# Budgeted Indirect Adversarial Attack on Graph-Based Anomaly Detection in Sensor Networks

arXiv: https://arxiv.org/abs/2509.17987 · HTML: https://mlsanity.com/paper/2509.17987/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 11 of its 30 references that are in the map.
- First posted on arXiv 22 Sep 2025.

## Builds on (most cited first, 11 of 11)

- [PyTorch: An Imperative Style, High-Performance Deep Learning Library](https://mlsanity.com/paper/1912.01703/) (2019)
- [Graph Attention Networks](https://mlsanity.com/paper/1710.10903/) (2017)
- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [One pixel attack for fooling deep neural networks](https://mlsanity.com/paper/1710.08864/) (2017)
- [Adversarial Attack on Graph Structured Data](https://mlsanity.com/paper/1806.02371/) (2018)
- [Adversarial Attack and Defense on Graph Data: A Survey](https://mlsanity.com/paper/1812.10528/) (2018)
- [A Survey of Adversarial Learning on Graphs](https://mlsanity.com/paper/2003.05730/) (2020)
- [Multivariate Time-Series Anomaly Detection based on Enhancing Graph Attention Networks with Topological Analysis](https://mlsanity.com/paper/2408.13082/) (2024)
- [Towards robust sensing for Autonomous Vehicles: An adversarial perspective](https://mlsanity.com/paper/2007.10115/) (2020)
- [mTSBench: Benchmarking Multivariate Time Series Anomaly Detection and Model Selection at Scale](https://mlsanity.com/paper/2506.21550/) (2025)
- [Towards an Awareness of Time Series Anomaly Detection Models' Adversarial Vulnerability](https://mlsanity.com/paper/2208.11264/) (2022)

## Abstract (arXiv)

Graph Neural Networks (GNNs) have emerged as powerful models for anomaly detection in sensor networks, particularly when analyzing multivariate time series. In this work, we introduce BETA, a novel indirect evasion attack targeting such GNN-based detectors, where the attacker is constrained to perturb sensor readings from a limited set of nodes, excluding the target sensor, with the goal of either suppressing a true anomaly or triggering a false alarm at the target node. BETA uses a graph explanatory model combined with a centrality-based pruning strategy to identify the most influential nodes, subsequently injecting carefully crafted adversarial perturbations into their features. Extensive experiments on three real-world sensor network datasets show that BETA consistently outperforms baseline attack strategies while operating under realistic constraints, reducing the F1-score of state-of-the-art GNN-based detectors by 36.07 to 50.45% on average.