Title: Intruding with Words: Towards Understanding Graph Injection Attacks at the Text Level
Venue: NeurIPS 2024
Accepted: yes
Keywords: Graph Neural Networks

Graph Adversarial Attack

Graph Injection Attack
Abstract: Graph Neural Networks (GNNs) excel across various applications but remain vulnerable to adversarial attacks, particularly Graph Injection Attacks (GIAs), which inject malicious nodes into the original graph and pose realistic threats.
Text-attributed graphs (TAGs), where nodes are associated with textual features, are crucial due to their prevalence in real-world applications and are commonly used to evaluate these vulnerabilities.
However, existing research only focuses on embedding-level GIAs, which inject node embeddings rather than actual textual content, limiting their applicability and simplifying detection.
In this paper, we pioneer the exploration of GIAs at the text level, presenting three novel attack designs that inject textual content into the graph.
Through theoretical and empirical analysis, we demonstrate that text interpretability, a factor previously overlooked at the embedding level, plays a crucial role in attack strength. 
Among the designs we investigate, the Word-frequency-based Text-level GIA (WTGIA) is particularly notable for its balance between performance and interpretability. 
Despite the success of WTGIA, we discover that defenders can easily enhance their defenses with customized text embedding methods or large language model (LLM)--based predictors. 
These insights underscore the necessity for further research into the potential and practical significance of text-level GIAs.

Intruding with Words: Towards Understanding Graph Injection Attacks at the Text Level

Abstract

Graph Neural Networks (GNNs) excel across various applications but remain vulnerable to adversarial attacks, particularly Graph Injection Attacks (GIAs), which inject malicious nodes into the original graph and pose realistic threats. Text-attributed graphs (TAGs), where nodes are associated with textual features, are crucial due to their prevalence in real-world applications and are commonly used to evaluate these vulnerabilities. However, existing research only focuses on embedding-level GIAs, which inject node embeddings rather than actual textual content, limiting their applicability and simplifying detection. In this paper, we pioneer the exploration of GIAs at the text level, presenting three novel attack designs that inject textual content into the graph. Through theoretical and empirical analysis, we demonstrate that text interpretability, a factor previously overlooked at the embedding level, plays a crucial role in attack strength. Among the designs we investigate, the Word-frequency-based Text-level GIA (WTGIA) is particularly notable for its balance between performance and interpretability. Despite the success of WTGIA, we discover that defenders can easily enhance their defenses with customized text embedding methods or large language model (LLM)-based predictors. These insights underscore the necessity for further research into the potential and practical significance of text-level GIAs. The code is available at https://github.com/Leirunlin/Text-level-Graph-Attack .

1 Introduction

Graph Neural Networks (GNNs) have exhibited exceptional performance in various tasks [30, 34]. However, their vulnerability to graph adversarial attacks has been increasingly exposed. Research shows that Graph Modification Attacks (GMAs), which perturb a small portion of edges and node features of the original graph, can significantly degrade the performance of GNNs [37, 38]. Besides GMAs, Graph Injection Attacks (GIAs) generate harmful nodes and connect them to the original nodes, thereby reducing the performance of GNNs. Since adding new content to the public dataset is more practical than modifying existing content, GIAs are considered one of the most realistic graph adversarial attacks [28, 33].

Yuchen Ren

Text-Attributed Graphs (TAGs), characterized by nodes with text-based features, form a crucial category among various graph types. In the early stages of GNNs, textual node feature processing is decoupled from the network design. Researchers transform text into fixed embeddings to investigate GNN designs on downstream tasks [13, 8, 27]. However, recent advancements have shifted toward a non-decoupled framework that integrates raw text into the design, significantly improving the ability to capture textual characteristics and enhance performance [9, 10]. Despite this progress in GNN design, current GIAs still focus on fixed embedding, aiming at only the injection of node embeddings rather than raw text on TAGs. This leads to several practical issues: 1) The attack setting is unrealistic. In real-world scenarios like social or citation networks, it is more practical to inject nodes with raw text rather than node embeddings. For example, to attack a citation network dataset, it would be more natural to upload fake papers rather than a batch of embeddings. 2) The injected embeddings may be uninterpretable. As minor perturbations at the embedding level can lead to unpredictable semantic shifts, traditional GIAs fail to ensure that injected nodes convey understandable semantic information. 3) Increased Detectability of Attacks. Attackers usually have access only to raw text, not the processed embeddings defenders use. This discrepancy makes it challenging for attackers to mimic the embedding methods of defenders, leading to structurally abnormal embeddings. For example, embeddings based on word frequency are sparse, while those from Pre-trained Language Models (PLMs) are typically output continuous and dense. If an attacker injects dense embeddings while a defender uses a word-frequency-based model, the difference in the embedding structure makes the injected embeddings easy to detect.

(a) The task of Text-Level GIAs

(b) Framework of ITGIA, VTGIA and WTGIA

Embedding-based GIA

InversionMethods

ITGIA

Evaluationand selection of

biases in machine learning

Vanilla GIA

Task:Poisoning

VTGIA

In this introduction,we define the

term bias as it is used in machine

Attacker

Poisoning Prompt

learning systems. We motivate the

importance of automated ...

8

Binary

Task:Words to Text

WTGIA

Embedding-based GIA

To address the above limitations, in this paper, we innovatively explore text-level GIAs, comprehensively examining their implementation, performance, and challenges. We explore three text-level GIAs: Vanilla Text-level GIA (VTGIA), Inversion-based Text-level GIA (ITGIA), and Word-frequency-based Text-level GIA (WTGIA), all of which successfully inject raw text into graphs and degrade the performance of GNNs, as shown in Figure 1b. Experiment results indicate that interpretability presents a significant trade-off against attack performance. ITGIA struggles to invert embeddings to interpretable text because the interpretable regions of the injected embeddings are ill-defined. VTGIA, which solely relies on Large Language Models (LLMs) for text generation, compromises attack effectiveness for its pursuit of text interpretability. WTGIA, as a balanced approach, manages to produce harmful and coherent text more effectively. However, the trade-off between performance and interpretability, coupled with poor transferability to different embedding methods, limits the performance of text-level GIAs in practice. Moreover, LLM-based predictors are shown to significantly enhance defenses against text-level GIAs, highlighting the substantial progress still needed to refine these attacks. In summary, our contributions are as follows:

To the best of our knowledge, we are the first to unveil the dynamics of text-level graph adversarial attacks on TAGs, especially for GIAs. We discuss the impracticality of embedding-based GIA in real-world applications and propose a more realistic attack setting.

We propose three effective text-level GIAs and demonstrate the trade-off between attack performance and text interpretability from both theoretical and empirical perspectives, providing insights for further refining text-level GIAs.

We reflect on the challenges of graph adversarial attacks at the text level. We discover that simple strategies at the text level can enhance defense performance against text-level GIAs, which reemphasizes the importance of exploring GIAs at the text level.

2 Background and Preliminaries

A Text-Attributed Graph (TAG) is represented as G = ( V , E , { s i } ) , where V is the node set and E , the edge set. We denote N as the number of nodes and A ∈ { 0 , 1 } N × N as the adjacency matrix. For each node v i ∈ V , a sequential text feature s i is associated. We focus on semi-supervised node classification tasks, where each node is categorized into one of C classes. The node labels are denoted by y ∈ { 0 , . . . , C -1 } N . The task is to predict test labels Y test based on G and training labels Y train .

Graph Neural Networks. We use f θ to denote a GNN parameterized by θ . Generally, raw text { s i } is first embedded into a feature matrix X ∈ R N × F using word embedding techniques, where F is the output dimension. In the rest of our paper, when referring to vanilla GNNs that take text embeddings as inputs, we represent the text-attributed graph as G = ( V , E , X ) and express f as f ( X ; A ) . The update process of the l -th layer of f can be formally described as:

where h 0 i = X i , N i is the neighborhood set of node v i , AGGR is the aggregation function, and f l is a message-passing layer that takes the features of v i and its neighbors as inputs.

Graph Injection Attacks and Related Works. Graph injection attacks aim to create a perturbed graph G ′ = ( V ′ , E ′ , X ′ ) to disrupt the accuracy of a GNN on target nodes. Formally, denote the number of injected nodes as N inj, and the number of nodes in the poisoned graph G ′ as N ′ . Then, the node set of G ′ can be formulated as V ′ = V ∪ V inj, and:

where X inj ∈ R N inj × F , A inj ∈ { 0 , 1 } N × N inj , and O ∈ { 0 , 1 } N inj × N inj .

For the design of injected node features, one line of research focuses on statistical features to ensure unnoticeability, sacrificing attack strength by excluding learnable processes for features [25, 4]. In parallel, other works target learnable injected embeddings. Wang et al. [29] pioneer injecting fake nodes with binary features to degrade GNN performance. AFGSM [28] introduces an approximation strategy to linearize the surrogate model, efficiently solving the objective function.

Starting from KDDCUP 2020, research shifts towards injecting continuous node embeddings under the constraints in Equation (3) [33, 36, 2]. Denote the budget of injected nodes as ∆ , the maximum and minimum elements in the original feature matrix X as x max and x min , and the maximum degree allowed for each injected node as b . The objective of these GIAs can be formulated as:

where V T is the target node set, d u is the degree for node u , and X 1 ≤ e X 2 indicates each element of X 1 is less than or equal to the corresponding element in X 2 . Among continuous strategies, TDGIA [36] generates node features by optimizing a feature smoothness objective function. Chen et al. [2] enhance homophily unnoticeability by adding a regularization term to the objective function. These approaches show better performance while maintaining unnoticeability at the embedding level.

It is worth noting that the evaluation datasets for the aforementioned GIAs are primarily TAGs [33], e.g., such as Cora and CiteSeer. However, all the studies remain at the embedding level. In our experiments, we adhere to the structural budget detailed in Equation (3), omitting embedding-level constraints as we pioneer GIAs at the text level. More related works are provided in Appendix D.

Evaluation Protocol. In this paper, we explore GIAs in an inductive , evasion setting, following the framework established by [33] to ensure closeness to practical scenarios. Attackers have access to the entire graph and associated labels, except for the ground-truth labels of the test set and the victim models of the defenders. l Defenders train their models on clean, unperturbed training data and then use trained models to classify unseen test data.

General Experiments Set-up. We conduct experiments on three TAGs, Cora [17], CiteSeer [6] and PubMed [23], which are commonly used in evaluating GIAs. The dataset statistics and attack budgets are provided in Table 5 and Table 7 in the Appendix. We adopt full splits in [33] for each

dataset, which uses 60% nodes for training, 10% nodes for validation, and 30% for testing. For word embeddings techniques, we include Bag-of-Words (BoW) and GTR [19], a T5-based pretrained transformer that generates continuous embeddings of unit norm. The default BoW method constructs a vocabulary using raw text from the original dataset based on word frequency, with common stop-words excluded. The embedding dimension of BoW is set to 500. In the experiments, we use a 3-layer vanilla GCN or a 3-layer homophily-based defender EGNNGuard following [2]. EGNNGuard defends homophily-noticeable attacks by cutting off message-passing between nodes below the specified similarity threshold. The hyperparameters and training details are provided in Appendix H.1. We repeat each experiment 10 times and report the average performance and the standard deviation. Unless otherwise specified, we bold the best (the lowest) results.

3 Text-Level GIAs: Interpretability Matters

Although GIAs are considered realistic graph attacks, traditional methods focus mainly on the embedding level, which can be overly idealized. Typically, attackers only have access to public raw data, such as paper content and citation networks, on platforms like arXiv, and defenders process this data more personally. Since attackers struggle to access embeddings trained by defenders, injecting nodes with suitable embeddings is challenging. Conversely, injecting new raw data into the public dataset is more realistic for attackers. This leads us to an important question: Can we generate coherent text for injection that ensures the effectiveness of attacks while maintaining interpretability?

3.1 Inversion-based Text-Level GIAs: Effective yet Uninterpretable

Embedding-level GIAs have demonstrated strong attack performance against GNNs [36, 2]. To achieve text-level attacks, a straightforward idea is to use inversion methods to convert embeddings back into text. Recent advancements in text inversion methods, such as Vec2Text [18], have enabled text recovery from PLM embeddings with a 66% success rate for examples averaging 16 tokens. This breakthrough opens new possibilities for achieving text-level GIA that is comparable in performance to those at the embedding level, which we term Inversion-based Text-level GIA (ITGIA) .

Implementation of ITGIA. ITGIA consists of two steps: generating poisoning and invertible embeddings, and then converting them into text. Since the effectiveness of current inversion methods has only been validated on normal text embeddings, it is crucial to ensure that generated embeddings lie within an interpretable and feasible region. However, defining these interpretable regions precisely is challenging. The constraint specified in Equation (3) limits generated embeddings to a cubic space, which may be overly broad for feasible embeddings. For example, PLMs typically produce embeddings located on a spherical surface with an L2-norm of 1, representing a significantly smaller region. To meet this fundamental requirement, we employ Projected Gradient Descent (PGD)[16], projecting each injected embedding onto the unit sphere after every feature update. To further address the challenge of defining interpretable regions, we incorporate Harmonious Adversarial Objective (HAO) [2] into the GIA objective function. Optimizing over HAO increases the similarity between injected embeddings and those of normal text from original datasets, thereby bringing the injected embeddings closer to interpretable regions. Details of ITGIA and HAO are provided in Appendix I.1 and H.1. Once the embeddings are obtained, we utilize the GTR inversion model in [18] with a 20-step correction process to revert embeddings back into text.

Analysis of Performance and Interpretability. Following [2], we use sequential injection frameworks, including the sequential variants of SeqGIA (Random injection), TDGIA, ATDGIA, MetaGIA, and AGIA as the embedding-level backbones. The results of ITGIA are displayed in Table 1. We can see the embeddings after inversion deviate significantly from the injected embeddings, as indicated by the low cosine similarity. This suggests substantial information loss during inversion, leading to poor attack performance. Figure 6 illustrates the underlying reason: although injected embeddings meet basic norm constraints, they struggle to fall within the much smaller interpretable embedding region, hindering accurate inversion. Although incorporating HAO enhances the inversion accuracy and improves attack performance, the improvement comes at the expense of embedding-level attack performance [2]. As a result, increasing HAO weights does not consistently yield better results, as shown in Figure 2. Furthermore, the generated text remains incoherent with high perplexity, as demonstrated in Appendix J. This renders real-world applications impractical and highlights the challenges faced by continuous embedding-level GIAs.

0

1

2

3

4

5

HAO Weight

0.0

0.5

1.0

Cosine Similarity

0.14

0.67

0.77

0.79

0

1

2

3

4

5

HAO Weight

0.11

0.56

0.70

0.76

CiteSeer

0

1

2

3

4

5

HAO Weight

0.05

0.59

0.72

0.77

PubMed

74.20

69.23

69.63

71.76

68.34

66.80

65.44

68.98

60.0

62.5

65.0

67.5

70.0

72.5

75.0

77.5

80.0

Attack Performance (%)

63.91

65.44

66.88

67.22

Cosine Similarity

Attack Performance

3.2 LLM-based Text-Level GIAs: Interpretable yet Ineffective

Although ITGIA manages to generate harmful text, interpretability remains challenging to address. To ensure that the generated text is both interpretable and deceptive, a direct approach is to utilize an LLM for text generation and guide it to produce poisoning content through carefully designed prompts. Based on experiences with embedding-level graph adversarial attacks, when the features of injected nodes exhibit heterophily, confusion, or irrelevance, the classification performance of their neighboring nodes is negatively affected [35]. Thus, we attempt to incorporate prior knowledge used in traditional GIAs and create prompts from three different angles:

Heterophily Prompt. This prompt involves sampling the text of nodes from the original dataset to generate heterophilic (dissimilar) content. Specifically, we first conduct embedding-level GIAs to obtain a perturbed graph. Next, we sample the content from the neighbors of injected nodes. Finally, we design a prompt that requests the generated content to be dissimilar to their neighboring nodes, exploiting the weakness of GNNs in handling heterophily.

Random Prompt. This prompt generates node text that is entirely unrelated to the original categories of the graph. For example, in the Cora dataset, the original categories are about machine learning topics. In this prompt, we generate papers in categories like sports, art, and history, which are dissimilar to all nodes in the original graph.

Mixing Prompt. This prompt generates node text that may be classified into multiple or even all categories. Using Cora as an example, a potential paper title could be: 'Unified Approach for Solving Complex Problems using Integrated Rule Learning, Neural Networks, and Probabilistic Methods'.

After defining the prompts, we propose a simple Vanilla Text-level GIA (VTGIA). This method first generates text for the injected nodes based on the prompt via LLMs and subsequently optimizes the graph structure. We use GPT-3.5-1106 [20] as the LLM backbone for text generation, and the five sequential injection backbones same as ITGIA. The pseudo-code of VTGIA, prompts, and generated examples are provided in Appendix I.2, H.2, and J. The results are shown in Table 2. Although the generated content exhibits adversarial effects, directly producing harmful text via prompts is not sufficiently effective and is far from the optimal results achievable by attacks at the embedding level.

4 Word-Frequency-based Text-Level GIAs

Based on previous analysis, to achieve an interpretable and effective GIA, the following conditions should be met: 1) Guidance from Embedding-level GIA to ensure effectiveness. 2) Utilization of LLMs to guarantee interpretability. 3) A well-defined LLM task formulation to minimize information loss during the embedding-text-embedding conversion process.

We address these conditions by employing word-frequency-based embeddings, specifically binary Bag-of-Words (BoW) embeddings, which offer several advantages: 1) Clear physical meaning. In binary BoW embeddings, a '1' indicates the presence of a word, while a '0' indicates its absence. 2) Clear task formulation. The task involves generating text containing specified words while excluding prohibited words, which can be effectively done via LLMs. 3) Controllable embedding-textembedding process. As long as the text includes specified words and excludes prohibited words, the embeddings can be exactly inverted. Building on these advantages, we design the Word-frequencybased Text-level GIA (WTGIA) , leveraging BoW embeddings and the generative capabilities of LLMs. Its implementation consists of three steps: 1) Obtain binary injected embeddings. 2) Formulate embedding to text tasks for LLMs. 3) Perform multi-round corrections for LLMs.

4.1 Row-wise Constrained FGSM: Unnoticeable and Effective at the Embedding Level

Implementaion of Row-wise Constrainted FGSM. To generate binary embeddings, we adopt a row-wise constrained Fast Gradient Sign Method (FGSM) algorithm based on [28]. Specifically, we first obtain vocabulary based on BoW on the original dataset. Next, we set the injected embedding X inj to all zeros. We then set a sparsity constraint S on injected embeddings, that each embedding can retain at most F ′ = ⌊ S ∗ F ⌋ non-zero entries, where F is the dimension of features. In each epoch, we define the flippable set as the entries in X inj that satisfy the sparsity constraint. Based on the element-wise gradient of the loss concerning X inj, we flip the most significant B entries from the flippable set, where B is the batch size. The process stops when all rows run out of word budgets. 2

Note that the sparsity budget S is a hyper-parameter that limits the use of at most F ′ words from the predefined vocabulary in a single text. Intuitively, a higher number of used words intensifies the embedding-level attack but can compromise text-level interpretability, as it becomes harder to integrate more specified words naturally in the generated text. Based on the row-wise constraints, we can formally establish the relationship between embedding-level performance and unnoticeability and text-level interpretability.

Definition 1 (Single node GIAs towards one-hot embedding) . For a target node v t with embedding k x t = [ ︷ ︸︸ ︷ 1 , · · · , 1 , 0 , · · · , 0] ∈ { 0 , 1 } F , k ≪ F , the embedding indicates that the node uses k words from a predefined vocabulary, while F -k words are not used. We define the set containing the specified k words as set W u and the set containing the F -k prohibited words as set W n . We assume words in W u are related to their corresponding class, whereas words in W n are associated with other classes. To attack node v t , an adversarial node v i with embedding x i ∈ { 0 , 1 } F is injected.

6

8

10

12

14

16

18

20

Sparsity Budget (%)

20

30

40

50

60

70

80

Performance (%)

6

8

10

12

14

16

18

20

Sparsity Budget (%)

40

50

60

70

CiteSeer

10

12

14

16

18

20

22

24

Sparsity Budget (%)

40

50

60

70

80

PubMed

Best GCN

Best Guard

Mean Sparsity

Performance: An attack is more effective against node v t if it uses more words w n ∈ W n . The intuition is that mixing words from other classes makes x t harder to be correctly classified.

Unnoticeability: An attack is less detectable if the similarity between x t and x i is higher.

Interpretability: An attack is more interpretable if fewer words are required to use in x i , which means x i · 1 is smaller. The intuition is that generating content with fewer specified words is easier, which fits in practical scenarios involving limited length.

Theorem 1. In the setting outlined in Definition 1, assume we apply a cosine similarity constraint with a threshold c ∈ (0 , 1) for unnoticeability. Specifically, this constraint requires that the cosine similarity between x t and x i satisfies x t · x i ∥ x t ∥∥ x i ∥ > c . Let a denotes the number of words used by x i from the set W u , and b denotes the number of words used by x i from W n . If the budget is m words at most to ensure interpretability, then the maximum value of b is max( b ) = max ( ⌊ ( m -c √ mk ⌋ , 0 ) .

The proof and detailed illustration for intuitions are provided in Appendix F. Theorem 1 reveals that as long as m ≥ k , we can find a positive value for b (disregarding the flooring operation for simplicity), effectively introducing harmful information to the target node. Practically, given the typically low value of c , a destructive x i can be easily identified with a relatively large m at the embedding level. In Figure 3, we present the average and best performance of Row-wise Constrained FGSM coupled with five sequential injection methods used in ITGIA and VTGIA against GCN and EGNNGuard. As the sparsity budget increases, the performance of EGNNGuard declines sharply, confirming that enhancements in performance are possible under the unnoticeability constraint. However, achieving significant performance degradation requires sacrificing interpretability. For example, to achieve a 10% performance drop in Cora and CiteSeer, FGSM attacks need a budget close to or exceed the maximum sparsity level of all texts belonging to the original datasets. The subsequent subsection will explore the consequences of sacrificing text-level interpretability while completing WTGIA.

4.2 Trade-off for Interpretability at the Text Level

Task Formulation of LLMs. After obtaining the binary injected embeddings, we can obtain the Specified words included and the Prohibited words excluded in each text based on the BoW vocabulary. Subsequently, we formulate the task for LLMs as a "word-to-text" generation problem. We request LLMs to generate text under a specified length limit using specified words, optionally within a given topic based on the origin dataset. 3 Handling prohibited words is more complex. Given the sparsity of BoW embeddings, the number of prohibited words is relatively large. Directly requesting the absence of prohibited words through the prompt would be challenging for LLMs to understand. So, for closed-source LLMs like GPT, we only constrain the specified words in the prompt. For open-source LLMs, we mask their corresponding entries during the output process.

Masking Prohibited Words. Denote t i +1 as the next token at time i . The standard generative process for LLM can be formulated as: t i +1 = argmax ( SoftMax ( logits ( t i +1 | t i , t i -1 , . . . ))) .

where logits ( t i +1 | t i , t i -1 , . . . ) are the unnormalized log probabilities of the potential next token given the previous tokens. To enforce constraints on avoiding prohibited words, we introduce a masking vector M such that: M [ j ] = 0 if token j is prohibited, and 1 otherwise. The generative process is then modified by applying this mask to the logits before the SoftMax operation: t i +1 = argmax ( SoftMax ( logits ( t i +1 | t i , t i -1 , . . . ) ⊙ M )) , where ⊙ represents the element-wise multiplication of the logits by the mask. This mask effectively removes words from outputs by making their probabilities negligible.

Multi-Round Correction. After obtaining the output from the LLM, we calculate the use rate ( Number of Specified Words used Number of Specified words ) in the generated text and correct any omissions in their usage. Through multiple rounds of dialogue, we select the text with the highest use rate as the final output for LLMs.

Main Results. We utilized GPT3.5-turbo-1106 [20] as the close-source LLM and Llama3-8b [26] as the open-source LLM to implement the WTGIA. Based on Row-wise FGSM in Figure 3, we combine WTGIA with the five injection strategies and report the average results. The specific prompt details are in Appendix H.2. The length limit is specified in Table 6. The variants that use prompts that specify the generated content must belong to the original class set are marked as "-T." The results are displayed in Figure 4. It can be seen that

Desirable Performance: WTGIA achieves comparable attack performance to Row-wise FGSM, demonstrating strong embedding-to-text capabilities.

Trade-off: Variants with topic specification perform worse than those without, sacrificing attack strength for better text-level unnoticeability.

Masking Helps: Llama-WM and GPT that do not mask prohibited words generally perform worse than Llama.

Complete experiments and full results are given in Appendix K and Appendix L. Overall, WTGIA effectively replicates the performance of FGSM at the embedding level, achieving both effectiveness and interoperability.

40

42

44

46

48

50

52

47.70

48.66

47.11 47.09 47.35 47.58

46

48

50

52

54

52.27

53.12

49.01

49.92

49.02

50.44

CiteSeer

40

42

44

46

48

50

46.67

48.48

45.56

46.56

45.70

46.78

PubMed

Attack Performance (%)

GPT

GPT-T

Llama

Llama-T

Llama-WM

Llama-WM-T

New Trade-offs. However, we fail to further enhance performance at the text level by increasing the sparsity budget, similar to FGSM at the embedding level. As shown in Figure 5, with the increasing sparsity budget, the use rate keeps decreasing, representing a trade-off to maintain the interpretability of the generated content. In Cora and CiteSeer, the text-level attacks perform best when sparsity is around 10%. In PubMed, GPT-Topic even fails to generate meaningful text with a sparsity budget S ≥ 15% . These observations confirm that in text-level attacks, interpretability represents an additional trade-off that is overlooked in embedding-level attacks . Enhancing or evaluating performance solely at the embedding level fails to provide a practical understanding of GIAs.

6

8

10

12

14

16

18

20

Sparsity Budget (%)

42

44

46

48

Performance (%)

Cora without Topic

6

8

10

12

14

16

18

20

Sparsity Budget (%)

44

46

48

50

52

Citeseer without Topic

10

12

14

16

18

20

Sparsity Budget (%)

45

46

47

48

49

Pubmed without Topic

50

60

70

80

90

60

70

80

90

40

50

60

70

80

Use Rate (%)

GPT Attack Performance

GPT Use Rate

Llama Use Rate

5 New Challenges for Text-level GIAs

5.1 Transferbility to Different Embeddings

In practical scenarios, defenders can employ any text embedding techniques they want to process the text once an attacker completes the injection. However, embedding-level attacks implicitly assume that defenders will use the same embeddings as the attackers during evaluation, potentially benefiting the attackers. In fact, it is crucial to fully consider the transferability of a text attack across different text embedding technologies for text-level attacks.

In Table 3, we present the results of ITGIA and WTGIA when transferred to different embeddings on the Cora dataset. When transferred to GTR embeddings, WTGIA does not exhibit a significant performance advantage over ITGIA. The performance of ITGIA when transferred to BoW embeddings is even poorer. Since the injected text is highly uninterpretable and deviates significantly from the original dataset, the BoW method inherently filters out uncommon terms, rendering the injected embeddings particularly sparse and ineffective. These limitations in embedding transferability underscore the research gaps between embedding- and text-level GIAs.

5.2 LLMs as Defender

Since attacks are text-level, the defenders can directly utilize LLMs as predictors for node classification tasks without necessarily employing GNNs. Taking the LLMs-as-Predictor from [3] as an example. The method feeds the formulation of the node classification task, texts of target nodes, and optionally, the sampled texts of their neighbors in the prompt. It then utilizes LLMs to predict the labels of target nodes directly. Remarkably, this method demonstrates superior performance on clean datasets. We now examine the performance of WTGIA against LLMs-as-predictor from [3]. For WTGIA, we select the strongest variant in Figure 4 for each dataset as the attacker. In the zero-shot setting, only the text of target nodes is fed to LLMs. In the few-shot setting, the text of labeled nodes with their labels is fed to LLMs as examples. On Cora and CiteSeer, we adopt the whole test set for evaluation. For PubMed, we sample 1000 nodes from the test set for evaluation.

The results are presented in Table 4. Remarkably, on the PubMed dataset, the baseline without the use of neighborhood information ('Clean (w/o Nei)') achieves outstanding performance, which is consistent with observations in [3]. Therefore, even without utilizing any neighborhood information, LLM-based predictors can achieve high accuracy in node classification, meaning defenders can evade the influence of injected nodes. For other datasets, Cora and CiteSeer, while incorporating neighborhood information enhances the performance of LLMs-as-Predictors, the "Clean (w/o Nei.)"

baseline still represents a practical upper limit for the GIAs. Even if attackers manage to degrade the performance below this baseline, defenders can turn to this neighbor-free method as a secure fallback. Consequently, the flexibility of defenders should be fully considered when evaluating GIAs at the text level in practical scenarios.

6 Conclusion

In this paper, we explore the design of GIAs at the text level. We address the limitations of embeddinglevel GIAs on TAGs by extending them to the text level, which better aligns with real-world scenarios. We present three types of text-level GIA designs: ITGIA, VTGIA, and WTGIA. Our theoretical and empirical analysis reveals a trade-off between attack performance and the interpretability of the injected text. Among these methods, WTGIA achieves the best balance between performance and interpretability. Additionally, our findings indicate that defenders can effectively counter these attacks using different text embedding techniques or LLM-based predictors, highlighting the complex and challenging nature of graph adversarial attacks in practical applications.

References

MV Balashov, BT Polyak, and AA Tremba. Gradient projection and conditional gradient methods for constrained nonconvex minimization. Numerical Functional Analysis and Optimization , 41(7):822-849, 2020.

Yongqiang Chen, Han Yang, Yonggang Zhang, Kaili Ma, Tongliang Liu, Bo Han, and James Cheng. Understanding and improving graph injection attack by promoting unnoticeability. In The Tenth International Conference on Learning Representations, ICLR 2022, Virtual Event, April 25-29, 2022 . OpenReview.net, 2022.

Zhikai Chen, Haitao Mao, Hang Li, Wei Jin, Hongzhi Wen, Xiaochi Wei, Shuaiqiang Wang, Dawei Yin, Wenqi Fan, Hui Liu, and Jiliang Tang. Exploring the potential of large language models (llms) in learning on graphs. CoRR , abs/2307.03393, 2023.

Junyuan Fang, Haixian Wen, Jiajing Wu, Qi Xuan, Zibin Zheng, and K Tse Chi. Gani: Global attacks on graph neural networks via imperceptible node injections. IEEE Transactions on Computational Social Systems , 2024.

Simon Geisler, Tobias Schmidt, Hakan Sirin, Daniel Zügner, Aleksandar Bojchevski, and Stephan Günnemann. Robustness of graph neural networks at scale. In Marc'Aurelio Ranzato, Alina Beygelzimer,

Yann N. Dauphin, Percy Liang, and Jennifer Wortman Vaughan, editors, Advances in Neural Information Processing Systems 34: Annual Conference on Neural Information Processing Systems 2021, NeurIPS 2021, December 6-14, 2021, virtual , pages 7637-7649, 2021.

C. Lee Giles, Kurt D. Bollacker, and Steve Lawrence. Citeseer: An automatic citation indexing system. In Proceedings of the 3rd ACM International Conference on Digital Libraries, June 23-26, 1998, Pittsburgh, PA, USA , pages 89-98. ACM, 1998.

Jiayan Guo, Lun Du, and Hengyu Liu. Gpt4graph: Can large language models understand graph structured data? an empirical evaluation and benchmarking. CoRR , abs/2305.15066, 2023.

William L. Hamilton, Zhitao Ying, and Jure Leskovec. Inductive representation learning on large graphs. In Advances in Neural Information Processing Systems 30: Annual Conference on Neural Information Processing Systems 2017, December 4-9, 2017, Long Beach, CA, USA , pages 1024-1034, 2017.

Xiaoxin He, Xavier Bresson, Thomas Laurent, and Bryan Hooi. Explanations as features: Llm-based features for text-attributed graphs. CoRR , abs/2305.19523, 2023.

Weihua Hu, Matthias Fey, Marinka Zitnik, Yuxiao Dong, Hongyu Ren, Bowen Liu, Michele Catasta, and Jure Leskovec. Open graph benchmark: Datasets for machine learning on graphs. In Hugo Larochelle, Marc'Aurelio Ranzato, Raia Hadsell, Maria-Florina Balcan, and Hsuan-Tien Lin, editors, Advances in Neural Information Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020, NeurIPS 2020, December 6-12, 2020, virtual , 2020.

Xuanwen Huang, Kaiqiao Han, Yang Yang, Dezheng Bao, Quanjin Tao, Ziwei Chai, and Qi Zhu. Can GNN be good adapter for llms? In Tat-Seng Chua, Chong-Wah Ngo, Ravi Kumar, Hady W. Lauw, and Roy Ka-Wei Lee, editors, WWW , pages 893-904. ACM, 2024.

Diederik P. Kingma and Jimmy Ba. Adam: A method for stochastic optimization. In 3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings , 2015.

Thomas N. Kipf and Max Welling. Semi-supervised classification with graph convolutional networks. In 5th International Conference on Learning Representations, ICLR 2017, Toulon, France, April 24-26, 2017, Conference Track Proceedings . OpenReview.net, 2017.

Yuhan Li, Zhixun Li, Peisong Wang, Jia Li, Xiangguo Sun, Hong Cheng, and Jeffrey Xu Yu. A survey of graph meets large language model: Progress and future directions. CoRR , abs/2311.12399, 2023.

Jiawei Liu, Cheng Yang, Zhiyuan Lu, Junze Chen, Yibo Li, Mengmei Zhang, Ting Bai, Yuan Fang, Lichao Sun, Philip S. Yu, and Chuan Shi. Towards graph foundation models: A survey and beyond. CoRR , abs/2310.11829, 2023.

Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In 6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Conference Track Proceedings . OpenReview.net, 2018.

Andrew McCallum, Kamal Nigam, Jason Rennie, and Kristie Seymore. Automating the construction of internet portals with machine learning. Inf. Retr. , 3(2):127-163, 2000.

John X. Morris, Volodymyr Kuleshov, Vitaly Shmatikov, and Alexander M. Rush. Text embeddings reveal (almost) as much as text. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, EMNLP 2023, Singapore, December 6-10, 2023 , pages 12448-12460. Association for Computational Linguistics, 2023.

Jianmo Ni, Chen Qu, Jing Lu, Zhuyun Dai, Gustavo Hernández Ábrego, Ji Ma, Vincent Y. Zhao, Yi Luan, Keith B. Hall, Ming-Wei Chang, and Yinfei Yang. Large dual encoders are generalizable retrievers. In Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, EMNLP 2022, Abu Dhabi, United Arab Emirates, December 7-11, 2022 , pages 9844-9855. Association for Computational Linguistics, 2022.

OpenAI. Gpt-3.5-turbo. https://openai.com/ , 2023. Accessed via OpenAI API.

Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, and Ilya Sutskever. Language models are unsupervised multitask learners. OpenAI blog , 1(8):9, 2019.

Nils Reimers and Iryna Gurevych. Sentence-bert: Sentence embeddings using siamese bert-networks. In Kentaro Inui, Jing Jiang, Vincent Ng, and Xiaojun Wan, editors, Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing, EMNLP-IJCNLP 2019, Hong Kong, China, November 3-7, 2019 , pages 3980-3990. Association for Computational Linguistics, 2019.

Prithviraj Sen, Galileo Namata, Mustafa Bilgic, Lise Getoor, Brian Gallagher, and Tina Eliassi-Rad. Collective classification in network data. AI Mag. , 29(3):93-106, 2008.

Xiangguo Sun, Jiawen Zhang, Xixi Wu, Hong Cheng, Yun Xiong, and Jia Li. Graph prompt learning: A comprehensive survey and beyond. CoRR , abs/2311.16534, 2023.

Yiwei Sun, Suhang Wang, Xianfeng Tang, Tsung-Yu Hsieh, and Vasant G. Honavar. Adversarial attacks on graph neural networks via node injections: A hierarchical reinforcement learning approach. In WWW '20: The Web Conference 2020, Taipei, Taiwan, April 20-24, 2020 , pages 673-683. ACM / IW3C2, 2020.

Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timothée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, Aurélien Rodriguez, Armand Joulin, Edouard Grave, and Guillaume Lample. Llama: Open and efficient foundation language models. CoRR , abs/2302.13971, 2023.

Petar Velickovic, Guillem Cucurull, Arantxa Casanova, Adriana Romero, Pietro Liò, and Yoshua Bengio. Graph attention networks. In 6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Conference Track Proceedings . OpenReview.net, 2018.

Jihong Wang, Minnan Luo, Fnu Suya, Jundong Li, and Zijiang Yang and== Qinghua Zheng. Scalable attack on graph data by injecting vicious nodes. Data Min. Knowl. Discov. , 34(5):1363-1389, 2020.

Xiaoyun Wang, Joe Eaton, Cho-Jui Hsieh, and Shyhtsun Felix Wu. Attack graph convolutional networks by adding fake nodes. CoRR , abs/1810.10751, 2018.

Lingfei Wu, Peng Cui, Jian Pei, Liang Zhao, and Xiaojie Guo. Graph neural networks: Foundation, frontiers and applications. In Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, KDD 2023, Long Beach, CA, USA, August 6-10, 2023 , pages 5831-5832. ACM, 2023.

Kaidi Xu, Hongge Chen, Sijia Liu, Pin-Yu Chen, Tsui-Wei Weng, Mingyi Hong, and Xue Lin. Topology attack and defense for graph neural networks: An optimization perspective. In Sarit Kraus, editor, Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence, IJCAI 2019, Macao, China, August 10-16, 2019 , pages 3961-3967. ijcai.org, 2019.

Ruosong Ye, Caiqi Zhang, Runhui Wang, Shuyuan Xu, and Yongfeng Zhang. Natural language is all a graph needs. CoRR , abs/2308.07134, 2023.

Qinkai Zheng, Xu Zou, Yuxiao Dong, Yukuo Cen, Da Yin, Jiarong Xu, Yang Yang, and Jie Tang. Graph robustness benchmark: Benchmarking the adversarial robustness of graph machine learning. In Proceedings of the Neural Information Processing Systems Track on Datasets and Benchmarks 1, NeurIPS Datasets and Benchmarks 2021, December 2021, virtual , 2021.

Yanping Zheng, Lu Yi, and Zhewei Wei. A survey of dynamic graph neural networks. Frontiers of Computer Science , 19(6):196323, 2025.

Jiong Zhu, Junchen Jin, Donald Loveland, Michael T. Schaub, and Danai Koutra. How does heterophily impact the robustness of graph neural networks?: Theoretical connections and practical implications. In Aidong Zhang and Huzefa Rangwala, editors, KDD '22: The 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, Washington, DC, USA, August 14 - 18, 2022 , pages 2637-2647. ACM, 2022.

Xu Zou, Qinkai Zheng, Yuxiao Dong, Xinyu Guan, Evgeny Kharlamov, Jialiang Lu, and Jie Tang. TDGIA: effective injection attacks on graph neural networks. In KDD '21: The 27th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, Virtual Event, Singapore, August 14-18, 2021 , pages 2461-2471. ACM, 2021.

Daniel Zügner, Amir Akbarnejad, and Stephan Günnemann. Adversarial attacks on neural networks for graph data. In Yike Guo and Faisal Farooq, editors, Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, KDD 2018, London, UK, August 19-23, 2018 , pages 2847-2856. ACM, 2018.

Daniel Zügner and Stephan Günnemann. Adversarial attacks on graph neural networks via meta learning. In 7th International Conference on Learning Representations, ICLR 2019, New Orleans, LA, USA, May 6-9, 2019 . OpenReview.net, 2019.

A Broader Impacts

In this paper, we potentially aid in developing more advanced and sophisticated attacks through understanding text-level vulnerabilities and providing significant positive impacts by enhancing the design of robust defense mechanisms. By pioneering the exploration of text-level GIAs, we enable the creation of more effective countermeasures to protect against these advanced threats, thereby improving the overall security and resilience of systems that rely on GNNs. This dual impact highlights the importance of our work in driving both offensive and defensive advancements, ultimately contributing to safer and more secure AI applications.

B Open Access to Data and Code

GPT-turbo: https://openai.com/ . In this paper, we use the GPT-3.5-turbo model provided by OpenAI for generating textual data. The model was accessed through OpenAI's API services, and all uses were in compliance with the terms of service provided by OpenAI.

Llama3: https://github.com/meta-llama/llama3?tab=readme-ov-file . In this paper, we use Meta Llama 3, which is governed by the Meta Llama 3 Community License Agreement (Meta Platforms, Inc., released April 18, 2024). This tool is employed strictly in accordance with the terms set forth in the licensing agreement and Meta's Acceptable Use Policy.

Raw Data and LLMs-as-Predictors: https://github.com/CurryTang/Graph-LLM . (MIT License).

GIA-HAO: https://github.com/LFhase/GIA-HAO . (MIT License)

C Device Information

All our experiments are conducted on a machine with an NVIDIA A100-SXM4 (80GB memory), Intel Xeon CPU (2.30 GHz), and 512GB of RAM.

D More Related Works

Graph Injection Attacks. Graph Injection Attacks aim to decrease the performance of GNNs by injecting suspicious nodes into the original graph. The newly injected nodes are allowed to process fake features and form connections with existing nodes on the graph. Wang et al. [29] first attempt to inject fake nodes to degrade the performance of GNNs. NIPA [25] applies reinforcement learning to make graph injection decisions. AFGSM [28] uses an approximation strategy to linear the model and solve the objective function efficiently. TDGIA [36] selects edges for newly added edges based on a topological defective edge selection strategy. It then generates node features by optimizing a proposed feature smooth objective function. Chen et al. [2] add a regularization term to the existing objective function for GIA to improve homophily unnoticeability. GANI [4] employs a statistics-based approach to calculate node features, ensuring the generated features remain unnoticeable but leading to a significant decline in performance. All the GIAs mentioned are designed at the embedding level. Despite some constraints being applied to the injected features, the semantic coherence and logical consistency of generated features at the text level remain unexplored.

Graph Modification Attacks. Graph Modification Attacks aim to decrease the performance of GNNs by modifying the graph structure or node features of the original graphs. Nettack [37] adopts a greedy strategy to select edge and node feature perturbations with unnoticeability constraints. Zügner et al. [38] treat the graph structure as a hyperparameter and use meta-gradients to solve the bilevel poisoning attack objective. Xu et al. [31] use Projected Gradient Descent (PGD) to find the best perturbation matrix. The above algorithms significantly degrade the performance of GNNs, yet all require O ( N 2 ) space complexity. To address the scalability issues, Geisler et al. [5] propose PRBCD and GRBCD using Randomized Block Coordinate Descent. The algorithms are of O ( |E| ) time and space complexity and can be scaled up to datasets containing more than 1 million nodes.

Raw Text learning on TAGs. With the development of LLMs, works combining them with GNNs have continuously emerged, showing outstanding performance in various graph-related tasks on

TAGs. TAPE [9] uses LLMs as a feature enhancer to obtain high-quality node features. In InstructGLM [32], the authors propose scalable prompts based on natural language instructions that describe the topological structure of a graph. Guo et al. [7] analyze the ability of LLMs to understand graph data and solve graph-related tasks. Chen et al. [3] conduct a benchmark evaluating the performance of LLMs as the feature enhancer and the predictor, respectively. More related works about LLMs in Graph could be referred to [15, 24, 14]. Although LLMs have seen numerous applications in graph tasks, works exploring the robustness of GNNs are still sparse.

Although Graph Modification Attacks are powerful attacks, recent works point out that they do not align well with real-world attack scenarios [33], and they are theoretically inferior to GIAs in attack performance [2]. Moreover, while raw texts are proven to be helpful in improving the performance of graph tasks, works exploring the robustness of GNNs at the text level are still sparse.

E Datatset Statistics and Budgets of Attacks

Dataset information is summarized in Table 5 and Table 6. The budget of GIAs is summarized in Table 7.

Table 6: The statistics reflect the number of words used in each dataset. "Avg." represents the average word count per dataset, while "Std." indicates the standard deviation of word counts. Assuming a normal distribution of word lengths, "Avg. + 2Std." denotes the upper bound of the 95% confidence interval. This metric is employed as a benchmark for establishing maximum word/token limits in paper generation experiments.

F Further Illustration and Proof to Theorem 1

The formulation for Theorem 1 relies on the below intuitions.

Performance: An attack is more effective against node v t if it uses more words w n ∈ W n .

Unnoticeability: An attack is less detectable if the similarity between x t and x i is higher.

Interpretability: An attack is more interpretable if fewer words are required to use, where the x t · 1 is smaller.

In the intuition behind performance, we actually believe that words beneficial to the classification of the target node are located in W u , while words detrimental to the classification of the target node are located in W n . However, strictly speaking, not all words in W n have a negative impact on the classification of the target node. Additionally, when a certain amount of classification words is introduced, the negative impact becomes marginal and does not consistently increase. Therefore, using more words w n ∈ W n does not linearly correspond to higher performance.

However, this does not affect the insight provided by Theorem 1. Since k ≪ F , the continuous increase in the usage of w n ∈ W n within a certain range is significant. Since we do not consider situations where m ≫ k , we indeed focus on 'uses more words w n ∈ W n in a certain range' intrinsically. Thus, under this premise, the theorem's description of performance remains applicable.

Proof. The problem is formulated as:

From inequality (6), we obtain:

which leads to:

Since a is positive, the only feasible solution is:

By substituting this into equation (5), we obtain:

Solving the resulting inequality with respect to b , we find:

Hence, the solution to the maximization problem is:

G Collections of Illustrations

G.1 Illustration of Interpretable Regions

The illustration of interpretable regions is provided in Figure 6.

Interpretable region

Feasible region (1)

Feasible region (2)

G.2 Alternative for PGD in ITGIA

In addition to the methods mentioned in the main body of the paper, we also considered using the Riemannian Gradient Descent as a way to obtain the embedding for ITGIA. This method performs gradient descent in the tangent space of the sphere to ensure the resulting embedding's normality.

Formally, to solve the optimization problem

using Riemannian gradient descent, we follow these steps:

Initialization : Start with an initial point x 0 such that ∥ x 0 ∥ = 1 .

Gradient Calculation : At each iteration k , compute the Euclidean gradient ∇ f ( x k ) .

Projection onto Tangent Space : Project the Euclidean gradient onto the tangent space of the sphere at x k :

where ∇ R f ( x k ) is the Riemannian gradient.

Update Step : Move in the direction of the Riemannian gradient and re-project onto the sphere:

where α k is the step size and Proj S ( y ) = y ∥ y ∥ ensures that the updated point lies on the sphere.

Iteration : Repeat steps 2-4 until convergence.

The PGD method we adopted can be regarded as the variant of Riemannian Gradient Descent without the 'Projection onto Tangent Space' step. Although the Riemannian Gradient Descent has better theoretical properties [1], since we did not observe significant advantages over PGD in our experiments, we opted for the simplicity of using PGD, as discussed in the main body of our paper.

G.3 Illustration of Co-occurrence Constraint

The co-occurrence constraint in [28] requires that columns that do not appear together in the original dataset must not appear together in the injected embeddings either.

Let X be a binary feature matrix with dimensions N × F , where N represents the number of samples and F represents the number of features. Each element x ij in the matrix X is defined as:

The co-occurrence matrix C is then an F × F matrix where each element c ij , representing the pair of words i and j , is computed as follows:

Here, X T is the transpose of X , and the multiplication X T X results in a matrix where each element c ′ ij is the sum of the products of corresponding elements of X :

The value c ij represents the number of texts where both words i and j are present. The physical meaning of c ij > 1 is that features i and j co-occur in at least one text, indicating a possible association or dependency between them within the dataset. A co-occurrence-constrained FGSM only allows flips that satisfy if word i and word j appear in the injected embeddings, they must have c ij > 1 .

We examine the sparsity of C in Table 8. We can see that almost every two words have co-occurred before, making the constraints meaningless.

H Experiment Details

H.1 Setup and Hyperparameters

Attacks. For the injected embedding features, we use PGD [33, 2] with a learning rate of 0.01, and the training epoch is 500. An early stop of 100 epochs according to the accuracy of the surrogate model on the target nodes. For TDGIA and ATDGIA, we use the method of [36] to generate injected embeddings. The weights k 1 and k 2 are set 0 . 9 and 0 . 1 by default. The sequential step is set as 1 . 0 for MetaGIA to save computational costs, while 0 . 20 for methods. For Binary FGSM, the batch size is set to as B = 1 in Cora and CiteSeer, and B = 50 for PubMed. For the hyperparameters of SeqGIA, MetaGIA, and SeqAGIA, we directly follow the setting as in [2]. A simplified description of the Sequential injection framework is provided in Appendix 1, and the FGSM function is provided in Appendix 2.

Harmonious Adversarial Objective. The HAO constraint can be formulated as:

Here, L pred represents the cross-entropy loss on target nodes, calculated between the current predictions of the surrogate model and the original predictions made on the clean dataset by the same model. The loss term L HAO = sim ( X ′ inj , ( X ′ A ′ ) inj ) , where sim returns the cosine similarity between injected node features and propagated injected node features. We set γ = 10 in SeqGIA, SeqAGIA and MetaGIA, γ = 1 in TDGIA, ATDGIA and set γ = 1 e -6 in FSGM, where we empirically find a balance in the attack performance and unnoticeability to escape from homophily-based defender.

Note that in Figure 2, γ is multiplyed by the weights as the final coefficient. Denote γ ′ = γ ∗ w , where w is the weight listed in the x-axis of the figure, we apply L = L pred + γ ′ L HAO as the final loss function.

Defense. For both GCN and EGNNGuard, we set the number of layers as 3 and use a hidden dimension of 64. We set the dropout rate as 0.5 and adopt Adam optimizer [12] with a learning rate of 0.01. The number of training epochs is 400. We adopt the early stop strategy with a patience of 100 epochs. The threshold is set as 0.1 following [2], which we find powerful enough in detecting noticeable injections.

Others. The temperature of the GPT-turbo is set as 0.7. In ITGIA, the beam-width is set as 2. In WTGIA, the max-token for gpt-turbo and Llama3 is set to 500 for Cora and CiteSeer and 550 for

PubMed. We set the the number of dialogs in multi-round corrections as 3. We set the max-token to avoid over-length generation. Based on the typical ratio of 0.75:1 between the number of words and the number of tokens, we proportionally scale this relationship using the data from Table 6 to obtain the specific numbers for this limitation.

H.2 Prompt Design

Table 9 provides our prompt designs for different prompt strategies of vanilla text-based GIAs. The <adj/example_paper_content> is comprised of paper id, title, and abstract of adjacent/example nodes, and ... denotes fillable blanks for the model to fill in. The <LMIN> and <LMAX> correspond to the length limit for each dataset as specified in Table 6. Generally, our experiments find that the current instructions allow the LLM to produce output that conforms well to the expected format without significant deviations.

Table 9: Prompts of vanilla text-based GIAs. Number of positive examples are set to as 5, and number of negative examples are set to as 3.

Table 10 provides prompts of WTGIA with different generation type.

I Collections of Pseudo-code

I.1 Pseudo-code for Sequential GIAs

The pseudo-code for sequential node injection strategy is displayed in Algorithm 1. A simple illustration of the feature update function of SeqGIA, MetaGIA, TDGIA, and SeqAGIA is given in Algorithm 3. The pseudo-code for Binary FGSM feature update functions is displayed in Algorithm 2. For FGSM binary attacks, we implement the structure updates in the sequential node injection manner, as it is shown more powerful by previous works [28, 2]. The initialization of X inj is set as X inj = 0

and applying feature update function as in Algorithm 2. For the details about the structure update function H of SeqGIA, MetaGIA, TDGIA, ATDGIA, AGIA, and the feature update function of TDGIA and ATDGIA, please refer to [2, 36].

Note that in ITGIA, if normalized, after each single epoch of feature update, we project the output X inj to a unit sphere. A text illustration of PGD can be found in G.2, where an alternative to vanilla PGD is discussed.

Algorithm 1: Sequantial Attack Framework

I.2 Pseudo-code for Vanilla Text-Level GIAs

The pseudo-code for vanilla text-level GIAs is displayed in Algorithm 4, which is implemented in a sequential manner following SeqGIA. Note that the feature is not updated within the 'while loop' since gradient information is infeasible.

J Interpretability of Generated Texts

J.1 Perplexity and Use Rate

We calculate perplexity based on GPT2 [21] following https://huggingface.co/docs/ transformers/perplexity . Note that due to the model capacity constraint, the output of ITGIA is truncated to 32 tokens. So, we truncate all texts into 32 tokens before calculating Perplexity to make them comparable to each other. We present the results of average perplexity, and use rate in WTGIA in Table 11, Table 12, Table 13 and Table 14.

In the experiments, VTGIA consistently achieves the lowest perplexity scores, indicating superior performance, followed by the WTGIA model. Conversely, ITGIA exhibits the highest perplexity, rendering it the least interpretable. Notably, even the variant incorporating -HAO fails to enhance interpretability corrsponding to normal texts. Furthermore, our findings suggest a positive correlation between model use rate and perplexity. Specifically, a lower use rate corresponds to reduced perplexity, thereby enhancing interpretability. This observation aligns with the hypothesis that as the use rate decreases, LLMs preferentially select words from a specified set that are more interpretable, rather than striving to utilize all specified words.

J.2 Examples of VTGIA

We show the generated examples on the Cora dataset for VTGIA, one for each prompt type.

Heterophily Prompt Example. Title: Reinforcement Learning Techniques for Rule Learning Optimization Abstract: This paper explores the application of reinforcement learning techniques to optimize the process of rule learning. Traditional rule-learning algorithms often struggle with complex datasets and high-dimensional feature spaces, leading to suboptimal rule sets. By leveraging the power of reinforcement learning, we propose a novel approach that dynamically adapts the rule learning process based on feedback from the environment. We start by formulating the rule learning problem as a Markov decision process, where the agent's actions are the selection and refinement of rules based on the input data. We introduce a reward function that incentivizes the discovery of rules with high predictive power while maintaining simplicity and interpretability. Through a series of experiments on benchmark datasets, we demonstrate the effectiveness of our approach in outperforming traditional rule learning methods. Furthermore, we investigate the convergence properties of our reinforcement learning algorithm and provide theoretical bounds on its performance. Our results show that by combining reinforcement learning with rule learning, we can achieve more accurate and concise rule sets, leading to improved generalization performance on unseen data. Overall, this paper contributes to the intersection of reinforcement learning and rule learning, opening up new possibilities for optimizing rule-based systems in various domains.

Random Prompt Example. Title: Exploring the Influence of Martial Arts on Japanese History Abstract: This paper delves into the deep-rooted connection between martial arts and the historical landscape of Japan. By tracing the evolution of various martial art forms such as Judo, Kendo, and Karate, we analyze how these disciplines have not only shaped the physical combat techniques but also contributed significantly to the cultural, philosophical, and political development of Japan. Through studying the impact of samurai warriors, martial arts schools (ryu), and renowned martial artists throughout different historical periods, this paper uncovers the intricate interplay between martial arts and Japan's societal norms, values, and power dynamics. Furthermore, by exploring the

ways in which martial arts have been depicted in art, literature, and popular culture over the centuries, we gain a deeper understanding of how these practices have transcended mere combat techniques to embody spiritual, ethical, and aesthetic principles. Ultimately, this paper aims to shed light on the enduring legacy of martial arts in Japanese history and the profound influence they continue to exert on various aspects of Japanese society today.

Mixing Prompt Example. Title: Unified Approaches in Machine Learning and Control Systems Abstract: This paper presents a novel approach to machine learning and control systems by integrating various techniques such as probabilistic methods, neural networks, case-based reasoning, genetic algorithms, theory, reinforcement learning, and rule learning. The proposed framework leverages the strengths of each approach to address complex problems in a unified manner. It introduces a new algorithm, contextual machine learning, which incorporates adaptative history-sensitive models for source separation, making use of the temporal structure of input data. Furthermore, the paper explores the application of non-linear systems in robust control and the use of functional programming by analogy in the domain of program synthesis. Additionally, it presents a learning algorithm for Disjunctive Normal Form (DNF) under the uniform distribution, with implications for the case when certain parameters are constant. The paper also discusses the use of Gaussian noise in sigmoidal belief networks and the training of such networks using slice sampling for inference and learning. Finally, it showcases the application of radial basis function networks in predicting power system security margin. Overall, this paper provides a comprehensive overview of the diverse applications and advancements in machine learning and control systems, demonstrating the potential for creating unified approaches that transcend traditional boundaries.

J.3 Examples of ITGIA

We show the generated examples on the Cora dataset for ITGIA in this subsection. The output is highly uninterpretable due to ill-defined interpretable regions for injected embeddings.

ITGIA-TDGIA without HAO, Cos: 0.136

of the following: MC Dallas' NSA sign, and some of the relays of the past few years: Trumpet Jam's sinus

the liner notes of The MC6's "Desirty Pigs": the relayed that some of the plaque

liner notes of The MC's "The Lion's Pie" album: some relayed that the 'bumpy' fluid

the following: One of the croons of the "Petsy on the MC12" relayed: Demitab

ITGIA-TDGIA with HAO, Cos: 0.742

'Sympteric' Alignment. This is one of the best examples of how to achieve high level information retrieval algorithms using proportion

"Asymptotically" by Grant. This is a key method for constructing local information representation systems that support multicluster connections

Emilia. The 'Proplective information with no associativity at all' NNNN algorithms are based on Monte simple scenarios

J.4 WTGIA

We show the generated examples on the Cora dataset with sparsity budget set as 'average' for WTGIA in the subsection. We choose the FGSM-TDGIA for embedding generation. We display one example for each generation type.

GPT. Title: Hierarchical Recurrent Neural Networks for Visual Sequence Identification and Dimensional Improvement

Abstract: In this article, we demonstrate the idea of using hierarchical recurrent neural networks for visual sequence identification, resulting in dimensional improvement. We show that this approach requires the underlying mechanisms of backpropagation through time to obtain a more powerful representation of visual sequences. Additionally, we identify the nonlinear nature of the sequence identification problem and how the use of recurrent neural networks leads to nonlinear improvement in identifying visual sequences. Furthermore, we present a novel approach to dealing with hierarchical

structures in visual sequences, utilizing the power of recurrent neural networks to identify objects in a hierarchical and sample-efficient manner. This work contributes to the science of visual sequence processing and demonstrates the capability of recurrent neural networks to handle complex visual sequences, such as trees, lines, and vector objects.

GPT-Topic. Title: Hierarchical Neural Networks for Visual Sequence Identification: Exploring the Power of Recurrent Mechanisms in Computer Science

Abstract: This paper presents an investigation into the use of hierarchical neural networks for visual sequence identification in computer science. The underlying idea is to demonstrate the power of recurrent mechanisms in identifying dimensional visual sequences. The resulting improvement in identification accuracy leads to the direct application of backpropagation mechanisms for obtaining nonlinear vector representations of visual sequences. In addition, the paper explores the application of hierarchical neural networks in identifying hierarchical tree structures within visual sequences. The research also requires the exploration of probabilistic methods for identifying sample sequences and tree structures within visual sequences. This work contributes to the advancement of science in computer vision and object recognition by exploring the hierarchical structure of sequences.

Llama. Title: Harnessing the Power of Hierarchical Neural Trees for Dimensionally-Transformed Sequence Identification and Improvement through Addition and Recurrent Back-Propagation

Abstract: This article proposes a groundbreaking idea that combines the strengths of hierarchical neural trees and recurrent back-propagation to identify and classify nonlinear sequences. By leveraging the underlying mechanisms of neural trees and incorporating the addition of recurrent feedback, we demonstrated a remarkable improvement over conventional sequence identification methodologies through the power of back-propagation. Our methodology requires the creation of a vector-based object that represents the sequence, which is then fed into a hierarchical neural line that utilizes recurrent back-propagation to identify the underlying dimensional transformations. This leads to a resulting sample of sequences that can be analyzed and visualized to obtain a deeper comprehension of the object's underlying mechanisms. To validate our idea, we conducted a comprehensive sequence identification experiment, where we utilized a sample of sequences to train and fine-tune our hierarchical neural trees. Our resulting sequences demonstrated a remarkable capability to identify and classify nonlinear sequences, out-performing other leading methodologies, and providing a visual insight into the underlying mechanisms. This breakthrough has the power to revolutionize the science of sequence identification and has far-reaching implications for fields such as signal-processing, image-recognition, and predictive analytics.

Llama-Topic. Title: Hierarchical Recurrent Neural Trees for Dimensionally Reduced Sequence Identification and Power System Monitoring

Abstract: This article demonstrates the effectiveness of hierarchical recurrent neural trees (HRNT) for identifying sequences of nonlinear phenomena occurring within power grids. By leveraging the power of back-propagation through trees, HRNT is capable of capturing underlying mechanisms governing the system's nonlinear interactions. Our HRNT-based sequence identification idea requires a hierarchical arrangement of recurrent neural trees, which are then utilized to identify sequences of interest along a dimensional line of power transmission. Notably, our methodology leads to a resulting improvement of up to [X]% over conventional sequence identification schemes, which has been demonstrated through a sample dataset of power system measurements. Furthermore, our HRNT-based system can effectively identify nonlinear phenomena, such as addition of harmonics, and nonlinear interactions between power system objects, leveraging the power of vector calculus to obtain a comprehensive picture. Our visualizations of the resulting sequences and underlying mechanisms have been found to be particularly insightful for power system scientists, contributing to the advancement of the science and providing a valuable addition to the scientific community.

K More Experiments about WTGIA and ITGIA

K.1 Transfer WTGIA to More Datasets

In Tables 15 and Table 16, we included the ogbn-arxiv dataset [10], containing over 160,000 nodes, and a social network dataset, Reddit [11], with more than 30,000 nodes, to evaluate the scalability and generalization of text-level GIAs. We injected 1,500 nodes into ogbn-arxiv, following the budget

specified in [2], and proportionally injected 500 nodes into Reddit. On both datasets, WTGIA maintains use rates above 90% and shows good attack performance when transferred to GTR.

K.2 Against More Defense Models

In Table 17, Table 18, Table 19, Table 20, Table 21, and Table 22, we include classic methods like GAT [27] and GraphSAGE [8], as well as the EGNNGuard and Layernorm (LN) methods, which have been proven highly effective in [2].

We discover interesting new results, such as LN's effectiveness on text-level GIAs not being as strong as previously reported for embedding-level attacks, especially for WTGIA. This is because embedding-level GIAs often exhibit abnormal norms, which LN exploits for defense. However, text-level GIAs derive embeddings from real text, avoiding structural anomalies and bypassing LN's defenses. This suggests that some traditional defense methods that were particularly effective may be limited to the embedding level. The EGNNGuard method is generally effective and performs well overall. As mentioned in the main paper, attackers can use techniques like HAO to bypass EGNNGuard, but this often involves trade-offs.

K.3 Transfer to More Embedding Methods

In Table 23 and Table 24, we included SentenceBert all-MiniLM-L6-v2 [22] as a new embedding backbone. We find that WTGIA shows some transferability between different embeddings, but the

results are still unsatisfactory. Although GTR and SBERT are both PLM-based embeddings, the adversarial text by ITGIA performs even worse than WTGIA when transferred to SBERT. We believe the transferability of text-level GIAs remains a significant challenge.

L Full Experiment Results

L.1 Figure 5 for WTGIA with Topic

The results of WTGIA variants with topic constrained in the prompt are shown in Figure 7.

6

8

10

12

14

16

18

20

Sparsity Budget (%)

42

44

46

48

50

52

Performance (%)

Cora with Topic

6

8

10

12

14

16

18

20

Sparsity Budget (%)

44

46

48

50

52

Citeseer with Topic

10

12

14

16

18

20

Sparsity Budget (%)

50

60

70

80

Pubmed with Topic

50

60

70

80

90

50

60

70

80

90

0

20

40

60

80

Use Rate (%)

GPT Attack Performance

GPT Use Rate

Llama Use Rate

L.2 Full Results for ITGIA

Full results for ITGIA, as shown in Figure 2 are displayed in Table 1, Table 26, Table 27, and Table 28.

L.3 Full Results for Row-wise FGSM

Full results for Row-wise FGSM, as shown in Figure 3 are displayed in Table 29, Table 30, Table 31, Table 32, and Table 33.

L.4 Full Results for WTGIA

Full results for WTGIA, as shown in Figure 5 are displayed in the below tables. For average sparsity budget: Table 34, Table 35, Table 36.

For sparsity budget 0.10: Table 37, Table 38.

For sparsity budget 0.15: Table 39, Table 40. Table 41.

For sparsity budget 0.20: Table 42, Table 43. Table 44.

NeurIPS Paper Checklist

1. Claims

Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?

Answer: [Yes]

Justification: The claims we made accurately reflect the paper's contributions and scope.

Guidelines:

The answer NA means that the abstract and introduction do not include the claims made in the paper.

The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.

The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.

It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.

2. Limitations

Question: Does the paper discuss the limitations of the work performed by the authors?

Answer: [Yes]

Justification: We discuss the limitations of text-level attacks in Section 5.

Guidelines:

The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.

The authors are encouraged to create a separate "Limitations" section in their paper.

The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.

The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.

The authors should reflect on the factors that influence the performance of the approach. For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.

The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.

If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.

While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.

3. Theory Assumptions and Proofs

Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?

Answer: [Yes]

Justification: We provide proof to our theorem in the Appendix.

Guidelines:

The answer NA means that the paper does not include theoretical results.

All the theorems, formulas, and proofs in the paper should be numbered and crossreferenced.

All assumptions should be clearly stated or referenced in the statement of any theorems.

The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition.

Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.

Theorems and Lemmas that the proof relies upon should be properly referenced.

4. Experimental Result Reproducibility

Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?

Answer: [Yes]

Justification: We provide the pseudo-code in the Appendix and the code URL in the abstract.

Guidelines:

The answer NA means that the paper does not include experiments.

If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.

If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.

Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.

While NeurIPS does not require releasing code, the conference does require all submissions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example

(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.

(b) If the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.

(c) If the contribution is a new model (e.g., a large language model), then there should either be a way to access this model for reproducing the results or a way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).

(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.

5. Open access to data and code

Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material?

Answer: [Yes]

Justification: We report open access information in Appendix B.

Guidelines:

The answer NA means that paper does not include experiments requiring code.

Please see the NeurIPS code and data submission guidelines ( https://nips.cc/ public/guides/CodeSubmissionPolicy ) for more details.

While we encourage the release of code and data, we understand that this might not be possible, so 'No' is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).

The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines ( https: //nips.cc/public/guides/CodeSubmissionPolicy ) for more details.

The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.

The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only a subset of experiments are reproducible, they should state which ones are omitted from the script and why.

At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).

Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted.

6. Experimental Setting/Details

Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?

Answer: [Yes]

Justification: We provide experimental settings in Appendix H.1.

Guidelines:

The answer NA means that the paper does not include experiments.

The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them.

The full details can be provided either with the code, in appendix, or as supplemental material.

7. Experiment Statistical Significance

Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?

Answer: [Yes]

Justification: We repeat experiments 10 times and report the standard deviation in the tables.

Guidelines:

The answer NA means that the paper does not include experiments.

The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).

The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)

The assumptions made should be given (e.g., Normally distributed errors).

It should be clear whether the error bar is the standard deviation or the standard error of the mean.

It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors is not verified.

For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).

If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.

8. Experiments Compute Resources

Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?

Answer: [Yes]

Justification: We have included resources information in Appendix C.

Guidelines:

The answer NA means that the paper does not include experiments.

The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.

The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.

The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).

9. Code Of Ethics

Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.cc/public/EthicsGuidelines ?

Answer: [Yes]

Justification: We conform in every respect with the NeurIPS Code of Ethics.

Guidelines:

The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.

If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.

The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction).

10. Broader Impacts

Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?

Answer: [Yes]

Justification: We have included Broader Impacts section in the Appendix A.

Guidelines:

The answer NA means that there is no societal impact of the work performed.

If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.

Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.

The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.

The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.

If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).

11. Safeguards

Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?

Answer: [NA]

Justification: The paper poses no such risks.

Guidelines:

The answer NA means that the paper poses no such risks.

Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.

Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.

We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.

12. Licenses for existing assets

Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?

Answer: [Yes]

Justification: We have included the license clarification in Appendix B.

Guidelines:

The answer NA means that the paper does not use existing assets.

The authors should cite the original paper that produced the code package or dataset.

The authors should state which version of the asset is used and, if possible, include a URL.

The name of the license (e.g., CC-BY 4.0) should be included for each asset.

For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.

If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset.

For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.

If this information is not available online, the authors are encouraged to reach out to the asset's creators.

13. New Assets

Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?

Answer: [Yes]

Justification: The paper included anonymized code in the supplementary file. The training, license, and limitations have been discussed in Appendix B, Appendix H.1.

Guidelines:

The answer NA means that the paper does not release new assets.

Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.

The paper should discuss whether and how consent was obtained from people whose asset is used.

At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.

14. Crowdsourcing and Research with Human Subjects

Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?

Answer: [NA]

Justification: The paper does not involve crowdsourcing nor research with human subjects.

Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should be included in the main paper.

According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.

15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects

Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?

Answer: [NA]

Justification: The paper does not involve crowdsourcing nor research with human subjects. Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.

For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.

Peer reviews:
comments: SUMMARY:
The paper studies Graph Injection Attacks on text-attributed graphs. The study presents three attack designs: Vanilla Text-level GIA (VTGIA), Inversion-based Text-level GIA (ITGIA), and Word-frequency-based Text-level GIA (WTGIA). The key contributions include demonstrating the effectiveness of text level perturbation on Graph Injection Attack and the performance of using LLMs as a defender. WTGIA shows significant attack potential while maintaining understandability. It is a timely study on the vulnerabilities of text attributes in graphs.

STRENGTHS:
1. Good investigation on the role of text manipulation in graph injection attacks. The text attributes in graphs are getting increasingly important. Demonstrating their vulnerabilities to GIA and the role of LLM can play as a defender are important to applications using text-attributed graphs.

2. The proposed WTGIA method achieves good attack performance with understandable text perturbation.

WEAKNESSES:
1. The embedding-text-embedding process is not very clear to me. Additional explanation will be helpful. It is unclear how different embedding models may affect the performance of this process. 

2. The term interpretability in this paper has different semantics to the commonly used one in explainable AI. It is confusing and creates unnecessary obstacles in reading. It is better replace with understandability.

QUESTIONS:
1. What is the computing complexity of WTGIA? How long does it take to generate an attack in average in your experiment environment? 

2. What is the impact of different text embedding models on the attack performance?

LIMITATIONS:
Limitations on transferability is discussed in the paper.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 4
DATE: 2024-07-09

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper investigates an interesting topic. The authors first discuss the practicality of Graph Injection Attacks (GIA), arguing that previous approaches, which merely inject harmful embeddings, are unrealistic. It introduces three text-level GIA methods: ITGIA, VTGIA, and WTGIA, and conducts a thorough examination of their attacking performance and interpretability. The findings reveal that WTGIA excels in both attacking effectiveness and interpretability. Additionally, the paper explores the defensive capabilities of Large Language Models (LLMs) and discovers that they can effectively evade the impact of injected nodes. This underscores the importance of enhancing the performance of text-level attackers.\n\nSTRENGTHS:\n1. This paper first addresses the impracticality of embedding-based GIAs and explores text-level GIAs, introducing three novel text-level GIA methods. Among these, WTGIA effectively balances attack performance and interpretability.\n\n2. The authors have conducted comprehensive experiments that thoroughly address the research questions posed in the study.\n\n3. The theorem discusses the conditions under which destructive texts can be identified, providing a clear theoretical foundation for the work.\n\n4. This paper offers valuable insights into the new challenges associated with text-level GIAs, identifying emerging directions in this field.\n\nWEAKNESSES:\n1. The authors should provide references for the cited papers on TDGIA, ATDGIA, MetaGIA, and AGIA.\n\n2. The authors should explain why the attack performance initially decreases and then increases as the sparsity budget increases, as shown in Figure 5.\n\n3. The authors should clarify how the LLM optimizes the graph structure after generating the text for the injected nodes.\n\nQUESTIONS:\n1. For VTGIA, how does the LLM optimize the graph structure after generating the text for the injected nodes?\n\n2. The attacking method of WTGIA is interesting. Could this idea inspire other areas of GNN?\n\n3. In Section 4, could you clarify the embedding-text-embedding process? Specifically, in Section 3, under Analysis of Performance and Interpretability, it seems that after inversion, text is generated. What embedding results after this inversion?\n\n4. Why do you introduce FGSM to generate binary embeddings? Is it not possible to directly transform the embeddings into binary embeddings?\n\n5. In Figure 5, why does the attack performance initially decrease and then increase as the sparsity budget increases?\n\nLIMITATIONS:\nSome parts of Section 4.1 are hard to understand, I admit I didn't check the proof related to the theorem in the Appendix. I think the authors could add figures or improve their presentations to better illustrate WTGIA.", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 4, "DATE": "2024-07-10"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper studies GIAs, particularly focusing on text-attributed graphs (TAGs). It introduces a method for GIAs by injecting textual content directly into the graph, as opposed to the traditional method of embedding-level attacks. The authors propose three new attack designs: Vanilla Text-level GIA (VTGIA), Inversion-based Text-level GIA (ITGIA), and Word-frequency-based Text-level GIA (WTGIA). They demonstrate that text interpretability is necessary for the effectiveness of these attacks. They also show that defenses can be enhanced using customized text embedding methods or large language model (LLM)–based predictors.\n\nSTRENGTHS:\nI found this to be a very original paper as it shifts from embedding-level GIAs to text-level GIAs. Three new attacks are created and are tested theoretically and empirically.  Most importantly, the GIAs created ensure that the attacked nodes have semantically useful information, making the attack more realistic, using LLMs.\n\nWEAKNESSES:\nThe paper does not explore the robustness of the proposed GIAs against more sophisticated defense mechanisms beyond customized text embedding methods and LLM-based predictors. \n\nAlthough the authors mention that LLM-based defenses enhance protection against text-level GIAs, the experiments primarily focus on a few specific methods and datasets. These are limited in scope. \n\nThe trade-offs between performance, unnoticeability, and interpretability, as discussed in Sections 4.1 and 4.2, could be examined more thoroughly. While the paper shows that increasing the sparsity budget enhances attack performance but reduces interpretability, further experiments across a wider variety of datasets could validate these findings more convincingly, especially with additional baselines. Including more traditional GIA methods or other recent advancements in graph attack techniques would also be useful.\n\nThe discussion on the practical implementation of these attacks in real-world applications could be expanded. The paper mainly provides experimental insights but lacks detailed exploration of the real-world scenarios you stake your paper around, and practical challenges like the scalability of the proposed methods to larger and more complex graphs, the computational costs associated with implementing these attacks, and potential detection mechanisms in real-world systems are not thoroughly addressed. Providing more actionable insights and guidelines for practitioners could significantly enhance the practical relevance of the research.\n\nLastly, while the authors discuss the potential for enhancing defenses using customized text embedding methods or LLM-based predictors, they do not explore the possibility of integrating multiple defense strategies. Combining different defense mechanisms could potentially create more robust protection schemes against text-level GIAs. \n\nTypos: line 296 and line 211\n\nQUESTIONS:\n1. Can the authors provide more details on how the sparsity budget impacts the interpretability and effectiveness of the text-level GIAs across different datasets?\n2. How would this work apply to dynamic graphs where nodes and edges evolve over time?\n3. Are there any challenges in scaling the proposed GIAs to larger graphs or more complex datasets?\n\nLIMITATIONS:\nN/A", "TITLE": "Official Review", "RECOMMENDATION": 8, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 4, "DATE": "2024-07-12"}

comments: SUMMARY:
This paper explores the vulnerability of GNNs to Graph injection Attacks (GIAs), which involve injecting malicious nodes into a graph. This paper explores GIAs at the text level, presenting three types of GIA designs that inject textual content into the graphs. The significance of text interpretability in attack effectiveness and the defense against text-level GIAs are also explored.

STRENGTHS:
1. The idea is straightforward and easy to follow.
2. The study of text-level graph injection attacks is interesting and practical.

WEAKNESSES:
1. In line 126–131, the paper claims that traditional methods focus mainly on the embedding level. However, some existing works (e.g., [1]) focus on the raw feature level. The authors fail to discuss why these works cannot be applied to this task.
2. Limited technical contribution. In this paper, three kinds of text-level GIA are proposed. However, I think all of them are simply combining both existing GIA techniques and language models, which are kind of incremental contributions. 
3. I think the proposed text-level GIA is similar to the traditional GIA, especially when the nodes' texts are encoded into embeddings by LMs. Therefore, I think some existing defense methods against GIA can be also applied to this task. The authors need to discuss that. 
4. The experiments only focus on small-scale datasets. More large-scale datasets need to be included.
5. Only vanilla GCN is used in the experiments, which may induce to biases to the conclusions. More advanced GNNs need to be included.



[1] Understanding and Improving Graph Injection Attack by Promoting Unnoticeability. ICLR 2022.

QUESTIONS:
Refer to weaknesses.

LIMITATIONS:
A section to discuss the limitations is missing.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 2
DATE: 2024-07-23