## 1 Introduction  
Graph Neural Networks (GNNs) have been remarkably successful across a spectrum of graph-based learning tasks, including node classification [1], edge prediction [2], and graph classification [3]. Node classification, in particular, is a pivotal task in this domain. It involves GNNs in learning node representations by integrating information from adjacent nodes, which then aids in mapping these nodes to their respective categories. For example, in the context of social networks, information collectors can predict political inclinations [4, 5], hobbies [6], or social bots [7]. Similarly, in citation networks, GNNs can categorize scholarly articles into various classes [8]. However, the rich and flexible structural information in graph data, as compared to Euclidean data types like images, audio, or text, makes it more susceptible to adversarial attacks. Adversarial attacks on graph data can be more detrimental due to the intricate connections and dependencies within the graph structure. Prior research has established that Graph Modification Attacks (GMAs) [9, 10, 11] can significantly impair the efficacy of Graph Neural Networks (GNNs) by introducing adversarial perturbations to the graph structure or node attributes. In such scenarios, an attacker capable of executing GMA has the ability to either establish new edges or delete existing ones between nodes within the graph. Moreover, they can also manipulate the node attributes. In the majority of scenarios, it is challenging for an attacker to possess such extensive operational privileges. Graph Injection Attack (GIA), which injects fake nodes into the graph without modifying the existing graph data, is gaining more attention. For instance, in social networks, it would be difficult for a GMA attacker to alter the attributes of a genuine user or to force a connection between the target and another real user. Conversely, for a GIA attacker, registering a fake user with specific attributes and creating a link with the victim real user is a task that can be achieved easily. GIAs present a more complex challenge than GMAs as they require the attacker to create fake nodes with unnoticeable adversarial features. Additionally, the attacker must carefully connect the fake nodes with the existing nodes, as well as establishing edges among the fake nodes themselves, ensuring that their injection into the graph is both inconspicuous and aggressive. The majority of graph injection attacks are conducted under white-box conditions [12; 13], where the attacker enjoys unrestricted access to both the parameters of the target model and the graph data. In this adversarial setting, attackers can significantly weaken the target model's performance by introducing meticulously crafted fake nodes. However, in the context of real-world applications, it is exceedingly difficult for an attacker to gain access to the training datasets or to possess full knowledge of the target model's parameters. Consequently, the black-box scenario is a more realistic adversarial setup for graph injection attacks, as it restricts attackers from accessing detailed information about the target model, limiting their interactions to query certain data and outputs received from the target model. Black-box graph injection attacks can be categorized into two types, i.e., transfer-based and query-based strategies. The transfer-based approach initiates an attack by training a substitute model, in which adversarial nodes are crafted based on the surrogate model and subsequently transferred to the target black-box model. Drawing on extensive knowledge from the white-box attack domain, the transfer-based approach does not need to know the inner workings of the target model's parameters. However, this approach demands a thorough comprehension of the graph dataset, encompassing the features and connections of the training nodes as well as the corresponding true labels.