## 5 Experiment
### Ablation Study  
In the proposed GCIA method, the node encoder is a Graph Contrastive Learning (GCL) model with two graph convolutional layers. The reward predictor, which serves as a proxy for the target model, is a two-layer Multilayer Perceptron (MLP) model. To verify the effectiveness of different components in GCIA, we implement them using various architectural configurations and conduct ablation studies. To assess the impact of the complexity of the reward predictor on the effectiveness of the attack, we have implemented three reward predictors with different model complexities:  
* **MLP**: The two-layer Multilayer Perceptron (MLP), as demonstrated in the paper, which is considered the most simple model. Given that the node encoder can extract unsupervised knowledge from the graph to generate high-quality node embeddings, a simple reward predictor may suffice for GCIA. * **MLP-head**: This model utilizes a linear layer to extract features and then constructs a separate head for each target class to predict the classification confidence for that class. This model has moderate complexity. Since the CW loss requires the reward predictor to have a higher imitation ability for the classification confidence of the target model, then using the MLP-head may improve the performance of the GCIA method. * **MLP-attention**: This model employs a multi-head attention mechanism to aggregate the features of the target node and its neighboring nodes, ultimately outputting the classification confidence for the node. This model has the highest complexity among the three models. Since the node encoder utilizes two graph convolutional  
Figure 4: Misclassification rates of various attack methods in Setup 4. The experiments are conducted on the GAT model using the Cora dataset. The horizontal coordinate corresponds to the different fake node numbers, while the vertical coordinate illustrates the different fake edge numbers. The orange circles denote the GCIA method, while blue circles signify the G\({}^{2}\)A2C method. The radius of each circle corresponds to the misclassification rate induced by the attack, which has been proportionately scaled for clearer visual representation. layers to extract the embedding of the target node, which may differ from the feature aggregation process of the target model, then incorporating an attention mechanism into the reward predictor may improve the performance of the attack. In the 10-th query, benefiting from the well-trained reward predictor, the fake node generator can generate effective fake nodes. To evaluate the effect of the complexity of the reward predictor on the attack effectiveness, we performed an adversarial attack on the GCN, SAGE, GAT, and APPNP models in the Cora dataset. The misclassification rate was considered as the metric to assess the performance of the reward predictor. The experimental results are depicted in Figure 5 and Table 5, from which it is evident that the complexity of different reward predictors has a small impact on the effectiveness of the attack, with the simpler MLP reward predictor achieving the best results. Since the node encoder is capable of mining unsupervised information from the graph to obtain discriminative node embeddings, a simple reward predictor can serve as a proxy for the target model. In contrast, more complex reward predictors are prone to overfitting, which may lead to a decline in attack performance. We evaluated the efficacy of the node encoder by employing various view generation strategies to test its ability to extract unsupervised knowledge from the graph data. In the initial query of a black-box attack using GCIA, there is no access to any information about the target model, and the attack performance depends on the feature extraction capabilities of the node encoder. Consequently, we used the misclassification rate of GCIA-1 as the performance metric for the node encoder and tested on GCN, SAGE, GAT, and APPNP. Table 6 shows the misclassification rate of the proposed GCIA method during the initial query.