## 1 Introduction
In contrast, the query-based approach starts with an initial set of fake nodes, enabling the attacker to optimize these nodes through a process of iteratively querying the target model, particularly focusing on the classification confidence scores of the target node. These methods eschew the need for ground-truth labels, requiring only the sub-graph that includes the victim node and its neighbors. Consequently, a query-based approach can be regarded as a more practical and better-suited approach to the constraints of real-world contexts. In query-based attacks, the features of the fake nodes are usually randomly initialized, followed by a process of iterative optimization via repeated queries, which demands multiple queries to effectively perform the attack. To bridge this gap, we introduce a strategy that harnesses graph knowledge in an unsupervised manner, through Graph Contrastive Learning (GCL) [14; 15; 16], to guide the initial generation of the fake nodes. This approach significantly enhances the attack success rate in the initial query and reduces the overall number of queries required. Specifically, the proposed method involves training a GCL model to capture the embeddings of the target nodes. Leveraging this model, we fine-tune the features and edges of the fake nodes by maximizing the variation in the embeddings of the target nodes after injecting fake nodes. This technique employs unsupervised graph knowledge to sharpen the attack strategy. After obtaining responses from the target model, we utilize the classification confidence scores of the target nodes to train a simple classifier that stands in as a surrogate for the target model. By minimizing the confidence level in the genuine class, we are able to effectively optimize the fake nodes using the output from our classifier. In this work, we concentrate on the query-based black-box graph injection attack, which closely resembles real-world scenarios. Within this framework, access is limited to the features of the target nodes and their neighbors, as well as the adjacency matrix that represents the connections between these nodes. Furthermore, the ability to query the target model is also available. To launch an evasion attack under these constrained conditions, we introduce a Graph Contrastive Learning-based Graph Injection Attack(GCIA) method. The GCIA methodology is comprised of three core components: a node encoder, a reward predictor, and a fake node generator. The node encoder in GCIA is a Graph Contrastive Learning (GCL) model equipped with two graph convolutional layers. It employs a strategy of randomly removing edges and masking node features to generate diverse graph views, thereby producing node embeddings in an unsupervised fashion. The reward predictor functions as a surrogate for the target model, learning the correlation between the node embeddings and the query results through a straightforward Multi-Layer Perceptron (MLP) architecture. The fake node generator is designed to optimize the fake nodes and their edges, with the dual objectives of maximizing the shift in the embedding space of the target node and minimizing the categorical confidence scores provided by the reward predictor. The proposed GCIA method initiates by training a feature encoder on the accessible graph data, which is followed by an iterative process of generating fake nodes and conducting queries. With each query result, the reward predictor is meticulously fine-tuned using the queried classification confidence scores to better grasp the decision boundaries of the target model. Thereafter, the fake node generator utilizes the insights from previous unsuccessful forays to produce fake nodes and edges that are more likely to lead to a successful attack. The key contributions of this work are as follows:  
* To the best of our knowledge, this is the first work that utilizes unsupervised learning for graph injection attacks. By maximizing the changes in the target node in the embedding space, we have significantly enhanced the success rate of the initial attack query.