GOttack: Universal Adversarial Attacks on Graph Neural Networks via Graph Orbits Learning
Authors: Zulfikar Alom
Tran Gia Bao Ngo
Murat Kantarcioglu
Cuneyt Gurcan Akcora
Venue: ICLR 2025 Poster (2025)
Keywords: graphlet
orbit
adversarial machine learning
graph mining
graph convolutional networks
semi-supervised learning
Primary area: learning on graphs and other geometries & topologies
TL;DR: We identify an equivalence group for graph nodes and show that gradient-based attack models predominantly employ the group in their selection.

Abstract: Graph Neural Networks (GNNs) have demonstrated superior performance in node classification tasks across diverse applications. However, their vulnerability to adversarial attacks, where minor perturbations can mislead model predictions, poses significant challenges. This study introduces GOttack, a novel adversarial attack framework that exploits the topological structure of graphs to undermine the integrity of GNN predictions systematically. 

By defining a topology-aware method to manipulate graph orbits, our approach generates adversarial modifications that are both subtle and effective, posing a severe test to the robustness of GNNs. We evaluate the efficacy of GOttack across multiple prominent GNN architectures using standard benchmark datasets. Our results show that GOttack outperforms existing state-of-the-art adversarial techniques and completes training in approximately 55% of the time required by the fastest competing model, achieving the highest average misclassification rate in 155 tasks. 
This work not only sheds light on the susceptibility of GNNs to structured adversarial attacks 
but also shows that certain topological patterns may play a significant role in the underlying robustness of the GNNs. Our Python implementation is shared at https://github.com/cakcora/GOttack.

Published as a conference paper at ICLR 2025
GOTTACK: UNIVERSAL ADVERSARIAL ATTACKS ON GRAPH NEURAL NETWORKS VIA GRAPH ORBITS LEARNING
Zulfikar Alom', Tran Gia Bao Ngo', Murat Kantarcioglu', Cuneyt Gurean Akcora
Department of Computer Science, University of Manitoba, Canada
2 Department of Computer Science, Virginia Tech, USA
3 Al Initiative University of Central Florida, USA
md. a almm wow.. ca, ngot 1 www.eeemmtttbma.mmmmmmm ca, muratkêvt. edu
cuneyt akcora@ucf.commmm edu
ABSTRACT
Graph Neural Networks (GNNs) have demonstrated superior performance node classification tasks across diverse applications. However, their vulnerability adversarial attacks, where minor perturbations can mislead model predictions, poses significant challenges. This study introduces GOttack, novel adversarial attack framework that exploits the topological structure of graphs to undermine the integrity of GNN predictions systematically.
By defining topology-aware method to manipulate graph orbits, our approach generates adversarial modifications that are both subtle and effective, posing a severe test to the robustness of GNNs. We evaluate the efficacy of GOttack across multiple prominent GNN architectures using standard benchmark datasets. Our results show that GOttack outperforms existing state-of- fetthhhert adversarial techniques and completes training in approximately 55% of the time required by the fastest competing model, achieving the highest average misclassification rate in 155 tasks. This work not only sheds light on the susceptibility of GNNs to structured adversarial attacks but also shows that certain topological patterns may play significant role in the underlying robustness of the GNNs. Our Python implementation is shared httph::///// httpg/gttt.....aaeeceeeeeeeeeeee wwt.:/cc..cccca/..CC//CC
INTRODUCTION
Recent advances in Graph Neural Networks (GNNs) have brought significant progress in node classifi- cation tasks, utilizing the power of graph topology and node features to generate insightful inferences across various application domains such social networks (Fan et al. 2020), bioinformatics (Zhang ett al. 2021) and communication systems (He et al. 2021). Despite their effectiveness, GNNs exhibit inherent vulnerabilities adversarial attacks: minor yet strategically designed perturbation the graph structure or nodal features can deceive the model into erroneous predictions. This suscepti- bility not only undermines the reliability of GNNs but also poses grave security risk in eritical applications.
Existing approaches predominantly rely on direct node feature manipulation or edge modifications without considering their topological impact. We address this limitation by designing novel adversarial attack framework that systematically alters the graph topology to induce misclassification errors. Distinct from existing methods, leverage node connectivity patterns (i.c., orbits) in local graph structures to maximize adversarial efficacy.
Our studies of graph topology yield surprising result; we have uncovered universal attack strategy commonly employed by several well-known gradient- gradient-based adversarial models. This strategy uses two graph orbits to delineate the resilience of GNNs adversarial manipulations. Following this discovery, we introduce the GOttack algorithm, an advanced method that identifies and exploits these vulnerable graph orbits. GOttack not only enhances attack misclassification rates but also operates

---

Published as a conference paper at ICLR 2025
with greater efficiency, reducing the complexity of the attack search associated with such adversarial interventions.
Through rigorous experiments across three GNN node classification backbones, four state-of-th art adversarial models, five benchmark datascts, and four defense models, we demonstrate that GOttack achieves higher misclassification rates, maintains lower computational overhead, and proves effective against defense models.
Our contributions can be summarized as follows:
We determine key topological equivalence group among graph nodes, revealing its frequent use in the selection process of gradient- bastiennt-baedd adversarial models.
Our findings present a new vulnerability in GNNs related to graph topology. Our experiments demonstrate that such attacks are highly effective against state-of-the-an defense models.
Our proposed attack strategy, GOttack, achieves the highest misclassification rate and represents scalable attack model suitable for large graphs.
NOTATION AND PRELIMINARIES
We consider the task of node classification in graph, denoted (V,E,X), where V represents the set nodes, & C {(V, w) o. w E V} is the set of edges, and X {ro. Ti,..., In-1} comprises feature vectors such that 2; R& is the M-dimensional feature vector of node i. The adjacency matrix A E {0, N for the graph G has elements A = if there is an edge 6vw connecting nodes and w, and 0 otherwise.
subset of nodes Vr. C V is labeled, each associated with class labels from the set C= where Yu denotes the true label of node in V/.- This setup facilitates examining how shared labels influence edge formation between nodes. an essential aspect of understanding neighbor influence on node classification. Homophily (Zhu al.] 2020) in graphs traditionally characterized by the similarity between connected node pairs, where nodes are considered similar if they share identical labels. The homophily ratio is constructed based on this premise as follows:
Definition (Homophily Ratio). Let G denote the aforementioned graph and y represent the vector of node labels. The homophily ratio is defined as the proportion of edges connecting nodes with the same labels, formally given by: hG (yo; U V\) [8] D(r,uye 11 [ ywe), where 1() denotes the indicator function.
A graph is considered highly homophilous if the homophily ratio l(()) is large, typically within the range 0.5 S i((-) < Conversely, low homophily ratio indicates a heterophilous graph.
Node Classification. a probability distribution over the class set to each unlabeled node v, where G. is the predicted class for node v, identified as the class with the highest probability in g(v). This setup, characterized as transductive learning, implies that the model predictions are based on instances both seen and used during training.
The goal of node classification is to infer function g - (C)., that assigns
The Graph Convolutional Network (GCN), as introduced by Kipf & Welling 2017), provides a foundational model for understanding and analyzing the vulnerabilities exposed by our proposed attack model. GCN employs a pessage-passingg technique that utilizes the features of neighboring nodes, making it susceptible adversarial manipulations that can alter node connections and lead to misclassifications. As result, this section will define our attack using the GCN operations, which detailed in Appendix B.I
Adversarial Attack. Adversarial attacks on graph data aim to subtly perturb graph structures or node features, causing GCN to misclassify specific nodes. This entails creating a new graph G' (A) from the original G = (A,X) with changes to A (i.c., structural attacks) or X (i.c.. feature attacks). In an attack, subset of nodes e E Vr S V are targeted to have the GCN misclassify their labels
fe # Ye within specified budget A Σ. E, X., X Encio
A
A A.
The node may be directly affected (i.c., u = v), or influence attacks can impact any other node within the graph (i.e., * v). The attacks take various forms and occur during different phases.
2

---

Published as a conference paper at ICLR 2025
Poisoning attacks occur during training time, aiming to compromise the model by manipulating the training dataset. Evasion attacks occur at test time, attempting to generate deceptive samples that evade detection by trained model. ii) In targeted attacks, the objective is misclassify specific target nodes Vr, while in non-targeted attacks, the goal is to reduce the overall accuracy of the model.
3 RELATED WORK
Recent interest has grown in adversarial attacks on graph neural networks Günnemann (022). These attacks demonstrate how minor changes to input features or graph structure can alter network outputs, often eausing incorrect classifications. We begin with an overview of gradient attacks and then discuss non-gradient-basee based methods (refer to App. Table (56 for complete classification).
Gradient-based attacks. Gradient- attacks on graph neural networks exploit the gradients of the model to perturb node features or graph structure, aiming to mislead the network into making incorrect predictions. Zügner et al. 2018) proposed Nettack, which marked the inaugural exploration of gradient attacks attributed graphs, revealing significant accuracy declines even with minor alterations. Another novel approach by Xu et al. significantly reduced classification performance by causing small number of edge perturbations (Xu al. 2019a). Similarly, [Li al. (2023) introduced the SGA framework to target nodes by using a smaller subgraph around the target node and leveraging gradient information for attack optimization. Fast Gradient Attack (FGA) used gradient information from GCNs and outperformed baseline methods by efficiently disturbing network embedding with minimal link rewiring (Chen et al., 2018). To describe the robustness of deep learning models for graph-based based tasks. Zügner & Günnemann (209)) introduced training- time attacks using meta- gradients to perturb graph structures, which effectively renders the model near-useless for production use, all without direct access to the target classifier. Our approach also uses a gradient-basee based attack; however, we reduce the amount of costly gradient computations.
Non-gradient-basse attacks. Sun et al. (2020) introduced a novel node injection poisoning attack that used hierarchical Q-learning to optimize the injection process. Likewise, [Chang et al. (2022) proposed the GF-Attack for conducting black-box adversarial attacks on graph embedding models without access to labels. [uussain et al. (202T) proposed Structack, which uses structural centrality and similarity insights to lower GNN costs efficiently. Similarly, [oo al. (2021) proposed the topological defective graph injection attack, where adversaries inject adversarial nodes into existing graphs rather than modifying links node attributes. /Zhang al. (2023) proposed membership inference attacks targeting edges, also known as link-stealing attacks, which used customized attacks by introducing group-based attack paradigm that is suited to various groups of edges. Mu al. (2021) proposed the attack as an optimization problem to minimize perturbations to the graph structure, with a particular emphasis on the difficult hard-label black-box attack scenario.
The approach we propose in this paper differs from all the above-mentioned proposals in that none have attempted identify equivalence groups for graph nodes based on graph orbits to minimize the search space in discrete optimization. Furthermore, our proposed solution introduces highly effective and efficient algorithm for universal attacks on node classification models, demonstrating significantly faster performance compared to existing methods (e.g., attack training in approximately 55% the time required by the fastest competing model).
METHODOLOGG
We propose the GOttack framework to execute adversarial attacks on node classification GNNs while minimizing changes to the graph's 's structure. Figure Iillsttrates the overview of the GOttack research workflow.
Challenge. A significant attack challenge in our task is the substantial time complexity, as structural attacks on the underlying graph data might require up to 0(2 steps for finding the optimal set of edges to remove add. This scale of complexity necessitates the development of efficient methods.
GOttack Philosophy. GOttack draws inspiration from the Mapper philosophy of Topological Data Analysis (TDA), as described by (Singh et al. (2007). This philosophy posits that data has shape, and finding the shape may allow to build better models. In our case, focus identifying and
3

---

Published as a conference paper at ICLR 2025
Corrupted gropic
GOV Generator
Tangeiand
Moddie
ppet 2048
1900
Samogite modal
3909
a $4
algonthin
Figure 1: Complete research workflow diagram of GOttack.
grouping nodes the graph so that graph topology can help select which nodes and edges to attack in GNNs.
GOttack Solution. GOttack utilizes group theory [Bogopoiskij 2008) to identify node equivalence classes (Alon) 2007) on graph, which guide our decisions on which edges to add or remove. This approach strategically groups nodes according to their positions the graph in potential attack strategies, thereby enhancing both the precision and time-efficiency of our adversarial interventions.
4.1 ATTACK MODEL
We aim to target specific node V in targeted, structural, direct poisoning attack to alter its predicted class. As the prediction of depends not only on its individual attributes but also on the characteristics of neighbouring nodes ((e) within the graph, we are focused on perturbations the initial graph G with the condition: 3w, A * Asw where w E V. However, to prevent the attacker from completely modifying the graph, we impose a constraint on the total number of allowable changes, controlled by a specified budget A: ΣwEV AAw - A'm A.
Problem Statement. Consider an initial graph 9 = (A, target node v. and its true class ye- Our goal is to modify the graph's ' structure such that the classification of changes from yo to Ye', where * Yo', thereby maximizing the difference from its original classification. The proposed attacks can be mathematically formulated as a bi-level optimization problem:
arg max max In Ze.y.r In Z
(1)
(A X) N//
where = (o- X') and 0 = arg ming L(0: A', X' subject to the budget constraint. Specifically, we aim find modified graph g' (A', in which the target node v is assigned label yor that maximizes the difference from its original label yo in terms of probability scores.
4.2 EQUIVALENCE CLASSES IN STRUCTURAL ATTACKS
We utilize an attack strategy based on node equivalence groups to guide our decisions regarding the addition and deletion of edges. This section begins by defining graphlets, which are instrumental in identifying node equivalence groups. We then discuss orbits, representing the specific positions node can assume within graphlet facilitate effective grouping. As last step, compute Graph Orbit Vectors from all graphlets to develop multi-orbit based attack strategy.
A toy graph where shared node colors imply similar orbit counts. Nodes u. 2, and w have 15 and 18 or- bits, respectively.
Figure 2:
Definition 2 (Graphlet [Kloks et al. 20000). A graphlet gap within a larger
graph G = (V, E, is a connected induced subgraph Gs' =V ,','',,,, where V C V, and E' includes all edges Eun E E with both and v in V", and [V* typically equals 5 (as defined in Appendix Figure 6
There are 30 distinct graphlets of 5-nodes (see Appendix Figure 6 for the shapes). For instance, consider the nodes {u, x, v, k. y} in Figure 2 which forms graphlet with [V]] =
Orbits are defined by automorphisms of the graphlet; an automorphism a of a graphlet Gyp satisfies ggp Ggp- Nodes and in V are similar if there exists automorphism such that (v)
4

---

Published as a conference paper at ICLR 2025
The orbit of a node v, denoted by Orb(9gp- 2), is the set of all nodes w V that can be mapped onto v by some automorphism of the graphlet:
Definition 3 (Orbit (Alon 2007)) Orb(Ggp, v) = fw E VI E Aut(Ggp): : = w).
where ggp is the group of automorphisms of ggp. Each orbit is denoted by Orby, where is a unique identifier for each orbit within a specific graphlet. A node v touches an orbit Orb, if is part of an induced subgraph in the graph and v belongs Orb,. By extension, a node may appear in multiple graphlets and, hence, occupy multiple orbits. For example, in Figure 2 node æ appears in graphlets comprising of nodesets {xx v, k. I, w and {x,, v. k. y. I and so on. Overall, the 30 distinct graphlets create 73 distinct orbits (see Appendix Figure O for the orbit positions). The number of graphlets and orbits are all uniquely determined by the choice of using 5-node graphlets.
Definition 4 (Graph Orbit Vector). We propose Graph Orbit Vector (GOV) as numerical repre- sentation of a node's 's participation across the 73 orbits in graph. Consequently, GOV, v of node o is an π = 73-dimensional vector, where each dimension corresponds to the count of specific orbit touched by node v. This dimensionality reflects the full set of topological positions a node can occupy across all 5-node graphlets, making it a comprehensive description of node 's structural embedding.
We initialize the vector element for Orby of node zero and increase it by one each time v appears in orbit Orb, of any graphlet, where Orb is an induced subgraph containing This count reflects the number of graphlets in which v participates through orbit Orby. As a result, the Graph Orbit Vector provides a profile of a node's 's topological embedding within the graph. Notably, orbit discovery is performed for the entire graph as a pre-processing step, eliminating the need for recomputation for each target node.
17
20
21
19
4.3 GOTTACK: GRAPH STRUCTURE POISONING VIA ORBIT LEARNING
C
In our exploration of graph topology. we have discovered a distinctive feature shaped by orbits 15 and 18: nodes touching these orbits appear peninsula- like subgraphs (such as the one formed in Figure 2 by nodes {u, x. k, ()). These orbits (see Figure 3) are characteristic of being three or four edges away from another endpoint in the graphlet and serve critical indicators of topological peripheries within a graph. This geometric arrangement lends a substantial foundation to our subsequent analyses and adversaria strategies graph data, discussed in the following hypotheses and experimental sections.
Figure 3: Graphlets where orbits 15 and 18 are defined.
We start by stating our topological observation as influenced by the Mapper philosophy: 1) Orbit Proxy. Under the homophily assumption, node classification posits that graph neighbors are similar to node in the label. Consequently, nodes in more distant positions, as be identified by orbits, are less similar. 2) Periphery Orbits. Orbits 15 and 18 indicate the topological periphery in graph and provide a useful proxy for identifying distant nodes that differ in labels.
We claim that the path distance within the graph encodes a notion of remoteness, which in turn yields minimal information about node's 's label. This indicates that physical proximity within the network strongly influences the predictive accuracy regarding node labels. In our experiments (Section (5), we also provide empirical evidence demonstrating the utility of the Orbit Proxy in heterophilic graph cases, albeit in a weaker form.
In Theorem I we formally state that nodes located in orbits 15 and 18, due to their peripheral placement, are particularly effective for establishing paths to remote parts of the graph. This has significant implications for designing network protocols and algorithms that rely on efficient data traversal and retrieval mechanisms.
Theorem 1 (Remote Connection Candidates). Let I (v, w) denote the expected random walk hitting time from node v to node w in G. For any target node E V. nodes in orbits 15 and 18 are the most effective candidates of w for establishing paths to the most remote parts of G. due to their longer expected hitting times H H(v, w) compared to other nodes not in these orbits.
Due to space limitations, the proof is given in Appendix
A
The Periphery Orbits observation forms the backbone of our attack strategy; we identify nodes of periphery orbits (i.e., 15 and 18) and affect the adjacency matrix (i.e., add or remove edges to these
5

---

Published as a conference paper at ICLR 2025
nodes) accordingly to confuse GNN to misclassify a target. Consider the target node in Figure Our hypothesis posits that creating an edge from v (or any other node) to either of the (orbit 15 and 18) nodes u, w will yield the highest misclassification enror in GCN. The selection among periphery nodes uses a gradient-based method, as we detail below in surrogate loss.
Orbits (15, 18). We define two ordered orbit categories based on the highest and recond-highes orbit counts. The highest is given by Orb max = arg max (GOV,) ). If multiple orbits share this count, one is chosen arbitrarily. The second-highen is Orb arg max GOV, j + Orb })- Each node is then assigned an orbit category Orb" = Orbmax ||Orbsc, where order does not matter.
Example 1. Consider node in graph G. Although GOttack works with k 5-node graphlets, for simplicity, this example employs three-node graphlets (k = 3) for orbit counting, yielding a 4-dimensional vector to store all possible orbits. Suppose the orhit count vector for node is GOV, = [4, 15, 11, 12]. The task is to identify the largest and second-largest orbit count values in GOV. 0. The largest orbit count value 15, denoted by Orbmax - 01, and the acoondlarges, orbit count value is 12, denoted by Orb = 03. Thus, node v is categorized into the orbit category Orb" 01 or 0103 in short.
Surrogate loss. Our objective is to maximize the discrepancy in log probabilities for the target node e within a specified budget A. The log- log-probabilities can be simplified to A'W. We linearize the model by replacing the nonlinearity (.) with simple linear activation function. Therefore, from Eq. Z' softmax softmax(AAx "A w?) softmax(AA" (A² XW). Therefore, the surrogate loss function, L. W.W.or v), is designed to optimize the following objective: arg max L. (AA', X: v), where,
(A',))EO'
W,, the surrogate loss function L, is defined as L. X; W, v) = max X 1,, [ [2xW]o.. Ju,w- This function aims to solve the maximum loss over a set of permissible changes in A of
Structure poisoning. We compute candidate node set called the orbit category, denoted as Orbeat- consisting only of allowable elements (v, u) where the edge changes from 0 to 1 (i.c., adding an edge) vice versa. Specifically, for a given target node where Orb max = 1518. Among the candidate edge changes, we select the one that yields the highest surrogate loss. However, to compute the surrogate loss score, we first need to determine the class prediction of the target node after adding or removing an edge (u, v). Here, we are optimizing the loss score with respect to A: the term X'W is constant. The bog-prbbabilities of node v are then given by g(v)= = [ C. where [ denotes a row vector and C is the constant term (XW). Thus, we only need to inspect how this row vector changes to determine the optimal edge manipulation. Following the insight developed by [Zügner& & Günnemann (209)), we can derive an incremental update, so there is no need to recompute the updated [A]], from scratch.
create candidate set such that V
We assume access to the complete graph and its training labels, allowing adversaries to exploit its structure but not the target model, focusing instead on transferable attacks. This setting applies to domains like social and transaction networks, where graph structures publicly visible (e.g., social media friendships, academic citations, and cryptocurrency transactions).
Time Complexity. Orbit discovery is the primary computational cost of GOttack. The time complex- ity for computing all orbits for all nodes is O(E) x d + [V] x d²), where O(V) x d²) corresponds to the time required to enumerate all five-node graphlets, and d denotes the maximum degree in the graph. For instance, orbit discovery on the CORA dataset takes only 0.17 seconds. All time costs for orbit discovery are provided in Appendix Table 52
EXPERIMENTS
This section presents the experimental evaluation carried out to show the effectiveness of the proposed approach. We answer the following questions: i) How effective is the GOttack approach in terms of misclassification rate compared with existing state-of-the-ar approaches? ii) How efficient is the proposed model in terms of computation time compared with the existing models? iii How easy is it to defend against GOttack compared to existing models?
Datasets. We conduct experiments on five widely used node classification datasets, the statistics of which are provided in Table 1 Cora (Yang et al. 2016), Citeseer (Yang et al., 2016) and Pubmed

---

Published as a conference paper at ICLR 2025
Table 2: Misclassification rate (in %) (1) of target nodes in five datasets where three backbone GNNs (GCN, GIN and GraphSAGE) are attacked in node classification with budget A = 1. See Appendix D. for stds.
Citeseer
Polblogs
BlogCasaog
Pebmned
Method
GSAGE
GCN
GIN
GSAGE
GCN
GIN
GSAGE
GCN
GIN
CSAGB
GCN
GIN
GSAGE
GCN
GIN
Random
19.11
2.07
17.30
50.01
2.01
10.03
15.13
12.04
17.04
3.09
12.09
4.19
14.02
20.05
20.55
Nettock
58.94
34.06
46.10
66.09
46.04
57.04
29.02
38.04
13,02
50.11
20.02
65.07
12.01
50.04
47.02
PGA
54,08
32.05
40.09
60.11
31.10
44,10
22.08
31,09
14,02
46.15
10.04
61.09
42.05
32,02
52.00
SCA
41 41.05
57.06
60.06
41.06
37.07
35.08
51.45
57.04
47.01
PRBCD
35,02
41.06
36.10
55.04
46.04
42.02
42.07
33.00
33.05
33.05
38,02
52.03
43.06
GOttack (ours)
59.05
41.52
37.03
51.00
46.07
57.06
29:03
$1.08
15.08
52.10
22.01
63.08
$2,08
$7.09
55.05
(Yang et al. 2016) datasets are citation networks with undirected edges and binary features where nodes are publications and edges citation links.
In the Polblogs (Adamic & Glance 2005) dataset, nodes are political blogs, and edges are links between them. In the BlogCatalog (Tang & Liu 2209) 2 dataset, nodes' attributes are constructed by keywords, which are generated by users as a short description of their blogs. We split the networks into labeled (20%) and unlabeled nodes (80%).
We further split the labeled nodes into equal parts training and validation sets to train the surrogate model. We have used the ORCA algorithm (Hocevar & Demsar (214) for the orbit discovery process on these datasets.
Table 1: Dataset statistics.
Dataset
Hom.
Nodes
Edges
Features
Labels
Cora
0.81
2,485
5,069
1,433
7
Citeseer
0.74
2,110
3,668
3,703
Polblugs
0.91
1,222
16,714
1,490
2
Pulmed
0.8
19,717
44,325
500
BlogCatalog
0.40
5,196
171,743
8,189
Experimental Setup. We have conducted the ex- periments under the transductive, semi-supervised learning setting. We have used both common node classifier GNNs, including GCN (Kipf & Welling
2017), GIN (Xu et al. (019)))))) and GraphSAGE (Hamilton et al. (2017) and defense models, including RobustGCN (Zhu et al. 2019), GCN-Jaccard (Wu et al.) 2019, GCN-SVD (Entezari et al. 2020). and MedianGCN (Chen et al. 2021) as the backbone to evaluate our adversarial attacks.
We average over five different random initializations/spliss, where for each, we follow these steps: Initially, we train the surrogate model on the labeled data. From the test set, among all nodes correctly classified, we adopt the popular practice of Nettack and select: (i) the 10 nodes with the highest margin of classification, indicating clear correctness, (ii) the 10 nodes with the lowest margin (still correctly classified), and (iii) 20 additional nodes randomly chosen. These selected nodes will be the targets for the attacks. All results presented here computed by us in the same settings.
In our attack model, the budget A limits the number of allowed perturbations, such as edge additions or deletions. Its optimal value depends on the graph's 's structure, particularly node degrees: small A (e.g., or 2) can significantly impact low-degree nodes, while higher values suit high-degree nodes. To ensure comparability, we adopt fixed budgets (A I,.... 5), following prior works like Nettack and FGA.
We compare GOttack against five state-of-the-art graph adversarial attack frameworks: Nettack (Zügner et al., 2018), FGAttack (FGA) et al. 2018). SGAttack (SGA) (Li et al.) 2023) and PRBCD (Geisler et al. 2021) as well as Random (dummy) baseline (see App. Section B.2 for descriptions). We use GCN as the surrogate model for the attack models except for SGA, which suggests SGC. We report the misclassification rate, which the percentage of nodes that were incorrectly classified by the model in relation to the total number of nodes being classified.
In our experiments, we utilized the PyG (PyTorch Geometric) library, which employs PyTorch as the backend for implementing GNN models. Additionally, we used the PyTorch adversarial library DeepRobust (Li et al. 2020) for robustness evaluations. The experiments were conducted using Python (Version 19 and PyTorch Version 3.00. The computational environment was a Linux cluster equipped with an AMD Ryzen Threadripper 3960X 24-core processor, 2520GB RAM and NVIDIA RTX A6000 with 49GB RAM GPUs Our Python implementation is shared at https://githuse com/ www.ccaaccccoooo Cottakk
Parameters setting. Our models were trained using the Adam (Kingma & Ba 2015 optimization algorithm, employing a fixed learning rate of 0.01. Training sessions were conducted over a span of 200 epochs; employed the sofimax activation function.
7

---

Published as a conference paper at ICLR 2025
Misclassiitcalll (%)
Misclas Misclassiftcalle anssssiitaation (%)
505
Misclassifito wissssitttaiionn (%)
80-
80-
80
60
8G
60
60
40
20
Perturbation Budget
Perturbation Budget
Perturbation Budget
GraphSAGE model
(b) GCN model
(c) GIN model
Figure 4: Budgeted attack results on the Citeseer dataset.
5.1 GOTTACK MISCLASSIHICATION RESULTS
Table shows the misclassification rate achieved with a single edge perturbation (addition or deletion). GOttack yields the highest misclassification rates in out of 15 attack settings and ranks second in 5 other settings. SGAttack yields 4 best attacks, while PRBCD and Nettack each perform best in 2 attack settings. PRBCD, widely used method adopted by Py PyTorch, yields surprisingly low rates in two datasets for GSAGE and GIN. GOttack yields the highest overall rate of 52.08, whereas the second best Nettack yields 47.02.
Likewise, Table shows the misclassification rates of the top-3 attack models on defense models with single edge perturbation. GOttack yields the highest misclassification rates in 7 out of 16 attack settings and ranks second in 7 other settings, while SGA achieves the best performance in 7 attack settings. GOttack achieves the highest overall rate of 33.07, whereas SGA has rate of 32.5.
In Figure we gradually increase the attack budget and represent the corresponding misclassificattin rates on the Citeseer dataset (see Appendix [ for all results). We observe that for GraphSAGE, GOttack yields better misclassification results, reaching maximum misclassification score of 97% with 5 perturbations. Similarly, for the GCN and GIN models, the proposed approach attains misclassification scores of 77% and 76%, respectively, outperforming the SOTA models.
Extending the analysis the relationship between increasing budgets (A = 1, ..., 5) and misclassifi- cation rates all datasets, observe the following behavior (see Section D for complete results): GOttack achieves the highest misclassification rate in 28 out of 65 tasks for GCN, GSAGE and GIN models across all budgets. The numbers 16 for PRBCD, 16 for SGAttack, and 3 for Nettack. GOttack achieves the highest average rate of 0.58 over all budgets and datasets compared to the second best model of PRBCD and SGAttack with 0.57 (Appendix Table
Furthermore, as shown in Table GOttack demonstrates superior computational efficiency and scalability, making it particularly well-suited for large-scale graph datasets. This efficiency stems from its topological approach to candidate node selection, which reduces the search space for potential attack points without sacrificing effecctiveness. For example, in the BlogCatalog dataset, GOttack requires only about 55% of the time taken by Nettack to execute, significantly reducing computational overhead. Despite its speed, GOttack still maintains a high level of attack effectiveness, generating attack candidates in less than 10 minutes, even for datasets with a large number of nodes and edges. This balance between performance and computational cost highlights GOttack's s practical applicability to real-world scenarios.
While both Nettack and GOttack are scalable for large graphs, their methodologies differ: Nettack selects candidates based on degree distribution in each iteration, whereas GOttack leverages orbit structures. Although orbit discovery incurs some overhead, reduces the candidate set to about 23% of all nodes (see Appendix Figure B), making the initial cost worthwhile. Among alternative methods,
Table 3: Misclassification rate (in %) (1) of target nodes in different datasets against four defense models (RGCN, GCN-Jaccard, GCN-SVD and MedianGCN) are attacked in node classification with budget A 1. See Appendix D.2 for stds.
Coca
Citeseer
Pulbiogs
BiogCaalog
Method
RGCN
JAC
SVD
MIGCN
ROCN
JAC
SVD
MUGGN
ROCN
JAC
SVD
MIGCN
ROCN
JNC
SVD
MUGCN
SGA
31.01
33.02
28.00
32.05
53.00
36.01
24.04
36.01
46.03
43.05
16.01
43.05
25.02
35,02
15,05
20001
Netroc
4K08
3..0
24.01
32.05
45.04
$2.01
28.04
27.05
36.05
46.03
12.04
33.02
35.04
19:03
19.00
17.02
GOltack (eurs)
43.04
28.08
25.02
40012
53.06
10.02
20,02
19:03
8

---

Published as a conference paper at ICLR 2025
Zoget eni
Paottrr unds
Negalle liMd
Viry Inperted Elge
Lon oeporter rog
(a) Computation graph before attack
(b) Computation graph after attack
Figure 5: The computation graph for the targeted node 1978 from the CORA datasets, as identified by GNNExplainer (Luo et al. 2020). The edge (1978, 387) is added during the successful attack. Edge importances change considerably after the attack and negative class gains importance due to the newly added nodes.
only SGA is more scalable, it focuses on local neighborhoods for candidate selection; however, its performance is worse than GOttack.
We compared GOttack to adaptive attacks, which consider specific model architectures during attack generation. Results (see Appendix Section D) reveal that while adaptive attacks outperform in single-model scenarios, GOttack's transferable perturbations exhibit broader applicability across diverse settings, reinforcing its utility exploratory research on adversarial robustness.
5.2 INSIGHTS FROM GOTTACK RESULTS
GOttack strategically selects nodes using the graph topology. This selection criterion prompts several thoughts and questions, which we address below:
The periphery definition. A visual inspection of Figure shows that more orbits, such 19, 39, and 27, could fit the periphery definition. The primary reason for not considering these orbits is their relative scarcity all the graph datasets. For example, node orbits from the Cora dataset in Appendix Figure [ show that most nodes predominantly feature orbits within the 1518 and 1922 groups. Furthermore, as shown in Appendix Section D attacks based on 1819, 1519 and 1922 yield less powerful attacks.
Higher order orbits. GOttack uses two orbits: 1518. The decision against using 2 orbits is influenced by the fact that nodes typically do not have more orbits. For the single orbit case, our experiments had larger time complexity, as larger pool of nodes was considered, yet the efficacy of attacks remained similar.
Table End-to-end time costs seconds (L). See Appendix Table 5
5 for stds.
Global
Local
GOttack
Nettack
PGA
PRBCD
SGA
Cora
48.27
59.57
55.63
242.37
32.24
Citeseer
42,02
46.12
42.43
210:55
41.02
Polblogs
139.68
175.22 23
165.37
210.87
16: (17
HlogCatalog
6122.04
916.91
223.02
259 38
335 91
Gradient-based models target 1518 nodes. Our analysis reveals that gradient-based models pre- dominantly target 1518 nodes, as shown for Net- tack in Table and for other models in Appendix Tables 6 and 7 For instance, Table Shows that in the highly homophilous Polblogs, 97.5% of initial attacks involve 1518 nodes, despite these nodes comprising only 9.41 % of the total. A similar trend appears in the heterophilous BlogCatalog dataset (2.5% and 22.5% in network attacks.
Pubmed
246.96
243.78
533.55
210.25
68.23
165.37
240.23
1,2 attacks). This highlights the strategic role of orbit 1518 nodes in
Node, Homophily, Distance and Subgraph-basee Explanations for GOttack. We conducted comprehensive analysis to understand how GOttack causes node misclassification. Initially, we used GNN explainers (see Appendix Section E. 1b. which factor in the subgraph effects and node features in perturbations. Figure 5 the importance of existing edges, which offers evidence that explanations specific to nodes or edges alone are insufficient to adequately explain attack, shown in Figure However, as widely noted in the literature (Li et al., 2024a; Li et al., 2024b), explainers often disagree on the exact interpretation (see Figure 9b).
example where misclassifications are due to changes in

---

Published as a conference paper at ICLR 2025
Next, we focused node-centric metrics to determine the positional changes of the target node within the graph following the attack. As detailed in Appendix Table (45 the target nodes' clustering coefficient, degree, betweenness, and closeness centralities did not show significant difference compared to those influenced by other attacks. Secondly, we examined whether the attack brought in nodes with different labels into the computation graph of the target node (see Appendix [50. We found that after the attack, both similar and differently labeled nodes increased by 0.92 and 3.36 on average, respectively. However, these values are not as pronounced as those seen in other attacks, suggesting that the induced label diversity change by GOttack is not substantial. Next, we computed the shortest path distances from the target nodes to nodes with similar and different labels the entire graph (see Appendix Table48). This analysis provided empirical proof supporting our Theorem [ the 1518 strategy more significantly reduces the distance to nodes of different labels (-0.03) than to those of similar labels -.0.... This behavior, which indicates a targeted modification in network dynamics, was not observed with other orbits.
Budget Selection and Structural Implications. The choice of the attack budget A is important in determining the effectiveness and practicality of adversarial attacks. Fixed budgets, as employed in this study, provide consistency for benchmarking but may oversimplify real-world scenarios where the impact of a perturbation is context- context-dependent. For example, a budget of 5 for a node with a degree of 2 introduces a disproportionate perturbation compared the same budget applied to node with degree of 2000. Future work could explore dynamic or adaptive budget strategies that account for degree distribution and other structural factors. Tables 42 43 and. 44 present comparisons of GOttack with established budget settings, specifically considering the percentile of node degrees (e).
Defenses and Availability. GOttack can be defended against by attending to node orbit types in GNN ag- gregations and reducing the importance of neighbors in 1518 orbits. In that case, topology offers new orbits to attack, such as 1519 and 1922, as we study and re- port in Appendix D We have created a graph-algebra- based orbit selection scheme in Appendix [C33 that can attack i) graph of any size and ii) graph with- out the periphery orbits of 1518. However, we note that in all the datasets used, nodes belonging orbit 1518 were particularly common (see Figure B).
Table 5: Comparison of based node se- lection in sequential Nettack phases.
Datsset
Orbex
9: modes
S 1d Attock
2 Attack
1518
24,00%%
77.00%
71.10%
Com th - 0.50)
1519
14.4%%
5.70%
14.29%
1819
11.59%
10.075
12,50%
Ciieaaer 0.6
21.18%
12.90%
15.00%
11,50%
9.00%
1515
9.41%
77.005
6000%%
Polblags dh 0.913
1519
2.29%
0.005
0.00%
1819
12.95%
2.595
27.508
Pulmaa
23.07%
$2.50%
22.90 22.90%
10.00%
Limitations. A notable limitation of our study is the assumption of access to complete graph and training labels, which may not always hold in real-world sce- narios. Future work could relax these assumptions to enhance practical applicability while retaining the theoretical contributions. GOttack optimizes candidate node selection for attacks using a topological approach. Our primary hypothesis is that this topological method offers both efficiency and effectiveness. While brute-force methods or gradient-based optimizations can theoretically achieve the same attack success by exhaustively ex- ploring all possible options, these approaches come with significant computational costs. Thus, the tradeoff between attack efficiency and runtime must be carefully balanced. GOttack addresses this by providing a principled strategy based on topology, offering a more computationally feasible solution without sacrificing attack efficacy.
1515
3,25%
2.50%
22.50%
Bllegturalog (h 0.40)
1519
61.57%
63.505 33.509
31.50%
1922
19.77%
35.00%
40.00%
6 CONCLUSION
We have identified a key equivalence group for graph nodes based on their topological positions within the graph and demonstrated that gradient-based attack models frequently target this group in their attacks. Our approach, GOttack, introduces seminal topological strategy in adversarial graph machine learning. By uncovering this previously unexplored vulnerability tied to graph topology, our work highlights the susceptibility of graph neural networks to topology-basee attacks and paves the way for developing efficient attack models. GOttack not only enhances misclassification rates but does so in a scalable manner. For future work, we aim to study topological defenses against attack models.
10

---

Published as a conference paper at ICLR 2025
ACKNOWLEDGMENTS
This work has received funding from Canadian NSERC Discovery Grant RGPIN-2020-0560 Data Science on Blockchain and Canadian Research Manitoba grant 324278-352400-2NM
Bonafide: Decentralized Services for Sharing and Searching User Generated Data, and from the NSF awards DMS-2204795, OAC42115094, CNS-2331 1424, ARL/Army Research Office awards W91 INF-2----- 0202 and 191 14 and NIH award 5RMIHG009034-08.
REFERENCES
Lada A Adamic and Natalic Glance. The political blogosphere and the 2004 us election: divided they blog. In Proceedings of the 3rd international workshop Link discovery, pp. 36-43, 2005.
Uri Alon. Network motif's: theory and experimental approaches. Nature Reviews Genetics, 8(6):
450-461, 2007.
Peter W. Battaglia, Jessica B. Hamrick, Victor Bapst, Alvaro Sanchez-Gonzalez, Vinícius Flores Zambaldi, Mateusz Malinowski, Andrea Tacchetti, David Raposo, Adam Santoro, Ryan Faulkner, Çaglar Gülçehre, H. Francis Song, Andrew J. Ballard, Justin Gilmer, George E. Dahl, Ashish Vaswani, Kelsey R. Allen, Charles Nash, Victoria Langston, Chris Dyer, Nicolas Heess, Daan Wierstra, Pushmeet Kohli, Matthew M. Botvinick, Oriol Vinyals, Yujia Li, and Razvan Pascanu. Relational inductive biases, deep learning, and graph networks. CoRR, Meos//806.01211, 2018.
URL http::://axxi..ogg/// hwtp///b//1// 01066012611
Oleg Vladimirovië Bogopolskij. Introduction to group theory, volume 6. European Mathematical Society, 2008
Aleksandar Bojchevski and Stephan Günnemann. Adversarial attacks on node embeddings via graph poisoning. In International Conference on Machine Learning, pp. 695-704. PMLR, 2019.
Raffaella Burioni and Davide Cassi. Random walks on graphs: ideas, techniques and results. Journal of Physics A: Mathematical and General, 38(8):R45, 2005.
Heng Chang, Yu Rong, Tingyang Xu, Wenbing Huang, Honglei Zhang, Peng Cui, Xin Wang, Wenwu Zhu, and Junzhou Huang. Adversarial attack framework on graph embedding models with limited knowledge. IEEE Transactions on Knowledge and Data Engineering, 35(5):4499 4513, 2022.
Jinyin Chen, Yangyang Wu, Xuanheng Xu, Yixian Chen, Haibin Zheng, and Qi Xuan. Fast gradient attack on network embedding. CoRR, abs/aa09..0000 80900999777 2018. URL http:tttp//axiv.ccom www.xiiiioor/aaaaoo /bs/
1809. 02797]
Liang Chen, Jintang Li, Qibiao Peng, Yang Liu, Zibin Zheng, and Carl Yang. Understanding structural vulnerability in graph convolutional networks. Proceedings of the Thirtieth International Joint Conference on Artificial Intelligence, IJCAI 2021, Canada, 19-27 August 2021, pp. 2249- 2255. ijcai.org, 2021. doi: ...4963/JJCAA.22211311
URLtttpss: doo .org 24966/
1 Cicai 1 2021/315
Hanjun Dai, Hui Li, Tian Tian, Xin Huang, Lin Wang, Jun Zhu, and Le Song. Adversarial attack on graph structured data. In 35th International Conference Machine Learning, ICML 2018, Stockholm, Sweden, July 10-15, 2018, volume 80, pp. 1123-1132, PMLR, 2018. URL http!
//proceedings..o ml. www.mress.rr......mmmmmeemmmm press v80 htt//daalbb..h...
Negin Entezari, Saba A. Al-Sayouri, Amirali Darvishzadeh, and Evangelos E. Papalexakis. All you need low (rank): Defending against adversarial attacks on graphs. WSDM '20: The Thirteenth ACM International Conference on Web Search and Data Mining, Houston, TX, USA, February 3-7, 2020, pp. 169-177. ACM, 2020. URL hhttps://dol. org/ / 10. 11 45 5155333311999 3371 789
Wenqi Fan, Yao Ma, Qing Li, Jianping Wang, Guoyong Cai, Jiliang Tang, and Dawei Yin. A graph neural network framework for social recommendations. IEEE Transactions on Knowledge and Data Engineering, 34(5):2033-2047, 2020.
11

---

Published as a conference paper at ICLR 2025
Jian Feng and Shaojian Chen. Link prediction based orbit counting and graph autoeencoder.
IEEE Access, 01122673-226788 2020. doi: /C0.://CCCCSSS20.0005550 URL https? //doi.org//1/ 1ww./11199/111//
Simon Geisler, Tobias Schmidt, Hakan Şirin, Daniel Zügner, Aleksandar Bojehevski, and Stephan Günnemann. Robustness of graph neural networks at scale. Advances in Neural Information Processing Systems, 34:7637-7649, 2021.
Stephan Günnemann. Graph neural networks: Adversarial robustness. Graph neural networks: foundations, frontiers, and applications, pp. 149-176, 2022.
William L. Hamilton, Zhitao Ying. and Jure Leskovec. Inductive representation learning on large graphs. Advances in Neural Information Processing Systems 30: Annual Conference on Neural Information Processing Systems 2017, December 4-9, 2017, Long Beach, CA, USA, pp. 1024-1034, 2017.
Shiwen He, Shaowen Xiong, Yeyu Ou, Jian Zhang, Jiaheng Wang, Yongming Huang, and Yaoxue Zhang, An overview on the application of graph neural networks in wireless networks. IEEE Open Journal of the Communications Society, 2:2547-2565, 2021.
Tomaz Hocevar and Janez Demsar. A combinatorial approach to graphlet counting. Bioinform.. 30 (4):559-565,, 2014.
Hussain Hussain, Tomislav Duricic, Elisabeth Lex, Denis Helic, Markus Strohmaier, and Roman Kern. Structack: Structure-based adversarial attacks on graph neural networks. In Proceedings of the 32nd ACM Conference on Hypertext and Social Media, pp. 112-120, 2021.
Di Jin, Bingdao Feng, Siqi Guo, Xiaobao Wang, Jianguo Wei, and Zhen Wang. Local-global defense against unsupervised adversarial attacks on graphs In Proceedings of the AAAI Conference on Artificial Intelligence, volume 37, pp. 8105-8115 2023.
Jeff D Kahn, Nathan Linial, Noam Nisan, and Michael E Saks. On the cover time of random walks on graphs. Journal of Theoretical Probability, 2: 121--128 1989.
Diederik P. Kingma and Jimmy Ba. Adam: A method for stochastic optimization. In 3rd International Conference on Learning Representations, ICLR 2015, San Diego CA, USA, May 7-9, 2015, Conference Track Proceedings, 2015.
6980
Thomas N. Kipf and Max Welling. Semi-supervised classification with graph convolutional networks. 5th International Conference on Learning Representations, ICLR 2017, Toulon, France, April 24-
26, 2017, Conference Track Proceedings. 2017. http:t/s::/ wwwp///eee..nee......// www.eeeeoouuaaee [d=SJU4ayYq
Ton Kloks, Dieter Kratsch, and Haiko Müller. Finding and counting small induced subgraphs efficiently. Information Processing Letters, 145--1):11--21,, 2000. doi: 00.1016500200010000 00047-8.
(CO) 00047-8
Miroslaw Kowaluk, Andrzej Lingas, and Eva-Marta Lundell. Counting and detecting small subgraphs via equations. SIAM Journal on Discrete Mathematics, 27(2):892 909, 2013. doi: 10.1137/
110859798. URL htttstts: //cttps://oi.... 0tt.a//.//01.11111111111
Jintang Li, Tao Xie, Liang Chen, Fenfang Xie, Xiangnan He, and Zibin Zheng. Adversarial attack on large scale graph. IEÉE Transactions on Knowledge and Data Engineering, 35(1):82 9008822222222881 2023. URL http:https://do org. 0009/ TTDE 2021 02200013330 202...0727..... 3078755
Yaxin Li, Wei Jin, Han Xu, and Jiliang Tang. Deeprobust: A pytorch librrrr for adversarial attacks and defenses. CoRR, abs/2005.06 06.006144 149, 2020. URL htt.htts://// http:://axxxi....abbb/////s
Dongsheng Luo, Wei Cheng, Dongkuan Xu, Wenchao Yu, Bo Zong, Haifeng Chen, and Xiang Zhang Parameterized explainer for graph neural network. Annual Conference on Neural Information Processing Systems, 2020.
Jiaqi Ma, Shuangrui Ding, and Qiaozhu Mei. Towards more practical adversarial attacks on graph neural networks. Annual Conference Neural Information Processing Systems, NeurIPS, 2020.
12

---

Published as a conference paper at ICLR 2025
Ine Melckenbeeck, Pieter Audenaert, Didier Colle, and Mario Pickavet. Efficiently counting all orbits of graphlets of any order in a graph using autogenerated equations. Bioinformatics, 38): 1372-1380, 2018.
org/ http:://........................
Jiaming Mu, Binghui Wang. Qi Li, Kun Sun, Mingwei Xu, and Zhuotao Liu. hard label black-box adversarial attack against graph neural networks. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, pp. 108-125, 2021.
Gurject Singh, Facundo Mémoli, and Gunnar E. Carlsson. Topological methods for the analysis of high dimensional data sets and object recognition. 4th Symposium on Point Based Gruphics, PBG@ Furographics 2007, Prague, Czech Republic, September 2-3, 2007, pp. 91-100, 2007. URL httts:://aaa . .rg.
/t0l//////000 10. 2312/ SPPG// 008007709111000
Mingjie Sun, Jian Tang, Huichen Li, Bo Li, Chaowei Xiao, Yao Chen, and Dawn Song. Data poisoning attack against unsupervised node embedding methods. CoRR, ftss/1810.1288//1 2018.
URL http:://aaiiiia org/ abs/ /1t///111...1 12881
Yiwei Sun, Suhang Wang, Xianfeng Tang, Tsung- Yu Hsieh, and Vasant G. Honavar. Adversarial attacks on graph neural networks via node injections: A hierarchical reinforcement learning approach. WWW '20; The Web Conference 2020, Taipei, Taiwan, pp. 673-683, 2020. URL https: /ww..
338C149
Lei Tang and Huan Liu. Relational learning via latent social dimensions. Proceedings of the 15th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, Paris, France, pp. 817-826, 2009,
org 10. 15/ /5/44/111555 115555511115 1557109
Shuchang Tao, Qi Cao, Huawei Shen, Junjie Huang. Yunfan Wu, and Xueqi Cheng. Single node injection attack against graph neural networks. In Proceedings the 30th ACM International Conference on Information Knowledge Management, pp. 1794-1803, 2021.
Shuchang Tao, Qi Cao, Huawei Shen, Yunfan Wu, Liang Hou, Fei Sun, and Xueqi Cheng. Adversarial camouflage for node injection attack on graphs Information Sciences, 649:119611 2023. URL /ettps//doo... orrgo.oorr// /10 1016/1 ins 2023. 1et.1116111
Marein Waniek, Tomasz Michalak, Talal Rahwan, and Michael J. Wooldridge. Hiding individuals and communities in social network. Nature Human Behaviour, abs/1608.00377 2016. URL
httt:://axivv.oo www.oorgg/a........... 1ww.//668.000 608.00077775
Huijun Wu, Chen Wang, Yuriy Tyshetskiy, Andrew Docherty, Kai Lu, and Liming Zhu. Adversarial examples for graph data: Deep insights into attack and defense. Proceedings of the Twenty-Eight International Joint Conference on Artificial Intelligence, IJCAI, Macao, China, August 10-16,
2019, pp. 4816 4823, 2019. (tt ponttps://do::. org/ 24w....3///caa.......
Yihan Wu, Aleksandar Bojchevski, and Heng Huang. Adversarial weight perturbation improves generalization graph neural networks. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 37, pp. 10417-10425, 2023.
Kaidi Xu, Hongge Chen, Sijia Liu, Pin- Yu Chen, Tsui-Wei Weng, Mingyi Hong, and Xue Lin. Topology attack and defense for graph neural networks: An optimization perspective. In Proceedings of the Twehty-Eighth International Joint Conference on Artificial Intelligence, IJCAI 2019, Macao, China, August 10-16, 2019, pp. 3961-3967. ijcai.org, 2019a. URL pttpps:/ddoi...o .ar.ioorg/01.0 http:/11.29933/jcaa. (tt.j/aaa..1119555 201975501
Keyulu Xu, Weihua Hu, Jure Leskovec, and Stefanie Jegelka. How powerful are graph neural networks? 7th International Conference Learning Representations, ICLR 2019, New Or- leans, LA, USA, May 6-9, 2019, 2019b. URL https: http:s////p/peeeeeeeoeom net http/ffrummmiim ryGs6iA4 6555m
Zhilin Yang, William W. Cohen, and Ruslan Salakhutdinov. Revisiting sumi-supervised learning with graph embeddings. In Proceedings of the 33nd International Conference Machine Learning, ICML 2016, volume 48, pp. 40-48, 2016. URL http:tt:///rrroeenggss mlr.. wtt.s/////....p...s//.s..... yangal 6. html
13

---

Published as a conference paper at ICLR 2025
Zhitao Ying, Dylan Bourgeois, Jiaxuan You, Marinka Zitnik, and Jure Leskovec. Gnnexplainer: Generating explanations for graph neural networks. Anmual Conference on Neural Information Processing Systems, NeurlPS 2019, Vancouver, BC. Canada, pp. 9149-240999 92000-9251,,0 2019.
He Zhang, Bang Wu, Shuo Wang. Xiangwen Yang, Minhui Xue, Shirui Pan, and Xingliang Yuan. Demystifying uneven vulnerability of link stealing attacks against graph neural networks. In International Conference on Machine Learning, pp. 41737-41752. PMLR, 2023.
Xiao-Meng Zhang, Li Liang, Lin Liu, and Ming-Jing Tang. Graph neural networks and their current applications in bioinformatics. Frontiers in genetics, 12:690049, 2021.
Ziwei Zhang, Peng Cui, and Wenwu Zhu. Deep learning on graphs: A survey. IEEE Transactions on Knowledge and Data Engineering, 34(1):249-270, 2022. URL htttps:///oi..rr///1
1109/ TtL//KKE..00 2020 2981333
He Zhao, Zhiwei Zeng, Yongwei Wang. Deheng Ye, and Chunyan Miao. Hgattack: Transferable hetcrogeneous graph adversarial attack. IEEE International Conference on Agents, ICA 2024, Wollongong, Australia, pp. 100-105, 2024. URL wttp:://///oo........00..
2024. 00028
Jie Zhou, Ganqu Cui, Shengding Hu, Zhengyan Zhang, Cheng Yang, Zhiyuan Liu, Lifeng Wang, Changcheng Li, and Maosong Sun. Graph neural networks: A review of methods and applications. Al Open, 1:57-81, 2020. URL https:
www.oo.g...oooooooooooooo.... 10100.10116000 6/10166--.. aioenn. 2021. 01. 001
Dingyuan Zhu, Ziwei Zhang, Peng Cui, and Wenwu Zhu. Robust graph convolutional networks against adversarial attacks, In Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery Data Mining, KDD, USA, pp. 1399-1407. ACM, 2019. URL https 7/doi. Proi.org/100. 10. 1145/32925000 333C851
Jiong Zhu, Yujun Yan, Lingxiao Zhao, Mark Heimann, Leman Akoglu, and Danai Koutra. Beyond homophily in graph neural networks: Current limitations and effective designs, Annual Conference on Neural Information Processing Systems, NeurlPS, 2020.
Xu Zou, Qinkai Zheng, Yuxiao Dong, Xinyu Guan, Evgeny Kharlamov, Jialiang Lu, and Jie Tang. Tdgia: Effective injection attacks on graph neural networks. In Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining, pp. 2461-2471, 2021.
Daniel Zügner and Stephan Günnemann. Adversarial attacks on graph neural networks via meta learn- ing. In 7th International Conference on Learning Representations, ICLR 20/9. OpenReview.net, 2019. /tttpp:://peereevieee. htt. forum?
Daniel Zügner, Amir Akbarnejdd and Stephan Günnemann. Adversarial attacks on neural networks for graph data. In Proceedings of the Twenty-Eighth International Joint Conference Artificial Intelligence, IJCAI 2019, Macao, China, pp. 6246-6250. ijeai.org, 2018. URL StlLttts::/ ://oi
org/10. 24963/ feai .etaa..0199/00 2019/872
14


Reviews:
[{"review_id": "aEwMV0Ylj9", "reviewer": "Reviewer_Lu7v", "summary": "The paper presents GOttack, an adversarial attack framework targeting Graph Neural Networks (GNNs) through manipulation of graph orbits to maximize misclassification rates in node classification tasks. GOttack leverages topological properties, specifically graph orbits, to systematically alter graph structure with minimal changes, showing superior efficiency and effectiveness compared to other adversarial methods across multiple datasets and GNN architectures.", "questions": "1. In line 286, why GOattack works with k=5-node graphlets?\n2. Please give the time used in orbit discovery to better show the efficiency of the method. \n3. Does the used time of GOattack presented in Table 4 includes the preprocessing phase (i.e., orbit discovery)?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "1. Provides comprehensive experimentation across various datasets, GNN models, and defense mechanisms, demonstrating GOttack’s robustness.\n2. The idea of using graph orbits learning is interesting.\n3. According to the presented results, the proposed method has better time efficiency than baselines.", "weaknesses": "1. It is unclear why existing methods, which rely on direct node feature manipulation or edge modifications, do not account for topological impact. Could the authors provide specific examples of how these approaches might implicitly consider topology and clarify what unique advantages GOttack offers by explicitly leveraging topology?\n\n2. Orbit discovery is extremely time-consuming, which could limit the practical applicability of the method in real-world settings. Although the orbit discovery on graphlets is performed as a pre-processing step, it would be helpful for the authors to discuss scenarios where the graph structure updates dynamically. Additionally, considering large-scale graphs (e.g., OGB-arxiv) may require significant computational resources. Providing empirical runtime comparisons on such large-scale datasets and discussing potential strategies for dynamic graphs would strengthen the discussion on scalability.\n\n3. The proposed method appears to rely heavily on specific orbit structures (e.g., orbits 15 and 18). Could the authors elaborate on the selection of these specific orbits and clarify whether the effectiveness of the method would hold if these particular structures were not present in the target graph?\n\n4. PRBCD is designed for the scalable graph adversarial attack, but the experiments are mainly on small-scale datasets. Evaluating on some large-scale datasets, such as Reddit and ODB-arxiv, would provide a more robust assessment of the scalability claims, especially in comparison with GOttack.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "usVGoIpsJX", "reviewer": "Reviewer_EmAo", "summary": "The paper proposes GOttack, a first-of-its-kind local attack on GNNs via structure perturbations, that leverages graph orbits to narrow down the search space. That is, via topological analysis, a short list of nodes is created for the targeted node. This shortlist is then used to generate the perturbations. The authors validate the efficacy of their method on 5 graphs, 3 GNNs, and, additionally, four GNN defenses.", "questions": "1. Have the authors tried to scale to larger graphs? E.g., OGB arXiv, Products, or Papers100M (as PRBCD does)?\n1. Is $\\mathcal{G}\\_{g p} = \\mathcal{G}\\_{s'}$ in Definition 2\n1. Are orbits 15 and 18 special regardless of the number of nodes? If so, could the authors please elaborate a bit more?\n1. Why do the authors focus on very small budgets 1..5? Usually, the budget is made relative to the degree of the attacked node.\n1. How is the preprocessing of Gottack included in the times reported in Table 4?", "limitations": "", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "1. The authors propose a new angle on the adversarial attack problem for structure perturbation using insights from topology.\n1. The found perturbations transfer well between different GNN architectures.\n1. The paper is well structured and (except for some details) it is easy to follow.\n1. The empirical verification not only assesses misclassification rates but also uses explainers for qualitative insights.", "weaknesses": "1. The attack is an indirect attack using a surrogate (i.e., non-adaptive [1]). This severe limitation should be discussed prominently in the text. Moreover, GOttack seems to transfer evasion attacks to the poisoning setting and the attack is not evaluated against adaptive attacks (except for GCN; e.g. directly attack  GSAGE/GIN with PRBCD and not the GCN surrogate).\n1. I had a hard time following some of the discussion Section 4.2 since it is not clear when numbers are general constants or tailored to the example in Figure 2.\n1. The attack does not seem scalable due to the required preprocessing (see question below).\n1. The authors do not properly discuss scalable attacks on GNNs. For example, the authors compare with PRBCD but ignore its properties in their discussion. For example, the argument on ll. 517-519 does not necessarily apply to PRBCD. Also, the statement that PRBCD was of quadratic scalability seems wrong/imprecise (Section B.2).\n1. The topological analysis is independent of the node features, implicitly assuming that they are somewhat different to ensure attack efficacy.\n1. The evaluated defenses are not state-of-the-art [1].\n\nI am willing to increase my score if especially the first two weaknesses are properly addressed.\n\nMinor:\n1. It is not clear why Metattack is mentioned in the related work, but there is no further discussion about the differences.\n1. The bilevel nature of poisoning attacks (eq. 2) usually arises from the fact that one wants to contrast predictions of the model trained on the clean data and perturbed data. The inner maximization is usually rather considered part of the loss.\n1. The authors might want to note that the reliability of GNN explanations is debated [2,3]\n\n[1] Mujkanovic et al. Are Defenses for Graph Neural Networks Robust? NeurIPS 2022.\n\n[2] Li et al. Graph Neural Network Explanations are Fragile. ICML 2024.\n\n[3] Li et al. Explainable Graph Neural Networks Under Fire. arXiv 2024.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "wmkz3SKshX", "reviewer": "Reviewer_oJkK", "summary": "The work tackles the problem of adversarial attack for Graph Neural Networks (GNNs). The authors propose a new “universal” attack to the graph topology through graph orbits, denoted GOttack. The paper identify that nodes from a certain part of the structure (specifically from the concept of orbits) are rather more vulnerable to attacks and consequently would be good targets. The main key of the method is the proposed trade-off between attack success rate and the time-complexity.", "questions": "- Please provide the attack success when subject to the defenses proposed in [1] and [2], as they will allow the user to judge the real validity of the method.\n- The theoretical analysis doesn’t seem to take into account the node features ? Could you please clarify on that\n- Is it possible to provide empirical results validating the claims in Theorem 1? Refer to my proposed setting in the Weakness section, otherwise I am open to any other proposition.\n- Is your framework also adaptable to node-feature based adversarial attacks ? As it seems you refer to it in general attack formulation in Section 2 (mainly Eq. 1).\n\nI am willing to raise my score if the some of the previous question were answered.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- The paper is well motivated and well written.\n- The method is targeting the complexity challenge of attack adversarial attack, which is something that is very sparse in current literature as the majority of the work rather evaluate from an attack perspective (lower attack accuracy) rather than the time complexity — making sometimes their method not possible in some practical settings.\n- Evolving the concept of graph orbits and graphlets in the perspective of adversarial attack is novel. Specifically, the theoretical analysis in Theorem 1 is very interesting.", "weaknesses": "The main weakness of the paper is related to the experimental part. Specifically the following points:\n- The authors only consider RGCN, GCN-Jaccard, GCN-SVD and MediaGCN as a defense method to attack. Recent work have clearly shown the failure of these defense in defending (specifically targeted attacks). I would rather consider adding other benchmarks such as GCNGuard [1] and specifically the newly presented GCORN [2]. \n- The Budgeted attack results are rather focusing on the GCN, GIN and GraphSage and ignores the defense methods. Typically in the adversarial litterature, we are rather interested in the attack success rate when subject to the defense method, as by definition the original models are rather known to be vulnerable to attacks. \n- Small note: While I understand that you provide the std values for the success rate in the appendix, it would have been much easier to include them also on the main paper’s tables. \n\nAdditionally, from the theoretical perspective:\n- The theoretical insights presented in Theorem 1 are very interesting. It would be great to also validate the claims experimentally. One first experimental setting would be to consider the effect of choosing nodes in the orbits 15 and 18 and other orbits to see the effect of the hitting times.\n\n———\n\n[1] GNNGuard: Defending Graph Neural Networks against Adversarial Attacks, Zhang & Zitnik - Neurips 2020\n\n[2] Bounding the Expected Robustness of Graph Neural Networks Subject to Node Feature Attacks. Abbahaddou & Al. - ICLR 2024.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "ky67aYa3MK", "reviewer": "Reviewer_TZkg", "summary": "This paper presents GOttack, an adversarial attack framework that manipulates graph orbits to disrupt Graph Neural Networks (GNNs) with subtle yet effective modifications. GOttack outperforms existing methods by achieving the highest misclassification rates while reducing training time by 45% across multiple GNN architectures and benchmark datasets. The study highlights the vulnerability of GNNs to structured attacks on graph orbits.", "questions": "- What is the runtime of the preprocessing stage?\n- How large of a graph can GOttack scale to?\n- In Table 2, why is there a significant difference (over 30%) between GOttack-GCN and GOttack-GSAGE on BlogCatalog?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "- This work proposed an interesting approach for attacking GNNs using the concept of graph orbits.\n- Authors offered some insights into the effectiveness of GOttack.\n- Authors have compared GOttack with several attack methods, including PRBCD.", "weaknesses": "- The improvement over attack baselines is not very convincing. In Table 2, GOttack outperforms the baselines by less than 1% in many cases—an improvement smaller than the standard deviation reported in Appendix D. This raises concerns that GOttack may not consistently outperform these baselines, as using a different random seed could potentially alter the ranking of attack methods in Table 2.\n- GOttack underperforms compared to attack baselines in most cases when the budget exceeds 1, as shown in Tables 9–13.\n- GOttack appears ineffective on heterophilic graphs, as suggested by the homophily assumption in line 256 and the empirical results in Appendix D.\n- Some recent and more effective defense methods are missing from the experiments. The authors only consider defense methods published before 2021, while several more powerful approaches have been proposed in the past two years. For example, GARNET [1] and SG-GSR [2] have shown stronger results than the defense methods included in this work.\n\n[1] Deng et al., \"GARNET: Reduced-Rank Topology Learning for Robust and Scalable Graph Neural Networks\", LoG'22. \\\n[2] In et al., \"Self-Guided Robust Graph Structure Refinement\", WWW'24.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)