## 6 Conclusions  
In this work, we investigate graph injection attacks in a black-box setting. We propose the Graph Contrastive Learning-based Graph Injection Attack (GCIA) method to fully exploit the unsupervised knowledge contained in graph data. This approach comprises three components: a node encoder, a reward predictor, and a fake node generator. Specifically, the node encoder is a graph contrastive learning model that extracts embedded representations of nodes from existing data. The reward predictor can be regarded as a simplified surrogate for the target model, with inputs being the embedded nodes and \begin{table}
\begin{tabular}{l l l l l} \hline \hline
**Data Sets** & **Models** & **Feature Masking** & **Edge Removing** & **Both** \\ \hline \multirow{4}{*}{Cora} & GCN & 0.271 & 0.265 & 0.262 \\  & SAGE & 0.321 & 0.296 & 0.329 \\  & GAT & 0.288 & 0.275 & 0.299 \\  & APPNP & 0.198 & 0.199 & 0.208 \\ \hline \multirow{4}{*}{Citeseer} & GCN & 0.38 & 0.395 & 0.407 \\  & SAGE & 0.513 & 0.504 & 0.513 \\  & GAT & 0.444 & 0.444 & 0.454 \\  & APPNP & 0.359 & 0.355 & 0.355 \\ \hline \multirow{4}{*}{Reddit} & GCN & 0.966 & 0.984 & 0.971 \\  & SAGE & 0.933 & 0.967 & 0.932 \\  & GAT & 0.866 & 0.715 & 0.801 \\  & APPNP & 0.905 & 0.937 & 0.933 \\ \hline \multirow{4}{*}{PubMed} & GCN & 0.642 & 0.547 & 0.701 \\  & SAGE & 0.571 & 0.439 & 0.586 \\ \cline{1-1}  & GAT & 0.694 & 0.453 & 0.453 \\ \cline{1-1}  & APPNP & 0.459 & 0.382 & 0.501 \\ \hline \multicolumn{2}{l}{Avg. Rank} & 2.000 & 2.344 & 1.656 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Misclassfication rate of the GCIA-1 method with different augmentation methodologies on Cora, Citeseer, Reddit, and PubMed. outputs being the classification confidence of nodes. The fake node generator effectively creates fake nodes by maximizing the embedding changes of target nodes in the node encoder while minimizing the confidence of the original class of target nodes in the reward predictor. When attackers construct multiple fake edges for a fake node, the GCIA method iteratively establishes appropriate fake edges for fake nodes through an optimization-selection-optimization strategy. Compared to other query-based attack methods, GCIA is capable of leveraging graph contrastive learning models to extract unsupervised knowledge from graphs, achieving a high initial misclassification rate. On the GCN model, the GCIA method achieved misclassification rates of 26.4%, 39.0%, 99.1%, and 68.8% in the first query on the Cora, Citeseer, Reddit, and PubMed datasets, respectively. After several queries, the GCIA method outperformed the state-of-the-art methods in most cases. Compared to our preliminary work [17], this work introduces a fake edge generation algorithm, enabling attacks with multiple fake nodes and multiple fake edges. Extensive comparative and ablation experiments have demonstrated the effectiveness of the proposed GCIA method. The GCIA method demonstrates effectiveness for graph injection attack, and at the same time it has promising directions for future works. From the perspective of an attacker, early queries could focus on obtaining the classification boundaries of the target model, thereby generating adversarial samples with higher attack capabilities in later queries. From the defender's perspective, detecting adversarial samples during the attacker's queries is of paramount importance in a black-box setting, especially when the distribution of fake nodes is similar to that of normal nodes. Conceptualization, X.L. and W.Z. ; methodology, J.H. ; software, X.L. ; validation, Z.C., Y.P. and M.X. ; formal analysis, J.H. ; investigation, W.Z. ; resources, Z.C. ; data curation, Y.P. ; writing--original draft preparation, X.L. ; writing--review and editing, J.H. and W.Z. ; visualization, M.X. ; supervision, W.Z. ; project administration, J.H. ; funding acquisition, W.Z. and J.H. All authors have read and agreed to the published version of the manuscript.