MemFreezing: A Novel Adversarial Attack on Temporal Graph Neural Networks under Limited Future Knowledge
Authors: Yue Dai
Liang Liu
Xulong Tang
Youtao Zhang
Jun Yang
Venue: ICML 2025 poster (2025)
Keywords: Adversarial Attack
Graph Neural Network
Dynamic Graph
Primary area: social_aspects->security
TL;DR: We introduce a novel adversarial attack towards temporal graph neural network, which enables attackers to conduct attacks without knowing post-attack graph changes in dynamic graphs.

Abstract: Temporal graph neural networks (TGNN) have achieved significant momentum in many real-world dynamic graph tasks.
While most existing TGNN attack methods assume worst-case scenarios where attackers have complete knowledge of the input graph, the assumption may not always hold in real-world situations, where attackers can, at best, access information about existing nodes and edges but not future ones after the attack.
However, studying adversarial attacks under these constraints is crucial, as limited future knowledge can reveal TGNN vulnerabilities overlooked in idealized settings.
Nevertheless, designing effective attacks in such scenarios is challenging: the evolving graph can weaken their impact and make it hard to affect unseen nodes. 
To address these challenges, we introduce MemFreezing, a novel adversarial attack framework that delivers long-lasting and spreading disruptions in TGNNs without requiring post-attack knowledge of the graph. 
MemFreezing strategically injects fake nodes or edges to push node memories into a stable “frozen state,” reducing their responsiveness to subsequent graph changes and limiting their ability to convey meaningful information. 
As the graph evolves, these affected nodes maintain and propagate their frozen state through their neighbors. 
Experimental results show that MemFreezing persistently degrades TGNN performance across various tasks, offering a more enduring adversarial strategy under limited future knowledge.

MemFreezing:
A Novel Adversarial Attack on Temporal Graph Neural Networks under Limited Future Knowledge
Yue Dai 1
Liang Liu 22 Xulong Tang'
Youtao Zhang' Jun Yang? 2
Abstract
1. Introduction
Dynamic graphs are prevalent in real-world scenarios, span- ning areas like social media (Kumar et al., 2018), knowl- edge graphs (Leblay & Chekol, 2018), autonomous sys- tems (Leskovec et al., 2005), and traffic graphs (Pareja et al., 2020). Inspired by the success of GNNs (Kipf & Welling, 2016; Hamilton et al., 2017: Veličković et al., 2017; Xu et al., 2018), Temporal Graph Neural Networks (TGNNs) have become leading solutions for dynamic graph tasks (Trivedi et al., 2019; Kumar al., 2019; Rossi et al., 2020; Zhang et al., 2023; You et al., 2022). As such, there is a pressing need to study their robustness towards adversarial attacks, especially since such attacks have shown significant effi- cacy against traditional GNNs (Wang et al., 2018; Tao et al., 2021; Zügner et al., 2018: Zou et al., 2021; Ma et al., 2020; Zang et al., 2020; Bojchevski & Günnemann, 2019; Sun et al.. 2022: Li al., 2022). By modifying the input graphs with imperceptible and subtle perturbations, the adversarial attacks can make the models yield incorrect or adversary- expected results. For instance, a social media such as RED- DIT (Kumar et al., 2018) may employ TGNN to decide whether comments (as edges) from users to posts (as nodes) should be banned based on his/her comment histories. With subtle adversarial attacks, malicious messages can easily bypass this checking functionality.
Temporal graph neural networks (TGNN) have achieved sigmificant momentum in many real- world dynamic graph tasks. While most existing TGNN attack methods assume worst-case scenar- ios where attackers have complete knowledge of the input graph, the assumption may not always hold in real-world situations, where attackers can, at best, access information about existing nodes and edges but not future ones after the attack. However, studying adversarial attacks under these constraints erucial, as limited future knowledge can reveal TGNN vulnerabilities overlooked in idealized settings. Nevertheless, designing effec- tive attacks in such scenarios is challenging: the evolving graph can weaken their impact and make it hard to affect unseen nodes. To address these challenges, we introduce MemFreezing, a novel adversarial attack framework that delivers long- lasting and spreading disruptions in TGNNs with- out requiring post-attack knowledge of the graph. MemFreezing strategically injects fake nodes or edges to push node memories into a stable "frozen state," reducing their responsiveness to subse- quent graph changes and limiting their ability to convey meaningful information. As the graph evolves, these affected nodes maintain and prop- agate their frozen state through their neighbors. Experimental results show that MemFreezing per- sistently degrades TGNN performance across var- ious tasks, offering a more enduring adversarial strategy under limited future knowledge.
While several studies have explored the effectiveness of adversarial attacks on dynamic graphs (Lee et al., 2024; Sharma et al., 2022; 2023; Chen et al., 2021), they often assume that attackers have complete knowledge of the input graphs the time of the attack, which may be challenging to achieve in many real-world scenarios. In practice, as dynamic graphs evolve, by the time attackers observe the entire evolution (i.e., track all changing nodes and edges) and identify the optimal timestamps to inject adversarial perturbations (e.g., adding fake nodes or edges), those key timestamps may have already passed, making it challenging to inject noises timely. Hence, in real-world cases, despite white-box (i.e., model parameters are known) or black-box setups (i.e., model parameters are unknown). the adversary may attack TGNN without knowing future changes on the graph. Therefore, studying TGNN adversarial attacks under these real-world constraints is essential since attacking un-
'Equal contribution 'Department of Computer Science, Uni- versity of Pittsburgh. Pittsburgh. USA 'Department of Electrical and Computer Engineering, University of Pittsburgh, Pittsburgh, USA. Correspondence to: Yue Dai syud42@pitt.edue Liang Liu <lil125@ pitt.eduz.
Proceedings of the 4nnd International Conference Machine Learning. Vancouver, Canada. PMLR 267, 2025. Copyright 20255 by the author(s).

---

MemFreezing: A Novel Adversarial Attack on Temporal Graph Neural Networks under Limited Future Knowledge
der limited future knowledge may exhibit unique patterns that reveal TGNN vulnerabilitties overlooked in idealized, full-knowledge analyses. However, attacking TGNNs with limited knowledge up to the attack time faces significant challenges due to the evolving nature of dynamic graphs. First, the impact of adversarial noise can quickly decay as the graph evolves and node information updates. Second, it difficult to influence unseen nodes or edges that appear after the attack, as their information is unknown. Thus, effective strategy must endure the graph's 's evolution and affect both current and future nodes despite this uncertainty.
ers only see the graph up to the attack time, posing unique challenges for adversarial attacks on TGNNs.
We propose MemFrrezing, which disrupts TGNN node memories by pushing them into unnaturally stable states. It adopts a cross-frezzin mechanism to keep nodes' mem- ories stable despite future updates and encourages af- fected nodes to propagate stable states by simulating their future neighbors.
We compare our method with prior GNN adversarial at- tacks on various dynamic graphs. Experimental results show that, MemFreezing effectively and persistently mis- leads TGNN predictions across diverse datasets and mod- els, outperforming state-of sfte-of-theearr GNN attacks, even in the presence of defenses.
Interestingly, the node updating mechanism in Temporal Graph Neural Networks (TGNNs) offers unique potentials for persisting and propagating adversarial noises in dynamic graphs. Generally, TGNNs maintain and update node status vectors, often referred to node memory by recent stud- ies (Rossi et al., 2020; Zhou et al., 2022; Wang & Mendis, 2024; Zhou et al., 2023; Wang & Mendis, 2023), to capture nodes' temporal history, which is crucial for delivering accu- rate predictions in dynamic graph tasks. Moreover, a node's memory vector can potentially affect its neighbors. When graph changes occur as the addition and deletion of nodes or edges- the memory vectors of related nodes are updated based on their neighbors' memories. This raises intriguing questions: Can TGNN predictions be disrupted by disabling their memories, and can this effect persist and spread through their memory updates?
2. Background and Related Work
Dynamic Graphs. Unlike a static graph, dynamic graph consists of nodes and edges evolving over time. Dynamic graphs can be represented in two ways: Discrete- TTmme Dy- namic Graphs (DTDGs) describe dynamic graphs as a series of static snapshots taken periodically, while Continuous- Time Dynamic Graphs (CTDGs) view the graph as a col- lection of events events-each event detailing updates like node or edge changes. Recent TGNNs focus on CTDGs since they can retain more information than DTDGs' fixed inter- vals and more complex (Kazemi et al., 2020). Within the CTDG paradigm, the dynamic graphs are represented as G= {a((t)), xx(2), ...}. in which xr(4)) indicates an event happened at timestamp 4, Generally, the prediction task for CTDGs can be depicted in equation 1.
To address this inquiry, we thoroughly investigated the mem- ory update patterns of nodes within TGNNs and made the following observations: (1) Although it is not possible to directly affect unseen predictions, we can degrade TGNN prediction accuracy by pushing
seen or un- seen-into a relatively 'frozen' state, their memories remain stable and exhibit limited responsiveness to surrounding changes, reducing their ability to convey updated or mean- ingful information. (2) While a noisy node's memory vector may struggle to maintain its noisy state over time on its own, this state can persist for much longer if its neighboring nodes have similar memory states.
3/- fo(G., t.) = fo((x(t1), (61))))((((22))))) ((t2),...((t-:))) (I)
At the prediction time t,, the model fo(-) takes all previ- ous events G; = {a((t),, xx(2)),.... predicts the testing nodes' classes or future edges.
as inputs and
Temporal Graph Neural Networks. The memory- based Temporal Graph Neural Networks (TGNN) are widely stud- ied and achieve state-of-te tf-e-oof-hhe-rr accuracies in dynamic graph tasks (Trivedi et al., 2019; Kumar et al., 2019; Rossi et al., 2020; Kazemi et al., 2020; Zhang et al., 2023; You et al., 2022; Ahmadi, 2020). Generally, these TGNNs maintain state vector for each node that tracks the node's 's history, and use it for predictions. Note that, despite their differ- ent names (e.g., node memories (Rossi et al., 2020; Wang et al., 2021), node representations (Trivedi et al., 2019). node dynamic embeddings (Kumar et al., 2019)) across various TGNNs, these node features are represented vec- tors on presented nodes and evolve over time to capture the temporal information of these nodes. Following existing general TGNN frameworks (Zhou et al., 2022; 2023; Wang & Mendis. 2024; 2023; Rossi et al., 2020), we refer to these evolving node feature vectors as node memories. As illus-
To this end, we introduce MemFreezing, a novel adversar- ial attack to expose TGNN vulnerabilities under limited knowledge about input graphs. At a specific attack times- tamp. MemFreezing strategically selects groups of victim nodes that reinforce each other's noisy states using scheme called cross-freezing. By injecting carefully crafted fake messages, MemFreezing leads nodes into a stable "frozen state", reducing their responsiveness to graph changes and thereby misleading predictions. Additionally, it simulates victim nodes' future neighbors to encourage the propaga- tion of the frozen effect. We summarize our contributions as follows:
We identify a highly possible threat model where attack-
2

---

MemFreezing: A Novel Adversarial Attack on Temporal Graph Neural Networks under Limited Future Knowledge
Time
Event r Adding Edge e23
Prediction at 4: Y2 =?
Step 3: Node Embedding
ms
2
$2
$2
1g 1
3
ms sz
S3 S
Step 1: Message Generating
Step 2: Memory Updating
Y2 (Mz)((2) Prediction
Figure 1. The three steps TGNN computing assuming a new event at timestamp Lg adds an edge e23 to the dynamic graph: Firstly, messages msgg3 are generated for the nodes involved in this event nodes 2 and 3. Next, the nodes aggregate messages from their neighhors and update their memories (c.g., 82 + s.). ). At a future prediction time to, nodes aggregate memories (c.g., 81 and 82) from their neighbors and embed them into node vectors (e-g., h2) for the prediction.
trated in Figure 1, TGNNs produce node embedding for the predictions in three steps. When an event rttt adds an edge Cue from node u to node v (i.e., ==t²)= = Cuv). two messages are generated as equation 2 (Step 1). For simplicity, we only present the updating and following operations of node u, which is the same for node U.
GNN predictions by modifying the nodes and edges of input graphs. For example. (Wang et al., 2018) introduces fake nodes with fake features that can minimize the loss between prediction results the original graphs and the targeted fake results; (Züggner et al., 2020) adds and deletes edges that can cause the most substantial increases in the training losses the original graphs. Recently, there have also been few studies that explored the effectiveness of adversarial attacks on dynamic graphs and TGNNs (Lee et al., 2024; Sharma et al., 2023; 2022; Chen et al., 2021).
Myu = msg(su. Sus AT, CTe)
The msg(-) is a learnable function such as Multi-Layer- Perceptions (MLPs). The 8y and 8, denote the memories of node u and node v at their last updated times, and AT represents the difference between the current timestamp and the nodes' last updated times. Next, nodes u and aggregate messages from their neighbors and update their memories as equation 3 (Step 2).
3. Problem Analysis
Threat Model under Limited Future Knowledge. Prior TGNN attacks (Lee et al., 2024; Sharma et al., 2023; 2022; Chen et al., 2021) assume that attackers have full knowledge of the target graphs and that these graphs remain static after the attacks. However, this assumption may not hold in many real-world settings, as attackers cannot return to the optimal attack times after observing the entire evolution of a dynamic graph. In particular, when an attacker observes the evolution of dynamic graph at t, and identifies optimal attack timestamps fay lag...., bax < bn they would need to go back to these past timestamps to inject noise, which is infeasible in practice. To this end, we assume that an attacker's knowledge is limited to events up to the attack timestamp, and the graph continues to evolve afterward. Specifically, we set up the attack model as follows.
- = -UPDT(s Ik E N(u))),
(3)
The Nuu) denotes the neighbors of node u. The AGGR(.)
is usually implemented by a mean or coss_r func- tion to aggregate messages from the node's neighbors (Rossi et al., 2020). The (PD((-) uses the aggregated messages to update the node's 's memory and is usually implemented by a CateedRRecurret-Unii (GRU) (Chung al., 2014). When there is prediction involving node u, TGNNs use graph embedding module, such as Graph Attention Net- work (Veličković et al.. 2017), to embed the node's 's memory into the final node embedding, as depicted in equation 4 (Step 3).
Attacker's Goal: Given an evolving dynamic graph and a TGNN model, the attacker's ss goal is to misguide the TGNN predictions by introducing a limited amount of changes to the entire graph (c.g., affecting a small number total nodes limited by the attack budget.)
h = G salk E N(u),
(4)
During prediction. TGNNs use nodes' latest memories to compute the node embedding hn The resulting node em- bedding h2 is fed into an MLP for the final predictions.
Attacker's Knowledge: Attackers have access only to in- model
formation up to the attack's timestamps- parameters, presented graph inputs, and node memories before the attack- but not future graph changes. Re- garding acquiring presented graph information, platforms like Wikipedia, Reddit, Meta, or X typically offer pub- licly accessible dynamic graphs, allowing adversaries to reconstruct them reasonably. Likewise, many TGNN ar- chitectures and pre-trained models are open-sourced, and
Adversarial Attacks on Graph Neural Networks. The considerable achievements of GNNs have catalyzed numer- ous investigations into their resilience against adversarial attacks (Chen et al., 2017: 7: Bai et al., 2018; Wang et al., 2018; Zügner et al., 2018; 8; Bojchevski & Günnemann, 2019; Ma et al., 2020; Zang et al., 2020; Tao et al., 2021; Zou et al., 2021; Sun et al., 2022; Li et al., 2022; Zou et al., 2023). These adversarial attacks generally seek to misguide
3

---

MemFreezing: A Novel Adversarial Attack on Temporal Graph Neural Networks under Limited Future Knowledge
Persist: Node prosist with
Node 3 persist frozen with message from Node 2 and Node 5, Support
Persist:
Mem Frezinee Attack
message from Node 2. Support 5 UPDT AGG
Freeze Node Memories Propagate via Node Update
UP ( AGGR(m)s m
Support
A Attack
Propagate:
Node get frozen with message from Node 3,
Node get frozen with message from Node
Propagate:
Propagate
Propagate
t
t
i UPDT (cg A
t
5 UPDT (st AGG.GGRRMa (m)))
Time
t
t
t
Node Prediction
Truth
Node
Prediction
Truth
0.01
1
0.02
0.02
0.03
Figure 2. The resultant adversarial effects of the MemFreezing attack. (I) Vietim nodes are kept frozen with support (i.e., similar messages) from their frozen neighbors, such as node 3, which kept frozen at t and fz (2) Vietim nodes propagate frozen states to their future neighbors by inducing them to be similar, such as node 3 propagates to node at tj and 6 at fi
even when they are not, techniques like insider threats or model extraction (Yao et al., 2024; Oliynyk et al., 2023) can be used to obtain model parameters. (We also discuss black-box scenarios in Appendix B.15.)
provide critical information for predictions. ii) To affect unseen nodes and edges, we simulate future neighbors for the victim nodes and encourage these victim nodes to update the memories of their simulated future neighbors into simi- lar, stable states. As a result, the adversarial effects remain persistent through future changes and influence subsequent predictions, as illustrated in Figure 2.
Attacker's 's Capability: Attackers can add fake events as adding nodes/edges at the attack time. For example, while attacking TGNNs in social media, attackers can create fake user accounts as fake nodes and make junk com- ments to the blogs as fake edges.
Memory Freezing Objective. Instead of focusing on maxi- mizing prediction losses as prior adversarial attacks, which are limited by unknown and diverse future events, we pro- pose to transform victim nodes' memories into similar and stable states, which we refer to as Frozen State. In particular, by keeping node memories similar and unchanged over time, nodes in TGNNs hardly carry or convey meaningful in- formation, consequently disturbing predictions. To quantita- tively investigate the potential effectiveness of freezing node memories, we freeze the node memories in TGN (Rossi et al., 2020) and JODIE (Kumar et al., 2019) by consistently forcing their node memories to all zero, then evaluate their performances on edge prediction tasks on Wikipedia (Ku- mar et al., 2018) dataset. As shown in Figure 3(a), this leads to significant accuracy drops over time, demonstrating the impact of freezing node memories. Thus, we set our attack objective as freezing node memories unchanged.
Challenges in Limited Future Knowledge. Due to lim- ited knowledge up to the attack time, adversarial attacks on TGNNS must contend with unknown future changes in dynamic graphs. However, the subsequent changes after the attack may significantly limit the attack performances for two reasons: First, for seen and attacked targets, the noise that misleads their predictions becomes mixed with new information from future changes (as described in equation 3 and equation 4), making it too weak to mislead future pre- dictions. Second, unseen nodes and edges added after the attack are difficult to affect, as the attackers have no knowl- edge of these future elements and cannot generate effective noise to mislead them. As details shown in Section 5 (c.g.. Figure 5 and Table 1), while existing GNN attacks (Wang et al., 2018; Zou et al., 2021; Li et al., 2022) effectively reduce the model's 's accuracy immediately after the attack, they struggle to perturb predictions in the future timestamps.
4.1. Freezing and Persisting Node Memory
Challenges in Persisting Frozen Memories. However, keeping nodes' memories in frozen states is challenging, as unpredictable neighbor messages can significantly alter a node's memory during updates. An intuitive solution is to minimize the impact of incoming messages during an update. To explore the feasibility of this approach, we conducted a case study using TGN on the Wikipedia dataset. Specifically, we sampled 100 victim nodes, manipulated each node's memory to minimize the interference of messages during
4. The MemFreezing Attack
We propose MemFreezing, an adversarial attack specifically tailored for TGNNs. It consists of two key features: i) To create last-lasting adversarial effects, we induce nodes to mutually lock their memories, keeping them stable during future updates. Consequently, the victim nodes become less responsive to surrounding changes, limiting their ability to
4

---

MemFreezing: A Novel Adversarial Attack on Temporal Graph Neural Networks under Limited Future Knowledge
1.0
Defor/AAft Updatiing
1.0
Bofore/Atte Updetho)
1.0
Acnum Aramay
0.9
Cosine Stntlarity
Ceniae Sinillritt
1000
0.9
0.8
0.7
0.5
0.8
500
0.6
19N Uoailia-
0.7
0.5
0.6
0
10
30 Timestamp (a)
20
40
10
20 30 I l'imestamp
40
50
60
10
20
30
40
50
60
0.2
0.4
0.6
0.8
1.0
l'imestap (c)
Similarity (d)
Figure (a) The accumulated accuracy vanilla TGNNs and their frozen counterpart. The ranges (colored bar) and averages (line) the cosine similarities between node's 's evolving memories with (b) persisting frozen by node themselves and (c) by connected groups (cross-freezing). (c) The distribution cosine similarities among ideal frozen states different nodes.
updates, and assessed whether they remained unchanged over subsequent timestamps. As shown in Figure 3(b), the cosine similarities between nodes' pre- and post-update memories still dropped remarkably, indicating that future messages cannot be fully blocked in RNN or attention memory updating modules. We show further experimental details and theoretical analysis in Appendix A.I.
For any given node with its memory denoted as Su, and support neighbors Napp(() (u), our objective relies on two Mlean-Suureed EEror (MSE) losses. The first, ($ st aims to ensure that it updates its support neighbors' memory t close to their ideal frozen state sj so they cannot sense future changes after the attack. We get node k's ideal frozen state sf by repeatedly updating its memory using itself and its two support neighbors' memory until it stabilized (i.e., has more than 0.9 cosine similarity before/after updates) the maximum number of repeats is reached. The second loss, represented by L (st ) is designed to make sure that it updates its support neighbors' memory sy close to its own memory after updates (i.e., +()) so that the messages generated between them can potentially help to lock each other and keep their memory unchanged.
-quarc---rrr
Opportunities in Freezing. Although blocking messages from node's s neighbors is infeasible, can inject noise into those neighbors that their updates help sustain the node's ss'ssinenn frozen memory. In particular, we assume that node memories in TGNN can remain stable when surrounded by neighbors with similar memories. We verify the assumption using the same model and data as Figure 3(b). Specifically, we first sample one- third of 100 victim nodes as root node, node (referred to as support neighbors) and set their memories the same the root node, then observe their memory changes over time. As depicted in Figure 3(c). if nodes have similar neighbors, their memories quickly converge to a relatively stable state and persist through future changes-we we term this state as the node's ideal frozen state. Hence, if the victim nodes have similar ideal frozen states, they can mutually lock each other once they fall into these states. We give further theoretical analysis on the phenomenon in Appendix A.2. Fortunately, as shown in Figure 3d)), the ideal frozen states from different nodes are similar; therefore, is possible to keep nodes frozen by driving their memories into similar and stable states.
then sample
neighbors for each
4.2. Propagating Frozen States
Future Simulating. To make a node's memory influence unknown future neighbors, we propose using existing neighbors simulate potential future ones, which can then be used to optimize the victim nodes' ability propagate their frozen state. This approach is based on the principle of homophily in real-world graphs, where neighboring nodes often exhibit strong similarities (McPherson et al., 2001), As an example, while applying TGN for the edge prediction tasks on Wikipedia dataset, nodes' neighbors have 0.87 cosine similarity on average, with over 60% neighboring nodes having similarities over 0.9. Hence, for a given node u, we simulate its future neighbors in two steps:
Cross- Cross-Freezing Loss. To this end, we propose freeze victim nodes in connected groups and make them persist frozen with mutual support from each other. We termed this approach as Cross-Freezing. Specifically, we first sample one-third of the victim node as the root node, then sample two its neighbors as support modes-note that these sup- port neighbors also cost our attack budgets then force their memories minimize the loss in equation 5.
For node u, we first augment its current neighbor set N by adding "presented fake future neighbors", created by sampling up to ten of the most recent neighbors and injecting Gaussian noise (mean 0, standard deviation at 0.2 times the neighbor's memory std) into their memories. Next, we simulate "newly presented fake future neighbors" to reflect brand-new nodes in the graph, initializing their memories to all zeros. The number of these new fake neighbors is proportional to the fraction of newly appeared nodes among the most recent ten neighbors of u. We also include more
C freeze
(Emso(sk: st)) + Lm (tt. sx)) (EeNeup)
Σ
(5)
5

---

MemFreezing: A Novel Adversarial Attack on Temporal Graph Neural Networks under Limited Future Knowledge
MemFreezing Attack
Step 1: Find nodes' ideal frozen state for cross freezing (Sec. 4.1)
Step Select High-degree Root Nodes
Sz
Update
U Update
Update
Update
$2
5
$3
Step 2: Augment nodes' neighbor with simulated future neighbors (Sec. 4.2)
Step 2: Select High-degree Support Nodes
$2
S2
$2
S2
81
S2 + 81
$3
S3
S3
Sz + 82
| S Supporting neighbors:
Simulate node,
Simulate nodes
Augmented neighbors: Naug (3) = (2. a2)
suupp (2) (3)
Step 3: Solve nodes' adversarial memories Solve adversarial messages 2211
N suup (3) [2]
s/
42 53 s'y a 43 = ms2. M263
Stage 1: Victim Node Selecting
Stage 2: Adversarial Message Solving
Modify Graph
Figure 4. The two stages of the MemFreezing attack. In the vietim node selecting stage, greedily select victim nodes under the attack budget. In the adversarial message solving stage, we solve the victim nodes' targeted memory and corresponding adversarial messages. The solved messages are added to the graphs as fake events and removed after the attack timestamp.
details about the future simulation in Appendix A.3 and further discuss its effectiveness under extremely random and irregular graphs, where nodes have drastically changing neighbors, in Appendix B.16.
solve the adversarial event to be injected to each victim node u in three steps: In the first step, we find the nodes' ideal frozen states (i.e., s in equation 5) by updating its memory using current neighbors until convergence. In the second step, we simulate the future changes by augmenting victim nodes' neighbors with simulated futures (i.e., nodes/edges). The resulting neighbors are used as N'( in equation 6. In the third step, we solve the adversarial memory 8. of the victim nodes by minimizing the total memory loss in equation 7, which is calculated by summing its persisting (i.e., equation 5) and propagating (i.e., equation 6) losses.
To make the frozen nodes contagious to potential future neighbors, we then use the resulting aug- mented neighbors (u) to solve the problem described in equation 6.
Propagating Loss.
Σ (M)
Limse UPDT(sR, ma)))))
(6)
The objective of this loss is to minimize the Mean Squared Errors (MSEs) between a node's memory and the mem- ories of its new neighbors after an update. By doing so, we encourage the node's 's memory to update its neighbors' memories (i.e.. sy) to become similar to itself (i.c.. s.).
Lu = Cfrezze + Corop
Then, we solve the adversarial messages described in equa- tion 8 so that these messages can update the nodes' memo- ries into their solved frozen states.
arg min Ease (UPDT (su, AGGR(M m.)), Bw)) (8) A
4.3. Attack Framework
Combining the above-mentioned goals together, we intro- duce the two-stage attack framework as illustrated in Fig- ure 4 (Detailed algorithm is presented in Appendix A.4).
The My represents the aggregated messages collected from i's other neighbors. In short, for node u. the solution aims to find a fake message m.A that minimizes the MSE loss between the expected noise memory 8,, and the memory updated after inserting it to the graph. Lastly, for each victim node, we add the solved noisy message as a fake event from fake node and remove it after the attack.
Stage 1: Victim Node Selecting, In this stage, we use simple greedy approach to select victim nodes in two steps: First, we select the nodes with the highest degrees in the current graph as root nodes. The intuition behind this is that we want the injected noises to be propagated to as many nodes as possible, and these high-degree nodes, such as oop-oommented posts on social media, are usually popular in existing and future graphs. Next, for each root node, we select its two highest-degree neighbors as its support nodes. The following procedure will treat all the root and support nodes as victim nodes and transform them into frozen states.
5. Evaluation
5.1. Experimental Setup
Models and Datasets: evaluation: JODIE (Kumar et al., 2019), Dyrep (Trivedi et al., 2019), TGN (Rossi et al., 2020) and Roland (You et al., 2022). The experiments use four dynamic graph
We use on four TGNN models for
Stage 2: Adversarial Message Solving. In this stage, we
6

---

MemFreezing: A Novel Adversarial Attack on Temporal Graph Neural Networks under Limited Future Knowledge
Table 1. Accumulated accuracy of edge prediction in the vanilla/attrakedd TGNNs over different timestamps; lower matrices indicate
more effective attacks. Results on more datasets and node classification tasks are included in Appendix B.4
Dataset
WIKI
REDDIT
REDDIT
--ODY
Model
TGN
JODIE
Dyrep
Roland
TGN
JODIE
Dyrep
Roland
TGN
JODIE
Dyrep
Roland
Vanilla
0.93
0.87
0.86
0.94
0.97
0.98
0.96
0.95
0.90
0.87
0.90
0.88
FN
0.81
0.74
0.74
0.82
0.84
0.83
0.84
0.83
0.76
0.82
0.77
0.79
Meta-h
0.90
0.83
0.81
0.85
0.93
0.95
0.90
0.92
0.86
0.83
0.88
0.85
to
TDGIA
0.77
0.72
0.71
0.80
0.74
0.80
0.81
0.74
0.72
0.81
0.74
0.76
Ours
0.89
0.78
0.83
0.87
0.75
0.84
0.94
0.82
0.84
0.85
0.81
0.78
FN
0.92
0.87
0.85
0.94
0.97
0.97
0.96
0,93
0.90
0,86
0.89
0.88
Meta-h
0.93
0.87
0.84
0.93
0.96
0.98
0.94
0.96
0.89
0,86
0.90
0.87
125
TDGIA
0.93
0.81
0.84
0.92
0.94
0.95
0.95
0.90
0.89
0.85
0.89
0.88
Ours
0.80
0.75
0,77
0.85
0.81
0.84
0.91
0,80
0.81
0.84
0.76
0.80
FN
0.94
0.87
0.86
0.94
0.97
0.97
0.96
0.95
0.90
0.86
0.90
0.88
Meta-h
0.93
0.87
0.85
0,93
0.97
0.98
0.94
0.95
0.90
0.86
0.90
0.88
tso
TDGIA
0.93
0.87
0.85
0,93
0.96
0.97
0.95
0.92
0.89
0.86
0.90
0.87
Ours
0.75
0.76
0.75
0.84
0.80
0.84
0.91
0.80
0.77
0.82
0.76
0.77
Clean Acc.
Clean Acc. 90%
Clean : 88 %
Accunssllated
Accurndattdd
Accuuralaated
Acxuaay
Accuracy
0.9
0.8
0.9
Fadilo
Traills Pukaheek (US)
Takattide (7%)
Takatiado (7%)
Pukettade
Mantinedaa
Nostreosiy (9%)
0.5
0.5
0.5
20
Timestamp
Timestamp
Timestamp
Figure 5. Accumulated accuracies of TGN under no defense(left), Adv__rdaaaaatae train(middle)) and Lip_ reg(rrh)))))))) with FakeNode and our attack WIKI dataset. More results in Appendix B.5
datasets: Wikipedia (WIKI), Reddit (REDDIT) (Kumar et al., 2019), Reddit-body (REDDIT-BON) and Reddit- (Kumar et al., 2018). More details about the models and datasets are included in Appendix B.I. We also present results million-node dataset, Wikipedia Talk Network (Wi k Ta-Taall 1 Lik--eeppp Tempora (Leskovec et al., 2010) in Appendix B.4.4.
Defense Setup:
We adopt following defenses: Adversar- ial Trainin(AAd_ttriingg Regularization under empirical Lipschitz (Lip_reg)) and GNNGua rd from static GNNs. More details about the defense setup are in Appendix B.3.
title (REDDIT-TITIL
5.2. Experimental result
Overall Performance. We examine the accumulated accu- racy three timestamps: to = 0, 225 25, and t50 50. The results of the edge prediction task are presented in Table 1. As observed, all prior attacks cause significant ac- curacy drops at to. but their impact quickly diminishes over time. By ł25 and t50. the accumulated accuracy under these attacks is nearly identical to the baseline. contrast, Mem- Freezing consistently disrupts model predictions. While does not cause the largest accuracy drop to compared to other attacks due to the freezing objective, its effects are more persistent and even increase over time, achieving greater drops as the timestamps shift to 125 and 1so- We also observe similar effects on MemFreezing when con- ducting the attack at different timestamps as detailed in Appendix B.7. The attacks on JODIE are less effective because JODIE employs memory decay mechanism that uniformly decays previous memories. This introduces addi- tional information outside the node memory, making JODIE more resilient to memory-based attacks. We discuss this phenomenon in more detail and explore potential defenses
Tasks & Metrics:
We evaluate the models on two tasks:
node classification and edge prediction (Rossi et al., 2020). For a timestamp, we measure the accuracy or area under the ROC Curve (ROC-AUC) based all presented predictions from the beginning, which termed accumulated ac- curacy and accumulated ROC-AUC. More details about the tasks and matrices are in Appendix B.1 Attack Setup: We compare our work with three state- of-the-art GNN attacks: FakeNode (FN) (Wang et al., 2018), IDGIA(TDGIA) (Zou et al., 2021) and Meta-Attack- Heuristic(Meta-h) (Li et al., 2022). The results from Table I evaluate all attacks with 5% attack budgets, where we inject noises to 5% nodes of the input graph. In Appendix B.4, we evaluate attacks with 1% attack budgets. For our attack, we use 1/3 budget for the root nodes and 2/3 for support nodes. All methods attack at the beginning of the test set (i.e., attack at ty). We also include more details about the baseline attacks in Appendix B.2 and the results of injecting attacks in multiple timestamps in Appendix B.6.

---

MemFreezing: A Novel Adversarial Attack on Temporal Graph Neural Networks under Limited Future Knowledge
Cosino Similarrty betwoen
Condrne Sinrillartt between
Cositae Siarilearity Letween
Vieai York lelle Naghhar Neiphar
Codra Siiillarit bebsernn
Vitia Nece
Naglo:
(1.8
(1.8)
0..5
2epp
Nazde MedeeMerrryyyy
Node:Mennayy
Node
Node
(1.0
0.00
0.0
0.4
Victan Nods (13g 2--2483 Boo Neighber
Viltin Neclo
I-loen Neiihhor
2-lie Neynher
10
15
15
Timestamp
Timestamp
Timestamp
Timestamp
Figure 6. The similaritics between victim nodes' initial noisy memories (at the time of the attack) and themselves //thiir subsequent
neighbors' memories in MemFreezing(lett) MemFreezing w/o (middle-left) frozen state, MemFreezing w/o cross- poos-ffrezzin loss (middle- right), and regular nodes (right). All results above are from TGN and WIKI. More results are included in Appendix B.8.
Affected Node Count
5000
of Affected Nodee57o)
Affected Node Count
300
*afFfflesst Neds (ilishat Bagreey
0.95
S0man133 V aauijunma
Accumulated Accuracy
X001
R1 of Affrccedd Nodel %6
A Cacauoncc
2,50
Adbor Arl- Aot. (Higliont Beeras)
Acc. of Afleeted 5%1)
200
600
150
4001
100
0.85
200
10
30
30
2
301
12
14
Timestamp
Timestamp
Attack Budget
Figure 7. (left) Count of nodes affected by MemFreezing and accuracy for the affected nodes over time. (middle) Count of affected nodes and overall accuracy over time with two strategies for selecting the injected node: 1% lowest degree versus 1% highest degree nodes. (right) The accumulated accuracy at to. 125, and too under different attack budgets (% of total nodes). All results above are from TGN and WIKI. Results more models and datasets are included in Appendix B.
against MemFreczing in Appendix C. We further illustrate the accumulated accuracy of TGNs under different defenses in Figure 5. Similar results are observed: the effects of baseline attacks quickly diminish, resulting in only a 1.1% accumulated accuracy drop by tso. In contrast, MemFreez- ing causes progressively larger accuracy drops over time, averaging over 10% drop by tso-
the similarity between nodes' initial attacked memory and their future counterparts drops drastically in the original TGNNs like (4). If the frozen states are not guaranteed like (2), the similarities also suffer drops and fail to achieve comparable similarities as (I). This is because, in such cases, the memories will change before reaching their con- verged states, making the final converged state different from the original adversarial memory states. Therefore, the converged state is essential for persisting noisy memories. The similarities drop faster if we remove the cross- froszifr loss like (3) since the cross-freezing mechanism is entirely disabled. Moreover, despite removing cross gross-freezing losses, the neighbors are getting more similar to the target nodes, indicating that the propagating loss works as expected. We also analyzed the advances of freezing node memories com- pared to maximizing prediction losses in Appendix B.9 and the stealthiness of the injected noises in Appendix B.
Ablation Studies. To analyze the propagating and persist- ing capability of the noise solved by MemFreezing, we capture 100 victim nodes in TGN in edge prediction on WIKI and monitor the changes in their memory and their neighbors' memory. In Figure 6, we compare the cosine similarity between the memories of the victim nodes at to with those in themselves and their one-hop and two-hop neighbors at each timestamp after the attack in four versions: (1) MemFreezing, (2) MemFreezing w/o frozen state (i.e., w/o using Emse (s xx) ) in equation 5). (3) MemFreezing w/o cross-freezing loss (i.e., without using entire C.reese in equation 5), and (4) original TGNN without attacks. The result shows that, in MemFreezing, the noise in the vietim node can persist over ten timestamps, with over 0.92 co- sine similarities. For the one-hop neighbors, at t = 1. they achieve 0.51 average similarities after the first update by the message from victim nodes, and at = 15, the average rises to 0.88. The two-hop neighbors, whose memories are updated by the message from one neighbor, have av- erage similarities that grow from 0.24 to 0.84. In contrast,
Propagation in Dynamic Graphs. To better understand how frozen effects spread in MemFreezing, we track all topologically connected nodes to the victim node, labeling them as affected nodes since noise can potentially propagate to them. We then measure the prediction accuracy of these affected nodes (represented by colored lines). As shown in Figure 7 (left), MemFreezing progressively impacts more nodes (shaded area) and significantly reduces prediction accuracy, even though some nodes were unseen the attack timestamp. On the one hand, attacking high-degree nodes
8

---

MemFreezing: A Novel Adversarial Attack on Temporal Graph Neural Networks under Limited Future Knowledge
helps propagate the noises to more nodes, nearly doubling the number of affected nodes compared to selecting low- degree nodes, shown in Figure 7 (middle). On the other hand, once nodes enter stable (frozen) state, they propagate adversarial effects to future neighbors, ensuring the attack's ' persistence and adaptability despite dynamic graph changes.
2018.
Bojchevski, A. and Günnemann, S. Adversarial attacks on node embeddings via graph poisoning. In International Conference on Machine Learning, pp. 695-704. PMLR, 2019.
Scale with Attack Budget. We also evaluate MemFreez- ing under broader attack budgets ranging from 1% to 15%. As shown in Figure 7 (right), higher attack budgets lead to greater accuracy drops, demonstrating MemFreezing's scalability with increased attack costs.
Chen, J., Zhang, J., Chen, Z., Du, M., and Xuan, Q. Time- aware gradient attack on dynamic network link prediction. IEEE Transactions on Knowledge and Data Engineering, 35(2):2091-2102, 2021.
Chen, Y., Nadji, Y., Kountouras, A., Monrose, F., Perdisci, R., Antonakakis, M., and Vasiloglou, N. Practical attacks against graph- clustering. In Proceedings of the 2017 ACM SIGSAC conference on computer and commu- nications security, pp. 1125-1142, 2017.
6. Conclusion
In this work, we propose MemFreezing, a novel adversarial attack tailored for TGNNs, to overcome the challenges in attacking TGNN under srniieddknowledeee scenarios. The MemFreezing attack misleads model predictions by freezing node memories in TGNNs into stable and dysfunctional states. The experimental results show that our approach can produce long-lasting and contagious noises in dynamic graphs, leading to significant performance drops in TGNNs.
Chung, J., Gulcehre, C., Cho, K., and Bengio, Y. Empirical evaluation of gated recurrent neural networks on sequence modeling, arXiv preprint arXiv: 2014.
Hamilton, W., Ying, Z., and Leskovec, Inductive repre- sentation learning on large graphs. In Advances in neural information processing systems, pp. 1024-1034, 2017.
Acknowledgement
Jia, Y., Zou, D., Wang, H., and Jin, H. Enhancing node- level adversarial defenses by lipschitz regularization of graph neural networks. In Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pp. 951-963, 2023.
The authors would like to thank the anonymous ICML re- viewers for their constructive feedback and suggestions. This work is supported in part by the U.S. National Science Foundation grants #2154973, #2334628, and #2312157.
Kazemi, S. M., Goel, R., Jain, K., Kobyzev, I., Sethi, A., Forsyth, P., and Poupart, P. Representation learning for dynamic graphs: A survey. The Journal of Machine Learning Research, 21()):2648-2720, 2020.
Impact Statement
Temporal Graph Neural Networks (TGNNs) have emerged as the state-of-the-ar paradigm for modeling dynamic re- lational data in domains ranging from social networks to recommendation systems. As they become increasingly in- tegral to real-world systems, understanding and enhancing their robustness is essential. Our work introduces Mem- Freezing, the first adversarial attack that assumes only lim- ited future knowledge- constraint inherent to live envi- ronments-and shows how subtle memory-freezing pertur- bations can persistently degrade TGNN performance. By exposing this practical vulnerability, we underscore the ur- gent need for defenses specifically designed for the dynamic, streaming nature of real-world graph applications.
Kingma. D. P. and Ba, J. Adam: A method for stochastic optimization. arXiv preprint 141.6994 2014.
Kipf, T. N. and Welling, M. Semi-supervised classifica- tion with graph convolutional networks. arXiv preprint arXiv: I 1609.02907, 2016.
Kumar, S., Hamilton, W. L., Leskovec, J., and Jurafsky, D. Community interaction and conflict on the web. In Proceedings of the 2018 world wide web conference, pp. 933 003-943,711 2018
Kumar, S., Zhang, X., and Leskovec, J. Predicting dynamic embedding trajectory in temporal interaction networks. In Proceedings of the 25th ACM SIGKDD international conference on knowledge discovery & data mining, pp. 1269- 1278, 2019.
References
Ahmadi, A. H. K. Memory-based graph networks. Univer- sity of Toronto (Canada), 2020.
Bai, S., Kolter, J. Z., and Koltun, V. An empirical evalua- tion of generic convolutional and recurrent networks for sequence modeling. arXiv preprint arXiv: arXiv:1803.00 1803.01271,
Leblay, J. and Chekol, M. W. Deriving validity time in knowledge graph. In Companion Proceedings of the The Web Conference 2018 pp. 1771-1776, 2018.

---

MemFreezing: A Novel Adversarial Attack on Temporal Graph Neural Networks under Limited Future Knowledge
Lee, D., Lee, J., and Shin, K. Spear and shield: Adversarial attacks and defense methods for model-based link predic- tion on continuous-time dynamic graphs. In Proceedings of the AAAI Conference on Artificial Intelligence, vol- ume 38, pp. 13374-13382, 2024.
for dynamic graphs. In Proceedings of the AAAI confer- ence artificial intelligence, volume 34, pp- 5363-5370, 2020.
Rossi, E., Chamberlain, B., Frasca, F., Eynard, D., Monti, F., and Bronstein, M. Temporal graph networks for deep learning on dynamic graphs. arXiv preprint arXiv:2006. 2020.
Leskovec, J. and Sosič, R. Snap: A general-purpose network analysis and graph-mining library. ACM Transactions on Intelligent Systems and Technology (TIST), 8(1):1-20, 2016.
Sharma, K., Trivedi, R., Sridhar, R., and Kumar, S. Im- perceptible adversarial attacks on discrete dynamic graph models. In NeurIPS 2022 temporal graph learning workshop, 2022.
Leskovec, J., Kleinberg, J., and Faloutsos, C. Graphs over time: densification laws, shrinking diameters and possi- ble explanations. In Proceedings of the eleventh ACM SIGKDD international conference on Knowledge discov- ery in data mining, pp. 177-187, 2005.
Sharma, K., Trivedi, R., Sridhar, R., and Kumar, S. Tempo- ral dynamics-avee adversarial attacks on discrete-time dynamic graph models. Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pp. 2023-2035, 2023.
Leskovec, J., Huttenlocher, D., and Kleinberg, J. Predict- ing positive and negative links in online social networks. In Proceedings of the 19th international conference on World wide web, pp. 641-650, 2010.
Sun, L., Dou, Y., Yang, C., Zhang, K., Wang. J., Philip, S. Y., He, L., and Li, B. Adversarial attack and defense on graph data: A survey, IEEE Transactions on Knowledge and Data Engineering, 2022.
Li, K., Liu, Y., Ao, X., and He, Q. Revisiting graph adversar- ial attack and defense from a data distribution perspective. In The Eleventh International Conference on Learning Representations, 2022.
Tao, S., Cao, Q..
Shen, H.,, Huang, J., Wu, Y., and Cheng, Single node injection attack against graph neural networks. In Proceedings of the 30th ACM International Conference Information & Knowledge Management, pp. 1794-1803, 2021.
Liu, Y., Chen, X., Liu, C., and Song, D. Delving into transferable adversarial examples and black-box attacks. arXiv preprint arXiv: /61 1.02770, 2016.
Ma, J., Ding, S., and Mei, Q. Towards more practical adversarial attacks on graph neural networks. Advances in neural information processing systems, 33:4756-4766, 2020.
Trivedi, R., Farajtabar, M., Biswal, P., and Zha, H. Dyrep: Learning representations over dynamic graphs. Inter- national conference on learning representations, 2019.
Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv: 1706. 7766000083, 2017.
Veličković, P., Cucurull, G., Casanova, A., Romero, A., Lio, P., and Bengio, Y. Graph attention networks. arXiv 2017.
preprint
McPherson, M., Smith-Lovin, L., and Cook, J. M. Birds of feather: Homophily in social networks. Annual review of sociology, 27(1):415-444 2001.
Wang, X., Cheng, M., Eaton, J., Hsieh, C.-J., and Wu, F. At- tack graph convolutional networks by adding fake nodes. arXiv preprint /810 2018
Oliynyk, D., Mayer, R., and Rauber, A. I know what you trained last summer: A survey on stealing machine learn- ing models and defences. ACM Computing Surveys, 55 1145):1-41, 2023.
Wang, X., Lyu, D., Li, M., Xia, Y., Yang, Q., Wang, X., Wang, X., Cui, P., Yang, Y., Sun, B., et al. Apan: Asyn- chronous propagation attention network for real-time tem- poral graph embedding. In Proceedings of the 2021 in- ternational conference on management of data, pp. 2628- 2638, 2021.
Paranjape, A., Benson, A. R., and Leskovec, J. Motifs in temporal networks. In Proceedings of the tenth ACM international conference on web search and data mining, pp. 601-610, 2017.
Wang. Y. and Mendis, C. Tgopt: Redundancy- op- timizations for temporal graph attention networks. In Proceedings of the 28th ACM SIGPLAN Annual Sympo- sium on Principles and Practice of Parallel Progranming. pp. 354-368, 2023.
Pareja, A., Domeniconi, G., Chen, J., Ma, T., Suzumura, T., Kanezashi, H., Kaler, T., Schardl, T., and Leiserson,
C. Evolvegen: Evolving graph convolutional networks
10

---

MemFreezing: A Novel Adversarial Attack on Temporal Graph Neural Networks under Limited Future Knowledge
Wang, Y. and Mendis, C. Tglite: A lightweight program- ming framework for continuous-time temporal graph neu- ral networks. In Proceedings of the 29th ACM Interna- tional Conference on Architectural Support for Program- ming Languages and Operating Systems, Volume 2, pp- 1183-1199, 2024.
Zügner, D., Akbarnejad, A., and Günnemann, S. Adversarial attacks neural networks for graph data. In Proceed- ings of the 24th ACM SIGKDD international conference on knowledge discovery & data mining. pp. 2847-2856, 2018
Zügner, D., Borchert, O., Akbarnejad, A., and Günnemann, S. Adversarial attacks on graph neural networks: Pertur- bations and their patterns. ACM Transactions on Knowl- edge Discovery from Data (TKDD), 14(5):1-31, 2020.
Xu, K., Hu, W., Leskovec, J., and Jegelka, S. How powerful are graph neural networks? arXiv preprint arXiv:1810.00822 2018.
Yao, Y., Duan, J., Xu, K., Cai, Y., Sun, Z., and Zhang, Y. survey on large language model (IIm) security and pri- vacy: The good, the bad, and the ugly. High-Confidence Computing, pp. 100211, 2024.
You, J., Du, T., and Leskovec, Roland: graph learning framework for dynamic graphs. In Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pp. 2358-2366, 2022.
Zang, X., Xie, Y., Chen, J., and Yuan, B. Graph universal adversarial attacks: A few bad actors ruin graph learning models. arXiv preprint arXiv:2002.04784 2020.
Zhang, X. and Zitnik, M. Gnnguard: Defending graph neural networks against adversarial attacks. Advances in neural information processing systems, 33:9263-922 2020.
Zhang, Y., Xiong, Y., Liao, Y., Sun, Y., Jin, Y., Zheng, X., and Zhu, Y. Tiger: Temporal interaction graph embedding with restarts. arXiv preprint arXiv:2302.06003 2023.
Zhou, H., Zheng, D., Nisa, I. Ioannidis, V., Song, X., and Karypis, G. Tgl: A general framework for tem- poral gnn training on billion-scale graphs. arXiv preprint arXiv:2203. 14883, 2022.
Zhou, H., Zheng, D., Song, X., Karypis, G., and Prasanna, Distributed memory-based temporal graph neural network training. In Proceedings of the Inter- national Conference for High Performance Computing, Networking, Storage and Analysis, pp. 1-12, 2023.
V. Disttgl:
Zou, A., Wang, 7.,, Kolter, J. Z.,, and Fredrikson, M. Uni- versal and transferable adversarial attacks on aligned lan- guage models. arXiv preprint 2rXiv:2307.15044 2023,
Zou, X., Zheng, Q., Dong, Y., Guan, X., Kharlamov, E., Lu, J., and Tang, J. Tdgia: Effective injection attacks graph neural networks. In Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining, pp. 2461-2471,,0011
Zügner, D. and Günnemann, S. Adversarial attacks on graph neural networks via meta learning.< i> iclr</i>. In The Eighth International Conference on Learning Represen- tations, 2019.

---

MemFreezing: A Novel Adversarial Attack on Temporal Graph Neural Networks under Limited Future Knowledge
A. Extended Design
A.1. Self-freezing experimental setup and thcoretical analysis
We explored the viability of freezing a node by itself with a case study in TGN (Rossi ct al., 2020), where the (PT))) function is typically realized using a GRU (Chung et al., 2014). At particular timestamp, we randomly sample 100 nodes from the Wikipedia dataset and modify their memories. For each node, we use Adam optimizer (Kingma & Ba, 2014 4) to find a memory vector to suppress GRU updates by minimizing its reset gates (Chung al., 2014). We then assessed if this memory state remains consistent over time.
The TGN used by the experiment uses GRU for memory updating (i.e., for implementing UPDT(-) function in equation 3), as depicted in equation 9-12.
Tr o (W,,, byr + S1-1 + bar)
(9)
o oWia. + biz + W1 + bnz)
(10)
n tamh( (all(WWnn m4 + bin + 2 oW + bin)
(11)
8t = (1 - 2) o n4 + 2 O 8--1
(12)
where (.) the sigmoid function. Given the node memory 8t-1 E RM at the previous timestamp, and the aggregated message m E RD at time t, GRUs first compute reset gate T E R M update gate 24 E RM, and new gate n, E R-M
In this experiment, we aim to minimize the interference of the message, m,, and maintain the updated memory, St, close to the previous memory, 8t-1. To this scope, we can maximize all the features in the update gate, 2,, until it approaches 1, where the update gate will be directly used to control the portion of the previous memory, which is:
as 2 1, $1 - 0 ② n + 100 St-1 10-1=00 = St-1
(13)
Additionally, according to Equation 10, the update gate 2 is computed by the sum of two linear processes, and one is from the message, mi, and the other one is from memory s As we maximize the linear output of the memory, Whz 8t-1, the update gate, 2g is then maximized.
Hence, to analyze the maximum output of the linear process, Whz St-1, we formulate into a linear program problem with the equations:
max Σ Wh h= 8t-1
s.t. -1 <
(14)
Whe 8t-1 > 8
As the memory is the output of the tanh function rather than the unit-length vector, 8, is bounded by the limit of the tanh function, 1], Further, we introduce an addition constraint Wh: 8 > 8 to guarantee all dimensions of the linear output are bound by a constant, 5.
The optimal result for the memory, $7-1. for the linear problem only depends on the model weights, where given a TGN model, the solution of the self-freezing memory is unique, and we have conducted the experiment on three models TGN+WIKI, TGN+REDDIT, and a randomly initialized model.
The result in Figure 8-10 (a) shows the maximum update gate, =f, computed by ([W=.s(-)) In the TGN+wiki example, o is a 172-dimension vector, and it is distributed with mean of 0.64 and standard deviation of 0. As aforementioned, to achieve the self-freezing memory, the update gate, 21, is required to approach 1, but it is infeasible to fine the solution in the real world case under the constraints. In Figure 8-10 (b), we simulate the GRU updating starting with the optimal memory, 1 and monitor the cosine similarity between the memory before updated and after updated. The results further demonstrate even the optimal solution cannot accomplish the self-freezing goal.
To theoretically analyze the maximum of the in the general case, divide them into their eigen-repressentaiions, and the SVD decomposition:
Wh. = U. E. VT = Ee: e Up VV,, 8
Σ ai Vi ViEE
(15)
12

---

MemFreczing: A Novel Adversarial Attack on Temporal Graph Neural Networks under Limited Future Knowledge
In SVD decomposition, U and V the unitary matrix, and we the basis from V to decompose $t-1- Moreover, the linear process is written
Whx St-1 Ee a U. V Vi Σ es.
(16)
This linear process is represented by the linear combination on the basis of U. We can easily acquire the theoretical maximum of the output. As 8t-1 [-1, if Ve is a basis (-VM VM } 8t-1 = Sg can achieve the maximum
projection to this basis, which is, Og = v VM and 8 = Vg. Similarly, the linear output Whs 8t-1 achieves the maximum by there exist basis Ug- = { ( )M, and the linear output.
WB 88 - Eg
VM 1=
(17)
M
As is shown, the maximum output of the linear process is equal to the eigenvalue. According to the experiment, the largest eigenvalue of the weight matrix usually around 2. Therefore, the update gate, has the theoretical maximum value, (ca) = 0.88.
However, the weights, Whz, trained through the model update, which makes it impossible to find the ideal maximum in the practical case.
40
Cosine Similarity After
30
MESHERy Updatte
Counts
0.6
20
0.4
10
0.2
0.2
0.4
100
Distribution of the Otimmal Update Gate (z;)
Timestamp
(a)
(b)
Figure (a) The distribution the optimal update gate z7 (b) The cosine similarity between memory before update and after the update, starting with the optimal self- self-freezing memory si. Experiments are conducted in the TGN model with WIKI datasets.
30
Cosine Simillarity After
Manory Uppaate
0.8
Counts
10
0.2
Distribution of the Optmall Update Gate (z;)
90
100
T Timestamp
(a)
(b)
Figure (a) The distribution of the optimal update gate 27, (b) The cosine similarity between memory before the update and after the update, starting with the optimal self- sef--freezing memory s; Experiments are conducted in the TGN model with REDD IT datascts.
13

---

MemFreczing: A Novel Adversarial Attack on Temporal Graph Neural Networks under Limited Future Knowledge
Cosine Similarity After
Menery Uppdatee
0.8
30
20
0.4
0.2
50 Timestamp (b)
100
Distribution of the Optimal Update Gate (zz)
(a)
Figure 10. The distribution of the optimal update gate z (b) The cosine similarity between memory before the update and after the update, starting with the optimal self-freee leff-freezing memory si Experiments are conducted in the randomly sampled GRU model.
A.2. Theoretical analysis for memory under cross-freezing
In Appendix A.I, we show that the self-freezing will be hard to achieve as the update gate 2; is hard to achieve ones, 1. The update gate is computed by, 2, = iW + bız + Wh=St-1 + bnz), and in equation (14), we only consider the self-freeze term, St- 1. For the cross-freezing case, we introduce maximize the first two terms for the update gate, Wia + Wh=8t-1, and the objective function can be written
or more supporting nodes, and thus, can jointly
max ia (i @ Wh28
(18)
s.t. < 8 S
The message has four variable concatenated: my = [sscc &dst: e, 4], and the matrix product, M = Wis1 + Ws228dst + Wizse + Wzztt. this object function, we assume the cross-freeze state, the source and destination memory converge to a certain optimal, s*. Consider that there might be other non-supported nodes contributing to the message, mi, so we model this by coefficient vector, where e coefficient vector 1.
As the support node become the majority among the connected nodes, the
To simplify this problem, we rewrite the equation
(Win + (ize) 5) + Whes 8 + O(1) [E[c) Wa + Ele] Wiz2 + Wh:)s + O(1)
(19)
The above equation will be similar to Equation (14), as considering (E(e) Wiz + E[e] W + Whz) as a new matrix.
Let the weights in the GRU unit follows the Gassuian distribution, w (O, VM ). then the new matrix would follow,
/2 Hence, the optimal basis will then be, { 22 22
w' E N(0,
VM }M where its egienvalue can achieve
VM
/E + times larger than self-freeze one.
As result, the output update gate, 24, will scale accroding to E(c], and here the list of the outcome:
E(c] = 0.3, 2 = 0.919
E(c] 0.75, 2 0.94
(20)
E(e] = 0.96
Hence, it will become easier to freeze the memory by introducing the support nodes
A.3. Details of simulating fake future neighbors
To simulate the potential future neighbors of the victim nodes and enhance their capability contaminate those nodes, we randomly sample existing neighbors from victim nodes' and add Gaussian noise to their features. For the mean of the Gaussian noise, we use 0 as the mean for all nodes. We use 0.2 times the standard variation of the original neighbor's s memory for the standard variations of the Gaussian noise. In summary, for a node v, we follow Equation equation 21 to simulate a victim node's s neighbors,
$/ = NoO. ((((()))
(21)
14

---

MemFreczing: A Novel Adversarial Attack on Temporal Graph Neural Networks under Limited Future Knowledge
In which sf stands for the fake future neighbors and 8; stands for the memories from a sampled existing neighbor, N(w indicates the current neighbor set of node For the Gaussian noise (0 a((())), it has meant 0, 1) 0.2, and (s)()) as the standard variation of all features in existing neighbors.
We use the AT of the most recent clean message on the victim nodes for the timestamp of their appearances. For example, we attack node n, whose most recent message before our attack uses A at its updating, then the timestamp of the fake future neighbors will also AT,. also worth mentioning that, the AT has limited effects on the updating process. As proposed TGAT and used in TGN and other TGNN models, the AT encoded into time vector first as
R(AT) W cos (A)
in which W is a weight vector with 172 dimensions with descending magnitudes (for example, [1.00, 0.88, 0.78......I1 09, 9.99e 10)). Then, W is used update the memory. The value of W is very small except for the first few dimensions,
making them can hardly affect the updating process.
15

---

MemFreczing: A Novel Adversarial Attack on Temporal Graph Neural Networks under Limited Future Knowledge
A.4. Overall Algorithm
Algorithm MemFFrezzing Attack
Input :g (V)) Original graph with Node V, memories s(V)
Input :V VV..eV m $3: At) +- Messages hefore to
Input :B Number of attacked nodes (attack budget)
Input 4- Number of support neighbors for each rool node.
Input :V()), (V), (V) the full neighbors sets, supported neighbors, and augmented neighbors set
Output Va, e.a: Perturbed nodes and message.
1 Stage 1. Victim Node Sampling %/ 4- (g -1)
Vi V2 ;. ... n
<- lopk(degree(()),
for i E {1,2, 1,2,.... ... n do
V suppuri Vina
Vi, V N(Vrod))
(8a, .1, } + ComputeConveereesaate Support)
V VA. f Compurreeaveeerrrillllesssg $1, -., 3.g Vauppo))
** Stage 2. Solving Frozen State */
Function ComputeCoovvergeStteee
(V-uppor))
8 2.1. Solving the Ideal Frozen State */
for i V2 E Vsupport do
8; s(V))
m(8;, 8i, Bij. At) where VV Support
do
s/¹ m - m(s;, Si, Cij. At)
s, - (s,
while ||st - 8
$1.
89 <- si 82
+
2.2. Solving the Cross Frozen State #/ (0)
81 (0)
5q
st. 82 Sg ((0,n-a(s(V)))
for / E (0, 1,2, T do
ViE11.2.--991
(+) + -UPDT 88 .
for i E 10,1,2,.... .4) do
Cfreese x- EneNup (mmee (5 (t) .8%%
Lmse (1 .8k (1) (0, ((++))
prrap
EkeNin(() Lmse (UPDT(")" max))
8 (1+1) (1)+ a V., (C,(Crreee + pProp)
return {80
(T)
(T))
Stage 3. Solving the Adversarial Message */
Function ComputeAdve rsarial MMssaae (f6,, 81, ..)), Viuppnny
for V, E Vsupport do
ViA + V VIVE E N(V))
for t E {0, 1, ... T} do
(1)
m(ss, s(Va), (0) At)
LA - Luse (UPT( AGGR(M (0)
m.), 3i)
Ai f- - V CA
(t+1) (1)
At
return (VI.A) Ve.A...., "Vo.a" [EALSEAZ.... ". caAs.
16

---

MemFreezing: A Novel Adversarial Attack on Temporal Graph Neural Networks under Limited Future Knowledge
B. Extended Evaluation
B.1. Experimental Details.
Model Details. All four TGNNs we included maintain a memory vector in each node and follow the memory updating process as discussed in Section 2. And they are different in their node embedding procedure (i.e., equation 4). Specifically, Dyrep directly uses the node memories for the predictions (i.e., h = s)). JODIE applies time-decay coefficient the scale memories before classification (i.e., h 5(t) .(). TGN, on the other hand, refines memories using single-layer graph attention module, as outlined in equation 4. Unlike prior models, ROLAND (You et al., 2022) is recent model designed for DTDG graphs, yet it also maintains a history node feature for each node as memory. Specifically, it adopts a multi-layer memory mechanism by keeping memory for both memory and embedding stages. In other words, for the graph embedding part, it also adopts a GRU to combine nodes' previous embedding with the current embedding gathered from updated node memories. All the models update and embed memory for one time at each prediction (i.e., one layer aggregation in equation 3 and equation 4). The node memory dimension is set to 172, and the node embedding dimension is set to 100. Following the training steps in (Rossi et al., 2020), use Adam optimizer with learning rate 0.01 train the models 120 epochs.
Tasks Details. Models for node classification are trained to predict binary labels on each node. We use the commonly used Area under the ROC Curve (ROC-AUC) to measure the model performances. The models for edge prediction are self-supervise trained, using the edge information in future steps. During the testing, given a source node, they predict the possibility of whether another node will be its next incoming destination node and then decide which node will be its next neighbor. We use prediction accuracy for evaluating the edge prediction result.
Dataset Details. Reddit and Wikipedia are dynamic interaction graphs retrieved from online resources in (Rossi et al., 2020). In Wikipedia datasets, the nodes represent users and wiki pages, and the edges indicate editing from users to pages. In the Reddit dataset, the nodes represent users and subreddits, and an edge within it represents a poster from user posted on a subreddit. The edge features are represented by text features, and the node labels indicate whether a user is banned. All the abovementioned information is accompanied by timestamps. Align with their original designs (Kumar et al., 2019), and we set the newly input nodes' features as zero feature vectors. Reddit-body and Reddit-title are two larger-scale datasets that represent the directed connections between two subreddits (a subreddit is community on Reddit). The dataset is collected by SNAP using publicly available Reddit data of 2.5 years from Jan 2014 to April 2017 (Kumar et al., 2018). The statistics of the dataset used are shown in Table 2.
Table 2. Dataset details
# of Nodes
# of Edges
# Edge Feature
# of Node Feature
Wikipedia(WIKII Reddi(REDDDIT) Reddit Baddii-RRoyyBBEDDD--BOOYY
9,227
157,474
172
172
11,000
672,447
172
172
35,776
286,561
64
172
54,075
571.927
64
172
Platform details. We list then environment details in Table 3.
Table 3. Experimental Environment Sctting
Environment
Details
OS
Windows II
CPU Memory
Intel 99-1K
64GB DDR5 RAM
GPU
NVIDIA RTX 4090
Platform
PyTorch 2.2.
CUDA Version
CUDA 12.1
B.2. Baseline attack and attack setup
We adopt the following attacks toward static GNNs. Specifically, we adopt the attack at the same time as our attack time by attacking the existing dynamic graph as a static graph:
FakeNode (Wang et al., 2018) uses a greedy approach to generate edges of malicious nodes and their corresponding features
17

---

MemFreezing: A Novel Adversarial Attack on Temporal Graph Neural Networks under Limited Future Knowledge
to mislead the static GNN predictions. Note that this approach assumes that the added nodes/edges will be kept in the graph, so we keep the fake nodes and edges still after the attack timestamp. Differently, the attacking nodes in MemPrezzing removed after the attack.
TDGIA (Zou et al., 2021) is cutting-edge Graph Injection Attack tailored to compromise static GNNs. This method exploits the inherent vulnerabilities of GNNs and the unique topological characteristics of graphs. In our implementation for each target node, we adhere to the established methodology of TDGIA to identify the top 65% susceptible edges, utilizing their specialized scheme for selecting topologically defective edges. These edges are then optimized using gradient descent. Notably, the scale of modifications applied each target node in the TDGIA method substantially larger than our approach, involving adjustments 65% edges per node instead of just one edge per node. Furthermore, these modifications will be kept after the attack instead of being removed as our attack.
Loct_Attack Heuristic (Li et al., 2022) is a heuristic-based attack inspired by the meta attack (Zügner & Günnemann, 2019). This heuristic-basee based approach is an evolution of the original meta-attack, which relied on gradient- based edge selection. The updated heuristic version demonstrates greater versatility across a variety of GNN models and large-scale graphs, and it exhibits enhanced effectiveness compared to its predecessor. Notably, the meta-attack and its heuristic counterpart operate under the assumption that edges lack attributes. Consequently, in our application, we assign an all-zero feature to the fake edges inserted as part of the attack process.
For all attacks (including our attack), We select ranges of noisy messages (i.e., magnitudes of message features between -1 and I since 1 and I are the theoretical minimum and maximum values of the clean messages. The messages in TGNNs are usually memories of the nodes updated from previous timestamps, which have activation functions such as tanh/cosine functions right before the outputs. Therefore, all features of these messages (i.e., memories) should be within the range of -1 and 1 as the minimum and maximum values of the activation functions (i.e., tanh). Therefore, using- -1 and I produces messages that are exactly similar to those of the other features in the graph.
All adversarial messages/nodes in the baselines and our attacks use the AT of the most recent clean message on the victim nodes. For example, if we attack node n, whose most recent message before our attack uses AT₁ at its updating. then the timestamp of the fake messages added to this node will be AT& as well. It is also worth mentioning that the delta T has limited effects on the updating process, as we discussed in Appendix A.3.
For all attacks, we define the attack budget as the ratio of nodes that are affected. To ensure a fair comparison, all attacks target the same of victim nodes (the highest-degree ones). We would also like to mention that, although targeting these high-degree nodes, all benchmarked attacks, including MemFreezing, either inject one-degree nodes or edges into the graph and affect the same number of victim nodes at the time of the attack.
Specifically, MemFreezing targets high-degree nodes by introducing a temporary fake node for each target and creating an event (i.e., an edge) between the fake node and the target. In this way, MemFreezing, like FakeNode, injects nodes with a degree of one into the graph. However, unlike FakeNode, which retains the injected fake nodes and can potentially cause stronger adversarial effects, MemFreezing removes these fake nodes after the attack, minimizing structural changes while inducing long-lasting adversarial effects. Therefore, given graph with V nodes and E edges and targeting N 5%V victim nodes (i.e., 5% budget), MemFreezing adds N fake edges. Since nodes typically have degree greater than one, K = K=5%F > 5%V = N, the edge changes are less than 5% edges.
B.3. Baseline defenses setup
We adopt the following defensive strategies for the vanilla TGNN models:
Adversarial Training: In line with the approach detailed in (Madry et al., 2017), we introduce perturbations to the node memories in TGNN models during the training. We then employ minimax adversarial training scheme to enhance the robustness of the TGNN model against these perturbations.
Regularization under empirical Lipschitz bound: empirical Lipschitz bound during the TGNN training process, where the empirical Lipschitz bound, L, is computed by:
Following the methodology in (Jia et al., 2023), we minimize the
[I + A) f(x)
L sup
(22)
A
This regularization aims to bound the effectiveness of small perturbations, such as adversarial examples.
18

---

MemFreezing: A Novel Adversarial Attack on Temporal Graph Neural Networks under Limited Future Knowledge
Following the insights that only the similar node may provide significant information for prediction, GNN- Guard(Zhang & Zitmik, 2020) adopts cosine-similarity-aaae approach to discount the messages passing between dissimilar nodes.
GNNGurad:
Notably, most robust GCN models, such as RobustGCN, SGCN, GraphSAGE, and TAGCN mentioned in (Zou et al., 2021), )), are primarily tailored for static graph benchmarks. Given their design constraints, these models are unsuited for TGNN setup with dynamic graph benchmarks and do not offer a viable defense for the TGNN models targeted by our attack.
19

---

MemFreczing: A Novel Adversarial Attack on Temporal Graph Neural Networks under Limited Future Knowledge
B.4. Extra Main Results
Here we report edge prediction accuracies on REDDIT -ITTE in Table 4, and node classification AUCs WIKI in Table 5. The results indicate that: (1) The static attacks cannot last long and affect future nods. (2) Our approach can be more and more effective after the attack time.
B.4.1. EDGE PREDICTION RESULTS (5% ATTACK BUDGET)
Here, we report edge prediction accuracies on REDDIT SEDDIT-TITLE in Table 4. The results indicate that: (1) The static attacks cannot last long and affect future nods. (2) Our approach can be more and more effective after the attack time.
Table Accumulated accuracy edge prediction in vanilla/attacked TGNNs over different timestamps on REDD T-TITLE, lower matrices indicate more effective attacks.
Dataset
REDDIT-TITLE
Model
TGN
JODIE
Dyrep
ROLAND
Vanilla
0.93
0.92
0.91
0.91
FN
0.76
0.82
0.77
0.79
Meta_h
0.86
0.83
0.88
0.85
to
TDGIA
0.72
0.81
0.74
0.76
ours
0.84
0.85
0.81
0.78
0.9
0.86
0.89
0.88
Meta
0.89
0.86
0.9
0.87
125
TDGIA
0.89
0.85
0.89
0.88
0.81
0.84
0.76
0.80
FN
0.9
0.86
0.9
0.88
Meta
0.9
0.86
0.9
0.88
150
TDGIA
0.89
0.86
0.9
0.87
ours
0.77
0.82
0.76
0.77
B.4.2. NODE CLASSIFICATION RESULTS (5% ATTACK BUDGET)
Here, report node classification AUCs WIKI in Table 5. The results similar to the edge predictions: Static attacks are good at the first attack time but cannot last long and affect future nods. In contrast, MemFrezzing can be more and more effective after the attack time.
Table 5. The AUC of vanilla/attacked TGNNs on the node classification task; lower matrices indicate more effective attacks.
Dataset Model
WIKI JODIE
TGN
Dyrep
ROLAND
Vanilla
0.90
0.88
0.89
0.90
FN
0.77
0.87
0.75
0.78
Meta
0.86
0.83
0.86
0.85
t0
TDGIA
0.73
0.82
0.76
0.75
ours
0.82
0.88
0.84
0.80
FN
0.90
0.88
0.88
0.88
Meta
0.89
0.87
0.88
0.89
(25
TDGIA
0.88
0.87
0.88
0.89
0.82
0.85
0.81
0.79
FN
0.90
0.88
0.88
0.90
Meta
0.90
0.89
0.90
0.90
c50
TDGIA
0.90
0.88
0.88
0.90
ours
0.80
0.85
0.77
0.77
20

---

MemFreezing: A Novel Adversarial Attack on Temporal Graph Neural Networks under Limited Future Knowledge
B.4.3. RESULTS WITH DIFFERENT BUDGET( % ATTACK BUDGET)
To more comprchensively show the impact of the attack budget, include detailed results of baselines' and our attacks' effectiveness under the attack budget 1%. As shown in Table 6, Table 7, and Table 8, our approach outperform baselines well, despite fewer nodes being attacked.
Table Accumulated accuracy of edge prediction in the vamilla/attacked TGNNs over diffcrent timestamps on WIKI and REDD IT; The attack budget 1% attacks; lower matrices indicate more effective attacks.
Dataset
WIKI
REDDIT
Model
TGN
JODIE
Dyrep
ROLAND
TGN
JODIE
Dyrep
ROLAND
Vanilla
0.93
0.87
0.86
0.94
0.97
0.98
0.96
0.95
FN
0.89
0.83
0.82
0.85
0.93
0.93
0.92
0.85
Meta
0.92
0.85
0.83
0.89
0.95
0.96
0.94
0.93
to
TDGIA
0.83
0.81
0.77
0.83
0.89
0.88
0.88
ours
0.82
0.84
0.9
0.93
0.94
0.94
0.86
FN
0.92
0.87
0.85
0.94
0.97
0.97
0.96
0.95
Meta
0.93
0.86
0.85
0.93
0.95
0.98
0.95
0.94
l25
TDGIA
0.91
0.84
0.83
0.93
0.94
0.96
0.96
0.92
ours
0.8
0.82
0.82
0.88
0.81
0.84
0.91
0.84
FN
0.94
0.87
0.86
0,94
0.97
0.97
0.96
0.95
Meta
0.94
0.87
0.86
0.93
0.96
0.98
0.95
0.95
tso
TDGIA
0.94
0.87
0.85
0.93
0.96
0.97
0.95
0.93
ours
0.85
0.81
0.80
0.86
0.83
0.84
0.91
0.83
Table Accumulated accuracy of edge prediction in the vanilla/attacked TGNNs over different timestamps on REDDIT-BODY and REDDIT-TITLE The attack budget is 1% for all attacks; lower matrices indicate effective attacks.
Dataset
REDDIT -BDDY
REDDIT REDDIT-TITLE
Model
TGN
JODIE
Dyrep
ROLAND
TGN
JODIE
Dyrep
ROLAND
Vanilla
0.9
0.87
0.9
0.88
0.93
0.92
0.91
0.91
FN
0.85
0.85
0.81
0.83
0.88
0.88
0.85
0.83
Meta
0.87
0.85
0.87
0.86
0.92
0.89
0.89
0.9
lo
TDGLA
0.81
0.83
0.79
0.78
0.85
0.87
0.85
0.83
ours
0.87
0.85
0.85
0.82
0.88
0.9
0.86
0.85
FN
0.9
0.84
0.89
0.88
0.92
0.92
0.9
0.91
Meta
0.9
0.87
0.9
0.88
0.93
0.93
0.91
0.91
t25
TDGIA
0.88
0.86
0.9
0.87
0.92
0.92
0.9
0.91
ours
0.84
0.86
0.8
0.82
0.85
0.88
0.81
0.86
FN
0.9
0.87
0.9
0.88
0.93
0.92
0.9
0.91
Meta
0.9
0.88
0.9
0.88
0.93
0.93
0.9
0.91
1s0
TDGIA
0.89
0.87
0.9
0.87
0.93
0.91
0.9
0,9
ours
0.79
0.85
0.77
0.83
0.8
0.83
0.82
0.83
21

---

MemFreczing: A Novel Adversarial Attack on Temporal Graph Neural Networks under Limited Future Knowledge
Table The AUC of vanilla/attacked TGNNs the node classification task under 1% node attacked budget; lower matrices indicate
more effectivv attacks.
Dataset
WIKI
Model
TGN
JODIE
Dyrep
ROLAND
Vanilla
0.9
0.88
0.89
0.9
FN
0.83
0.88
0.83
0.83
Meta
0.87
0.85
0.88
0.88
to
TDGIA
0.81
0.85
0.83
0.8
0.86
0.88
0.86
0.85
FN
0.89
0.88
0.89
0.9
Meta
0.9
0.88
0.88
0.89
12
TDGIA
0.9
0.87
0.89
0.89
ours
0.82
0.85
0.81
0.81
FN
0.9
0.87
0.89
0,9
Meta
0.9
0.88
0.89
0.9
150
TDGIA
0.9
0.87
0.89
0.89
ours
0.82
0.88
0.79
0.82
B.4.4. RESULTS WITH LARGE-SCALE DATASET
To measure our approach a larger dataset, we select the largest temporal graph dataset on the SNAP dataset collec- tion(Leskovec & Sosië, 2016) represents Wikipedia users editing each other's Talk page. A directed edge (u, v, l) means user edited v's talk page at time t. The graph has 1,140,149 nodes and 7,833,140 collected over 2320 days.
(Paranjape et al., 2017) for further analysis. This dataset
The dataset has non con-attributed edges, so we set them as all zero vectors. Note that we set the memory size to instead of 172 to avoid the Out-Of-Memory issue. Due to the time limit, we train TGN and Roland for ten epochs instead of 20 in our prior experimental settings. The results are shown in Table As we can observe, even for very large graph with 1% node budget, our attack shows similar behavior as prior results -Our attack long-lasting and can affect more nodes' predictions in the future.
Table 9. Accumulated accuracy of edge prediction in the vanilla/attacked TGNNs over different timestamps on Wiki-Tall Tiiki-Taak-Tempozraa Tempprall
Dataset
Makiitalk Taenk--ammrrall
Attack Budget
5%
Model
TGN
ROLAND
TGN
ROLAND
Vanilla
0.97
0.98
0.97
0.98
FN
0.89
0.90
0.83
0.88
to
ours
0.94
0.91
0.86
0.88
FN
0.98
0.97
0.97
0.96
l25
ours
0.92
0.90
0.82
0.89
FN
0.97
0.98
0.97
0.97
150
ours
0.91
0.91
0.84
0.86
22

---

MemFreczing: A Novel Adversarial Attack on Temporal Graph Neural Networks under Limited Future Knowledge
B.5. Extra results attacks under defenses
We include the results of attacks, i.e., FakeNode and MemFrezzing, under the two defenses, i.e., adv_ and Lip reg. two TGNN models, i.e., JODIE and Dyrep. The observations similar to the prior analysis.
Accumnlated
0.9
Accurallated
0.9
Acnurac
0.8
Vanilla
Vantlla
0.7
YakeNode (1%)
0.7
FakeNade (3%
FakeNade
0.6
Menlireenng (1S)
0.6
Manaraadi (1%)
Frezing (7%)
0.5
5
10
15
20
Timestamp
Timestamp
Figure Accumulated accuracies of DyRep under _dv_tr (rt__trai(((f)), and _ui__regriii with FakeNode and our attack on WIKI.
0.9
Acommlattdd
Mccumnlatted
Acauray
0.8
00.8
0.7
Vanilla
PakeNode (1%)
1.7
FakeNode (%%
FakeNode (1%)
(2%)
Memmireedo
0.6
MennFreeang (1%)
0.6
Preeing (5)
MansFrecing
0.5
0.5
5
10
15
20
Timestamp
25
35
40
45
50
Timestamp
Figure 12. Accumulated accuracies of JODIE under Adv train(lefl). and Lip_ (eg(rgh)))))))) with FakeNode and our attack on WIKI.
To give a more in-depth evaluation, we design a defending method by leveraging the data-filtering concept GNN- Guard(Zhang Zitnik, 2020) for the evasion attack. Specificallly, following the insights that only the similar node may provide significant information for prediction, GNNGuard adopts desine-similarity-bale sages passing between dissimilar nodes. So. also the cosine similarities to rank and filter the messages. Specifically, similar to the GNNGuard, we compute the similarities between two nodes. For each node, we normalize the similarities between it and its neighbors, then prune the lower 50% (same as GNNGuard). We show the experiment results in Table 10.
approach to discount the mes-
Table 10. Attack Performance under the GNNGurad.
Attack Budget
5%
Dataset
WIKI
REDDIT TGN
WIKI
REDDIT
Model
TGN
ROLAND
ROLAND
TGN
ROLAND
TGN
ROLAND
Vanilla
0.93
0.94
0.96
0.95
0.93
0.94
0.96
0.95
After defense Acc.
0,92
0.91
0.94
0.90
0.92
0.91
0.94
0.90
FN
0.87
0.81
0.9
0.84
0.82
0.86
0.82
0.81
to
ours
0.87
0.88
0.91
0.88
0.85
0.83
0.8
0.82
FN
0.9
0.91
0.93
0.9
0.91
0.91
0.92
0.9
125
ours
0.84
0.87
0.82
0.81
0.79
0.81
0.81
0.8
FN
0.92
0.91
0.94
0.92
0.91
0.93
0.9
100
ours
0.83
0.85
0.81
0.81
0.76
0.82
0.8
0.83
23

---

MemFreczing: A Novel Adversarial Attack on Temporal Graph Neural Networks under Limited Future Knowledge
B.6. Extra results with gradually injected attacks
MemFreezing can be effective in both one-time and multiple-time attacks. We show the results of multiple-time attacks, in which attacks injected right before to: Es t1o, E15 with 1% attack budget (i.e., 1 % of all nodes) each time. The results shown in Table 13.
FaleNNode
0.94
FakeNode
IDGIA
IDGLA
0.92
Accumulated Accuracy
Ours
Accumulated Accuracy
0.92
0.9
0.88
0.86
0.86
0.84
10
20
Timestamp
Timestamp
Figure 13.
The accumulated accuracy under gradually injected attack to TGN on WIKI(left) and REDDIT(right). The attacks are injected right before to, to, tzo. fis with 1% attack budget (i.e., 1% of all nodes) each time.
As one observe, with multiple attack times, MemFreezing effectively decreases accuracies, while the FakeNode and TDGIA attacks have shorter effective periods and fail to achieve similar accuracy drops. This is because the attack introduced by these baseline attacks will be weakened once there are changes between the graph at the attack and the prediction timestamp, and even multiple-time attacks cannot ensure that the attacks are just injected right before each prediction; in contrast, the noises from our attack can last over graph changes and even be boosted by future attacks.
Multi-Time One-Time
Cosine Similarity
0.95
Cosine Similarity
0.95
0.9
0.9
0.85
0.85
Multi-Time
One-Time
0.8
0.8
5
10
15
Timestamp
Timestamp
Figure 14. The similarities between victim nodes' initial noisy memories (at the time of the attack) and themselves' /their subsequent neighbors' memories MemFreezing under one-time attack setup multiple-times attack setup.
To evaluate the effectiveness of cross-freezing under multiple-time attack cases, we investigate the similarities between victim nodes' initial noisy memories (at the time of the attack) and themselves' /their subsequent neighbors' memories in MemFreezing under one-time attack setup and multiple-time attack setup (following the setup Figure in our paper). As shown in Figure 14, despite multiple times of injections, MemFreezing significantly raises the similarities between nodes' memories. The results demonstrate that the freezing mechanism works effectively under multiple time attacks.
24

---

MemFreczing: A Novel Adversarial Attack on Temporal Graph Neural Networks under Limited Future Knowledge
B.7. Extra results on injecting attacks at different time stamps
To examine if MemFreezing can be effective despite the time injection. We its effectiveness under different injection timestamps instead of tn. then evaluate its performance in the subsequent 50 timestamps. For instance, may inject it at 1o and then evaluate the accumulated accuracies in the original TGNN models and those under attack tso. The results of TGN on WIKI and REDDIT are shown in Figure 15. As one can observe, the attack effects remain similar despite its injecting time, demonstrating that MemFreezing can yield long-lasting and contagious attack at arbitrary attack time.
0.96
0.98
0.80
0.00
0,98
Accumulated Accuracy
0.95
0.04
0.04
0.94
0.94
0.94
0.54
0.94
Accumulated Accuracy
0.95
Vanilla
0.9
Vanilla Mem MemFreezing (%%
0.9
MemF Frezzing (1 %)
0:87
Feezing
0.85
MemFreezing (5%)
0.85
0.82
0.54
0.83
0.44
0.80
0.79
0.80
0.00
0.80
0.78
0.80
0.78
0.81
0.78
0.75
0.75
0.78
0.76
0.75
0.75
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.8
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.8
Injected Time
Injected Time
Figure 15. Accumulated accuracy under attack at various timestamps on TGN for WIKI (left) and REDD IT (right). Attacks are injected 10%, 20%, 30%, 40%, 50%, 60%, 70%, and 80% test set.
B.8. Extra ablation study
We include the results for the ablation studies under the TGN model and REDDIT dataset in Figure 16. The results show similar pattern as we observed in Section 5.
Codne Stmilarity betwenn
L.Hup Neigilor Netethor
Cositz Siinbarity Letween
Hep Naghhor 2-1 Nagthon
Cosire Sirribuurity betwees
Hopp S.stpp Neighter
0.8
0.31
Menray
Merrory
Nade Node Mexryy
0.6
0.6
0.6
0.4
0.4
0.2
0.2
-0.2
Timestamp
Timestamp
Timestamp
Figure 16. The similarities between victim nodes' initial noisy memories (at the time of the attack) and themselves' /thiir subsequent neighbors' memories in MemFreezing w/o (left) converge state, MemFreezing w/o freezing loss (middle), and regular nodes (right). All results are from the TGN model and REDDI" dataset.
25

---

MemFreezing: A Novel Adversarial Attack on Temporal Graph Neural Networks under Limited Future Knowledge
B.9. Analysis freezing objective
To demonstrate the challenge of maximizing prediction losses, we add an extra term, Cude maximize the loss of predictions. Specifically, for each node change Equation 7 in paper as follows,
Lu
Cfrenze Li
+ Corop Ludv
We use a coefficient y to control the ratio of adversarial losses. The adversarial loss Ladu is defined as follows,
Ladv E(mn,)iiEN
In which yi presents the prediction result for the node i, t, is the ground truth of the prediction, and E(y,, 44) indicates the dinary-cross-entron loss between them. Similar to baselines, for each node u, the objection function is to maximize the prediction loss of all its neighbors. We present the prediction accuracies under different selections in Figure 17.
0.90
0.88
0.86
0.88
0.84
0.86
0.82
0.84
0.80
0.82
0.78
0.80
0.76
0.78
0.74
0.76
0.72
0.74
0.70
3
12
5
9 11 1511411711111111 Timestamp
Timestamp
y=0 0=0.1 V=0.25
y=
V=1.
V=0.
Figure 17. The accumulated accuracy with maximizing prediction losses under different selections TGN in WIKI(left) and REDDIT(right).
As shown in the figure, maximizing the adversarial losses can harm the predictions in the first batch (if and only if the predictions made immediately after the attack). In the later batches, the effectiveness of the noise decreases drastically.
To further understand the reasons behind this, we investigate the similarities between victim nodes' initial noisy memories (at the time of the attack) and their memories in the future-termed as Persist Similarity-in Figure 18, the similarities between victim nodes' memories and their neighbors' cannorics-callee Propagate Similarity in Figure 19.
1.00
1.00
Persist Similarity
Persist Similaritt
0.80
0.80
0.60
0.60
0.40
0.40
0.20
0.20
0.00
0.00
1
2
6
10
14
5
9
13
Timestami
Timestamp
0=
0=1
v=025
V= 0=0.1
0=0.25
Figure The similarities between victim nodes' initial noisy memories (at the time attack) their memories the future. The results collected from TGN WIXI(left) and REDDIT(right).
As one can observe, while introducing the adversarial losses, both persist and propagate similarities drop significantly, indicating that the nodes' memories cannot maintain the noisy states and may recover soon.
26

---

MemFreczing: A Novel Adversarial Attack on Temporal Graph Neural Networks under Limited Future Knowledge
Propagate Similarity
1.00
0.90
0.80
0.80
0.70
0.60
0.60
0.40
0.50
0.40
0.20
0.30
0.00
0.20
1
2
5
6 7 9 10
11
12 13 14
1
4
5
9 Timestamp
8
10
11
12
13 14
Timestamp
Y=
V=0.1 V=
V= V=0.25
Figure The similarities between victim nodes' memories and their future neighbors' memories. The results are collected from TGN on WIXI(left) and REDDIT(right).
B.10. Stealthness analysis
As discussed in Appendix B.2, we select ranges noisy messages between -1 and since -1 and I are the theoretical minimum and maximum values of the clean messages. To further investigate the MemFreezing attack introduces enough stealth fake events/nodes, we further investigate message) and message-wise standard deviation (i.e., the standard deviation of all features over each message) for clean and noisy messages produced by different attacks in Table 11.
range of message-wise means (i.e., means of all features over each
Table Ranges of message-win wise mean and standard deviation over all the clean messages (Clean) and noisy messages produced by MemFreezing in WIKI and REDDIT.
WIKI
REDDIT
Mean[min,maxx
Std[min,max]
Mean[min,max
Std[min,max]
Clean
[-0.033, 0.106]
[0.206, 0.866]
[-0.093, 0. 146]
[0.202, 0.789]
MemFreezing
[-0.014, 0.044]
[0.426, 0.570]
[-0.012, 0.038]
[0.580, 0.695]
FakeNode
[0.003, 0.008
[0.628, 0.702]
[-0.030, 0.018]
[0.525, 0.686]
The range of mean and std of our noisy messages included within the range of those in the clean message and are similar to the baseline attack, demonstrating that their distributions or magnitudes are similar to the other features in the graph. Moreover, MemFreezing can effectively penetrate the defenses of GNNGuard, which uses similarity to filter susceptible messages in which the nodes/events with apparently different information (i.e., having low similarities compared to other nodes/cvents), as shown in Appendix B.5. In summary, the results indicate that MemFreczing can freeze node memories in TGNN without introducing significant different nodes/events that can be detected by existing GNN adversarial defenses.
B.11. Extra sensitivity study
We include more results for different target node sampling strategics and attack budgets in Figure 20. The results show a similar pattern as we observed Section
27

---

MemFreczing: A Novel Adversarial Attack on Temporal Graph Neural Networks under Limited Future Knowledge
Affected Node Count
700
of Affected Node (llihhett Degree) of Affected Node (Lowest Degree) After Als. Acc. (ilighest Degree)
0.95
Accumulated Accuracy
Accumulatoon Accuracy
0.55
600
125
500
Afber Als. Acc. (1 (Lamat Degres)
0.9
200
100
0
0.88
10
15
25 Timestamp
20
30
35
40
45
50
Attack Budget (%)
Figure 20. (left) Comparison between two strategies for selecting the injected node: lowest degree and highest degree nodes. Count of affected nodes and overall accuracy over time. (RIGHT) The accumulated accuracy at la, l2s, and under different attack budgets (% of total nodes). All results above are from TGN and REDDIT
28

---

MemFreezing: A Novel Adversarial Attack on Temporal Graph Neural Networks under Limited Future Knowledge
B.12. Accumulated Accuracies Over Time Diverse Models
We report the accumulated accuracies over time collected from TGN, JODIE, and Dyrep on the WIKI and REDDIT datasets. The results include model accuracies under the vanilla (i.e., un-attacked), baseline (i.e., FakeNode), and our (i.e., MemFrezzing) attacks in edge prediction tasks.
Acrimalatedd
0.9
Acrummalatet
0.9
Acturac
Accuracy
Vanilla
Vanilla
0.7
FakeNode (1%
0.7
Falehidde
(8%)
FakeNode (3%
0.6
MemFrooing (1%)
0.6
MamFrooiin (1%
ManFrosiing (3%
Meml'rentng
0.5
0.5
5
10
15
20
25
30
35
40
45
50
5
10
15
20
25
30
35
40
45
50
Figure 21. Accumulated accuracies of TGN under different attacks in link prediction tasks over time in WIKI (left) and REDDI IT (right) datascts.
Accumn lated
0.9
Mccurndllleed
0.9
Accuracy
0.8
0.8
0.7
Vanilla
0.7
Vanilla
(1S)
TakaNode (5%)
FakeNode (P%)
MemFreecing
0.6
reeeing (1%)
ManFreeing (5%)
MenFreeoing (5%
0.5
10
15
25
30
35
40
45
50
15
20
30
35
50
Timestamp
Timestamp
Figure 22, Accumulated accuracies of JODIE under different attacks link predictions over time with WIKI I (left) and REDDIT (right) datasets.
Accumulltedd
0.9
Accmnultted
0.9
Acrurac
0.8
Vanilla
PakeNode (1%)
PaluNode (2%
PakeNode (5%)
(7%)
0.6
MenFrewing (1%)
reeadoe (1%
Frening (5%)
MonFreecing
0.5
20
25
45
25 Timestamp
Timestamp
Figure 23. Accumulated accuracies of Dyrep under different attacks in link predictions over time with W K (left) and REDD I (right) datascts.
29

---

Timestamp MemFreczing: A Novel Adversarial Attack on Temporal Graph Neural Networks under Limited Future Knowledge
1.13. Affected Nodes
We report the number and accumulated accuracies over time of affected nodes over time in JODIE and Dyrep on the WIKI and REDDIT datasets. The results include model accuracies under our (i.e., MemFrezzing) attack in edge prediction tasks.
Affected Norle Couill
1000
0.8
Affected Node Count
0.8
Accura slated Accuracy
Acc. of Affected N)de(5%)
Acc. of Aflected Node(5%)
800
Acc. of Affected Node(1%)
of Affected Node((1%) %%)
11000
Affected Node(1 %%) of Affected Node(5%)
0.6
600
of Affected Node(5%)
400
500
0.2
200
40
Timestamp
Figure 24. Count of affected nodes (presented the colored areas) and their accumulated accuracies (presented as lines) in WIKI (left) and REDDIT (right) over time. The data are collected TGN.
Affected Node Count
0.8
Affected Node Count
0.8
ACUIT Rotted Accuray couraay
800
Acc. of Affecied Node(5%)
Acc. of Affected Node(5%)
# of Affected Node(1%% %6)
Affected Node(1%
0.6
Roe pagerrreee
1000
of Affected Node(1% (6)
Affected Node(1%)
0.6
600
Affected Node(5%)
Affected Node(5%)
0.4
0.4
400
500
0.2
200
10
15
20
25
30
35
40
45
50
10 15
20
25 Timestamp
30
35
40
45
50
T Tim T'imestamp
Figure 25. Count of affected nodes (presented as the colored areas) and their accumulated accuracies (presented as lines) in WIKI (left) and REDDIT (right) time. The data collected JODIE.
Affected.Ne Node Count
800
Affected Nadl Count
Node(5%)
Acc. Affected Node(5%)
Acc. of Affected Node(1%)
Acc. Affected Node(1% (1))
600
of Affected Node(1%) %)
0.6
1.000
Affected Node(1%)
0.6
of Affected Node(5%)
of Affected Node(5%)
400
0.4
0.4
500
200
0.2
20
10
45
50
Timestamp
T Timestamp
Figure 26. Count of affected nodes (presented the colored areas) and their accumulated accuracies (presented lines) in MIKI (left) and REDDIT IT (right) over time. The data are collected Dyrep.
30

---

MemFreczing: A Novel Adversarial Attack on Temporal Graph Neural Networks under Limited Future Knowledge
B.14. Noise Propagating
We report the cosine similarities between the initial victim node and its neighbors over time in JODIE and Dyrep on the WIKI and REDDIT datasets. The results include similarities under our (i.e., MemFrezzing) attack in edge prediction tasks.
Cosine Similarity betwaen
Cosine Simriarrtt between
0.8
0.8
Nade Memry
Node Menayy
0.4
Root Node
0.40
Root Node
I-Hfop Neighbor
[-Hop Neighbor
Neighbor
2-Hop Neiphbor
10
12
14
4
10
12
14
Timestamp
Timestamp
Figure 27. The similarities between victim nodes' initial noisy memories (at the time of the attack) and themselves /their subsequent neighbors' memories WIKI (Ieft) and REDD IT (right) over time. The data are collected in TGN.
Cosine Similarity betwen
Cosine Simikarit between
0.8
0.8
Node Menory
Node Menra
0.6
0.6
0.4
Root Node
0.4
H-Hop Neighhor
Root Node
0.2
2.Hop Neighhor
0.2
2-Hop Neighbor
L-Hlop Neighhor
2
8
10
12
14
Timestamp
Timestamp
Figure 28. The cosine similarities between victim nodes' initial memory (at the time the attack) and themselves/their subsequent neighbors' memories in W K (left) and REDD IT (right) over time. The data are collected in JODIE.
Cosine Similarity botween
Cosine Similarity between
0.8
0.8
Node Mennay
NodeeMMrn Menary
0.6
0.6
0.4
Root Node
Nodee
0.4
Hop Neighbor
Roat Node
0.2
Hop Neighbor
0.22
I-Hop Neighbor
Hop Neighbor
10
14
Timestamp
Timestamp
Figure 29, The cosine similarities between vietim nodes' initial memory (at the time of the attack) and themselves/their subsequent neighbors' memories in WIKI (left) and REDDIT (right) over time. The data are collected in Dyrep.
31

---

MemFreczing: A Novel Adversarial Attack on Temporal Graph Neural Networks under Limited Future Knowledge
B.15. Evaluation Attacks in Black-Box Setting
In the black-box setting, attackers do not have access to the target model's parameters. To this end, evaluate black-box adversarial attacks using two commonly used setups: (i) surrogate models and (ii) zero-shot attacks.
B.15.1. SURROGATE MODES
A common approach in the adversarial attack domain is to train a surrogate model locally and use it to generate adversarial examples that can transfer to the target model. For temporal graph datasets, many popular benchmarks such as Wiki and Reddit are open-source, providing well-labeled, diverse data annotated with detailed timestamp information. Hence, We first evaluate Memfreezing under the following setup: (1) We first train surrogate models on randomly sampled subsets (60% or 80%) of the original training data. (2) Then, we use these models generate adversarial examples. (3) Lastly, we inject the generated adversarial examples into the dynamic graphs and evaluate the prediction accuracies in the target model trained on the complete (100%) dataset.
0.98
Similarity
Similarity
0.96
0.96
0.94
Surragate (NP%))
Surragate Model (80%))
Surrugate Model (80%)
Surragate Model (89%)
0.92
0.92
0.9
0.9
4
10
14
16
20
16
Training Epoch
Training Epoch
Figure 30. Cosine similarity of model parameters between surrogate model (80% and 60% training dataset) target model. (left) evaluated from TGN model using WIKI dataset; (right) are evaluated from TGN model using Reddit it dataset.
Cosine Similarity
0.8
Cosine Similarity
0.8
0.6
0.6
0.4
0.4
0.2
-
Ront Node
I-Hop Neighbor
0.2
Root Node
H-Hop Neighbor
2-Hop Neighbor
H-H Neighbor
0-
14
4
8
10
12
14
Timestamp
Timestamp
Root Node
Node
Cosine Similarity
0.8
2-Hop Neighbbr
I-Hop Neighbor
Cosine Similarity
0.8
2-Hop Neighbor
I-Hop Neighbor
0.6
0.6
0.4
0.4
0.2
0.2
0
10
12
14
Timestamp
Timestamp
Figure The similarities between victim nodes' initial noisy memories (at the time of the attack) and themselves' /thiir subsequent neighbors' memories. The noisy patterns computed from the surrogate model. (Top-left) the surrogate model is trained with 80% dataset WIKI; (Top-right) the surrogate model is trained with 80% dataset REDDIT; (Bottom-left) the surrogate model trained with 60% datasct in WIKI;; (Bottom-right) the surrogate model is trained with 60% dataset in REDDIT.
32

---

MemFreczing: A Novel Adversarial Attack on Temporal Graph Neural Networks under Limited Future Knowledge
We first investigate if surrogate models, which are trained with partial training data, can effectively represent the target models. In Figure 30, analyze the similarity of parameters between the surrogate and target models. The analysis includes weights and biases from both the GRU units and the attention-based classifier. We track this similarity across training epochs through 20. The results show gradual decrease in similarity as training progresses. For the surrogate model trained on 80% of the dataset, the similarity decay minimal, maintaining values between 0.94 and 0.96 at epoch 20. The surrogate model trained on 60% the dataset shows a more pronounced decay, with similarity values ranging from 0.90 to 0.92 at epoch 20.
Next, we evaluate how effectively adversarial examples generated from surrogate models persist in target models. We first apply the MemFreezing algorithm to the surrogate model generate noisy patterns, which then transfer to the target model. We assess the attack's s persistence by measuring the cosine similarity between the victim nodes' initial noisy memories (at the time of attacks) and both their own and their neighbors' memories over time. As shown in Figure 31, although the freezing capability is somewhat weakened due to the surrogate model's incomplete training data, our attack remains effective: the noisy patterns maintain a similarity above 0.8 even after 15 updates, and one-hop neighbors show significant influence with similarity values exceeding 0.6 relative to the noisy pattern.
Lastly, in Table 12, compare MemFreezing against baseline attacks under the measuring their impact overall model accuracy. While all attacks show reduced effectiveness in the black- black-box setting, MemFreezing maintains its superiority, achieving the largest accuracy drop compared to baseline attacks.
black-box setting by
Table 12. Accumulated accuracy of edge prediction in the vanilla/attacked TGNNs over different timestamps REDDIT and WIKI; The attack budget 5% attacks; lower matrices indicate more effective attacks.
Dataset
WIKI
REDDIT
Surrogate Model
Model
TGN
JODIE
Dyrep
ROLAND
TGN
JODIE
Dyrep
ROLAND
Vanilla
0.93
0.87
0.86
0.94
0.97
0.98
0.96
0.95
FN
0.87
0.85
0.82
0.86
0.93
0.94
0.92
0.93
Meta-h
0.90
0.83
0.81
0.85
0.93
0.95
0.90
0.92
to
TDGIA
0.87
0.84
0.82
0.85
0.91
0.88
0.86
0.88
0.90
0.85
0.86
0.88
0.92
0.91
0.95
0.91
FN
0.93
0.87
0.85
0.94
0.97
0.97
0.96
0.95
Meta-h
0,93
0.87
0.84
0.93
0.96
0.98
0.94
0.96
80%
f25
TDGIA
0.93
0.87
0.85
0.94
0.97
0.98
0.96
0.95
ours
0.83
0.83
0.83
0.84
0.89
0.90
0.92
0.88
FN
0.94
0.87
0.86
0.94
0.97
0.97
0.96
0,95
Meta-h
0.93
0.87
0.85
0.93
0.97
0.98
0.94
0.95
150
TDGIA
0.93
0.87
0.85
0.93
0.96
0.97
0.95
0.92
0.84
0.85
0.82
0.85
0.90
0.91
0.93
0.90
FN
0.91
0.86
0.86
0.92
0.96
0.96
0.93
0.94
Meta-h
0.90
0.83
0.81
0.85
0.93
0.95
0,90
0.92
to
TDGIA
0.90
0.84
0.82
0.89
0.92
0.90
0.90
0.92
ours
0.92
0.87
0.85
0.90
0.93
0.93
0.92
0.93
FN
0.93
0.87
0.85
0.94
0.97
0.97
0.96
0.95
Meta-h
0.93
0.87
0.84
0.93
0.96
0.98
0.94
0.96
60%
t25
TDGIA
0.93
0.87
0.84
0.94
0.97
0.98
0.96
0.95
ours
0.87
0.84
0.84
0.87
0.90
0.91
0.93
0.91
FN
0.94
0.87
0.86
0.94
0.97
0.97
0.96
0.95
Meta-h
0.93
0.87
0.85
0.93
0.97
0.98
0.94
0.95
t50
TDGIA
0.93
0.87
0.86
0.93
0.96
0.97
0.95
0.95
ours
0.87
0.86
0.85
0.90
0.92
0.92
0.94
0.90
B. 15.2. ZERO-SHOT ATTACKS
is also possible that, in real-world cases, the attackers have no idea about the model architecture or training datasets. To this end, we evaluate Memfreezing under the zero-shot transfer attack setup following the ensemble-ban -baed approach first
33

---

MemFreczing: A Novel Adversarial Attack on Temporal Graph Neural Networks under Limited Future Knowledge
proposed in (Liu al., 2016). Specifically, on the Wikipedia dataset, we generate the fake message by jointly optimizing the adversarial message for three models and then evaluating the effectiveness of this unified adversarial message diverse models. As shown in 32, although it performs worse than the white-box attack, Memfreezing can still effectively perturb model predictions. We also acknowledge that memfreezing is less harmful than cases with more accurate model information.
Vazill
Vanill
Varzlk
Transfer Atack
Trunder Albed
0.95
White Bos Aitcc
0.95
White-Ro Altec
0.55
White Alacl
Ascmmsbeed Azz
Accumulated Ace.
Accomulitedd
0.9
0.55
6.65
0.8
0.8
6.9
0.75
0.75
10
20
30
40
50
20
Timestamp
Timestampp
Timestamp
(a) Accumulated acouracy of adopting zero- shot Menfroozing attack on TGN WIKI
(b) Accurniiated sccuracy adopling zero- shat Memtreazing attack on DyRep in WIKI
(c) Acoumulated acpurasy of adopting zero- shat Memfraszing attack on JODIE in WIKI
Figure 32. The comparisons hetween performances of Memfreezing under zero-shot attack setup and white-hox counterparts.
34

---

MemFreezing: A Novel Adversarial Attack on Temporal Graph Neural Networks under Limited Future Knowledge
B.16. Analysis Future Simulation
To further understand if using nodes' current neighbor can be effective in extremely irregular and random graphs, we conduct the following experiments.
First, we further analyze the similarity among nodes' neighbors in diverse datasets using the same setup (e.g., model) as Figure 3(d). As shown in Figure 33, generally, nodes tend to have similar neighbors across diverse datasets. Hence, using current neighbors reasonably approximates future graph changes in practice.
250
300
200
Simflarity
150
Similarity
100
100
50
0
0
0.2
0.4
0.8
0
0.2
0.4
0.6
0.8
Distribution
Distribution
Figure The distribution of cosine similarities among the ideal frozen states different nodes in REDDIT and REDDIT -ODY datasets.
To investigate if our future neighbor simulation scheme is sufficient to freeze neighbors under irregular or highly random dynamic graphs, we simulate an irregular and random graph on top of the Wikipedia dataset. Specifically, we have victim nodes in the graph connected to nodes with random memories in the future timestamps. We also explored an alternative scheme to investigate whether the heuristic could further enhanced. Specifically, in this alternative, we simulate nodes' future neighbors using nodes with random memories.
Cositee Siogtarity
8.8
Cosiine Stenltartty
0..8
Cosine Similarity
0.8
Cosine Simillaiity
0.8
0.6
0.6
0.6
0.4
0.4
-o- Rost Nade Hop Naighhar 2.Hipp Noithher
8.4
-C- Reot Nade Lapp Neighber Tay Neathbed
0.4
-C- Reet Nodt
--- Nelghher -o Hop Neiaher
-O-1 Hlpp Neightor
0.2
0.2
0.2
Hap Neighhor
Timesdamp
Timestamp
Timesdampp
(c)
Figure 34. The similarities between victim nodes' initial noisy memories (at the time of the attack) and themselves' /thiir subsequent neighbors' memories in WIKI dataset and its randomized version under vanilla cases including (a) Using current neighbor for simulation under noisy future, (b) Using current neighbor for simulation under normal future, (c) Using random memory neighbor for simulation under noisy future, (d) Using random memory neighbor for simulation under a normal future.
As shown in Figure 34(a), although resulting in lower similarities, MemFreezing effectively freezes these random neighbors (as shown in (a)). This demonstrates that our future simulation schemes effective under even (i.e., Current Simulation) in irregular setups. The reason behind this is that, in addition to using current neighbors, also simulate "new future neighbors" with all-zero memories, which further enhance the noise's 's capability to freeze unseen nodes.
Although the alternative scheme (i.e., Random Simulation) performs better under random neighbor cases (i.e., Noise Future), as shown in Figure 34(c); it shows worse performances in the real cases (i.c., Normal Future), as shown in Figure 34(d) compared to as shown Figure 34(b). These findings collectively suggest that using current neighbors as surrogates is both practical and effective, even challenging dynamic graph scenarios.
35

---

MemFreczing: A Novel Adversarial Attack on Temporal Graph Neural Networks under Limited Future Knowledge
B.17. Effective in LSTM-based TGNNs
While existing TGNN uses RNN and GRU for node memory updating (Rossi et al., 2020; Trivedi al., 2019; Kumar et al., 2019; You et al., 2022), it is valuable understand how nodes' memory is frozen under memory updater with different RNN-variant.
To evaluate the effectiveness of MemFreezing when using LSTM as the memory updater, we replaced the GRU and RNN components TGN (Rossi et al., 2020) with LSTM. We then assessed the performance MemFreezing and baseline attacks under this new configuration. It is worth mentioning that since LSTM has two memories (i.c., long and short terms), they are different from GRU and RNN used in existing TGNNs. To adapt these two memories into one node memory under existing TGNN frameworks, concatenate the two memories of node together its memory and freeze them altogether.
0.94
0.92
0.94
Accumnlated Accuracy
Accumulated Accuracy
0.92
0.9
0.9
0.88
0.89
Our
0.86
0.86
0.84
0.84
0.82
Ours
TDGIA
0.82
0.8
Timestamp
Thnestamp
Figure The accumulated accuracy LSTM-based TGN under no-attack, TDGIA, and MemFreezing on WIKI (left) and REDDIT (right) datasets.
We first investigate the resulting accumulated accuracies in TGN. As shown in Figure 35, the LSTM- based TGN shows better robustness against MemFreezing. However, MemFreezing still effectively compromises predictions of LSTM-based TGN, leading to an average of 8% accuracy drops at t100- In contrast, the bascline (i.c., TDGIA) still fails to disturb the predictions under limited limited-knowledge setups.
0.8
0.8
Cosine Similarity
Cosine Similarity
0.6
0.6
0.4
0.4
Root Node HoHop Neighbor
0.2
0.2
o Root Node
1-Hop Nelghbor
4
6
8
10
12
14
2
10
12
14
Timestamp
Timestamp
Figure 36. The similarities between victim nodes' initial noisy memories (at the time of the attack) and themselves' /thiir subsequent neighbors' memories in LSTM-based TGN the WIKI dataset.
The LSTM-baase TGN makes more challenging since the attack has to freeze both long-term and short-term memories.
36

---

MemFreczing: A Novel Adversarial Attack on Temporal Graph Neural Networks under Limited Future Knowledge
To understand the phenomenon, further investigate the similarities between the victim nodes' initial memory and its subsequent and 1-hop neighbors' memories. As shown in Figure 36., the similarities between the victim nodes and their 1 -hop neighbors are as low as around 0.6, which is not as high the cases with GRU/RNNs (e.g., over 0.8).
37

---

MemFreezing: A Novel Adversarial Attack on Temporal Graph Neural Networks under Limited Future Knowledge
C. Discussion And Future Work
C.1. Limits under different models and graphs.
While the experiment results in Appendix B.4 and Appendix B.11 demonstrated that MemFrezzing can be well-generrliized on various inputs, several limitations can be observed according to the performance variance between different models. While our approach can effectively mislead TGN, ROLAND, and DyRep, its effectiveness is less significant JODIE, which uses differences between node's is current and its last update time to decay the memory. From these observations, deduce that our attack may encounter limitations in two specific scenarios:
Limited Influence of Node Memory on Predictions: Our attack's s effectiveness may be mitigated in situations where the node memory has a relatively minor role in influencing the model's predictions.
Usage of Additional Information in TGNN Models: The effectiveness may also be constrained when the targeted TGNN model incorporates additional information beyond the node memory for its predictive processes.
While our attack strategy outperforms the baselines, these insights highlight potential limitations under certain model-speeith conditions.
Nevertheless, Detecting a MemFreezing attack by observing node memory is challenging because nodes can naturally exhibit stable updates. For example, using TGN on the Wikipedia dataset, over 70% of node updates show high similarity (although they may not be consistently stable), which can also occur in real-world cases (e.g.. an Amazon user with consistent shopping preferences). Thus, it is hard to differentiate an attacked node from naturally stable ones.
For instance, one could devise "memory reset" module that resets the victim nodes' memories. To explore the potential of randomly and periodically resetting node memories, conduct experiments in which we (a) randomly reset node memories upon each update or (b) reset memories after each 25 timestamps. As the results shown in Figure 37, doing so may jeopardize the models' clean accuracy with limited effectiveness in defending against Memfreezing.
Tarzn
Burig
0.53
0.50
01.0
0.50
Accunslaced Ace.
Accunsiared Auc.
Accunsattal
0.
3.9
0.9
Accumiiatad
2.9
0.30
06:5
Bellina
Tinevtarp
Timsotastp
Timestupp
Tinestapp
(8) Accumulated accuracy with randomiy reset 30% node every 50 timestaps in TGN on WIkI
(b) Accumulated eccuracy with randomly reset 50% node every 50 timestamps in TGN on WIKI
(6) Accumulated accuracy with randomly reset 30% node avary 50 tmestamps TGN on REDDIT
(6) Accumulisted accuracy with randomly resat 50% node every 50 smestampa in TGN on RECDIT
Figure 37. The performances of Memfreezing upon randomly resetting node memories.
C.2. Potential Defenses.
While we demonstrate that many existing defense schemes, such as adversarial training or regularization, are less effective on our attacks, we expect a potential attack-oriented defense scheme for our attack using memory filtering. Specifically, a potential defensive approach for our attack is to pay less attention to the nodes' memory and rely more on their current input adaptively.
This scheme stems from the observation that our attacks are less effective on JODIE in node classification tasks. One key difference in JODIE is that it decays the node memory based on the time differences between the prediction time and the node's last update time. This mechanism introduces more hints (i.e., time differences) in addition to the memory itself, which cannot be effectively distorted by the attacks and yields some crucial information. For example, a Wikipedia user is less likely to be banned he/she makes a new post after being inactive for long while.
Therefore, using this non-memory information or current information that does not interact with node memory could
38

---

MemFreezing: A Novel Adversarial Attack on Temporal Graph Neural Networks under Limited Future Knowledge
effectively hinder adversarial noises. To this end, intelligent defense mechanism can judiciously filter out the memory and adaptively focus more non-memory information if the memory is suspicious potentially noisy.
39

---

MemFreczing: A Novel Adversarial Attack on Temporal Graph Neural Networks under Limited Future Knowledge
D. Complexity and Overheads of The Memfreezing Attack
further approximate the time complexity of the MemFreezing, as is crucial to understand its practicality. The time complexity of MemPreezing is approximately O(V +VD), where V is the number of victim nodes being attacked and D their average degree.
The computation of MemFreezing be divided into three main parts:
1. Finding the Stable State: For each victim node in V, we iteratively update its state using its two support neighbors until reaching the ideal stable state. Assuming a constant number of iterations for convergence, this step incurs time complexity of O(V).
Solving the Target Memory Using SGD: For each victim node, we optimize the target memory state using stochastic gradient descent (SGD), considering (a) The node itself, (b) Its support neighbors and (c)lts augmented neighbors. The total set has size of most D 20 (current neighbors plus simulated neighbors), where D approximates the number of the node's current neighbors. This optimization incurs a cost of ((D) per node, leading to a total time complexity of O(VD) across V victim nodes with D average degree.
Introducing Fake Neighbors: For each victim node, we compute and inject a fake neighbor to introduce noise. This step has cost of (1) per node, resulting in O(V) overall.
In summary, the overall time complexity of MemFreezing is dominated by the SGD optimization step for getting noisy memory, resulting in O(V VD) time complexity. Under the worst in which D V (c.g., fully connected graph), the complexity is ((V2) We further show the comparisons of each attack's s average latency per node in Table 13. The results show that the Memfreezing attack freezes nodes within seconds, indicating its potential in an online attack setup.
Table 13. Average latency per node of four attack methods on WIKI and REDDIT datasets.
Dataset
Model
MemFreeze (s)
Meta-h (us)
TDGIA (s)
FakeNode (s)
TGN
0.48
546.88
1.91
0.87
Jodie
0.49
957.51
1.63
0.81
WIKI
Dyrep
0.45
352.00
2.10
0.91
Roland
0.53
816.78
3.28
1.27
TGN
0.66
262.63
1.46
0.81
Jodie
0.46
158.91
1.49
0.76
REDDIT
Dyrep
0.45
155.96
1.20
0.89
Roland
0.53
392.90
2.14
1.47
40


Reviews:
[{"review_id": "GoGCeFEmzu", "reviewer": "Reviewer_qaAY", "summary": "The method makes use of a design component (node memory states) of recent temporal graph neural networks to disturb model predictions in future unseen time steps. This is done by selecting high-degree nodes (referred to as root nodes) and their 2 neighbours with the highest node degrees (referred to as support nodes) and adding noise to their node features, so as to achieve \"cross freezing\" of node memories. Doing so is done mainly at time 0 (but at other times as well in the side experiments).\n\nThe flow of the paper is clear, I appreciate the clear writing.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**We sincerely thank the reviewer for the positive feedback and valuable comments. In response, we exemplify the cross-freezing in a social media case, discuss its potential defenses, and clarify the assumption of similar ideal stable states among nodes. We will also carefully revise the paper following the reviewer’s suggestion.** \n\n---\n\n## **Q1. Cross-freezing in social media**\n\nIn a social media setting (e.g., Reddit, Facebook), an attacker may want to consistently deliver the content to a specific user (the victim). First, they collect the victim’s profile and its neighbors from public data. Next, for each victim node and its two supportive neighbors, the attacker creates a fake account and injects an adversarial message, such as malicious comments. These fake accounts and comments are later removed, but the TGNN has already recorded the noisy messages. As a result, the updates related to these messages trigger a “cross-freezing” effect that locks the victim’s (and its neighbors’) memory into a stable, noisy state, making them less responsive to real content. Consequently, the victim may consistently receive the same spam content even though their future actions show no interest in those contents.\n\n---\n\n\n## **Q2. Detecting Memfreezing**\n\nDetecting a MemFreezing attack by observing node memory is challenging because nodes can naturally exhibit stable updates. For example, using TGN on the Wikipedia dataset, over 70% of node updates show high similarity (although they may not be consistently stable), which can also occur in real-world cases (e.g., an Amazon user with consistent shopping preferences). Thus, it is hard to differentiate an attacked node from naturally stable ones.\n\nHowever, your insight also hints at a potential detection strategy: deliberately stimulate node changes and then observe how the node’s memory reacts. Concretely, we may check if a node is attacked by Memfreezing in the following two steps:\n\n1. **Introduce Divergent Neighbors**: Temporarily connect the node to new neighbors with significantly different memory states (e.g., low cosine similarity).\n\n\n2. **Monitor Update Response**: If the node remains unusually stable after interacting with these distinct neighbors—showing little or no memory shift—it suggests that MemFreezing may be in effect.\n\nBy testing for unnaturally persistent memory under a deliberately introduced variation, one can check whether the node is compromised by the MemFreezing attack.\n\n---\n\n## **Q3. Observation of similar ideal frozen states**\nThank you for the insightful question. The similar ideal frozen states widely exist in diverse real-world graphs. In addition to the experiments in Figure 3d, we further characterize the distributions of similarities between neighboring nodes’ stable states across diverse benchmarks and present the results in **Figure 32 of Appendix 16B** in our original paper. The results indicate that the property widely exists in other real-world graphs (i.e., Reddit and Reddit-body). This also aligns with the network homophily theory [1,2], which states that, based on node attributes, similar nodes may be more likely to connect to each other than dissimilar ones. \n\n\nWe also investigate the performance under the cases where connected nodes may have divergent features, which potentially give divergent ideal states, in Appendix B16. Specifically, we have victim nodes in the graph connected to nodes with random memories after the attack timestamps. In such cases, the nodes tend to be divergent and pose distinct ideal stable states. The results in **Figure 33 in Appendix B16** indicate that MemFreezing effectively freezes these random neighbors despite resulting in lower similarities. \n\n\n[1] McPherson, M., Smith-Lovin, L., & Cook, J. M. (2001). \"Birds of a Feather: Homophily in Social Networks\". Annual Review of Sociology. 27:415–444.\n\n[2] Himelboim, I., Sweetser, K. D., Tinkham, S. F., Cameron, K., Danelo, M., & West, K. (2014). Valence-based homophily on Twitter: Network Analysis of Emotions and Political Talk in the 2012 Presidential Election. New Media & Society.", "claims_and_evidence": "Yes.", "methods_and_evaluation_criteria": "Yes, they totally support the idea.", "theoretical_claims": "The claims are supported emprically.", "experimental_designs_or_analyses": "Yes.", "relation_to_broader_scientific_literature": "-", "essential_references_not_discussed": "This is one of my concerns.\n\nIn the paper it is mentioned that \n\"... While several studies have explored the effectiveness of adversarial attacks on dynamic graphs (Lee et al., 2024; Sharma et al., 2022; 2023; Chen et al., 2021), **they often** assume that attackers have complete knowledge of the input graphs at the time of the attack ...\"\n\nIt seems there have been previous adversarial attack method for dynamic graphs, as mentioned later in the paper:\n\n\"... Recently, there have also been a few studies that explored the effectiveness of adversarial attacks on dynamic graphs and TGNNs (Lee et al., 2024; Sharma et al., 2023; 2022; Chen et al., 2021). ...\".\n\nThe distinctions of the proposed method should clearly be mentioned.", "other_strengths_and_weaknesses": "-", "other_comments_or_suggestions": "Not included in score: typo in Sec. 2. \n\n\"... Recent TGNNs focus on CTDGs since they can retain more information than DTDGs’ fixed intervals and more complex (Kazemi et al., 2020). ...\"\n\n'and more complex' should be corrected to 'and are more complex'.", "questions_for_authors": "- In Sec. 3 under \"Attacker’s Capability\", in the provided social media example could you describe how the cross freezing of the proposed method would look like in that specific example?\n- Since the proposed attack method targets a specific design choice of TGNNs, isn't it easy to detect by, e.g., observing the node memory states?\n- It is mentioned that \"... in Figure 3(d), the ideal frozen states from different nodes are similar; therefore, it ...\". \nDoes this property hold for any real-world graph in general? and if it's violated, how does it affect the performance of the method?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "pVb8KKIseE", "reviewer": "Reviewer_EZNr", "summary": "The paper introduces MemFreezing, a novel adversarial attack framework designed to disrupt temporal graph neural networks (TGNNs) under realistic constraints where attackers have limited knowledge of future graph changes. The core idea is to strategically freeze node memories in TGNNs, rendering them unresponsive to subsequent updates and propagating these frozen states through neighboring nodes. Experimental results indicate that MemFreezing consistently undermines the performance of TGNN in diverse tasks, providing a more long - lasting adversarial approach when future knowledge is restricted.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**We sincerely thank the reviewer for the positive feedback and valuable comments. In response, we clarify the rationale behind the future simulation choices, discuss more block-box attack setups, and clarify the observation on stable states and attack budget. We will also carefully revise the paper following the reviewer’s suggestion.** \n\n---\n\n## **Q1. Why simulate a neighbor with noisy and all-zero nodes?**\n\nThe reasons for using noisy and all-zero nodes for future simulation are:\n\n- **Noise Nodes:** As indicated by the network homophily principle [1,2] (**as cited in Q3 for reviewer qaAY**) and  Figure 3(d) and Appendix B.16, real-world neighbors often have high memory similarity. Hence, we create neighbors with similar features to the victim node’s current neighbors to simulate potential neighbors that already exist in the graph.\n\n\n- **All-Zero Nodes:** In many TGNNs (e.g., TGN, JODIE, DyRep, etc.), new nodes start with an all-zero memory. Thus, we initialize some future neighbors with zeros to mimic newly added nodes to the graph.\nTogether, these strategies capture both the homophilous nature of existing neighbors and the default state of new nodes.\n\n---\n\n## **Q2. Zero-shot black-box attack**\n\nWe agree that further exploring more black-box constraints is valuable. Hence, we evaluate Memfreezing under the zero-shot transfer attack setup following the ensemble-based approach first proposed in [3]. Specifically, on the Wikipedia dataset, we generate the fake message by jointly optimizing the adversarial message for three models and then evaluate the effectiveness of this unified adversarial message on diverse models. As shown in **Figure R1(anonymous link:https://ibb.co/6pkw68K)**, although it performs worse than the white-box attack, Memfreezing can still effectively perturb model predictions. We also acknowledge that memfreezing is less harmful than cases with more accurate model information.\n\n[3] Liu, Yanpei, et al. \"Delving into transferable adversarial examples and black-box attacks.\" arXiv preprint arXiv:1611.02770 (2016).\n\n---\n\n\n## **Q3. Theoretical proof of cross-freezing**\n\nPlease refer to **Q3 for reviewer qaAY** for more quantitative demonstrations of similar stable states. We provide the mathematical proof of cross-freezing under the similar stable states as detailed in **Figure R2 (anonymous link: https://ibb.co/XfVksqdR).**\n\n---\n\n\n## **Q4. The defensive strategies**\n\nThank you for your valuable feedback. To our knowledge, no published methods currently detect or mitigate the specific mechanism of node memory freezing in TGNNs.  However, we agree that one could devise a “memory reset” module that resets victim nodes’ memories. \nTo explore the potential of randomly and periodically reset node memories, we conduct experiments in which we (a) random reset node memories upon each update or (b) reset memories after each 25 timestamps. The results are shown in **Figure R3 (anonymous link:https://ibb.co/NMrZsjq)**. As one can observe, doing so may jeopardize the models’ clean accuracy with limited effectiveness in defending against Memfreezing. As detailed in **Q2 to reviewer qaAY**, the key challenge is that doing so may overkill those naturally stable nodes, and we also follow up with a potential detecting scheme detailed in that response.\n\n---\n\n\n## **Q5. Attack budget in terms of noise magnitude.**\n\nWe specify the magnitude of our Gaussian noise in Appendix A.2, where each “fake future neighbor” has a mean of 0 and a standard deviation set to 0.2 times the standard deviation of its corresponding real neighbor’s memory. \nNote that we do **not** inject simulated fake neighbors into the graph; instead, we use their noisy states to generate a single adversarial message per victim node, which matches the theoretical min/max for the clean messages (see Appendix B.10 for a stealthiness analysis).\n\n---\n\n## **Q6. Diversity of the models**\n\nWe appreciate the reviewer’s suggestion to evaluate MemFreezing on a broader range of TGNN architectures. The four TGNNs represent diverse memory-update mechanisms across different temporal paradigms. Specifically, TGN and DyRep operate event-driven updates, while ROLAND processes discrete snapshots. Moreover, these models employ varied memory schemes: TGN and DyRep use event-based updates, JODIE incorporates a time-decay component, and ROLAND leverages repeated GNN layers or attention over snapshots. \nWe acknowledge that Memfreezing mainly targets memory-based TGNNs. As recent studies demonstrated [4], this TGNN family achieves SOTA performance for dynamic graph benchmarks. We will also discuss the memory-based graph network [5] in our revised paper, as suggested by the reviewer.\n[4] Huang, Shenyang, et al. \"Temporal graph benchmark for machine learning on temporal graphs.\" Advances in Neural Information Processing Systems 36 (2023): 2056-2073.\n\n[5] Ahmadi, Amir Hosein Khas. Memory-based graph networks. University of Toronto (Canada), 2020.", "claims_and_evidence": "The main claims such as persistent degradation of TGNN performance with cross-freezing and future neighbor simulation mechanisms are well supported. \nHowever, one contribution claims that MemFreezing effectively misleads TGNN predictions across diverse datasets and models even in the presence of defenses. I am afraid that the paper does not test specialized defenses designed to counter memory - freezing attacks, such as dynamic memory reset mechanisms. The defensive strategies mentioned in 5.1 are insufficient and incomplete. Other potential defenses regarding the memory-oriented aspects should be summarized more comprehensively with references in appendix C.2.", "methods_and_evaluation_criteria": "The main claims such as persistent degradation of TGNN performance with cross-freezing and future neighbor simulation mechanisms are well supported. \nHowever, one contribution claims that MemFreezing effectively misleads TGNN predictions across diverse datasets and models even in the presence of defenses. I am afraid that the paper does not test specialized defenses designed to counter memory - freezing attacks, such as dynamic memory reset mechanisms. The defensive strategies mentioned in 5.1 are insufficient and incomplete. Other potential defenses regarding the memory-oriented aspects should be summarized more comprehensively with references in appendix C.2.", "theoretical_claims": "Part 4.1 claims that node memories in TGNN can remain stable when surrounded by neighbors with similar memories. Furthermore, the ideal frozen states from different nodes are similar.\nHowever, it is not comprehensive enough to draw this conclusion merely from a single experiment with only 100 victim nodes sampled. Is there any support from previous literature or more detailed derivations of theoretical formulas?", "experimental_designs_or_analyses": "1. The paper mentions that the effectiveness is less significant on JODIE which uses differences between a node's current and its last update time to decay the memory. This may imply that the effectiveness of the method depends on the model architecture. Therefore, has the evaluation covered a sufficient variety of model types for dynamic graphs?  In part 5.1, only four models are compared, and there is no discussion on the differences in model structures. Thus, it is difficult for readers to determine whether the selection of dynamic graph models is comprehensive.\n\n2. In the \"Attack Setup\" section of 5.1, the attack budgets only include the percentage of attacked nodes, but the magnitude of the Gaussian noise injecting to \"fake future neighbors\" in MemFreezing is not specified. Are there similar perturbation constants in other attack methods?", "relation_to_broader_scientific_literature": "Dynamic Graphs are prevalent in real-world scenarios, while Temporal Graph Neural Networks (TGNNs) have become leading solutions for dynamic graph tasks. There is a pressing need to study their robustness towards adversarial attacks. Hence, in real-world cases, the adversarial may attack TGNN without knowing future changes on the graph. To address the challenges, this paper introduce MemFreezing, a novel adversarial attack framework that delivers longlasting and spreading disruptions in TGNNs without requiring post-attack knowledge of the graph.", "essential_references_not_discussed": "More works in the area of Memory - Based Graph Networks should be cited. [Memory-Based Graph Networks’20]", "other_strengths_and_weaknesses": "1. The paper introduces cross-freezing to stabilize node memories but does not provide a formal proof of stability. Can you mathematically demonstrate that the system of mutually reinforcing nodes will remain in a frozen state indefinitely under dynamic graph updates?\n2. In the appendix, The black-box evaluation uses surrogate models trained on partial data. How would MemFreezing perform against a truly unknown, closed-source TGNN? The credibility of the paper would be enhanced if the test results for closed - source models could be presented within the article.", "other_comments_or_suggestions": "The white - box attacks employed in the article yield highly remarkable results. Nevertheless, their usability in the real-world context may be constrained to a certain extent. It would be advisable to consider incorporating additional black - box attack methods, such as zero-shot transfer attacks.", "questions_for_authors": "During simulating the future neighbors of victim nodes, could you please provide the reasons for choosing the two initialization methods(noise nodes and as all - zero nodes)? Is there any relevant previous literature or theoretical basis to support this choice?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "U3HHue7yQ4", "reviewer": "Reviewer_BqbP", "summary": "The paper studies adversarial attacks on temporal graph neural networks and proposes an effective approach to generate attacks that can persist over future timesteps. They consider an online adversarial attack setting and add fake nodes with carefully crafted memory representations at each timestep such that the victim nodes' memories reach an expected ``frozen'' state. Results on different temporal GNNs and tasks show the effectiveness of the MemFreezing attack as compared to baselines.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**We sincerely appreciate the valuable comments and insights from the reviewer. In response, we carefully respond to the reviewer’s questions and will also revise the paper accordingly.**\n\n---\n\n\n## **Q1. Generalizability to non-memory-based TGNNs**\n\nWe acknowledge that MemFreezing primarily targets TGNNs that continuously track temporal information through evolving node features. Its memory-freezing objective is specifically designed to disrupt the dynamics inherent in such memory-based systems. For models that do not maintain temporal node features, the objective function needs to be modified. However, as recent studies [4] have shown, this TGNN family consistently achieves state-of-the-art performance on dynamic graph tasks, underscoring the practical relevance of our focus. We recognize the importance of extending our approach to non-memory-based architectures and plan to explore such adaptations in future work.\n\n---\n\n## **Q2. Discussion on accumulated accuracy**\n\nWe use the accumulated accuracy to capture the impact of an attack over time—answering the question, “What is the accuracy of predictions up to a specific timestamp?” Specifically, accumulated accuracy is not equivalent to accuracy at a specific timestamp. Instead, it represents the accuracy up to a particular timestamp, and **the attack can happen anytime before/after the measurement**. \n\n A **stagnant accumulated accuracy** indicates that new predictions continue to be misclassified, demonstrating that the adversarial effect persists over time. In contrast, if the model were recovering, the metric would gradually improve.\n\n---\n\n ## **Q3. Unnoticeability in targeting high-degree nodes**\n\nThank you for the insightful question. As noted in [6] (Constraint C4), repeatedly injecting edges into a single high-degree node could trigger anomaly detection. However, MemFreezing introduces **only one fake edge per victim node**—even if that node is high-degree—thereby not violating C4 or exceeding typical per-node perturbation limits.\n\nMoreover, we explore if Memfreeze can integrate the TDAP constraints  [6]. For C1 and C4,  we follow our original setup to limit the number of changes (C1) and per node changes (C4). In addition, we enable C2 by restricting the number of changes per batch and enable C3 by only selecting victim nodes that have an event within the most recent five batches. The results in **Figure R4 (anonymous link: https://ibb.co/p6Mnw2hq)** indicate that Memfreezing can outperform the prior approach under such constraints, suggesting that it can be integrated with [6] to provide more unnoticeable attacks.\n\n\n[6] Lee, Dongjin, Juho Lee, and Kijung Shin. \"Spear and shield: adversarial attacks and defense methods for model-based link prediction on continuous-time dynamic graphs.\" Proceedings of the AAAI Conference on Artificial Intelligence. Vol. 38. No. 12. 2024.\n\n---\n\n ## **Q4. Evaluation under transfer attacks**\n\nWe agree that further exploring more black-box constraints is valuable. Please refer to our results in **Q2 to reviewer EZNr**.\n\n---\n\n ## **Q5. Runtime**\n\nWe evaluate the average latency of Memfreezing and other attacks. The results in **Figure R5 (anonymous link:https://ibb.co/JwmqR2LD)** show each attack's average latency per node. The results show that the Memfreezing attack nodes within seconds, indicating its potential in an online attack setup.\n\n---\n\n ## **Q6. More related works**\n\nThank you for suggesting additional literature. We note that the online adversarial attack in [7] supports our threat model by demonstrating attacks on streaming data rather than on fully known inputs. However, [7] differs from our work: even though it faces streaming data, predictions are made at the attack time with complete input information (e.g., an image), whereas in our setup, the input for prediction is unknown at the attack time, making the attack more challenging.\n\nSimilarly, while the Homophily Unnoticeability approach in [8] effectively improves attack stealth, it relies on having the full adjacency matrix—a resource that is unavailable in our scenario. We analyze our attack's stealthiness in Appendix B10 and will expand our discussion on unnoticeability constraints from [8] and [6] in the revised paper.\n\nLastly, we did not evaluate the methods in [Chen et al., 2021 and Sharma et al., 2023] because they assume a divergent threat model where attackers have full knowledge of the dynamic graph, allowing them to optimally select when and where to inject perturbations over the entire graph evolution. In our limited-knowledge scenario, determining the optimal allocation of the attack budget across timestamps is significantly more challenging, making direct comparisons less fair.\n\n[7] Mladenovic, Andjela, et al. \"Online adversarial attacks.\" arXiv preprint arXiv:2103.02014 (2021). \n\n[8] Chen, Yongqiang, et al. \"Understanding and improving graph injection attack by promoting unnoticeability.\" arXiv preprint arXiv:2202.08057 (2022).", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "- The paper claims more practicality for limited knowledge of the future graphs but gives full access to the model, which is also not well motivated. \n- It is also not practical to inject edges with high-degree nodes as they can be easily detectable as malicious through simple anomaly detection methods. They should follow unnoticeability constraints like:\n  - Lee, Dongjin, Juho Lee, and Kijung Shin. \"Spear and shield: adversarial attacks and defense methods for model-based link prediction on continuous-time dynamic graphs.\" Proceedings of the AAAI Conference on Artificial Intelligence. Vol. 38. No. 12. 2024.\n- The memory terminology is specific to certain kinds of models and it is not clear how it can be extended to other models that do not explicitly formulate past interactions of the nodes in memory representations such as:\n  - Luo, Yuhong, and Pan Li. \"Neighborhood-aware scalable temporal network representation learning.\" Learning on Graphs Conference. PMLR, 2022.\n  - Besta, Maciej, et al. \"Hot: Higher-order dynamic graph representation learning with efficient transformers.\" Learning on Graphs Conference. PMLR, 2024.\n  - Wang, Yanbang, et al. \"Inductive representation learning in temporal networks via causal anonymous walks.\" arXiv preprint arXiv:2101.05974 (2021).\n- While the premise motivates that we do not know the timestep for the adversarial attack, the authors measure their task using a metric of accumulated accuracy which measures the accuracy at the current time step plus the previous timesteps accuracy. Thus, it basically measures the accuracy if the attack had happened at the current timestep. More detail and motivation about how the metric reflects the premise should be provided.\n\n-", "theoretical_claims": "N/A", "experimental_designs_or_analyses": "- The effectiveness of Memfreezing stagnates at a high perturbation rate with respect to accumulated accuracy while the premise of the work is to formulate attacks that can work regardless of future interactions.\n- The proposed method does not work as well in the case of black-box setting, indicating that MSE between memories requires the models to be precise. Here, one should also study a simpler transferability setting where the attacks from one model are used for another. \n- Running time analysis should also be conducted as this is supposed to happen in a practical online setting. \n- It is not clear why the model omits Chen et al., 2021 and Sharma et al., 2023 for discrete graph models (ROLAND). In addition, they should also include temporal dynamics aware perturbation constraint for unnoticeability of these perturbations.", "relation_to_broader_scientific_literature": "The paper studies the vulnerability of memory-based TGNNs in online evasion-based attacks.", "essential_references_not_discussed": "- Newer benchmark datasets should be considered for more comprehensive results [1].\n\n- A discussion with other online adversarial attacks, as studied in the current work is also missing [2, Sharma et al., 2023]. \n\n- The paper studies node injection attacks in temporal graphs but does not discuss a similar setting studied in static graphs [3]. \n\n- The paper does not discuss a more recent dynamic graph attack that studies poisoning attacks but establishes various unnoticeability constraints. \n\n[1] Huang, Shenyang, et al. \"Temporal graph benchmark for machine learning on temporal graphs.\" Advances in Neural Information Processing Systems 36 (2023): 2056-2073.\n\n[2] Mladenovic, Andjela, et al. \"Online adversarial attacks.\" arXiv preprint arXiv:2103.02014 (2021).\n\n[3] Chen, Yongqiang, et al. \"Understanding and improving graph injection attack by promoting unnoticeability.\" arXiv preprint arXiv:2202.08057 (2022).\n\n[4] Lee, Dongjin, Juho Lee, and Kijung Shin. \"Spear and shield: adversarial attacks and defense methods for model-based link prediction on continuous-time dynamic graphs.\" Proceedings of the AAAI Conference on Artificial Intelligence. Vol. 38. No. 12. 2024.", "other_strengths_and_weaknesses": "- Motivating examples and insights are appreciated and supplement the writing well.\n- A lot of main results are deferred to the Appendix which makes the it very hard to understand the key results.", "other_comments_or_suggestions": "- The submission draft is not in the correct format. \n- Impact statement is not included.", "questions_for_authors": "- How can the method be generalized to non-memory-based TGNNs? \n- Why does the accumulated accuracy stagnate?\n- How is it practical to form edges with high-degree nodes? Is it possible to make these attacks more unnoticeable given Spear and Shield and TDAP constraint?\n- How do the perturbations transfer across victim models in order to test the attacks under the more practical black-box setting?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "dKLiR0K8Kf", "reviewer": "Reviewer_wVV6", "summary": "The authors propose MemFreezing, an adversarial attack on temporal graph neural networks (TGNNs) that poisons TGNNs' recurrent neural network memory without knowledge about the future. For this, MemFreezing injects fake nodes into the graph that put their connected nodes into a \"fronzen\" state. Which means that their state becomes irresponsive and meaningless. The authors evaluate their attack on four TGNNs and compare to three baseline attacks.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**We sincerely thank the reviewer for the positive feedback and valuable comments. In response, we added more discussion on data crawling, adversarial training, and victim node selection, and we will also revise our paper accordingly.**\n\n---\n\n ## **Q1. Data Crawling**\nThank you for the valuable question. While social media platforms like X or Meta indeed impose rate limits on their APIs, adversaries can bypass these restrictions using multiple accounts, rotating IP addresses (proxies), or publicly accessible endpoints such as profile pages. Furthermore, partial data from archives or aggregated third-party services can fill in missing pieces. These combined methods enable attackers (or researchers) to assemble sufficient public information on connections and interactions, yielding a reasonably accurate reconstruction of Meta or X’s dynamic graph, despite official rate limits.\n\n---\n\n ## **Q2. Adversarial training**\n\nWe adopt a minimax scheme to conduct the adversarial training: the objective function can be formulated as:\n\n$$\\min_\\theta \\max_\\epsilon \\mathcal{L} (f_\\theta(s+\\epsilon),y)$$\n\nWe first perturb the memory of every training node by adding noise and use the noise to train the model. The training is conducted via a 10-step Projected Gradient Descent (PGD), and the noise is set to $\\pm 0.2$.\n\n\nAlthough adversarial attacks and importance weighting have been extensively studied on static graphs [9, 10], these methods prove less effective on dynamic graphs for two main reasons:\n\n1. **Dependence on a Complete Adjacency Matrix:**  \n   Methods such as the min-max topology attack [9] and robust diffusion [10] rely on the full adjacency matrix \\(A\\) of the graph. However, the complete \\(A\\) is unknown in dynamic graphs because future edges and nodes are not seen at the training graph.\n\n2. **Different Attack Objectives:**  \n   Traditional adversarial training schemes target attacks that maximize classification or link prediction loss. In contrast, MemFreezing aims to freeze node memories into stable states, indirectly disrupting predictions. Since this mechanism does not directly alter the output loss, defenses designed for loss-based attacks are insufficient to counter MemFreezing.\n\n\n[9] Xu et al. \"Topology Attack and Defense for Graph Neural Networks: An Optimization Perspective\" 2019 \n\n[10] Gosh et al. \"Adversarial Training for Graph Neural Networks\" 2023\n\n---\n\n ## **Q3. Attack node selection**\n\nWe agree that selecting victim nodes under a limited attack budget is crucial and that more sophisticated methods beyond our high-degree heuristic may yield improvements. Our choice was motivated by the challenge of identifying optimal targets without precise future knowledge, as approaches in [12, 13] typically rely on stable graph structures or additional information about upcoming changes. In a dynamic setting, a node's importance (or receptive field) can shift drastically once it gains new neighbors, making future-oriented selection inherently difficult.\n\nNonetheless, we acknowledge the potential for more specialized node selection methods, even under partial knowledge. To explore this, we integrated the importance-score-based node selection strategies from [11] into MemFreezing—applying their selection logic based solely on data available at the attack time—and tested both one-time and multiple-time attacks. As summarized in **Figure R6 (anonymous link:https://ibb.co/8LW5rtRc)**,  the scheme rates each node via an importance score, and the attack targets the node with the highest score. It achieves similar overall attack effectiveness compared to our simpler high-degree heuristic. This outcome suggests that, in highly dynamic scenarios, high-degree targeting remains a practical fallback, though we believe further research on adaptive selection in dynamic graphs is warranted.\n\n[11] Ma et al. \"Towards More Practical Adversarial Attacks on Graph Neural Networks\" 2020 \n\n[12] Geisler et al. \"Robustness of Graph Neural Networks at Scale\" 2021", "claims_and_evidence": "The authors' claims are well supported by evidence.", "methods_and_evaluation_criteria": "Yes.", "theoretical_claims": "Not applicable.", "experimental_designs_or_analyses": "The experimental design is sound. The experiments are comprehensive and also covers auxiliary aspects (defenses, stealthiness, …).", "relation_to_broader_scientific_literature": "The authors are the first to study adversarial attacks on TGNNs without knowledge about the future where they aim to put the memory in a frozen state. The authors reveal an important failure mode of TGNNs, and this failure mode is of interest to everyone who deploys TGNNs in practice.", "essential_references_not_discussed": "The authors cover the related literature well.\n\nWhat comes to my mind is the fact that the authors also choose a subset of nodes they aim to attack and adversarial training. Selecting the nodes that shall be attacked is a common problem in (static) graph robustness due to the simultaneous predictions on many nodes/edges. In other words, an attacker with a limited budget needs to decide on which nodes they are going to attack. While MemFreezing heuristically targets high-degree nodes, other works have, e.g., [1,2] discuss countermeasures/loss choices s.t. the attack optimization decides which nodes are to be attacked. Adversarial training and the important considerations were discussed previously for static graphs (e.g., [3,4]). Incorporating brief discussions could provide valuable pointers for future work. \n\n[1] Ma et al. \"Towards More Practical Adversarial Attacks on Graph Neural Networks\" 2020\n\n[2] Geisler et al. \"Robustness of Graph Neural Networks at Scale\" 2021\n\n[3] Xu et al. \"Topology Attack and Defense for Graph Neural Networks: An Optimization Perspective\" 2019\n\n[4] Gosh et al. \"Adversarial Training for Graph Neural Networks\" 2023", "other_strengths_and_weaknesses": "1. I am not particularly convinced that interesting all perturbations at a single timestamp is \"realistic\" nor desirable. I am much in favor of the setting where the attack is spread out over the duration of the test set. Hence, I would encourage the authors to place the results from section B.6 in the main body such that it is not overlooked.\n1. It is not impossible that an adversary can have (limited) knowledge about the future. In some parts, it reads like this was not possible.\n1. It might not be clear why vulnerabilities could be overlooked in idealized settings (e.g., as mentioned abstract). After all, the idealized setting is strictly more powerful. However, I agree that an attack in an idealized setting might not focus on vulnerabilities that are easy to utilize with limited knowledge. It seems that the attack is not generally revealing vulnerabilities in a more limited setting, it is rather utlizing one volnerabilitiy that exists in TGNN. Nevertheless, demonstrating that this limitation exists in TGNNs is a good contribution.\n1. The authors tempered with the template to remove, e.g., \"Anonymous Authors1\" below the title and line numbers are missing.", "other_comments_or_suggestions": "1. The last sentence before section 4.1 seems broken\n1. $msg$ reads like $m \\cdot s \\cdot g$. I would recommend using \"operatorname\" or similar $\\operatorname{msg}$. Same is true for UPDT, AGGR, GNN in Eq. 2-4\n1. White space missing in Section B.3 after \"GNNGuard\"\n1. Table 13 in Section B.6 should probably be Figure 13", "questions_for_authors": "1. Why can adversaries reconstruct graphs of Meta or X reasonably well? Don't they have strict rate limits, effectively hindering crawling their data?\n1. What perturbations are used for applying adversarial training? Is adversarial training applied to the training graph only?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: All reviewers positively evaluated the paper and found the core idea of strategically freezing node memories to be interesting.  While the attack is not general and only affects TGNNs with a certain type of architecture, such models are common and often SOTA. The reviewers generally agree that the main claims are well supported. The majority of raised questions and issues have been sufficiently addressed in the rebuttal. One reviewer increased their score.

As Reviewer BqbP notes the paper claims increased practicality due to limited knowledge of the future graphs, but gives full access to the model, i.e. we have a white-box attack. Reviewer EZNr raised a similar question about considering a black-box variant via transfer. The authors provided additional experiments showing that Memfreezing is still partially effectively. Nonetheless, the claims of practicality should  be appropriately "softened" in the final version to avoid over-claiming.

Taking everything into account I recommend acceptance.
Decision: Accept (poster)