodes or edges, i.e., Graph Modification Attack (GMA). Although GIA has achieved promising results, little is known about why it is successful and whether there is any pitfall behind the success. To understand the power of GIA, we compare it with GMA and find that GIA can be provably more harmful than GMA due to its relatively high flexibility. However, the high flexibility will also lead to great damage to the homophily distribution of the original graph, i.e., similarity among neighbors. Consequently, the threats of GIA can be easily alleviated or even prevented by homophily-based defenses designed to recover the original homophily. To mitigate the issue, we introduce a novel constraint -- homophily unnoticeability that enforces GIA to preserve the homophily, and propose Harmonious Adversarial Objective (HAO) to instantiate it. Extensive experiments verify that GIA with HAO can break homophily-based defenses and outperform previous GIA attacks by a significant margin. We believe our methods can serve for a more reliable evaluation of the robustness of GNNs.

Key facts. Cited by 62 papers in the map (data through 14 Oct 2026). Builds on 43 of its 65 references that are in the map. First posted on arXiv 16 Feb 2022.

Builds on

43 of 65 references.

References · 43

  1. 2014Adam: A Method for Stochastic Optimizationcited by 37,240
  2. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,305
  3. 2016Semi-Supervised Classification with Graph Convolutional Networkscited by 11,361
  4. 2017Graph Attention Networkscited by 8,923
  5. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  6. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  7. 2017Inductive Representation Learning on Large Graphscited by 6,320
  8. 2016Layer Normalizationcited by 5,669
  9. 2013Intriguing properties of neural networkscited by 5,155
  10. 2017Model-Agnostic Meta-Learning for Fast Adaptation of Deep Networkscited by 4,897
  11. 2018How Powerful are Graph Neural Networks?cited by 4,393
  12. 2019A Comprehensive Survey on Graph Neural Networkscited by 2,919
31 more
  1. 2019Fast Graph Representation Learning with PyTorch Geometriccited by 2,434
  2. 2020Open Graph Benchmark: Datasets for Machine Learning on Graphscited by 2,163
  3. 2016Understanding deep learning requires rethinking generalizationcited by 1,674
  4. 2018Graph Neural Networks: A Review of Methods and Applicationscited by 1,576
  5. 2018Relational inductive biases, deep learning, and graph networkscited by 1,360
  6. 2018Co-teaching: Robust Training of Deep Neural Networks with Extremely Noisy Labelscited by 1,059
  7. 2016Revisiting Semi-Supervised Learning with Graph Embeddingscited by 976
  8. 2018Representation Learning on Graphs with Jumping Knowledge Networkscited by 877
  9. 2020Geom-GCN: Geometric Graph Convolutional Networkscited by 826
  10. 2015Image-based Recommendations on Styles and Substitutescited by 706
  11. 2019DropEdge: Towards Deep Graph Convolutional Networks on Node Classificationcited by 680
  12. 2019GraphSAINT: Graph Sampling Based Inductive Learning Methodcited by 618
  13. 2017Representation Learning on Graphs: Methods and Applicationscited by 457
  14. 2018Adversarial Attacks on Neural Networks for Graph Datacited by 397
  15. 2020Graph Structure Learning for Robust Graph Neural Networkscited by 371
  16. 2018Adversarial Attack on Graph Structured Datacited by 301
  17. 2019Adversarial Attacks on Graph Neural Networks via Meta Learningcited by 261
  18. 2020Data Augmentation for Graph Neural Networkscited by 203
  19. 2019Topology Attack and Defense for Graph Neural Networks: An Optimization Perspectivecited by 196
  20. 2020GNNGuard: Defending Graph Neural Networks against Adversarial Attackscited by 195
  21. 2021Is Homophily a Necessity for Graph Neural Networks?cited by 182
  22. 2018Adversarial Attack and Defense on Graph Data: A Surveycited by 167
  23. 2020A Survey of Label-noise Representation Learning: Past, Present and Futurecited by 122
  24. 2019Graph Adversarial Training: Dynamically Regularizing Based on Graph Structurecited by 93
  25. 2019A Restricted Black-box Adversarial Framework Towards Attacking Graph Embedding Modelscited by 68
  26. 2021TDGIA:Effective Injection Attacks on Graph Neural Networkscited by 67
  27. 2020Scalable Attack on Graph Data by Injecting Vicious Nodescited by 50
  28. 2021Graph Robustness Benchmark: Benchmarking the Adversarial Robustness of Graph Machine Learningcited by 44
  29. 2020Rethinking Graph Regularization for Graph Neural Networkscited by 36
  30. 2018Attack Graph Convolutional Networks by Adding Fake Nodescited by 26
  31. 2020Self-Enhanced GNN: Improving Graph Neural Networks Using Model Outputscited by 11

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2022: 12; 2023: 21; 2024: 14; 2025: 10; 2026: 5.

62 papers.

Sort:

By area:

  1. 2022Trustworthy Graph Neural Networks: Aspects, Methods and Trendscited by 89
  2. 2023Unnoticeable Backdoor Attacks on Graph Neural Networkscited by 45
  3. 2023Does Invariant Graph Learning via Environment Augmentation Learn Invariance?cited by 42
  4. 2022Pareto Invariant Risk Minimization: Towards Mitigating the Optimization Dilemma in Out-of-Distribution Generalizationcited by 38
  5. 2022Natural Color Fool: Towards Boosting Black-box Unrestricted Attackscited by 38
  6. 2024Graph Machine Learning in the Era of Large Language Models (LLMs)cited by 33
  7. 2023Joint Learning of Label and Environment Causal Independence for Graph Out-of-Distribution Generalizationcited by 29
  8. 2023Adversarial Training for Graph Neural Networks: Pitfalls, Solutions, and New Directionscited by 28
  9. 2022EvenNet: Ignoring Odd-Hop Neighbors Improves Robustness of Graph Neural Networkscited by 26
  10. 2023Adversarial Robustness in Graph Neural Networks: A Hamiltonian Approachcited by 24
  11. 2023A Survey on Privacy in Graph Neural Networks: Attacks, Preservation, and Applicationscited by 22
  12. 2022A Survey of Trustworthy Graph Learning: Reliability, Explainability, and Privacy Protectioncited by 20
38 more
  1. 2022Let Graph be the Go Board: Gradient-free Node Injection Attack for Graph Neural Networks via Reinforcement Learningcited by 19
  2. 2023Revisiting Robustness in Graph Machine Learningcited by 19
  3. 2023On Strengthening and Defending Graph Reconstruction Attack with Markov Chain Approximationcited by 16
  4. 2022Towards Lightweight Black-Box Attacks against Deep Neural Networkscited by 13
  5. 2024How Interpretable Are Interpretable Graph Neural Networks?cited by 13
  6. 2022Adversarial Camouflage for Node Injection Attack on Graphscited by 11
  7. 2022GANI: Global Attacks on Graph Neural Networks via Imperceptible Node Injectionscited by 10
  8. 2022Restructuring Graph for Higher Homophily via Adaptive Spectral Clusteringcited by 9
  9. 2023Combating Bilateral Edge Noise for Robust Link Predictioncited by 9
  10. 2024Coupling Graph Neural Networks with Fractional Order Continuous Dynamics: A Robustness Studycited by 9
  11. 2024Bounding the Expected Robustness of Graph Neural Networks Subject to Node Feature Attackscited by 9
  12. 2024Intruding with Words: Towards Understanding Graph Injection Attacks at the Text Levelcited by 9
  13. 2023Simple and Efficient Partial Graph Adversarial Attack: A New Perspectivecited by 8
  14. 2023Node-aware Bi-smoothing: Certified Robustness against Graph Injection Attackscited by 8
  15. 2023Node Injection for Class-specific Network Poisoningcited by 5
  16. 2023VertexSerum: Poisoning Graph Neural Networks for Link Inferencecited by 5
  17. 2023Certifiably Robust Graph Contrastive Learningcited by 5
  18. 2023IDEA: Invariant Defense for Graph Adversarial Robustnesscited by 4
  19. 2023Rumor Detection with Diverse Counterfactual Evidencecited by 4
  20. 2022Person Text-Image Matching via Text-Feature Interpretability Embedding and External Attack Node Implantationcited by 3
  21. 2023Single Node Injection Label Specificity Attack on Graph Neural Networks via Reinforcement Learningcited by 3
  22. 2024Collective Certified Robustness against Graph Injection Attackscited by 3
  23. 2025Query-Based and Unnoticeable Graph Injection Attack from Neighborhood Perspectivecited by 3
  24. 2025Intellectual Property in Graph-Based Machine Learning as a Service: Attacks and Defensescited by 3
  25. 2022What Does the Gradient Tell When Attacking the Graph Structurecited by 2
  26. 2024Fast Inference of Removal-Based Node Influencecited by 2
  27. 2024Krait: A Backdoor Attack Against Graph Prompt Tuningcited by 2
  28. 2023Momentum Gradient-based Untargeted Attack on Hypergraph Neural Networkscited by 1
  29. 2023Resilient Graph Neural Networks: A Coupled Dynamical Systems Approachcited by 1
  30. 2023GNNBleed: Inference Attacks to Unveil Private Edges in Graphs with Realistic Access to GNN Modelscited by 1
  31. 2024Disttack: Graph Adversarial Attacks Toward Distributed GNN Trainingcited by 1
  32. 2024Adversarial Robustness of Graph Transformerscited by 1
  33. 2025On Measuring Unnoticeability of Graph Adversarial Attacks: Observations, New Measure, and Applicationscited by 1
  34. 2025Devil's Hand: Data Poisoning Attacks to Locally Private Graph Learning Protocolscited by 1
  35. 2023Multi-Instance Adversarial Attack on GNN-Based Malicious Domain Detectioncited by 0
  36. 2024Inferring Properties of Graph Neural Networkscited by 0
  37. 2024On the Adversarial Robustness of Graph Neural Networks with Graph Reductioncited by 0
  38. 2024AHSG: Adversarial Attack on High-level Semantics in Graph Neural Networkscited by 0

50 most cited of 62 All 62 (JSON)