## 5 Experiment  
### Settings  
**Datasets:** We conducted our experiments on four acknowledged datasets. Cora [32] and Citeseer [32] are citation datasets with discrete features, Pubmed [32] is a citation dataset with continuous features, and Reddit [33] is a social network dataset with continuous features. For Reddit, we explored the subgraphs and splits shared by G-NIA [19].  
**Comparison Methods:** We compared our work with four black-box graph injection attack methods. The G\({}^{2}\)A2C [22] method is a query-based GIA method that models the node injection attack as a Markov decision process. TDGIA [21] and G-NIA [19] methods are transfer-based black-box graph injection attacks which can access all data. They first train the surrogate model based on the whole dataset, and then optimize the fake nodes with the surrogate model as the target, and finally transfer the attack to the target model.  
We also compared our method with a random attacker which randomly generates features for the fake node and connects it to the target node. In Random-1 attack, the attacker first calculates the mean and variance of the features across all nodes, and subsequently samples a fake node randomly and establishes a direct link to the target node. In Random-10 attack, the attacker attacks the target node 10 times, and once the target node has been misclassified, the attack is considered successful.  
**Detailed Settings:** In our experiments, the attacker is restricted to acquiring the subgraph containing the target node and its two-hop neighbors, and to querying for the class probabilities of the target nodes. To make the attack unnoticeable, for the dataset with discrete features, we forced the mean of the injected features to be consistent with the original graph, and for the dataset with continuous features, we ensured that the injected features did not exceed the upper and lower bounds of the original graph. We relaxed the knowledge limitations of baseline methods due to their different experimental settings. Specifically, for TDGIA and G-NIA, which are transfer-based approaches, we allowed the attackers access to all data, as well as labels of the training set and validation set. In the G\({}^{2}\)A2C method, which is a generative-based approach, we allowed feature metrics of fake nodes to exceed the dataset's average. In all attack methods, the proposed GCIA adhered to the most rigorous knowledge constraints.  
**Number of Fake Nodes:** Considering that different attack methods have varying configurations for fake nodes and edges, we conducted comparative experiments under setups with different numbers of fake nodes and edges. The experimental setup is depicted in Table 2. For each target node, \(\Delta_{v}\) represents the number of fake nodes employed to attack that target node, and \(\Delta_{e}\) denotes the number of edges each fake node establishes with the nodes in the graph. The description of each setup is shown in the following:  
* Setup 1 uses a single fake node directly connected to the target node, and thus this experimental setup primarily assesses the capability of optimizing the features of the fake node.
* Setup 2 indicates the employment of multiple fake nodes directly connected to the target node. This experimental setup evaluates the capability in concurrently optimizing the features of multiple fake nodes.
* Setup 3 uses a single fake node to attack the target node through multiple fake edges. This setup evaluates the capability of generating fake edges.
* Setup 4 attacks the target node using multiple fake nodes, each containing multiple fake edges. This experimental setup evaluates the attack effectiveness that can be achieved under an ample attack budget.