## 5 Experiment
### Performance Comparison with Setup 1  
We compared the proposed GCIA with baseline methods in Setup 1 and present the results in Tables 3 and 4. We can see that graph learning models are vulnerable to graph invasion attacks even if the fake nodes are generated by random sampling. Despite having higher node degrees, Reddit and PubMed with continuous features are more susceptible to fake nodes than datasets with discrete features. This is due to the fact that the continuous features in a fake node can be more easily manipulated to embedded malicious information. Among all the attack methods, our proposed GCIA method achieves the highest misclassification rate in almost all cases. Compared with the state-of-the art G\({}^{2}\)A2C method, GCIA improves the misclassification rate by 7.9%, 10.3%, 11.4%, and 22.0% on Cora, Citeseer, Reddit, and PubMed, respectively. It should be noted that the proposed GCIA method has a significantly higher initial query success rate, which demonstrates that the graph contrastive learning model can extract rich graph information. By increasing the changes in the embedding of the target node, the initial fake nodes generated by GCIA sometimes have even stronger attacking capabilities than those produced by the comparison methods.  
\begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline \multirow{2}{*}{**Attack**} & \multicolumn{4}{c}{**Reddit**} & \multicolumn{4}{c}{**PubMed**} \\ \cline{2-9}  & **GCN** & **SAGE** & **GAT** & **APPNP** & **GCN** & **SAGE** & **GAT** & **APPNP** \\ \hline Clean & 0.162 & 0.154 & 0.157 & 0.199 & 0.208 & 0.272 & 0.258 & 0.194 \\ \hline Random-1 & 0.195 & 0.181 & 0.169 & 0.228 & 0.221 & 0.253 & 0.266 & 0.197 \\ \hline \hline \end{tabular}
\end{table}
Table 4: Misclassification rate on Reddit and PubMed datasets launched by the different attacker methods with Setup 1. The number following the method indicates the query times (the best scores and the second-best scores are in bold and with an underline, respectively).  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Setup** & \(\mathbf{\Delta_{v}}\) & \(\mathbf{\Delta_{e}}\) & **Compared Methods** \\ \hline
1 & 1 & 1 & G-NIA, TDGIA, G\({}^{2}\)A2C \\ \hline
2 & \(2,3\) & 1 & TDGIA, G\({}^{2}\)A2C \\ \hline
3 & 1 & 2, 3 & G-NIA, G\({}^{2}\)A2C \\ \hline
4 & \(2,3\) & \(2,3\) & G\({}^{2}\)A2C \\ \hline \hline \end{tabular}
\end{table}
Table 2: The number of fake nodes and fake edges used in the experiments, as well as the comparative methods under each experimental setup. \(\Delta_{v}\) denotes the number of fake nodes, and \(\Delta_{e}\) represents the number of fake edges for each fake node.  
\begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline \multirow{2}{*}{**Attack**} & \multicolumn{4}{c}{**Cora**} & \multicolumn{4}{c}{**Citeseer**} \\ \cline{2-9}  & **GCN** & **SAGE** & **GAT** & **APPNP** & **GCN** & **SAGE** & **GAT** & **APPNP** \\ \hline Clean & 0.177 & 0.21 & 0.187 & 0.154 & 0.298 & 0.329 & 0.306 & 0.291 \\ \hline Random-1 & 0.197 & 0.207 & 0.188 & 0.165 & 0.301 & 0.35 & 0.315 & 0.304 \\ \hline Random-10 & 0.251 & 0.267 & 0.241 & 0.207 & 0.363 & 0.44 & 0.374 & 0.345 \\ \hline G-NIA [19] & 0.423 & 0.37 & 0.396 & **0.309** & **0.648** & 0.537 & 0.580 & 0.483 \\ \hline TDGIA [21] & — & — & — & — & — & — & — & — \\ \hline G\({}^{2}\)A2C [22] & 0.261 & 0.355 & 0.412 & 0.293 & 0.394 & 0.559 & 0.552 & 0.454 \\ \hline GCIA-1 (ours) & 0.264 & 0.35 & 0.322 & 0.193 & 0.408 & 0.517 & 0.394 & 0.357 \\ \hline GCIA-10 (ours) & **0.490** & **0.534** & **0.439** & 0.299 & 0.636 & **0.703** & **0.581** & **0.484** \\ \hline \hline \end{tabular}
\end{table}
Table 3: Misclassification rate on Cora and Citeseer datasets launched by the different attacker methods with Setup 1. The number following the method indicates the query times (the best scores and the second-best scores are in bold and with an underline, respectively).