Original: T EMPORAL D YNAMICS A WARE A DVERSARIAL A TTACKS ON D ISCRETE -T IME G RAPH M ODELS
Revised: T EMPORAL D YNAMICS A WARE A DVERSARIAL A TTACKS ON D ISCRETE -T IME G RAPH M ODELS

Original: Anonymous authors
Revised: Anonymous authors

Original: Paper under double-blind review
Revised: Paper under double-blind review

Original: A BSTRACT
Revised: A BSTRACT

Original: Real-world graphs such as social networks, communication networks, and rating networks are constantly evolving over time.
Revised: Real- world graphs such as social networks communication networks , and rating networks are constantly evolving over time.

Original: Many architectures have been developed to learn effective node representations using both graph structure and its dynamics.
Revised: Many architectures have been developed to learn effective node representations using both graph structure and its dynamics.

Original: While the robustness of static graph models is well-studied, the vulnerability of the dynamic graph models to adversarial attacks is underexplored.
Revised: While the robustness of static graph models is well-studied, the vulnerability of the dynamic graph models to adversarial attacks is underexplored.

Original: In this work we design a novel adversarial attack on discrete-time dynamic graph models where we desire to perturb the input graph sequence in a manner that preserves the temporal dynamics of the graph.
Revised: In this work we design a novel adversarial attack on discrete-time dynamic graph models where we desire to perturb the input graph sequence in a manner that preserves the temporal dynamics of the graph.

Original: To this end, we motivate a novel
Revised: To this end, we motivate a novel

Original: Temporal Dynamics-Aware Perturbation (TDAP) constraint, which ensures that perturbations introduced at each time step are restricted to only a small fraction of the number of changes in the graph since the previous time step.
Revised: Temporal Dynamics-Aware Perturbation (TDAP) constraint, which ensures that perturbations introduced at each time step are restricted to only a small fraction of the number of changes in the graph since the previous time step.

Original: We present a theoretically-grounded Projected Gradient Descent approach for dynamic graphs to ﬁnd the effective perturbations under the TDAP constraint.
Revised: We present a theoretically-grounded Projected Gradient Descent approach for dynamic graphs to ﬁnd the effective perturbations under the TDAP constraint.

Original: Experiments on two tasks — dynamic link prediction and node classiﬁcation, show that our approach is up to 4 x more effective than the baseline methods for attacking these models.
Revised: Experiments on two tasks — dynamic link prediction and node classiﬁcation, show that our approach is up to 4 x more effective than the baseline methods for attacking these models.

Original: We also consider the practical online setting where graph snapshots become available in real-time and extend our attack approach to use Online Gradient Descent for performing attacks under the TDAP constraint.
Revised: We also consider the practical online setting where graph snapshots become available in real-time and extend our attack approach to use Online Gradient Descent for performing attacks under the TDAP constraint.

Original: In this more challenging setting, we demonstrate that our method achieves upto 5 x superior performance when compared to representative baselines.
Revised: In this more challenging setting, we demonstrate that our method achieves up to 5 x superior performance when compared to representative baselines.

Original:  I NTRODUCTION
Revised:  I NTRODUCTION

Original: Graph Neural Networks (GNNs) have been shown to be vulnerable to adversarial perturbations (Jin et al., 2020;
Revised: Graph Neural Networks (GNNs) have been shown to be vulnerable to adversarial perturbations (Jin et al., 2020;

Original: Bojchevski & G¨unnemann, 2019; Dai et al., 2018; Wu et al., 2019; Z¨ugner et al., 2018; Ma et al., 2020a).
Revised: Bojchevski & G¨unnemann, 2019; Dai et al., 2018; Wu et al., 2019; Z¨ugner et al., 2018; Ma et al., 2020a).

Original: This has raised major concerns against their use in important industrial applications such as friend/product recommendation (Ying et al., 2018; Sankar et al., 2021; Tang et al., 2020) and fraud detection (Zhao et al., 2021; Hooi et al., 2017).
Revised: This has raised major concerns against their use in important industrial applications such as friend/product recommendation (Ying et al., 2018; Sankar et al., 2021; Tang et al., 2020) and fraud detection (Zhao et al., 2021; Hooi et al., 2017).

Original: However, these advancements in designing attack and defense mechanisms have predominantly focused on GNN models for static, non-evolving graphs.
Revised: However, these advancements in designing attack and defense mechanisms have predominantly focused on GNN models for static, non-evolving graphs.

Original: In reality, the graph structure evolves with time as new interactions happen and new connections are formed (Leskovec et al., 2007;
Revised: In reality, the graph structure evolves with time as new interactions happen and new connections are formed (Leskovec et al., 2007;

Original: Kossinets & Watts, 2006).
Revised: Kossinets & Watts, 2006).

Original: GNN models that incorporate the temporal information are shown to outperform their static counterparts in modeling dynamic networks on tasks such as predicting link existence in the future (Kazemi et al., 2020;
Revised: GNN models that incorporate the temporal information are shown to outperform their static counterparts in modeling dynamic networks on tasks such as predicting link existence in the future (Kazemi et al., 2020;

Original: Pareja et al., 2020; Sankar et al., 2020; Goyal et al., 2018; Chen et al., 2018).
Revised: Pareja et al., 2020; Sankar et al., 2020; Goyal et al., 2018; Chen et al., 2018).

Original: However, the vulnerability of dynamic graph models to adversarial perturbations is less studied.
Revised: However, the vulnerability of dynamic graph models to adversarial perturbations is less studied.

Original: The design of adversarial attacks for dynamic graphs is challenging for two reasons — (1) Attacks must simultaneously optimize both the edge(s) to perturb and when to perturb them, and more importantly, (2) Attacks must preserve the original graph evolution after perturbation in order to be less detectable.
Revised: The design of adversarial attacks for dynamic graphs is challenging for two reasons — (1) Attacks must simultaneously optimize both the edge(s) to perturb and when to perturb them, and more importantly, (2) Attacks must preserve the original graph evolution after perturbation in order to be less detectable.

Original: Attacks that disturb original graph evolution are not desired since they can be detected as anomalies by defense mechanisms, e.g. graph anomaly detection methods (Akoglu et al., 2015; Bunke et al., 2007; Cai et al., 2021).
Revised: Attacks that disturb original graph evolution are not desired since they can be detected as anomalies by defense mechanisms, e.g. graph anomaly detection methods (Akoglu et al., 2015; Bunke et al., 2007; Cai et al., 2021).

Original: Therefore, it is crucial to formulate adversarial attacks over snapshots such that they do not signiﬁcantly alter the original change in the graph structure.
Revised: Therefore, it is crucial to formulate adversarial attacks over snapshots such that they do not signiﬁcantly alter the original change in the graph structure.

Original: In this work, we introduce a novel T emporal D
Revised: In this work, we introduce a novel T emporal D

Original: ynamics-
Revised: ynamics-

Original: A ware P erturbation (TDAP) constraint to formulate evolution-preserving attacks on discrete-time dynamic graphs.
Revised: A ware P erturbation (TDAP) constraint to formulate evolution-preserving attacks on discrete-time dynamic graphs.

Original: This constraint asserts that the number of modiﬁcations added at the current timestep should only be a small fraction of
Revised: This constraint asserts that the number of modiﬁcations added at the current timestep should only be a small fraction of

Original: [Table]
Revised: [Table]

Original: the actual number of changes with respect to the preceding timestep.
Revised: the actual number of changes with respect to the preceding timestep.

Original: We show theoretically that perturbations made under TDAP constraint preserves the rate of change both in the structural and the embedding spaces.
Revised: We show theoretically that perturbations made under TDAP constraint preserves the rate of change both in the structural and the embedding spaces.

Original: To ﬁnd effective attacks under this proposed constraint, we consider a targeted, white-box, and evasion setting.
Revised: To ﬁnd effective attacks under this proposed constraint, we consider a targeted, white-box, and evasion setting.

Original: As noted in Table 1, no prior works exist that can ﬁnd attacks under our novel setting.
Revised: As noted in Table 1, no prior works exist that can ﬁnd attacks under our novel setting.

Original: Thus, we present a theoretically-grounded Temporal Dynamics-aware Projected
Revised: Thus, we present a theoretically-grounded Temporal Dynamics-aware Projected

Original: Gradient Descent (TD-PGD) approach.
Revised: Gradient Descent (TD-PGD) approach.

Original: The locality of the constraint in time allows us to easily extend this approach to ﬁnd attacks in a more practical online setting (Mladenovic et al., 2021) that has not been studied before for dynamic graphs.
Revised: The locality of the constraint in time allows us to easily extend this approach to ﬁnd attacks in a more practical online setting (Mladenovic et al., 2021) that has not been studied before for dynamic graphs.

Original: Here, perturbations are found in real-time without any knowledge of the future snapshots.
Revised: Here, perturbations are found in real-time without any knowledge of the future snapshots.

Original: Our contributions can be summarized as follows:
Revised: Our contributions can be summarized as follows:

Original: We introduce a novel Temporal Dynamics-Aware Perturbation (TDAP) constraint to make perturbations in discrete-time dynamic graphs that preserves the evolution of the graphs.
Revised: We introduce a novel Temporal Dynamics-Aware Perturbation (TDAP) constraint to make perturbations in discrete-time dynamic graphs that preserves the evolution of the graphs.

Original: We present a theoretically-grounded PGD-based white-box attack to ﬁnd effective attacks on dynamic graphs under the novel TDAP constraint in both ofﬂine and online settings.
Revised: We present a theoretically-grounded PGD-based white-box attack to ﬁnd effective attacks on dynamic graphs under the novel TDAP constraint in both ofﬂine and online settings.

Original: We show that TD-PGD outperforms the baselines across 4 different datasets and 3 victim models on both dynamic link prediction and node classiﬁcation tasks.
Revised: We show that TD-PGD outperforms the baselines across 4 different datasets and 3 victim models on both dynamic link prediction and node classiﬁcation tasks.

Original: We test the attacks on dynamic graphs in a novel online setting and show that the online version of TD-PGD shows improved performance over existing baselines.
Revised: We test the attacks on dynamic graphs in a novel online setting and show that the online version of TD-PGD shows improved performance over existing baselines.

Original:  R ELATED W ORK
Revised:  R ELATED W ORK

Original: Representation Learning for Dynamic Graphs.
Revised: Representation Learning for Dynamic Graphs.

Original: GNNs have been combined with sequential modeling architectures (Kazemi et al., 2020) to model dynamic graphs.
Revised: GNNs have been combined with sequential modeling architectures (Kazemi et al., 2020) to model dynamic graphs.

Original: For instance, discrete-time graphs have been modeled by using GNNs and RNNs together in a pipeline (Narayan & Roe, 2018;
Revised: For instance, discrete-time graphs have been modeled by using GNNs and RNNs together in a pipeline (Narayan & Roe, 2018;

Original: Manessi et al., 2020) or an embedded manner (Chen et al., 2018; Pareja et al., 2020).
Revised: Manessi et al., 2020) or an embedded manner (Chen et al., 2018; Pareja et al., 2020).

Original: Attention-based models have also been proposed to jointly encode the graph structure and its dynamics (Sankar et al., 2020).
Revised: Attention-based models have also been proposed to jointly encode the graph structure and its dynamics (Sankar et al., 2020).

Original: For continuous-time graphs, both RNN (Kumar et al., 2019; Trivedi et al., 2017; 2019; Ma et al., 2020b) and attention-based models (Rossi et al., 2020; Xu et al., 2020) have been proposed such that embeddings are updated in real time upon an occurrence of a new event.
Revised: For continuous-time graphs, both RNN (Kumar et al., 2019; Trivedi et al., 2017; 2019; Ma et al., 2020b) and attention-based models (Rossi et al., 2020; Xu et al., 2020) have been proposed such that embeddings are updated in real time upon an occurrence of a new event.

Original: Adversarial attacks on graphs.
Revised: Adversarial attacks on graphs.

Original: Static GNNs are known to be vulnerable to adversarial attacks in different settings (Jin et al., 2020).
Revised: Static GNNs are known to be vulnerable to adversarial attacks in different settings (Jin et al., 2020).

Original: White-box attacks are studied assuming complete knowledge of the underlying model Wu et al.
Revised: White-box attacks are studied assuming complete knowledge of the underlying model Wu et al.

Original: ; Xu et al. (2019b).
Revised: ; Xu et al. (2019b).

Original: Limiting the model knowledge, gray-box (Z¨ugner et al., 2018) and black-box attacks (Dai et al., 2018) have also been proposed.
Revised: Limiting the model knowledge, gray-box (Z¨ugner et al., 2018) and black-box attacks (Dai et al., 2018) have also been proposed.

Original: In comparison, the literature on adversarial attacks for dynamic graphs is scarce.
Revised: In comparison, the literature on adversarial attacks for dynamic graphs is scarce.

Original: Time-aware Gradient
Revised: Time-aware Gradient

Original: Attack (TGA) (Chen et al., 2021b) is a white-box evasion attack that greedily selects the perturbations across time under a budget constraint.
Revised: Attack (TGA) (Chen et al., 2021b) is a white-box evasion attack that greedily selects the perturbations across time under a budget constraint.

Original: In addition, attacks to poison training data (Chen et al., 2021a) and black-box attacks using RL approaches (Fan et al., 2020) have also been proposed.
Revised: In addition, attacks to poison training data (Chen et al., 2021a) and black-box attacks using RL approaches (Fan et al., 2020) have also been proposed.

Original: Imperceptible perturbations.
Revised: Imperceptible perturbations.

Original: The most common strategy to formulate imperceptible attacks on graphs is to bound the total number of perturbations.
Revised: The most common strategy to formulate imperceptible attacks on graphs is to bound the total number of perturbations.

Original: In the case of dynamic graphs, perturbations must preserve the temporal ﬂow to be imperceptible.
Revised: In the case of dynamic graphs, perturbations must preserve the temporal ﬂow to be imperceptible.

Original: Traditional anomaly detection algorithms ﬂag an instance to be anomalous if distance between consecutive snapshots crosses a threshold (Akoglu et al., 2015).
Revised: Traditional anomaly detection algorithms ﬂag an instance to be anomalous if distance between consecutive snapshots crosses a threshold (Akoglu et al., 2015).

Original: In particular, Graph Edit Distance and Hamming distance between adjacency matrices have been used to monitor communication networks (Shoubridge et al., 2002; Bunke et al., 2007).
Revised: In particular, Graph Edit Distance and Hamming distance between adjacency matrices have been used to monitor communication networks (Shoubridge et al., 2002; Bunke et al., 2007).

Original: Neural approaches have looked at the consecutive change in the embedding space to detect anomalies without feature extraction (Goyal et al., 2018;
Revised: Neural approaches have looked at the consecutive change in the embedding space to detect anomalies without feature extraction (Goyal et al., 2018;

Original: Cai et al., 2021).
Revised: Cai et al., 2021).

Original:  M ETHODOLOGY
Revised:  M ETHODOLOGY

Original: Problem Let G 1 , G 2 , ··· , G T be the original graph snapshots and G (cid:48) 1 , G (cid:48) 2 ··· , G (cid:48)
Revised: Problem Let G 1 , G 2 , ··· , G T be the original graph snapshots and G (cid:48) 1 , G (cid:48) 2 ··· , G (cid:48)

Original: T be the corresponding perturbed snapshots.
Revised: T be the corresponding perturbed snapshots.

Original: Note that G i =
Revised: Note that G i =

Original: ( X i , A i ) where X i , A
Revised: ( X i , A i ) where X i , A

Original: i are the node features and the adjacency matrix for snapshot i , respectively.
Revised: i are the node features and the adjacency matrix for snapshot i , respectively.

Original: Also, let M be a victim dynamic graph model that we want to attack and let f M be a function that generates the corresponding node embeddings of G t given G 1: t − 1 .
Revised: Also, let M be a victim dynamic graph model that we want to attack and let f M be a function that generates the corresponding node embeddings of G t given G 1: t − 1 .

Original: Let y task be the actual labels for a given task (for dynamic link prediction, these correspond to binary labels representing link existence in the future snapshot).
Revised: Let y task be the actual labels for a given task (for dynamic link prediction, these correspond to binary labels representing link existence in the future snapshot).

Original: Then, the objective of the attacker is to introduce structural perturbations S t =
Revised: Then, the objective of the attacker is to introduce structural perturbations S t =

Original: A (cid:48) t − A t at each timestep t < T such that the model inference at timestep T for the target entities
Revised: A (cid:48) t − A t at each timestep t < T such that the model inference at timestep T for the target entities

Original: E tg deteriorates.
Revised: E tg deteriorates.

Original: More formally, the attacker solves the following optimization problem:
Revised: More formally, the attacker solves the following optimization problem:

Original: [Equation]
Revised: [Equation]

Original: such that
Revised: such that

Original: [Equation]
Revised: [Equation]

Original: for some constraint function C on the perturbed adjacency matrices A (cid:48) t for each time t .
Revised: for some constraint function C on the perturbed adjacency matrices A (cid:48) t for each time t .

Original: Here, (cid:98) y task denotes the predicted labels for the given task and L task is a task-speciﬁc loss, for example, a binary cross entropy (CE) loss for link prediction.
Revised: Here, (cid:98) y task denotes the predicted labels for the given task and L task is a task-speciﬁc loss, for example, a binary cross entropy (CE) loss for link prediction.

Original: The constraint function C is designed to ensure imperceptibility of the adversarial perturbations.
Revised: The constraint function C is designed to ensure imperceptibility of the adversarial perturbations.

Original: In the literature, a budget constraint has been widely used to enforce imperceptibility in graphs (Dai et al., 2018) and computer vision (Goodfellow et al., 2014).
Revised: In the literature, a budget constraint has been widely used to enforce imperceptibility in graphs (Dai et al., 2018) and computer vision (Goodfellow et al., 2014).

Original: However, this constraint only bounds the total amount of perturbations that can be introduced by an attacker.
Revised: However, this constraint only bounds the total amount of perturbations that can be introduced by an attacker.

Original: When the input is dynamic, as in the case of dynamic graphs, the perturbations should be constrained in the context of how the input evolves.
Revised: When the input is dynamic, as in the case of dynamic graphs, the perturbations should be constrained in the context of how the input evolves.

Original: However, since the budget constraint completely ignores the graph dynamics, it could lead to a drastic change in the evolution trend of the graph and thus, making the attacks easily detectable.
Revised: However, since the budget constraint completely ignores the graph dynamics, it could lead to a drastic change in the evolution trend of the graph and thus, making the attacks easily detectable.

Original: For instance, with the budget constraint, all the perturbations can be made at a single time step, leading to an anomalous spike, which would be easily detected as a possible attack by graph anomaly detection methods for dynamic graphs (Akoglu et al., 2015;
Revised: For instance, with the budget constraint, all the perturbations can be made at a single time step, leading to an anomalous spike, which would be easily detected as a possible attack by graph anomaly detection methods for dynamic graphs (Akoglu et al., 2015;

Original: Shoubridge et al., 2002;
Revised: Shoubridge et al., 2002;

Original: Bunke et al., 2007).
Revised: Bunke et al., 2007).

Original: Thus, a constraint is desired that can ensure that the introduced perturbations do not disrupt the evolving trend of the dynamic graphs.
Revised: Thus, a constraint is desired that can ensure that the introduced perturbations do not disrupt the evolving trend of the dynamic graphs.

Original: 3. T EMPORAL D YNAMICS -A WARE P ERTURBATION (TDAP) C ONSTRAINT
Revised: 3. T EMPORAL D YNAMICS -A WARE P ERTURBATION (TDAP) C ONSTRAINT

Original: The simplest measure to study evolution is to consider the change in the input between consecutive time steps.
Revised: The simplest measure to study evolution is to consider the change in the input between consecutive time steps.

Original: Thus, for a discrete-time input { x t } , this corresponds to considering the discrete-time differential norm at time t , given by d x t = (cid:107) x
Revised: Thus, for a discrete-time input { x t } , this corresponds to considering the discrete-time differential norm at time t , given by d x t = (cid:107) x

Original: t − x t − 1 (cid:107) .
Revised: t − x t − 1 (cid:107) .

Original: Then, we propose
Revised: Then, we propose

Original: Proposition 1 The number of perturbations introduced to input x at time step t must not be more than a fraction (cid:15) times the differential at t , i.e. TDAP ( (cid:15) ) :
Revised: Proposition 1 The number of perturbations introduced to input x at time step t must not be more than a fraction (cid:15) times the differential at t , i.e. TDAP ( (cid:15) ) :

Original: = (cid:107) x (cid:48)
Revised: = (cid:107) x (cid:48)

Original: t − x t (cid:107) ≤ (cid:15)d x t ∀ t .
Revised: t − x t (cid:107) ≤ (cid:15)d x t ∀ t .

Original: For the case of dynamic graphs, when the graph structure evolves (for example, in social networks and transaction networks (Pareja et al., 2020; Sankar et al., 2020)), this constraint becomes (cid:107) A (cid:48)
Revised: For the case of dynamic graphs, when the graph structure evolves (for example, in social networks and transaction networks (Pareja et al., 2020; Sankar et al., 2020)), this constraint becomes (cid:107) A (cid:48)

Original: t − A t (cid:107) 1 ≤ (cid:15)d A t .
Revised: t − A t (cid:107) 1 ≤ (cid:15)d A t .

Original: Alternatively, a dynamic graph may also involve a temporally-evolving signal at each node (Rozemberczki et al., 2021;
Revised: Alternatively, a dynamic graph may also involve a temporally-evolving signal at each node (Rozemberczki et al., 2021;

Original: Li et al., 2017; Panagopoulos et al., 2021), in which case, this constraint becomes (cid:107) X (cid:48)
Revised: Li et al., 2017; Panagopoulos et al., 2021), in which case, this constraint becomes (cid:107) X (cid:48)

Original: t − X t (cid:107) 1 ≤ (cid:15)d X t .
Revised: t − X t (cid:107) 1 ≤ (cid:15)d X t .

Original: In this work, we focus on dynamic graph structures such that the constraint C (in Equation 1) for the perturbations is a TDAP constraint.
Revised: In this work, we focus on dynamic graph structures such that the constraint C (in Equation 1) for the perturbations is a TDAP constraint.

Original: The optimization problem for the attacker, thus, becomes
Revised: The optimization problem for the attacker, thus, becomes

Original: [Equation]
Revised: [Equation]

Original: that
Revised: that

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: where (cid:15),ε 1 are given parameters for this optimization.
Revised: where (cid:15),ε 1 are given parameters for this optimization.

Original: We use (cid:107)·(cid:107) to denote the 1 -norm of the matrix ﬂattened into a vector, unless otherwise mentioned.
Revised: We use (cid:107)·(cid:107) to denote the 1 -norm of the matrix ﬂattened into a vector, unless otherwise mentioned.

Original: Implications.
Revised: Implications.

Original: We show that TDAP constraint has the following implications on the perturbations: 1.
Revised: We show that TDAP constraint has the following implications on the perturbations: 1.

Original: Perturbations under TDAP constraint preserves the average rate of structural change.
Revised: Perturbations under TDAP constraint preserves the average rate of structural change.

Original: Theorem 1 Let d A = 1 T (cid:80) t
Revised: Theorem 1 Let d A = 1 T (cid:80) t

Original: d A t ,d A (cid:48)
Revised: d A t ,d A (cid:48)

Original: =
Revised: =

Original: 1 T (cid:80) t d A (cid:48) t .
Revised: 1 T (cid:80) t d A (cid:48) t .

Original: Then,
Revised: Then,

Original: [Equation]
Revised: [Equation]

Original: for some constants α,β ∈ R ≥ 0 .
Revised: for some constants α,β ∈ R ≥ 0 .

Original: Proof.
Revised: Proof.

Original: By the deﬁnition of the perturbation matrix S τ , d A (cid:48) t = (cid:107) A (cid:48)
Revised: By the deﬁnition of the perturbation matrix S τ , d A (cid:48) t = (cid:107) A (cid:48)

Original: t − A (cid:48)
Revised: t − A (cid:48)

Original: t − 1 (cid:107) = (cid:107) ( A t + S t ) − ( A t − 1 + S t − 1 ) (cid:107) .
Revised: t − 1 (cid:107) = (cid:107) ( A t + S t ) − ( A t − 1 + S t − 1 ) (cid:107) .

Original: Then, using triangle inequality, we get d A (cid:48) t ≤ (cid:107)
Revised: Then, using triangle inequality, we get d A (cid:48) t ≤ (cid:107)

Original: A t + S t (cid:107) + (cid:107)
Revised: A t + S t (cid:107) + (cid:107)

Original: A t − 1 + S t − 1 (cid:107) .
Revised: A t − 1 + S t − 1 (cid:107) .

Original: Again using triangle inequality, d A (cid:48) t ≤ (cid:107)
Revised: Again using triangle inequality, d A (cid:48) t ≤ (cid:107)

Original: A t (cid:107) + (cid:107) S t (cid:107) + (cid:107)
Revised: A t (cid:107) + (cid:107) S t (cid:107) + (cid:107)

Original: A t − 1 (cid:107) + (cid:107) S t − 1 (cid:107) .
Revised: A t − 1 (cid:107) + (cid:107) S t − 1 (cid:107) .

Original: Now, since (cid:107) S τ (cid:107) ≤ (cid:15)d A t and (cid:107)
Revised: Now, since (cid:107) S τ (cid:107) ≤ (cid:15)d A t and (cid:107)

Original: A τ (cid:107) is a constant, we get d A (cid:48) t ≤ (cid:15)d A t
Revised: A τ (cid:107) is a constant, we get d A (cid:48) t ≤ (cid:15)d A t

Original: + (cid:15)d A t − 1 + C , for some constant C .
Revised: + (cid:15)d A t − 1 + C , for some constant C .

Original: d A (cid:48)
Revised: d A (cid:48)

Original: =
Revised: =

Original: 1 T (cid:80) t d A (cid:48) t ≤ 1 T (cid:80) t ( (cid:15)d A t
Revised: 1 T (cid:80) t d A (cid:48) t ≤ 1 T (cid:80) t ( (cid:15)d A t

Original: + (cid:15)d A t − 1 + C ) ≤ 2 (cid:15) 1 T (cid:80) t
Revised: + (cid:15)d A t − 1 + C ) ≤ 2 (cid:15) 1 T (cid:80) t

Original: d A t + C .
Revised: d A t + C .

Original: Hence, we get that d A (cid:48) ≤
Revised: Hence, we get that d A (cid:48) ≤

Original: αd A + β , for some constants α,β ≥ 0 .
Revised: αd A + β , for some constants α,β ≥ 0 .

Original: Perturbations under TDAP constraint preserves the rate of embedding change.
Revised: Perturbations under TDAP constraint preserves the rate of embedding change.

Original: Theorem 2 Let d Z t = (cid:107) Z t − Z t − 1 (cid:107) 1 .
Revised: Theorem 2 Let d Z t = (cid:107) Z t − Z t − 1 (cid:107) 1 .

Original: Then, for some constants γ,δ ∈ R ≥ 0 , d Z (cid:48) ≤
Revised: Then, for some constants γ,δ ∈ R ≥ 0 , d Z (cid:48) ≤

Original: [Equation]
Revised: [Equation]

Original: Proof.
Revised: Proof.

Original: Note that Z t = f
Revised: Note that Z t = f

Original: ( A t , A t − 1 , ··· , A 1 ) .
Revised: ( A t , A t − 1 , ··· , A 1 ) .

Original: We consider a stacked vector of ﬂattened matrices ∀ τ ∈ [0 ,t ] : q ≤ τ = ( q τ , q τ − 1 , ··· , q 1 , 0 , 0 , ··· , 0 ) , where q i is the ﬂattened vector of A τ
Revised: We consider a stacked vector of ﬂattened matrices ∀ τ ∈ [0 ,t ] : q ≤ τ = ( q τ , q τ − 1 , ··· , q 1 , 0 , 0 , ··· , 0 ) , where q i is the ﬂattened vector of A τ

Original: and we append ( t − τ ) 

Revised: and we append ( t − τ )

Original: s to make all vectors q ≤ i of ﬁxed dimension t .
Revised: s to make all vectors q ≤ i of ﬁxed dimension t .

Original: Then, by Cauchy’s Mean
Revised: Then, by Cauchy’s Mean

Original: Value Theorem in several variables, we have Z t − Z t − 1 ≤ ∇ f · ( q ≤ t − q ≤ t − 1 ) , which gives us (cid:107)
Revised: Value Theorem in several variables, we have Z t − Z t − 1 ≤ ∇ f · ( q ≤ t − q ≤ t − 1 ) , which gives us (cid:107)

Original: Z t − Z
Revised: Z t − Z

Original: [Equation]
Revised: [Equation]

Original: ≤ (cid:107)∇ f (cid:107) (cid:107) q ≤ t − q ≤ t − 1 (cid:107) by Cauchy-Schwarz inequality.
Revised: ≤ (cid:107)∇ f (cid:107) (cid:107) q ≤ t − q ≤ t − 1 (cid:107) by Cauchy-Schwarz inequality.

Original: We note that (cid:107) q ≤ t − q ≤ t − 1 (cid:107) 

Revised: We note that (cid:107) q ≤ t − q ≤ t − 1 (cid:107)

Original: = (cid:107) ( q t − q t − 1 , ··· , q 2 − q 1 , q 1 ) (cid:107) 1 = (cid:80) t (cid:107) q t − q t − 1 (cid:107) 1 = T d A .
Revised: = (cid:107) ( q t − q t − 1 , ··· , q 2 − q 1 , q 1 ) (cid:107) 1 = (cid:80) t (cid:107) q t − q t − 1 (cid:107) 1 = T d A .

Original: Thus, we have (cid:107) Z t − Z t − 1 (cid:107) 1 ≤ Cd A for some constant C ≥ 0 .
Revised: Thus, we have (cid:107) Z t − Z t − 1 (cid:107) 1 ≤ Cd A for some constant C ≥ 0 .

Original: Using Theorem 1, we get d Z (cid:48) ≤ Cd A (cid:48)
Revised: Using Theorem 1, we get d Z (cid:48) ≤ Cd A (cid:48)

Original: ≤ Ad A + B , for A =
Revised: ≤ Ad A + B , for A =

Original: Cα,B = Cβ .
Revised: Cα,B = Cβ .

Original: By mean-value theorem, we also have d Z t ≥ (cid:107)∇ f t − 1 (cid:107) (cid:107) q ≤ t − q ≤ t − 1 (cid:107) cos( θ ) =
Revised: By mean-value theorem, we also have d Z t ≥ (cid:107)∇ f t − 1 (cid:107) (cid:107) q ≤ t − q ≤ t − 1 (cid:107) cos( θ ) =

Original: C 2 d A ( θ is the angle between q ≤ t and q ≤ t − 1 ).
Revised: C 2 d A ( θ is the angle between q ≤ t and q ≤ t − 1 ).

Original: Hence, d Z (cid:48) ≤ γd Z + δ for some constants γ,δ ≥ 0 .
Revised: Hence, d Z (cid:48) ≤ γd Z + δ for some constants γ,δ ≥ 0 .

Original: We analyze the constants in these bounds in further detail in Appendix C.
Revised: We analyze the constants in these bounds in further detail in Appendix C.

Original: 3. A TTACK M ETHODS U NDER TDAP C ONSTRAINT
Revised: 3. A TTACK M ETHODS U NDER TDAP C ONSTRAINT

Original: While the TDAP constraint allows us to limit the effect of the perturbations on the graph’s evolution, it is not clear how one can efﬁciently ﬁnd perturbations that maximize a loss function under this constraint.
Revised: While the TDAP constraint allows us to limit the effect of the perturbations on the graph’s evolution, it is not clear how one can efﬁciently ﬁnd perturbations that maximize a loss function under this constraint.

Original: To this end, we present two algorithms to solve the optimization problem of Equation 2.
Revised: To this end, we present two algorithms to solve the optimization problem of Equation 2.

Original: Greedy.
Revised: Greedy.

Original: A greedy strategy can be adopted to ﬁnd effective perturbations under our TDAP constraint.
Revised: A greedy strategy can be adopted to ﬁnd effective perturbations under our TDAP constraint.

Original: In this approach, perturbations are selected in a greedy manner based on their gradient values with respect to the downstream loss.
Revised: In this approach, perturbations are selected in a greedy manner based on their gradient values with respect to the downstream loss.

Original: However, this does not scale well as one needs to ﬁnd gradient values corresponding to all the perturbations, which would be O ( T |V| ) , where V denotes the set of nodes.
Revised: However, this does not scale well as one needs to ﬁnd gradient values corresponding to all the perturbations, which would be O ( T |V| ) , where V denotes the set of nodes.

Original: Thus, inspired by (Chen et al., 2021b), we ﬁnd the perturbations in two steps — ﬁrst, we ﬁnd the top-gradient perturbation at each time step and then, select the one that reduces the prediction probability the most.
Revised: Thus, inspired by (Chen et al., 2021b), we ﬁnd the perturbations in two steps — ﬁrst, we ﬁnd the top-gradient perturbation at each time step and then, select the one that reduces the prediction probability the most.

Original: In particular, we greedily select the perturbations with the lowest probability such that TDAP ( (cid:15) ) is not violated for any time-step.
Revised: In particular, we greedily select the perturbations with the lowest probability such that TDAP ( (cid:15) ) is not violated for any time-step.

Original: We defer the full algorithm to Appendix A.
Revised: We defer the full algorithm to Appendix A.

Original: Temporal Dynamics-aware Projected Gradient Descent (TD-PGD).
Revised: Temporal Dynamics-aware Projected Gradient Descent (TD-PGD).

Original: Since the constrained optimization in Equation 2 has a general continuous objective, a greedy approach is only sub-optimal (even for a simpler convex objective) with no theoretical guarantees.
Revised: Since the constrained optimization in Equation 2 has a general continuous objective, a greedy approach is only sub-optimal (even for a simpler convex objective) with no theoretical guarantees.

Original: A more standard approach to do optimization under a convex constraint is to use projected gradient descent (PGD) (Boyd et al., 2004; Bubeck et al., 2015).
Revised: A more standard approach to do optimization under a convex constraint is to use projected gradient descent (PGD) (Boyd et al., 2004; Bubeck et al., 2015).

Original: Since our problem is in discrete-space, we ﬁrst relax it into continuous space, ﬁnd the solution using PGD and then, randomly round it to obtain a valid solution for the discrete problem.
Revised: Since our problem is in discrete-space, we ﬁrst relax it into continuous space, ﬁnd the solution using PGD and then, randomly round it to obtain a valid solution for the discrete problem.

Original: In particular, we relax the perturbation matrix S t into a continuous vector s t and show that a closed-form projection operator exists for the TDAP ( (cid:15) ) constraint.
Revised: In particular, we relax the perturbation matrix S t into a continuous vector s t and show that a closed-form projection operator exists for the TDAP ( (cid:15) ) constraint.

Original: Algorithmdemonstrates the steps involved in this approach (TD-PGD), following the result of Theorem 3.
Revised: Algorithmdemonstrates the steps involved in this approach (TD-PGD), following the result of Theorem 3.

Original: Theorem 3 Suppose S denotes the feasible perturbation space for the constraints (cid:107) A (cid:48)
Revised: Theorem 3 Suppose S denotes the feasible perturbation space for the constraints (cid:107) A (cid:48)

Original: t − A t (cid:107) / (cid:107)
Revised: t − A t (cid:107) / (cid:107)

Original: A t − A t − 1 (cid:107) ≤ (cid:15) for all 1 < t < T and (cid:107) A (cid:48) 1 − A 1 (cid:107) ≤ ε 1 .
Revised: A t − A t − 1 (cid:107) ≤ (cid:15) for all 1 < t < T and (cid:107) A (cid:48) 1 − A 1 (cid:107) ≤ ε 1 .

Original: Then, one can project a vector a t onto S using the following projection operator:
Revised: Then, one can project a vector a t onto S using the following projection operator:

Original: [Equation]
Revised: [Equation]

Original: Require: TDAP variables ε t (from Theorem 3), Initialperturbation vector s (0) , Loss function L task , actual labels y task , Target entities
Revised: Require: TDAP variables ε t (from Thm. 3), Initial vector s (0) , Loss function L task , Actual labels y task , Target entities

Original: E tg , Time steps T , Initial learning rate η 0 , Iterations N 
Revised: E tg , Time steps T , Learning rate η i , Iterations N , Rounding iterations N r

Original: Ensure: Perturbation vector s ( i ) preserves TDAP ( (cid:15) )
Revised: Ensure: Perturbation vector s ( i ) preserves TDAP ( (cid:15) )

Original: at every time step t 1: for i = 1 to N do 2:
Revised: at every time step t 1: for i = 1 to N do 2:

Original: Gradient descent : a ( i ) =
Revised: Gradient descent : a ( i ) =

Original: s ( i − 1) − η i ∇L task ( {G t ⊕ s ( i − 1) t ; ∀ t } , y task , E tg ) 3:
Revised: s ( i − 1) + η i ∇L task ( {G t ⊕ s ( i − 1) t ; ∀ t } , y task , E tg ) 3:

Original: Projection : For all t ∈ [1 ,T − 1] : s ( i ) t = Π S ( a ( i ) t ) according to Equation4: S t ∼ Bernoulli ( s ( N ) t ) such that S t ≤ ε t for all t where ε t =
Revised: Projection : For all t ∈ [1 ,T − 1] : s ( i ) t = Π S ( a ( i ) t ) according to Equation4: S t ← ROUND ( s ( N ) t ,N r , { ε t } ) from Algorithm 4. where ε t =

Original: (cid:15)d A t = (cid:15) (cid:107)
Revised: (cid:15)d A t = (cid:15) (cid:107)

Original: A t − A t − 1 (cid:107) for t > 1 , and P [0 , 1] ( x ) = x if x ∈ [0 , 1] , 0 if x < 0 , and 1 if x > 1 .
Revised: A t − A t − 1 (cid:107) for t > 1 , and P [0 , 1] ( x ) = x if x ∈ [0 , 1] , 0 if x < 0 , and 1 if x > 1 .

Original: Proof.
Revised: Proof.

Original: Please see Appendix B for the proof.
Revised: Please see Appendix B for the proof.

Original: Following (Xu et al., 2019b), we use the bisection method (Boyd et al., 2004) to solve the equation 1 T P [0 , 1] ( a t − µ t ) =
Revised: Following (Xu et al., 2019b), we use the bisection method (Boyd et al., 2004) to solve the equation 1 T P [0 , 1] ( a t − µ t ) =

Original: ε t in µ t for µ t ∈ [min( a t − 1) , max( a t )] .
Revised: ε t in µ t for µ t ∈ [min( a t − 1) , max( a t )] .

Original: This converges in the logarithmic rate, i.e. it takes O (log 2 [(max( a t ) − min( a t − 1)) /ξ ]) time for ξ -error tolerance.
Revised: This converges in the logarithmic rate, i.e. it takes O (log 2 [(max( a t ) − min( a t − 1)) /ξ ]) time for ξ -error tolerance.

Original: 3. O NLINE A DVERSARIAL A TTACKS
Revised: 3. O NLINE A DVERSARIAL A TTACKS

Original: We also consider the online version of the problem in Equation 2.
Revised: We also consider the online version of the problem in Equation 2.

Original: In this setting, the perturbations are added in real-time, i.e. they are both immediate and irrevocable .
Revised: In this setting, the perturbations are added in real-time, i.e. they are both immediate and irrevocable .

Original: More formally, Equationmust now be solved considering online updates of the optimization variables, i.e., (1) A (cid:48) t is updated at time step t without any knowledge of A t
Revised: More formally, Equationmust now be solved considering online updates of the optimization variables, i.e., (1) A (cid:48) t is updated at time step t without any knowledge of A t

Original: +1: T and (2) A (cid:48) t remains unchanged for future time steps.
Revised: +1: T and (2) A (cid:48) t remains unchanged for future time steps.

Original: Note that TDAP constraint must still hold for A (cid:48)
Revised: Note that TDAP constraint must still hold for A (cid:48)

Original: t at all time steps t .
Revised: t at all time steps t .

Original: Online TD-PGD.
Revised: Online TD-PGD.

Original: Inspired from its theoretical guarantees in online convex optimization (Zinkevich, 2003), we use Online Projected Gradient Descent for our problem.
Revised: Inspired from its theoretical guarantees in online convex optimization (Zinkevich, 2003), we use Online Projected Gradient Descent for our problem.

Original: In this framework, we are given a function f t for each step t and the goal is to choose x t in an online manner such that the regret on the ofﬂine optimum x ∗ t , R ( f ,x ) :
Revised: In this framework, we are given a function f t for each step t and the goal is to choose x t in an online manner such that the regret on the ofﬂine optimum x ∗ t , R ( f ,x ) :

Original: = (cid:80) t ( f t ( x t ) − f t ( x ∗ t )) is minimized.
Revised: = (cid:80) t ( f t ( x t ) − f t ( x ∗ t )) is minimized.

Original: In our problem, as deﬁned in
Revised: In our problem, as deﬁned in

Original: Equation 2, we need to minimize a loss h
Revised: Equation 2, we need to minimize a loss h

Original: ( A 1: T − 1 ) at the ﬁnal time step T .
Revised: ( A 1: T − 1 ) at the ﬁnal time step T .

Original: To use online gradient descent, we thus need to write h as (cid:80) t f t ( A t ) for some f t .
Revised: To use online gradient descent, we thus need to write h as (cid:80) t f t ( A t ) for some f t .

Original: Let us assume that h is a cross-entropy loss and that the embeddings at each time t are encoded in a sequential manner.
Revised: Let us assume that h is a cross-entropy loss and that the embeddings at each time t are encoded in a sequential manner.

Original: Then,
Revised: Then,

Original: [Equation]
Revised: [Equation]

Original: Thus, we can deﬁne f t ( A t ) =
Revised: Thus, we can deﬁne f t ( A t ) =

Original: − (cid:80) d ∈D y
Revised: − (cid:80) d ∈D y

Original: ( d )log p ( d, A t | A 1 , ··· , A t − 1 ) , which is the prediction loss for the data points D at time step t .
Revised: ( d )log p ( d, A t | A 1 , ··· , A t − 1 ) , which is the prediction loss for the data points D at time step t .

Original: Algorithm 1 can then be updated to ﬁnd attacks in real time, following Online Gradient Descent.
Revised: Algorithm 1 can then be updated to ﬁnd attacks in real time, following Online Gradient Descent.

Original: In particular, for time t , we ﬁnd perturbations s ( i ) t by replacing the loss in line 2 with L ( {G τ ⊕ s ( i − 1) τ } tτ =1 ,y ( t ) , · ) .
Revised: In particular, for time t , we ﬁnd perturbations s ( i ) t by replacing the loss in line 2 with L ( {G τ ⊕ s ( i − 1) τ } tτ =1 ,y ( t ) , · ) .

Original: Since the projection operator for TDAP (Equation 5) depends only on the current time step t , we can independently project for the current time, i.e. line 3 remains s ( i ) t
Revised: Since the projection operator for TDAP (Equation 5) depends only on the current time step t , we can independently project for the current time, i.e. line 3 remains s ( i ) t

Original: = Π S ( a ( i ) t ) .
Revised: = Π S ( a ( i ) t ) .

Original: For more details about the algorithm, refer Appendix D.
Revised: For more details about the algorithm, refer Appendix D.

Original:  E XPERIMENTAL S ETUP
Revised:  E XPERIMENTAL S ETUP

Original: Datasets.
Revised: Datasets.

Original: We use 3 datasets for dynamic link prediction — Radoslaw 1 , UCI 1 , and Reddit 2 .
Revised: We use 3 datasets for dynamic link prediction — Radoslaw 1 , UCI 1 , and Reddit 2 .

Original: Radoslaw and UCI are email communication networks, where two nodes (users) are connected if they have an email communication at time t .
Revised: Radoslaw and UCI are email communication networks, where two nodes (users) are connected if they have an email communication at time t .

Original: Reddit is a hyperlink network representing directed connections between subreddits if there is a hyperlink from one to the other at a given timestamp (Kumar et al., 2018).
Revised: Reddit is a hyperlink network representing directed connections between subreddits if there is a hyperlink from one to the other at a given timestamp (Kumar et al., 2018).

Original: For node classiﬁcation task, we use one publicly-available dataset, DBLP -
Revised: For node classiﬁcation task, we use one publicly-available dataset, DBLP -

Original: (Xu et al., 2019a).
Revised: (Xu et al., 2019a).

Original: This is a co-author network with node attributes as word2vec representations of the author’s papers.
Revised: This is a co-author network with node attributes as word2vec representations of the author’s papers.

Original: There are 5 node labels representing the different ﬁelds that the authors belong to.
Revised: There are 5 node labels representing the different ﬁelds that the authors belong to.

Original: Please refer to Appendix E for more details regarding the datasets.
Revised: Please refer to Appendix E for more details regarding the datasets.

Original: Attack Methods.
Revised: Attack Methods.

Original: We consider 4 different attack methods to ﬁnd perturbations under TDAP constraint.
Revised: We consider 4 different attack methods to ﬁnd perturbations under TDAP constraint.

Original: (1) TD-PGD is a projected gradient descent with a valid projection operator for the TDAP constraint, as speciﬁed in Algorithm 1. 
Revised: (1) TD-PGD is a projected gradient descent with a valid projection operator for the TDAP constraint, as speciﬁed in Algorithm 1. (2) TGA ( (cid:15) )

Original: (2) G REEDY greedily selects the perturbation with the highest gradient value of the loss.
Revised: greedily selects the perturbation with the highest gradient value of the loss (we adapt TGA (Chen et al., 2021b) to our setting, as speciﬁed in

Original:  (3) D EGREE ﬂips the edges (adds or deletes if already there) attached with the highest degree nodes in the graph at each time step while making at most (cid:15)d 
Revised: Section 3.2). (3) D EGREE ﬂips the edges (adds or deletes if already there) attached with the highest degree nodes in the graph at each time step, while making at most (cid:15)d A t perturbations.

Original: A t perturbations.

Original: (4) R ANDOM randomly ﬂips (add or delete) at most (cid:15)d A t edges at each time step t .
Revised: R ANDOM randomly ﬂips (add or delete) at most (cid:15)d A t edges at each time step t .

Original: Victim Models.
Revised: Victim Models.

Original: We test the performance of the above attack methods on 3 different discrete-time dynamic graph models.
Revised: We test the performance of the above attack methods on 3 different discrete-time dynamic graph models.

Original: (1) GC-LSTM (Chen et al., 2018) embeds GCN into an LSTM to encode the sequence of graphs.
Revised: (1) GC-LSTM (Chen et al., 2018) embeds GCN into an LSTM to encode the sequence of graphs.

Original: (2) E VOLVE GCN (Pareja et al., 2020) uses a recurrent model (RNNLSTM) to evolve the weights of a GCN.
Revised: (2) E VOLVE GCN (Pareja et al., 2020) uses a recurrent model (RNNLSTM) to evolve the weights of a GCN.

Original: We use the E VOLVE GCN-O version for our experiments.
Revised: We use the E VOLVE GCN-O version for our experiments.

Original: (3) D Y SAT (Sankar et al., 2020) is an attention-based architecture utilizing joint structural and temporal self-attention.
Revised: (3) D Y SAT (Sankar et al., 2020) utilizes joint structural and temporal self-attention to embed.

Original: Metrics.
Revised: Metrics.

Original: We use the relative drop, as deﬁned below, to evaluate the efﬁcacy of the attack methods.
Revised: We use the relative drop, as deﬁned below, to evaluate the efﬁcacy of the attack methods.

Original: Rel. Drop (%) =
Revised: [Equation]

Original: Perturbed performance − Original performance Original performance
Revised: Original performance

Original: [Equation]
Revised: [Equation]

Original: where performance is evaluated using ROC-AUC for dynamic link prediction and using Accuracy for node classiﬁcation.
Revised: where performance is evaluated using ROC-AUC for dynamic link prediction and using Accuracy for node classiﬁcation.

Original: In order to evaluate the detectability of the attack methods, we propose a novel metric
Revised: In order to evaluate the detectability of the attack methods, we propose a novel metric

Original: Embedding
Revised: Embedding

Original: Variability (EV) to compare the consecutive embedding difference for the perturbed graph and that for the original graph.
Revised: Variability (EV) to compare the consecutive embedding difference for the perturbed graph and that for the original graph.

Original: Consecutive embedding difference has been used to identify anomalies in the data (Goyal et al., 2018).
Revised: Consecutive embedding difference has been used to identify anomalies in the data (Goyal et al., 2018).

Original: Here, we measure how the range of this difference changes due to the perturbation.
Revised: Here, we measure how the range of this difference changes due to the perturbation.

Original: In particular, we consider
Revised: In particular, we consider

Original: [Equation]
Revised: [Equation]

Original: This measures the relative variability of the consecutive change in the embedding space.
Revised: This measures the relative variability of the consecutive change in the embedding space.

Original: For the attacks to be less detectable, this metric should be close to 0 .
Revised: For the attacks to be less detectable, this metric should be close to 0 .

Original: Note that we do not directly optimize for this metric in our constraint.
Revised: Note that we do not directly optimize for this metric in our constraint.

Original:  R ESULTS
Revised:  R ESULTS

Original: We compare the performance of different attack methods for the 3 victim models on link prediction and node classiﬁcation tasks.
Revised: We compare the performance of different attack methods for the 3 victim models on link prediction and node classiﬁcation tasks.

Original: We also test the attack performance on dynamic link prediction in the novel online setting.
Revised: We also test the attack performance on dynamic link prediction in the novel online setting.

Original: For all the experiments, we vary (cid:15) from 0 to 1 and ﬁx ε 1 =
Revised: For all the experiments, we vary (cid:15) from 0 to 1 and ﬁx ε 1 =

Original: min t> 1 ε t :=
Revised: min t> 1 ε t :=

Original: (cid:15)d A t .
Revised: (cid:15)d A t .

Original: 5. D YNAMIC L INK P REDICTION
Revised: 5. D YNAMIC L INK P REDICTION

Original: In this section, we show the attack performance on the task of dynamic link prediction (Sankar et al., 2020; Pareja et al., 2020).
Revised: In this section, we show the attack performance on the task of dynamic link prediction (Sankar et al., 2020; Pareja et al., 2020).

Original: The task here is to predict whether a link ( u,v ) will appear or not at the future timestep.
Revised: The task here is to predict whether a link ( u,v ) will appear or not at the future timestep.

Original: The objective of the attacker, thus, is to introduce perturbations in the past time steps to make the model mispredict link’s existence in future.
Revised: The objective of the attacker, thus, is to introduce perturbations in the past time steps to make the model mispredict link’s existence in future.

Original: We test the victim models on the ﬁnal snapshot for a set of target links.
Revised: We test the victim models on the ﬁnal snapshot for a set of target links.

Original: We consider 3 different sets of 100 positive and 100 negative random targets and show the mean relative ROC-AUC drop with error bars.
Revised: We consider 3 different sets of 100 positive and 100 negative random targets and show the mean relative ROC-AUC drop with error bars.

Original: Figure 1 shows the performance of different attack methods on this task across different datasets and models.
Revised: Figure 1 shows the performance of different attack methods on this task across different datasets and models.

Original: TD-PGD outperforms the other baselines in all cases, except in GC-LSTM model trained on Reddit .
Revised: TD-PGD outperforms the other baselines in all cases, except in GC-LSTM model trained on Reddit .

Original: Moreover, TD-PGD is able to drop the AUC by upto 4 times the baselines and lead to ∼ 100% drop in the AUC, completely ﬂipping the prediction.
Revised: Moreover, TD-PGD is able to drop the AUC by up to 4 times the baselines and lead to ∼ 100% drop in the AUC, completely ﬂipping the prediction.

Original: We also note that TD-PGD often has a continuously decreasing slope and its performance saturates much later than the other baselines.
Revised: We also note that TD-PGD often has a continuously decreasing slope and its performance saturates much later than the other baselines.

Original: The second best baseline is often G REEDY but in many cases, it is only as good as random.
Revised: The second best baseline is often TGA ( (cid:15) ) but in many cases, it is only as good as random.

Original: One can also note that E VOLVE GCN shows a larger drop than the other 2 models across all datasets.
Revised: One can also note that E VOLVE GCN shows a larger drop than the other 2 models across all datasets.

Original: This may pertain to the lower model complexity of E VOLVE GCN compared to others.
Revised: This may pertain to the lower model complexity of E VOLVE GCN compared to others.

Original: We discuss these results in further detail in Appendix H.
Revised: We discuss these results in further detail in Appendix H.

Original: [Figure]
Revised: [Figure]

Original: Detectability of the attack methods: Here, we use the EV metric, as deﬁned in Section 4, to assess how detectable the attack methods are under our constraint.
Revised: Detectability of the attack methods: Here, we use the EV metric, as deﬁned in Section 4, to assess how detectable the attack methods are under our constraint.

Original: Table 2 compares the attack performance of the best method TD-PGD at (cid:15)
Revised: Table 2 compares the attack performance of the best method TD-PGD at (cid:15)

Original: = 0 .
Revised: = 0 .

Original: 5 and the corresponding variability in the embeddings, as given by Equation 7.
Revised: 5 and the corresponding variability in the embeddings, as given by Equation 7.

Original: One can note that E is smaller than 0 .
Revised: One can note that E is smaller than 0 .

Original: 5 in all but one case and that TD-PGD is able to cause up to 90% drop in performance while changing the evolution by only a factor of 0 .
Revised: 5 in all but one case and that TD-PGD is able to cause up to 90% drop in performance while changing the evolution by only a factor of 0 .

Original: 22 , on average.
Revised: 22 , on average.

Original: This shows that TDAP allows for undetectable yet effective attacks.
Revised: This shows that TDAP allows for undetectable yet effective attacks.

Original: Please refer to Appendix H for more analysis.
Revised: Please refer to Appendix H for more analysis.

Original: 5. N ODE C LASSIFICATION
Revised: 5. N ODE C LASSIFICATION

Original: In this section, we compare the attack performance on the task of semi-supervised node classiﬁcation (Pareja et al., 2020).
Revised: In this section, we compare the attack performance on the task of semi-supervised node classiﬁcation (Pareja et al., 2020).

Original: In this task, the objective is to predict node labels of a set of nodes while knowing the labels of the other nodes at that time step.
Revised: In this task, the objective is to predict node labels of a set of nodes while knowing the labels of the other nodes at that time step.

Original: [Table]
Revised: [Table]

Original: [Table] 
Revised: [Table] [Figure] [Table]

Original: [Figure]
Revised: [Figure]

Original: Figure 2 shows the effect of structural perturbations on node classiﬁcation task by different attack strategies for the 3 models.
Revised: Figure 2 shows the effect of structural perturbations on node classiﬁcation task by different attack strategies for the 3 models.

Original: Due to sparsity of edges in DBLP -5, randomly chosen targets only allow for  a very small number of perturbations under the TDAP constraint.
Revised: Misclassifying the labels for inﬂuential top-degree targets can signiﬁcantly impact a model’s usability in practice.

Original: Therefore, we consider the performance on 50 top-degree nodes for each class.
Revised: Therefore, we consider the performance ontop-degree nodes for each class.

Original: Results show that TD-PGD outperforms the baselines in all models except D Y SAT, in which all attacks perform almost equally.
Revised: Results show that TD-PGD outperforms the baselines in all models except D Y SAT, in which all attacks perform almost equally.

Original: In particular, TD-PGD is able to cause a 30% drop in E VOLVE GCN while the baselines only lead to a drop of 5% .
Revised: In particular, TD-PGD is able to cause a 30% drop in E VOLVE GCN while the baselines only lead to a drop of 5% .

Original: We show the performance on random targets in Appendix H and note that feature perturbations are more effective in these cases when the structural information is sparse.
Revised: We show the performance on random targets in Appendix H and note that feature perturbations are more effective in these cases when the structural information is sparse.

Original: 5. O NLINE A DVERSARIAL A TTACKS
Revised: 5. O NLINE A DVERSARIAL A TTACKS

Original: In this section, we consider the online setting as described in Section 3.3 and compare the online version of TD-PGD with the R ANDOM and D EGREE baselines on the dynamic link prediction task.
Revised: In this section, we consider the online setting as described in Section 3.3 and compare the online version of TD-PGD with the R ANDOM and D EGREE baselines on the dynamic link prediction task.

Original: Since the loss at the ﬁnal step is not available at time step t , one cannot select the perturbations in a greedy manner of the gradients.
Revised: Since the loss at the ﬁnal step is not available at time step t , one cannot select the perturbations in a greedy manner of the gradients.

Original: Therefore, we do not have a G REEDY baseline for this setting.
Revised: Therefore, we do not have a TGA ( (cid:15) ) baseline for this setting.

Original: Figure 3 shows the average performance of the three methods for dynamic link prediction task ondatasets over 3 random seeds.
Revised: Figure 3 shows the average performance of the three methods for dynamic link prediction task ondatasets over 3 random seeds.

Original: Please refer Appendix H for results on node classiﬁcation.
Revised: Please refer Appendix H for results on node classiﬁcation.

Original: TD-PGD outperforms the other online baselines in most cases and is able to achieve competent performance to the ofﬂine version.
Revised: TD-PGD outperforms the other online baselines in most cases and is able to achieve competent performance to the ofﬂine version.

Original: In particular, it shows up to 5 times improvement over the existing baselines (for E VOLVE GCN on UCI ), which is close to the ofﬂine TD-PGD as shown in Figure 1.
Revised: In particular, it shows up to 5 times improvement over the existing baselines (for E VOLVE GCN on UCI ), which is close to the ofﬂine TD-PGD as shown in Figure 1.

Original: However,
Revised: However,

Original: TD-PGD does not perform well in Figures 3a and 3i.
Revised: TD-PGD does not perform well in Figures 3a and 3i.

Original: Online TD-PGD perturbs the graph at time t according to the loss at that time step rather than the ﬁnal step.
Revised: Online TD-PGD perturbs the graph at time t according to the loss at that time step rather than the ﬁnal step.

Original: While it is guaranteed to give strong bounds for a convex objective, some models may learn a complex non-convex function in its input.
Revised: While it is guaranteed to give strong bounds for a convex objective, some models may learn a complex non-convex function in its input.

Original: We conjecture that the degradation 
Revised: We conjecture that the degradation may be due to such functions being learned in these cases.

Original: [Figure]
Revised: [Figure]

Original:  C ONCLUSION
Revised:  C ONCLUSION

Original: Our work has shown that state-of-the-art dynamic graph models can be effectively attacked while preserving the temporal dynamics.
Revised: Our work has shown that state-of-the-art dynamic graph models can be effectively attacked while preserving the temporal dynamics.

Original: We introduce a novel Temporal Dynamics-Aware Perturbation (TDAP) constraint to devise perturbations in discrete-time dynamic graphs that preserves the graph evolution in both the structural and embedding spaces.
Revised: We introduce a novel Temporal Dynamics-Aware Perturbation (TDAP) constraint to devise perturbations in discrete-time dynamic graphs that preserves the graph evolution in both the structural and embedding spaces.

Original: Next, we present an effective PGD-based approach to ﬁnd perturbations under this constraint and show improved attack performance than baselines in both ofﬂine and online settings.
Revised: Next, we present an effective PGD-based approach to ﬁnd perturbations under this constraint and show improved attack performance than baselines in both ofﬂine and online settings.

Original: We hope that our work serves as a ﬁrst step towards opening exciting research avenues on studying attacks and defense mechanisms for both discrete and continuous-time dynamic graphs.
Revised: We hope that our work serves as a ﬁrst step towards opening exciting research avenues on studying attacks and defense mechanisms for both discrete and continuous-time dynamic graphs.

Original: Some limitations of our current exposition can be noted.
Revised: Some limitations of our current exposition can be noted.

Original: First, the proposed method TD-PGD is not memory-efﬁcient and may not scale to larger graphs (more details in Appendix G).
Revised: First, the proposed method TD-PGD is not memory-efﬁcient and may not scale to larger graphs (more details in Appendix G).

Original: Second, randomly rounding the solution to discrete space may lead to suboptimal perturbations.
Revised: Second, randomly rounding the solution to discrete space may lead to suboptimal perturbations.

Original: Future work can study more effective and efﬁcient methods to attack dynamic graphs under TDAP constraint in the more restrictive black-box setting.
Revised: Future work can study more effective and efﬁcient methods to attack dynamic graphs under TDAP constraint in the more restrictive black-box setting.

Original: B P ROOF O F T HEOREM
Revised: B P ROOF O F T HEOREM

Original: Suppose S denotes the feasible perturbation space for the constraints (cid:107) A (cid:48)
Revised: Suppose S denotes the feasible perturbation space for the constraints (cid:107) A (cid:48)

Original: t − A t (cid:107) / (cid:107)
Revised: t − A t (cid:107) / (cid:107)

Original: A t − A t − 1 (cid:107) ≤ (cid:15) for all 1 < t < T and (cid:107) A (cid:48) 1 − A 1 (cid:107) ≤ ε 1 .
Revised: A t − A t − 1 (cid:107) ≤ (cid:15) for all 1 < t < T and (cid:107) A (cid:48) 1 − A 1 (cid:107) ≤ ε 1 .

Original: Then, one can project a vector a t onto S using the following projection operator:
Revised: Then, one can project a vector a t onto S using the following projection operator:

Original: [Equation]
Revised: [Equation]

Original: where ε t =
Revised: where ε t =

Original: (cid:15)d A t = (cid:15) (cid:107)
Revised: (cid:15)d A t = (cid:15) (cid:107)

Original: A t − A t − 1 (cid:107) for t > 1 , and P [0 , 1] ( x ) = x if x ∈ [0 , 1] , 0 if x < 0 , and 1 if x > 1 .
Revised: A t − A t − 1 (cid:107) for t > 1 , and P [0 , 1] ( x ) = x if x ∈ [0 , 1] , 0 if x < 0 , and 1 if x > 1 .

Original: Proof.
Revised: Proof.

Original: Let the perturbation vector be s =
Revised: Let the perturbation vector be s =

Original: [ s 1 , s 2 , ··· , s T − 1 ] T .
Revised: [ s 1 , s 2 , ··· , s T − 1 ] T .

Original: Then, for all t ∈ [2 ,T − 1] , since s t =
Revised: Then, for all t ∈ [2 ,T − 1] , since s t =

Original: A t − A t − 1 , our constraint becomes (cid:107) s t (cid:107) ≤ (cid:15)d A t ≤ (cid:15) (cid:107)
Revised: A t − A t − 1 , our constraint becomes (cid:107) s t (cid:107) ≤ (cid:15)d A t ≤ (cid:15) (cid:107)

Original: A t − A t − 1 (cid:107) =: ε t , which reduces to 1 T s t ≤ ε t .
Revised: A t − A t − 1 (cid:107) =: ε t , which reduces to 1 T s t ≤ ε t .

Original: For t = 1 , we have (cid:107) A (cid:48) 

Revised: For t = 1 , we have (cid:107) A (cid:48)

Original: ( V 1 ) − A 1 ( V 1 ) (cid:107) ≤ ε 1 , which also becomes 1 T s 1 ≤ ε 1 .
Revised: ( V 1 ) − A 1 ( V 1 ) (cid:107) ≤ ε 1 , which also becomes 1 T s 1 ≤ ε 1 .

Original: Hence, we have the constraint 1 T s t ≤ ε t for all t .
Revised: Hence, we have the constraint 1 T s t ≤ ε t for all t .

Original: By deﬁnition, then, projection operator must be Π S ( a ) =
Revised: By deﬁnition, then, projection operator must be Π S ( a ) =

Original: argmin s ∈S 12 (cid:107) s − a (cid:107) 2 , where S = { s ∈ [0 , 1] n | 1 T s t ≤ ε t ∀ t } .
Revised: argmin s ∈S 12 (cid:107) s − a (cid:107) 2 , where S = { s ∈ [0 , 1] n | 1 T s t ≤ ε t ∀ t } .

Original: This reduces to the following optimization problem:
Revised: This reduces to the following optimization problem:

Original: [Equation]
Revised: [Equation]

Original: such that ∀ t ∈ [1 ,T ] : 1 T s t ≤ ε t where I [0 , 1] ( x ) = 

Revised: where I [0 , 1] ( x ) =

Original: if x ∈ [0 , 1] n and ∞ otherwise.
Revised: if x ∈ [0 , 1] n and ∞ otherwise.

Original: This can be solved by the Lagrangian method.
Revised: This can be solved by the Lagrangian method.

Original: We note that the Lagrangian function of the above optimization problem is L ( s , a ,µ )
Revised: We note that the Lagrangian function of the above optimization problem is L ( s , a ,µ )

Original: = (cid:80) t ∈ [1 ,T ] (cid:16) 12 (cid:107) s t − a t (cid:107) 

Revised: = (cid:80) t ∈ [1 ,T ] (cid:16) 12 (cid:107) s t − a t (cid:107)

Original: + I [0 , 1] ( s t ) + µ t ( 1 T s t − ε t ) (cid:17) .
Revised: + I [0 , 1] ( s t ) + µ t ( 1 T s t − ε t ) (cid:17) .

Original: ∂ L /∂ s t = 

Revised: ∂ L /∂ s t =

Original: = ⇒ s t = a t − µ t .
Revised: = ⇒ s t = a t − µ t .

Original: However, if s t,i < 0 or s t,i > 1 for any i , then L = ∞ .
Revised: However, if s t,i < 0 or s t,i > 1 for any i , then L = ∞ .

Original: Thus, the minimizer to the above function is s ∗ t = P [0 , 1] ( a t − µ t ) , where P [0 , 1] ( x ) =
Revised: Thus, the minimizer to the above function is s ∗ t = P [0 , 1] ( a t − µ t ) , where P [0 , 1] ( x ) =

Original: x if x ∈ [0 , 1] , 

Revised: x if x ∈ [0 , 1] ,

Original: if x < 0 and 1 if x > 1 .
Revised: if x < 0 and 1 if x > 1 .

Original: In addition, the solution must satisfy the following KKT conditions ∀ t :
Revised: In addition, the solution must satisfy the following KKT conditions ∀ t :

Original: [Equation]
Revised: [Equation]

Original: If µ t > 0 , then we must have 1 T P [0 , 1] ( a t − µ t ) = ε t .
Revised: If µ t > 0 , then we must have 1 T P [0 , 1] ( a t − µ t ) = ε t .

Original: Otherwise if µ t = 0 , then 1 T P [0 , 1] ( a t ) ≤ ε t .
Revised: Otherwise if µ t = 0 , then 1 T P [0 , 1] ( a t ) ≤ ε t .

Original: C I NTERPRETING T HE T HEORETICAL B OUNDS O N E VOLUTION
Revised: C I NTERPRETING T HE T HEORETICAL B OUNDS O N E VOLUTION

Original: In this section, we analyze the constants in the theoretical bound on the average structural change after perturbation under TDAP constraint, as proved in Theorem 1.
Revised: In this section, we analyze the constants in the theoretical bound on the average structural change after perturbation under TDAP constraint, as proved in Theorem 1.

Original: In particular, we show how
Revised: In particular, we show how

Original: Theorems 1 and 2 shows that a local TDAP constraint preserves the average trend of structural and embedding change as a linear combination of the original trends.
Revised: Theorems 1 and 2 shows that a local TDAP constraint preserves the average trend of structural and embedding change as a linear combination of the original trends.

Original: Thus, if the linear factors are small enough, then, the average trend of evolution remains well-preserved.
Revised: Thus, if the linear factors are small enough, then, the average trend of evolution remains well-preserved.

Original: This ensures imperceptibility as perturbations that lead to a change in the trend of structural/embedding evolution can be easily detected by various anomaly detection algorithms (Cai et al., 2021; Goyal et al., 2018).
Revised: This ensures imperceptibility as perturbations that lead to a change in the trend of structural/embedding evolution can be easily detected by various anomaly detection algorithms (Cai et al., 2021; Goyal et al., 2018).

Original: In particular, while the TDAP constraint allows us to ﬁnd a bound on the perturbed trend in terms of the original trend, no existing constraints give us such a bound.
Revised: In particular, while the TDAP constraint allows us to ﬁnd a bound on the perturbed trend in terms of the original trend, no existing constraints give us such a bound.

Original: This is because we constrain the number of perturbations introduced at each time step to be within a factor of the changes introduced in the original graph at that time step while existing constraints only impose a global constraint on the perturbations over all time steps.
Revised: This is because we constrain the number of perturbations introduced at each time step to be within a factor of the changes introduced in the original graph at that time step while existing constraints only impose a global constraint on the perturbations over all time steps.

Original: One can note that α = 2 (cid:15) and β = 1 T (cid:80) t (cid:107)A t (cid:107) + (cid:107)A t − 1 (cid:107) =
Revised: One can note that α = 2 (cid:15) and β = 1 T (cid:80) t (cid:107)A t (cid:107) + (cid:107)A t − 1 (cid:107) =

Original: 2 T (cid:80) t (cid:107)A t (cid:107) − (cid:107)A T (cid:107) ≤ 2 T (cid:80) t (cid:107)A t (cid:107) .
Revised: 2 T (cid:80) t (cid:107)A t (cid:107) − (cid:107)A T (cid:107) ≤ 2 T (cid:80) t (cid:107)A t (cid:107) .

Original: In other words, the average rate of structural change after perturbations within a TDAP constraint remains within a factor of 2 times the permitted fraction for the TDAP constraint of the original average rate, plus 2 times the average no. of edges in the adjacency matrix.
Revised: In other words, the average rate of structural change after perturbations within a TDAP constraint remains within a factor of 2 times the permitted fraction for the TDAP constraint of the original average rate, plus 2 times the average no. of edges in the adjacency matrix.

Original: Since we consider a targeted case, the adjacency matrix includes only a single column and the additive factor corresponds to 2 times the average degree of the target vertex over all time steps.
Revised: Since we consider a targeted case, the adjacency matrix includes only a single column and the additive factor corresponds to 2 times the average degree of the target vertex over all time steps.

Original: Since (cid:15) is a parameter that is chosen by the attacker, a small enough (cid:15) allows the attacker to preserve the evolution within a small enough multiplicative factor.
Revised: Since (cid:15) is a parameter that is chosen by the attacker, a small enough (cid:15) allows the attacker to preserve the evolution within a small enough multiplicative factor.

Original: The additive shift in the trend is equal to twice the average degree of the target vertex, which can inform the choice of the target for the attacker according to his permitted limit.
Revised: The additive shift in the trend is equal to twice the average degree of the target vertex, which can inform the choice of the target for the attacker according to his permitted limit.

Original: In comparison, a simple budget constraint gives no bound on the average structural change in terms of the original change.
Revised: In comparison, a simple budget constraint gives no bound on the average structural change in terms of the original change.

Original: This is because, (cid:80) t (cid:107) S t (cid:107) ≤ B , where B is the budget.
Revised: This is because, (cid:80) t (cid:107) S t (cid:107) ≤ B , where B is the budget.

Original: Thus, using similar calculations as Theorem 1, we get d A (cid:48)
Revised: Thus, using similar calculations as Theorem 1, we get d A (cid:48)

Original: t ≤ 2 T B + 2 T (cid:80) t (cid:107)A t (cid:107) .
Revised: t ≤ 2 T B + 2 T (cid:80) t (cid:107)A t (cid:107) .

Original: Therefore, perturbations introduced using a budget constraint can exceed the average trend of structural change when B /T >
Revised: Therefore, perturbations introduced using a budget constraint can exceed the average trend of structural change when B /T >

Original: (cid:15)d A t .
Revised: (cid:15)d A t .

Original: D O NLINE G RADIENT D ESCENT
Revised: D O NLINE G RADIENT D ESCENT

Original: Problem 1 Given a convex set K and at every step i = 1 , 2 , ··· ,T , we are presented with f i such that we have to choose a solution x ( i ) ∈ K at every step in a way that minimizes the regret R = (cid:80) i ( f i ( x ( i ) )
Revised: Problem 1 Given a convex set K and at every step i = 1 , 2 , ··· ,T , we are presented with f i such that we have to choose a solution x ( i ) ∈ K at every step in a way that minimizes the regret R = (cid:80) i ( f i ( x ( i ) )

Original: − f i ( x ∗ )) without knowing the future functions f i +1: T .
Revised: − f i ( x ∗ )) without knowing the future functions f i +1: T .

Original: Lemma 1 (Zinkevich, 2003 (Zinkevich, 2003)) Let G denote an upperbound on (cid:107)∇ f i ( x ) (cid:107) 2 for any x ∈ K and any i , and let D = max x,y ∈K (cid:107) x − y (cid:107) 2 be the diameter of K .
Revised: Lemma 1 (Zinkevich, 2003) Let G denote an upperbound on (cid:107)∇ f i ( x ) (cid:107) 2 for any x ∈ K and any i , and let D = max x,y ∈K (cid:107) x − y (cid:107) 2 be the diameter of K .

Original: The online gradient descent algorithm with η = DG √ T gives a regret per step of at most 2 DG √ T after T steps.
Revised: The online gradient descent algorithm with η = DG √ T gives a regret per step of at most 2 DG √ T after T steps.

Original: Online Gradient Descent requires replacing ∇ f ( x ( i ) ) with ∇ f i ( x ( i ) ) .
Revised: Online Gradient Descent requires replacing ∇ f ( x ( i ) ) with ∇ f i ( x ( i ) ) .

Original: Algorithm 3 presents the corresponding online version for TD-PGD.
Revised: Algorithm 3 presents the corresponding online version for TD-PGD.

Original: E D ATA STATISTICS AND PRE - PROCESSING
Revised: E D ATA STATISTICS AND PRE - PROCESSING

Original: Table 3 shows the statistics of the datasets used in this paper.
Revised: Table 3 shows the statistics of the datasets used in this paper.

Original: DBLP -5 is the node classiﬁcation dataset with 5 labels while the others are dynamic link prediction datasets with varying sizes.
Revised: DBLP -5 is the node classiﬁcation dataset with 5 labels while the others are dynamic link prediction datasets with varying sizes.

Original: The datasets span over differing periods of time.
Revised: The datasets span over differing periods of time.

Original: We split each of them into ﬁnite number of timesteps to keep a large enough number of time steps while maintaining a realistic period of splitting.
Revised: We split each of them into ﬁnite number of timesteps to keep a large enough number of time steps while maintaining a realistic period of splitting.

Original: Radoslaw is split using a 3 -week period in 13 snapshots while the 13 snapshots in UCI denote a
Revised: Radoslaw is split using a 3 -week period in 13 snapshots while the 13 snapshots in UCI denote a

Original: Require: Current time t , TDAP variable ε t , Initial perturbation vector s (0) , Loss function L task , actual labels y task , Target entities E tg , Time steps T , Initial learning rate η 0 , Iterations N 
Revised: Require: Current time t , TDAP variable ε t , Initial perturbation vector s (0) , Loss function L task , Actual labels y task , Target entities E tg , Learning rate η i , Iterations N , Rounding iterations N r .

Original: Ensure: Perturbation vector s ( i ) t preserves TDAP ( (cid:15) ) 1: for i = 1 to N do 2:
Revised: Ensure: Perturbation vector s ( i ) t preserves TDAP ( (cid:15) ) 1: for i = 1 to N do 2:

Original: Gradient descent : a ( i ) t =
Revised: Gradient descent : a ( i ) t =

Original: s ( i − 1) t − η i ∇L task ( {G τ ⊕ s ( i − 1) τ ; ∀ τ ∈ [1 ,t ] } , y task ( t ) , E tg ) 3:
Revised: s ( i − 1) t + η i ∇L task ( {G τ ⊕ s ( i − 1) τ ; ∀ τ ∈ [1 ,t ] } , y task ( t ) , E tg ) 3:

Original: Projection : s ( i ) t = Π S ( a ( i ) t ) 4: S t ∼ Bernoulli ( s ( N ) t ) such that S t ≤ ε t  2 -week period.
Revised: Projection : s ( i ) t = Π S ( a ( i ) t ) 4: S t ← ROUND ( s ( N ) t ,N r ,ε t ) from Algorithm 4. 2 -week period.

Original: The Reddit dataset is spanned over 3 years, thus we use a 2 -month split to obtain the 20 snapshots.
Revised: The Reddit dataset is spanned over 3 years, thus we use a 2 -month split to obtain the 20 snapshots.

Original: We use the publicly available pre-processed data for DBLP -

Revised: We use the publicly available pre-processed data for DBLP -

Original: (Xu et al., 2019a).
Revised: (Xu et al., 2019a).

Original: For datasets with no node features, i.e., Radoslaw , UCI , and Reddit , we use uniformly random features with dimension 10 .
Revised: For datasets with no node features, i.e., Radoslaw , UCI , and Reddit , we use uniformly random features with dimension 10 .

Original: The pre-processed DBLP -5 has 100 node features for each node.# Nodes [Table] Edges
Revised: The pre-processed DBLP -5 has 100 node features for each node.

Original: [Table]
Revised: [Table]

Original: Time
Revised: Time

Original: [Table]
Revised: [Table]

Original: Labels
Revised: Labels

Original: [Table]
Revised: [Table]

Original: F A DDITIONAL D ETAILS O N E XPERIMENTAL S ETUP F. S ETUP
Revised: F A DDITIONAL D ETAILS O N E XPERIMENTAL S ETUP F. S ETUP

Original: We consider a targeted setting with single targets, that are selected using either a random sampling or a degree-biased sampling.
Revised: We consider a targeted setting with single targets, that are selected using either a random sampling or a degree-biased sampling.

Original: Each target is attacked one-by-one and the total performance of an attacker is measured using either an ROC-AUC or an Accuracy over the set of sampled targets.
Revised: Each target is attacked one-by-one and the total performance of an attacker is measured using either an ROC-AUC or an Accuracy over the set of sampled targets.

Original: F. H YPERPARAMETERS
Revised: F. H YPERPARAMETERS

Original: For TD-PGD optimization, we used ADAM optimizer (Kingma & Ba, 2014) with the initial learning rate of 10 .
Revised: For TD-PGD optimization, we used ADAM optimizer (Kingma & Ba, 2014) with the initial learning rate of 10 .

Original: The initial perturbation vector s (0) was initialized with all ones, thus, giving each perturbation an equal chance at the start.
Revised: The initial perturbation vector s (0) was initialized with all ones, thus, giving each perturbation an equal chance at the start.

Original: The algorithm was run for 50 iterations.
Revised: The algorithm was run for 50 iterations.

Original: We use Binary Cross Entropy loss for training dynamic link prediction and Weighted Cross Entropy for node classiﬁcation.
Revised: We use Binary Cross Entropy loss for training dynamic link prediction and Weighted Cross Entropy for node classiﬁcation.

Original: As we show in the Appendix H.6, G REEDY algorithm does not scale well to higher (cid:15) and larger perturbation space.
Revised: As we show in the Appendix H.6, TGA ( (cid:15) ) algorithm does not scale well to higher (cid:15) and larger perturbation space.

Original: For this reason, we stop the greedy search if the time taken exceeds 300 s, which is at least 3 times that of TD-PGD.
Revised: For this reason, we stop the greedy search if the time taken exceeds 300 s, which is at least 3 times that of TD-PGD.

Original: F. V ICTIM M ODEL TRAINING
Revised: F. V ICTIM M ODEL TRAINING

Original: Table 4 shows the performance on the test set of the victim models on different datasets.
Revised: Table 4 shows the performance on the test set of the victim models on different datasets.

Original: The performance is evaluated using ROC-AUC for the dynamic link prediction and using Accuracy for the node classiﬁcation tasks.
Revised: The performance is evaluated using ROC-AUC for the dynamic link prediction and using Accuracy for the node classiﬁcation tasks.

Original: The test set for dynamic link prediction task denotes the edges and non-edges in the ﬁnal snapshot, while for node classiﬁcation, we use a 20% held-out set of nodes as the test set for noting the performance and attacking.
Revised: The test set for dynamic link prediction task denotes the edges and non-edges in the ﬁnal snapshot, while for node classiﬁcation, we use a 20% held-out set of nodes as the test set for noting the performance and attacking.

Original: [Table]
Revised: [Table]

Original: F. I MPLEMENTATION
Revised: F. I MPLEMENTATION

Original: We use the TorchGeometric-Temporal 3 implementation of E VOLVE GCN and GC-LSTM to train these models.
Revised: We use the TorchGeometric-Temporal 3 implementation of E VOLVE GCN and GC-LSTM to train these models.

Original: For D Y SAT, we use the pytorch implementation 4 .
Revised: For D Y SAT, we use the pytorch implementation 4 .

Original: We adapt the ofﬁcial code of
Revised: We adapt the ofﬁcial code of

Original: TGA 5 to implement the greedy approach.
Revised: TGA 5 to implement the greedy approach.

Original: For TD-PGD implementation, we adapt the DeepRobustimplementation for dynamic graphs under TDAP constraint.
Revised: For TD-PGD implementation, we adapt the DeepRobustimplementation for dynamic graphs under TDAP constraint.

Original: Full code is provided in the attached supplementary for reference.
Revised: Full code is provided in the attached supplementary for reference.

Original: G C OMPLEXITY A NALYSIS
Revised: G C OMPLEXITY A NALYSIS

Original: G REEDY : It makes O ( (cid:15) (cid:80) t
Revised: TGA ( (cid:15) ) : It makes O ( (cid:15) (cid:80) t

Original: d A t ) backward calls to the victim model for gradient calculation.
Revised: d A t ) backward calls to the victim model for gradient calculation.

Original: Let the gradient calculation takes T bw for a model M .
Revised: Let the gradient calculation takes T bw for a model M .

Original: Then, the total time for the greedy is given by
Revised: Then, the total time for the greedy is given by

Original: O ( (cid:15) (cid:80) t
Revised: O ( (cid:15) (cid:80) t

Original: d A t T bw ) .
Revised: d A t T bw ) .

Original: TD-PGD:
Revised: TD-PGD:

Original: It makes O ( N ) backward calls to the victim model for gradient calculation.
Revised: It makes O ( N ) backward calls to the victim model for gradient calculation.

Original: In addition, the projection step takes O ( (cid:80) t log 2 [(max( a t ) − min( a t − 1)) /ξ ]) time per iteration and the random rounding takes O ( (cid:80) t | s t | )
Revised: In addition, the projection step takes O ( (cid:80) t log 2 [(max( a t ) − min( a t − 1)) /ξ ]) time per iteration and the random rounding takes O ( (cid:80) t | s t | )

Original: =
Revised: =

Original: O ( T |V| ) time.
Revised: O ( T |V| ) time.

Original: Therefore, the total time taken by TD-PGD is given by
Revised: Therefore, the total time taken by TD-PGD is given by

Original: O ( NT bw + N (cid:80) t log 

Revised: O ( NT bw + N (cid:80) t log

Original: (max( a t ) − min( a t − 1)) /ξ ]
Revised: (max( a t ) − min( a t − 1)) /ξ ]

Original: + T |V| ) .
Revised: + T |V| ) .

Original: Note that the bottleneck, here, is the term T bw and TD-PGD replaces the dependence on the no. of perturbations to a constant (which is ﬁxed to 50 in the experiments for all the datasets).
Revised: Note that the bottleneck, here, is the term T bw and TD-PGD replaces the dependence on the no. of perturbations to a constant (which is ﬁxed to 50 in the experiments for all the datasets).

Original: Therefore, while G REEDY ﬁnds it hard to scale to larger datasets, TD-PGD can scale as long as there is enough memory.
Revised: Therefore, while TGA ( (cid:15) ) ﬁnds it hard to scale to larger datasets, TD-PGD can scale as long as there is enough memory.

Original: It is worthwhile to note here that TD-PGD would clearly need more memory storage as it needs to store the complete perturbation vector s in the memory during optimization.
Revised: It is worthwhile to note here that TD-PGD would clearly need more memory storage as it needs to store the complete perturbation vector s in the memory during optimization.

Original: A recent paper proposes an alternative method, called PR-BCD, which stores only optimizes for a ﬁxed set of random perturbations (Geisler et al., 2021).
Revised: A recent paper proposes an alternative method, called PR-BCD, which stores only optimizes for a ﬁxed set of random perturbations (Geisler et al., 2021).

Original: Such an approach can be employed with our projection operator to scale to larger datasets at ﬁxed memory usage.
Revised: Such an approach can be employed with our projection operator to scale to larger datasets at ﬁxed memory usage.

Original: We leave testing the effectiveness of this approach on large dynamic graphs for the future.3 https://pytorch-geometric . io/en/latest/index . html#https://github .
Revised: We leave testing the effectiveness of this approach on large dynamic graphs for the future.

Original: com/

Original: /DySAT

Original: https:// com/  https H A DDITIONAL E XPERIMENTS H. PGD P ERFORMANCE O N D IFFERENT M ODELS
Revised: H A DDITIONAL E XPERIMENTS H. PGD P ERFORMANCE O N D IFFERENT M ODELS

Original: Figure 4 compares the TD-PGD attack performance over random targets of different victim models for dynamic link prediction.
Revised: Figure 4 compares the TD-PGD attack performance over random targets of different victim models for dynamic link prediction.

Original: One can note that E VOLVE GCN is the least robust among these models as TD-PGD causes the most drop in this model across datasets.
Revised: One can note that E VOLVE GCN is the least robust among these models as TD-PGD causes the most drop in this model across datasets.

Original: On the other hand, GC-LSTM and
Revised: On the other hand, GC-LSTM and

Original: D Y SAT show similar drop with D Y SAT being slightly more robust among them.
Revised: D Y SAT show similar drop with D Y SAT being slightly more robust among them.

Original: One can explain this result using the architectural differences between these models as D Y SAT, being an attentionbased architecture, makes use of more parameters than other models.
Revised: One can explain this result using the architectural differences between these models as D Y SAT, being an attentionbased architecture, makes use of more parameters than other models.

Original: GC-LSTM embeds GCN into an LSTM and thus, uses the number of parameters than a combination of GCN and LSTM.
Revised: GC-LSTM embeds GCN into an LSTM and thus, uses the number of parameters than a combination of GCN and LSTM.

Original: On the other hand, E VOLVE GCN uses a LSTM architecture to evolve the weights of a GCN, which is more efﬁcient.
Revised: VOLVE GCN uses a LSTM architecture to evolve the weights of a GCN, which is more efﬁcient.

Original: H. D YNAMIC L INK P REDICTION O N T OP -D EGREE T ARGETS
Revised: H. D YNAMIC L INK P REDICTION O N T OP -D EGREE T ARGETS

Original: Figure 5 shows the attack performance on dynamic link prediction with targets being 100 top-degree edges and non-edges each.
Revised: Figure 5 shows the attack performance on dynamic link prediction with targets being 100 top-degree edges and non-edges each.

Original: These targets are picked in the decreasing order of the sum of the degrees of the end-nodes over the time-steps.
Revised: These targets are picked in the decreasing order of the sum of the degrees of the end-nodes over the time-steps.

Original: One can note that TD-PGD outperforms the existing baselines in most cases for these targets as well
Revised: One can note that TD-PGD outperforms the existing baselines in most cases for these targets as well.

Original: . H. E MBEDDING V ARIABILITY
Revised: H. E MBEDDING V ARIABILITY

Original: In this section, we plot the raw values of embedding variability (EV) of different models with increasing (cid:15) .
Revised: In this section, we plot the raw values of embedding variability (EV) of different models with increasing (cid:15) .

Original: Figure 6 shows the mean EV values with their standard deviations at different (cid:15) , while
Revised: Figure 6 shows the mean EV values with their standard deviations at different (cid:15) , while

Original: Figure 7 shows the median values with the interpercentile range ( 10% and 90% ).
Revised: Figure 7 shows the median values with the interpercentile range ( 10% and 90% ).

Original: We note that mean and median values are close to zero for all the methods (only D EGREE reaches 1 ).
Revised: We note that mean and median values are close to zero for all the methods (only D EGREE reaches 1 ).

Original: D EGREE is usually the most detectable of the methods based on the variability caused in the embeddings.
Revised: D EGREE is usually the most detectable of the methods based on the variability caused in the embeddings.

Original: Huge variance in Figure 6 can be attributed to the existence of outliers in the data as the median and 90% quantile value is usually low for all methods, except for D EGREE (as shown in Figure 7.
Revised: Huge variance in Figure 6 can be attributed to the existence of outliers in the data as the median and 90% quantile value is usually low for all methods, except for D EGREE (as shown in Figure 7) [Figure]

Original: H. N ODE C LASSIFICATION O VER R ANDOM T ARGETS
Revised: H. N ODE C LASSIFICATION O VER R ANDOM T ARGETS

Original: In this section
Revised: In this section

Original: [Figure]
Revised: [Figure]

Original: we compare the attack performance on the node classiﬁcation task over randomlyselected target nodes from the test set.
Revised: we compare the attack performance on the node classiﬁcation task over randomlyselected target nodes from the test set.

Original: In addition to structural perturbations, we also do feature perturbations while following the TDAP constraint
Revised: In addition to structural perturbations, we also do feature perturbations while following the TDAP constraint

Original: [Figure]
Revised: [Figure]

Original: Structural perturbations Figure 8 compares the drop caused by different attack methods on the node classiﬁcation task for different models over random targets.
Revised: Structural perturbations Figure 8 compares the drop caused by different attack methods on the node classiﬁcation task for different models over random targets.

Original: One can note that all attack models perform as good as the other on E VOLVE GCN and D Y SAT, while TD-PGD outperforms others on
Revised: One can note that all attack models perform as good as the other on E VOLVE GCN and D Y SAT, while TD-PGD outperforms others on

Original: [Figure]
Revised: [Figure]

Original: [Figure] 
Revised: [Figure] [Figure] [Figure]

Original: [Figure] [Figure]
Revised: [Table] [Table] [Figure]

Original: ) Reddit

Original: [Figure] [Figure]
Revised: [Equation] [Figure]

Original: GC-LSTM by a factor of 2 .
Revised: GC-LSTM by a factor of 2 .

Original: No attack method is found to achieve a signiﬁcant drop, i.e., below 5% , in the accuracy of D Y SAT and E VOLVE GCN on DBLP .
Revised: No attack method is found to achieve a signiﬁcant drop, i.e., below 5% , in the accuracy of D Y SAT and E VOLVE GCN on DBLP .

Original: Feature perturbations Further analysis shows that feature perturbations are more effective in this task for random targets.
Revised: Feature perturbations Further analysis shows that feature perturbations are more effective in this task for random targets.

Original: Here, the task is to introduce continuous perturbations S Xt
Revised: Here, the task is to introduce continuous perturbations S Xt

Original: = X (cid:48)
Revised: = X (cid:48)

Original: t − X t such that (cid:107) X (cid:48) t − X t (cid:107) ≤ (cid:15)d X t for all t .
Revised: t − X t such that (cid:107) X (cid:48) t − X t (cid:107) ≤ (cid:15)d X t for all t .

Original: Equation 1, thus, becomes
Revised: Equation 1, thus, becomes

Original: [Equation]
Revised: [Equation]

Original: [Equation]

Original: ) such that ∀ t ∈ (1 ,T ) : (cid:107) X
Revised: such that ∀ t ∈ (1 ,T ) : (cid:107) X

Original: [Equation]
Revised: [Equation]

Original: (cid:107)

Original: [Equation]

Original: [Table]

Original: We adapt the Algorithm 1 to this problem to ﬁnd effective perturbations.
Revised: We adapt the Algorithm 1 to this problem to ﬁnd effective perturbations.

Original: In particular, we replace s t to denote the feature perturbation vector at time t , i.e., the vector corresponding to X (cid:48)
Revised: In particular, we replace s t to denote the feature perturbation vector at time t , i.e., the vector corresponding to X (cid:48)

Original: t − X t .
Revised: t − X t .

Original: Finally, since the perturbations are supposed to be in continuous space, we remove the rounding step (line 4) and return the matrix form of { s t } as S X .
Revised: Finally, since the perturbations are supposed to be in continuous space, we remove the rounding step (line 4) and return the matrix form of { s t } as S X .

Original: Thus, TD-PGD can be used to ﬁnd effective attacks in the feature perturbation setting as well.
Revised: Thus, TD-PGD can be used to ﬁnd effective attacks in the feature perturbation setting as well.

Original: However, since G REEDY and D EGREE takes decisions based on the structure, we omit these baselines for this setting.
Revised: However, since TGA ( (cid:15) ) and D EGREE takes decisions based on the structure, we omit these baselines for this setting.

Original: We use R ANDOM to introduce uniformly random perturbations in the feature matrices of the random nodes.
Revised: We use R ANDOM to introduce uniformly random perturbations in the feature matrices of the random nodes.

Original: Figure 9 compares the attack performance of the two feature perturbation methods on DBLP -5 over random targets.
Revised: Figure 9 compares the attack performance of the two feature perturbation methods on DBLP -5 over random targets.

Original: One can note that TD-PGD is able to achieve around 30% drop for all the models  while it could not drop the performance below 5% for these random targets using structural perturbations.
Revised: One can note that TD-PGD is able to achieve around 30% drop for all the models [Figure] [Figure] while it could not drop the performance below 5% for these random targets using structural perturbations.

Original: This can be explained by the low degree of these targets (average ∼ 10 over 10 time steps) which allows for a small no. of perturbations per time step according to the TDAP constraint.
Revised: This can be explained by the low degree of these targets (average ∼ 10 over 10 time steps) which allows for a small no. of perturbations per time step according to the TDAP constraint.

Original: Furthermore, the node features here correspond to the word2vec attributes of the author papers while the labels represent the ﬁeld of the author.
Revised: Furthermore, the node features here correspond to the word2vec attributes of the author papers while the labels represent the ﬁeld of the author.

Original: Thus, there is a strong connection between the attributes and the downstream labels, which makes feature perturbation more effective than structural co-author perturbations to ﬂip predicted labels for the classiﬁcation task.
Revised: Thus, there is a strong connection between the attributes and the downstream labels, which makes feature perturbation more effective than structural co-author perturbations to ﬂip predicted labels for the classiﬁcation task.

Original: H. O NLINE A DVERSARIAL A TTACKS
Revised: H. O NLINE A DVERSARIAL A TTACKS

Original: In this section, we show the performance of the 3 methods in the online setting for node classiﬁcation on the DBLP dataset.
Revised: In this section, we show the performance of the 3 methods in the online setting for node classiﬁcation on the DBLP dataset.

Original: Figures 10 and 11 show performance over random and top-degree targets respectively.
Revised: Figures 10 and 11 show performance over random and top-degree targets respectively.

Original: One can note that TD-PGD shows competitive performance over other baselines while obtaining a 5 x gain in the relative drop for GC-LSTM.[Figure] [Figure]
Revised: One can note that TD-PGD shows competitive performance over other baselines while obtaining a 5 x gain in the relative drop for GC-LSTM.

Original: H. R UNNING T IME
Revised: H. R UNNING T IME

Original: Figure 12 compares the running time per target for different attack methods on the largest dataset,
Revised: Figure 12 compares the running time per target for different attack methods on the largest dataset,

Original: Reddit .
Revised: Reddit .

Original: The times are averaged over 200 targets from 3 different seeds and error bars note the standard deviation.
Revised: The times are averaged over 200 targets from 3 different seeds and error bars note the standard deviation.

Original: G REEDY is the most expensive method in terms of time and scales almost linearly with (cid:15) (capped at 300 s).
Revised: TGA ( (cid:15) ) is the most expensive method in terms of time and scales almost linearly with (cid:15) (capped at 300 s).

Original: TD-PGD takes around half the time than G REEDY and remains constant with increase in (cid:15) .
Revised: TD-PGD takes around half the time than TGA ( (cid:15) ) and remains constant with increase in (cid:15) .

Original: This trend can be attributed to the difference in the complexity of the two methods, as shown in Appendix G.
Revised: This trend can be attributed to the difference in the complexity of the two methods, as shown in Appendix G.

Original:  Figure 13 compares the average running time of different methods at varying size of the dataset for a ﬁxed (cid:15) (here = 0 . 5 ).
Revised: [Figure] [Figure] Figure 13 compares the average running time of different methods at varying size of the dataset for a ﬁxed (cid:15) (here = 0 . 5 ).

Original: As noted in Table 3, Radoslaw is the most dense and Reddit is the largest dataset in terms of edges.
Revised: As noted in Table 3, Radoslaw is the most dense and Reddit is the largest dataset in terms of edges.

Original: We ﬁnd that TD-PGD scales at a smaller rate than G REEDY across different victim models.
Revised: We ﬁnd that TD-PGD scales at a smaller rate than TGA ( (cid:15) ) across different victim models.

Original: I T IME -A WARE P ERTURBATION : D ISCUSSION
Revised: I T IME -A WARE P ERTURBATION : D ISCUSSION

Original: Clariﬁcations : A targeted attack requires the derivative to be with respect to targets only.
Revised: Clariﬁcations : A targeted attack requires the derivative to be with respect to targets only.

Original: Thus, (cid:107)
Revised: Thus, (cid:107)

Original: A t − A t − 1 (cid:107) in Equation 2 considers adjacency matrices over the target nodes in the set E tg only.
Revised: A t − A t − 1 (cid:107) in Equation 2 considers adjacency matrices over the target nodes in the set E tg only.

Original: An untargeted attack, on the other hand, would take the differential norm over all the entities in the input (i.e., all the nodes in a graph).[Figure] [Figure]
Revised: An untargeted attack, on the other hand, would take the differential norm over all the entities in the input (i.e., all the nodes in a graph).

Original: J E XTENDED R ELATED W ORK
Revised: J E XTENDED R ELATED W ORK

Original: Adversarial attacks on static graphs.
Revised: Adversarial attacks on static graphs.

Original: Various attack environments, based on attacker’s knowledge and intention, are studied in the literature to assess model performance under adversarial attacks on static graphs (Jin et al., 2020).
Revised: Various attack environments, based on attacker’s knowledge and intention, are studied in the literature to assess model performance under adversarial attacks on static graphs (Jin et al., 2020).

Original: In the literature, adversarial attacks are studied in different settings based on (a) attacker’s knowledge of the underlying model (white-box v/s black-box), (b) their intention for the attack (targeted v/s untargeted), and (c) the timing of their attack (poisoning v/s evasion) (Jin et al., 2020).
Revised: In the literature, adversarial attacks are studied in different settings based on (a) attacker’s knowledge of the underlying model (white-box v/s black-box), (b) their intention for the attack (targeted v/s untargeted), and (c) the timing of their attack (poisoning v/s evasion) (Jin et al., 2020).

Original: Each such combination allows us to assess the model’s performance in different attack environments. 
Revised: Each such combination allows us to assess the model’s performance in different attack environments. [Figure]

Original: We consider a white-box, targeted, evasion setting where the objective is to introduce targeted perturbations to an already trained, ﬁxed victim model assuming complete knowledge about its architecture and parameters.
Revised: We consider a white-box, targeted, evasion setting where the objective is to introduce targeted perturbations to an already trained, ﬁxed victim model assuming complete knowledge about its architecture and parameters.

Original: Optimization approaches for white-box evasion attacks in static graph literature include PGD (Xu et al., 2019b) and IG-JSMA (Wu et al., 2019).
Revised: Optimization approaches for white-box evasion attacks in static graph literature include PGD (Xu et al., 2019b) and IG-JSMA (Wu et al., 2019).

Original: In the present work, we show how to use PGD to generate effective perturbations on dynamic graphs under our novel TDAP constraint.
Revised: In the present work, we show how to use PGD to generate effective perturbations on dynamic graphs under our novel TDAP constraint.

Original: Secondly, IG-JSMA is proposed for the case of static graphs under a global budget constraint.
Revised: Secondly, IG-JSMA is proposed for the case of static graphs under a global budget constraint.

Original: It is not clear how the importance scores calculated for each edge in the graph sequence would be chosen in a greedy manner to hold our local TDAP constraint.
Revised: It is not clear how the importance scores calculated for each edge in the graph sequence would be chosen in a greedy manner to hold our local TDAP constraint.

Original: Adversarial attacks on dynamic graphs.
Revised: Adversarial attacks on dynamic graphs.

Original: Adversarial attack on dynamic graphs is an underexplored problem and no direct baselines exist that study attacks on dynamic graphs that can preserve temporal evolution (in particular, the proposed TDAP constraint).
Revised: Adversarial attack on dynamic graphs is an underexplored problem and no direct baselines exist that study attacks on dynamic graphs that can preserve temporal evolution (in particular, the proposed TDAP constraint).

Original: We only found three works that study adversarial attacks on dynamic graphs (Chen et al., 2021a;b; Fan et al., 2020).
Revised: We only found three works that study adversarial attacks on dynamic graphs (Chen et al., 2021a;b; Fan et al., 2020).

Original: Out of these, only Chen et al.
Revised: Out of these, only Chen et al.

Original: (2021b) considers a white-box evasion (test-time) attack, which is the same set- [Figure] ting as ours.
Revised: (2021b) considers a white-box evasion (test-time) attack, which is the same setting as ours.

Original: We adopt the greedy strategy proposed in Chen et al.
Revised: We adopt the greedy strategy proposed in Chen et al.

Original: (2021b)
Revised: (2021b)

Original: to our constraint to ﬁnd feasible perturbations for our problem setting as the G REEDY baseline.
Revised: to our constraint to ﬁnd feasible perturbations for our problem setting as the TGA ( (cid:15) ) baseline.

Original: Other methods either consider black-box attacks (Fan et al., 2020) or train-time (backdoor) attacks (Chen et al., 2021a), which cannot be directly applied here.
Revised: Other methods either consider black-box attacks (Fan et al., 2020) or train-time (backdoor) attacks (Chen et al., 2021a), which cannot be directly applied here.

Original: This is because white-box attacks assume full knowledge of the victim model while black-box attacks ﬁnd perturbations in a model-agnostic manner, which would be suboptimal in a setting where model knowledge is available.
Revised: This is because white-box attacks assume full knowledge of the victim model while black-box attacks ﬁnd perturbations in a model-agnostic manner, which would be suboptimal in a setting where model knowledge is available.

Original: Secondly, backdoor attacks considers the objective of ﬁnding a trigger sequence of subgraphs that is added to the train graphs such that the model trained on these perturbed train graphs misclassiﬁes a target link.
Revised: Secondly, backdoor attacks considers the objective of ﬁnding a trigger sequence of subgraphs that is added to the train graphs such that the model trained on these perturbed train graphs misclassiﬁes a target link.

Original: In contrast, we introduce edge-level perturbations directly to the end-points of the target link (instead of subgraphs) during test time which implies that the trained model parameters are not updated.
Revised: In contrast, we introduce edge-level perturbations directly to the end-points of the target link (instead of subgraphs) during test time which implies that the trained model parameters are not updated.

Original: Imperceptible Attacks.
Revised: Imperceptible Attacks.

Original: In addition to bounding the total number of perturbations with a budget, other strategies have been developed to make the attacks imperceptible for static graphs.
Revised: In addition to bounding the total number of perturbations with a budget, other strategies have been developed to make the attacks imperceptible for static graphs.

Original: These include rewiring the perturbed edges (Ma et al., 2019; 2021), perturbing the low degree nodes (Ma et al., 2020a), and preserving the degree/feature distribution statistics (Z ¨ ugner et al., 2018). 
Revised: These include rewiring the perturbed edges (Ma et al., 2019; 2021), perturbing the low degree nodes (Ma et al., 2020a), and preserving the degree/feature distribution statistics (Z¨ugner et al., 2018). K A DDITIONAL PROOFS Theorem 4 d A (cid:48) ≥ | 1 − 2 (cid:15) | d A

Revised: Proof.

Original: K P OTENTIAL N EGATIVE S OCIETAL I MPACTS
Revised: TDAP ensures that (cid:107) A (cid:48) t − A t (cid:107) 1 ≤ (cid:15) (cid:107) A t − A t − 1 (cid:107) 1 . Now, we note that since (cid:107)·(cid:107) 1 ≥ (cid:107)·(cid:107) 2 , we also get (cid:107) A (cid:48)

Revised: t − A t (cid:107) 2 ≤ (cid:15) (cid:107)

Revised: A t − A t − 1 (cid:107) 1 .

Revised: Further note that (cid:107) x − y (cid:107) 2 ≤ c implies y − c e r ≤ x ≤ y + c e r for all unit vectors e r ( (cid:107) e r (cid:107) = 1 ).

Revised: Thus, (cid:107) A (cid:48)

Revised: t − A t (cid:107) 2 ≤ (cid:15) (cid:107)

Revised: A t − A t − 1 (cid:107) 1 implies A t − (cid:15) (cid:107)

Revised: A t − A t − 1 (cid:107) 1 e r ≤ A (cid:48) t ≤ A t + (cid:15) (cid:107)

Revised: A t − A t − 1 (cid:107) 1 e r .

Revised: Substituting the above inequalities for A (cid:48) t and A (cid:48) t − 1 in (cid:107) A (cid:48)

Revised: t − A (cid:48)

Revised: t − 1 (cid:107) 1 , we get (cid:107) A (cid:48)

Revised: t − A (cid:48)

Revised: t − 1 (cid:107) 1 ≥ (cid:107)

Revised: A t − A t − 1 − (cid:15) (cid:107)

Revised: A t − A t − 1 (cid:107) e r, 1 − (cid:15) (cid:107)

Revised: A t − 1 − A t − 2 (cid:107) e r, 2 (cid:107) 1 , for some unit vectors e r, 1 , e r, 2 .

Revised: Using reverse triangle inequality, (cid:107) A (cid:48)

Revised: t − A (cid:48)

Revised: t − 1 (cid:107) 1 ≥ (cid:12) (cid:12)(cid:12) (cid:107)

Revised: A t − A t − 1 (cid:107) 1 − (cid:15) (cid:107)(cid:107)

Revised: A t − A t − 1 (cid:107) 1 e r, 1 +

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Table]

Revised: we get (cid:80)

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: we get d A (cid:48) ≥ | 1 − 2 (cid:15) | d A .

Revised: Theorem

Revised: [Equation]

Revised: A t − A t − 1 (cid:107)

Revised: Proof.

Revised: By Cauchy’s MVT, Z (cid:48) t − Z t ≤ ∇ f · q (cid:48) t − q t , which gives us (cid:107) Z (cid:48) t − Z t (cid:107) ≤ (cid:107)∇ f (cid:107) (cid:107) q (cid:48)

Revised: t − q t (cid:107) by

Revised: Cauchy-Schwarz inequality.

Original: {+Note that (cid:107) q (cid:48) t − q t (cid:107) 
+}
Revised: {+Note that (cid:107) q (cid:48) t − q t (cid:107) 
+}

Revised: = (cid:107) A (cid:48)

Revised: t − A t (cid:107) 1 .

Revised: Thus, (cid:107) Z (cid:48)

Revised: t − Z t (cid:107) ≤ (cid:107)∇ f (cid:107) (cid:107) A (cid:48)

Revised: t − A t (cid:107) =

Revised: C (cid:107) A (cid:48)

Revised: t − A t (cid:107) ≤ C(cid:15) (cid:107)

Revised: A t − A t − 1 (cid:107) , by the deﬁnition of TDAP constraint.

Revised: Theorem 6 d Z (cid:48) ≥

Revised: χd Z

Revised: Proof.

Revised: Note that Z t = f

Revised: ( A t , A t − 1 , ··· , A 1 ) .

Revised: We consider a stacked vector of ﬂattened matrices ∀ τ ∈ [0 ,t ] : q ≤ τ = ( q τ , q τ − 1 , ··· , q 1 , 0 , 0 , ··· , 0 ) , where q i is the ﬂattened vector of A τ

Original: {+and we append ( t − τ ) 
+}
Revised: {+and we append ( t − τ ) 
+}

Revised: s to make all vectors q ≤ i of ﬁxed dimension t .

Revised: Then, by Cauchy’s Mean Value

Revised: Theorem in several variables, we have Z t − Z t − 1 ≥ ∇ f t − 1 · ( q ≤ t − q ≤ t − 1 ) , which gives us (cid:107) Z t − Z t − 1 (cid:107) ≥ (cid:107)∇ f t − 1 (cid:107) (cid:107) q ≤ t − q ≤ t − 1 (cid:107) cos

Revised: ( θ ) by the deﬁnition as θ is the angle between q ≤ t and q ≤ t − 1 .

Revised: We note that (cid:107) q ≤ t − q ≤ t − 1 (cid:107) 1 = (cid:107) ( q t − q t − 1 , ··· , q 2 − q 1 , q 1 ) (cid:107) 1 = (cid:80) t (cid:107) q t − q t − 1 (cid:107) 1 =

Revised: T d A .

Revised: Thus, we have (cid:107) Z t − Z t − 1 (cid:107) 1 ≥ C 3 d A for some constant C 3 ≥ 0 .

Revised: Using Theorem 4, we get d Z (cid:48) ≥ C 3 d A (cid:48) ≥ C 3 | 1 − 2 (cid:15) | d A .

Revised: By mean-value theorem and Cauchy-Schwarz inequality, we also have d Z t ≤ (cid:107)∇ f (cid:107) (cid:107) q ≤ t − q ≤ t − 1 (cid:107) =

Revised: C 4 d A .

Revised: Hence, d Z (cid:48) ≥ C 3 | 1 − 2 (cid:15)

Revised: |

Revised: d A ≥ C 3 C 4 | 1 − 2 (cid:15) | d Z = χd Z for some constant χ ≥ 0 .

Revised: L A NOMALY D ETECTION W ITH TDAP C ONSTRAINT

Revised: Anomaly detection methods for dynamic graphs can be divided into two broad categories based on the available input Akoglu et al.

Revised: ; Ma et al.

Revised: (2021); Ranshous et al.

Revised: Supervised methods.

Revised: Ground-truth labels for anomalous edges are known or estimated from the data.

Revised: A model is trained to minimize a supervised loss to classify the labeled edges in the training set.

Revised: For example, Cai et al.

Revised: ; Zhu et al.

Revised: (2020) use Cross Entropy loss while Zheng et al.

Revised: ; Wang et al.

Revised: (2020) use margin loss on a parameterized anomalous score that is calculated for each edge using end-to-end trained node embeddings.

Revised: Since these anomaly detection methods are trained on supervisory signals that may not be accessible to an attacker, evading these anomaly detectors is not the focus of our work.

Revised: Unsupervised methods.

Revised: Here, anomalies are detected by studying certain properties of the dynamic graph in the structural or embedding space.

Revised: Victim graph representation models can employ such unsupervised strategies as a defense mechanism against adversarial perturbations.

Revised: Thus, an attacker must be able to defend against such methods to be effective in practice.

Revised: The focus of our current work is thus to make the unsupervised methods fail to detect adversarial edges as anomalies.

Revised: Traditional methods have studied, different graph distance metrics between consecutive snapshots such as graph edit distance, hamming distance, and spectral distance, to detect anomalous snapshots

Revised: Shoubridge et al.

Revised: Bunke et al.

Revised: If the distance with the previous snapshot exceeds a threshold then the instance is deemed anomalous.

Revised: These papers, however, have focused on effectively detecting graph anomalies instead of edge anomalies at any point in time.

Revised: In our work, we consider a targeted attack setting, where perturbations (anomalies) are added to only change the local behavior around the target and not the global graph dynamics.

Revised: A graph-level anomaly detection would thus not be able to detect local perturbations.

Revised: For this reason, we study these distance metrics for just the ego-network around the target node.

Revised: Theorems 1 and 4 show that the average rate of structural change remains preserved within certain factors that can be tuned to fool these detectors.

Revised: Suppose one had chosen a threshold B such that d A t ≥ B is deﬁned an anomaly.

Revised: If initially the graph sequence was not anomalous on average, i.e., d A ≤ B , then after perturbation, d A (cid:48) ≥ B would happen if d A (cid:48) ≥ | 1 − 2 (cid:15) | d A ≥ B , i.e., d A ≥ B/ ( | 1 − 2 (cid:15) | ) .

Revised: Thus, one can choose a value of (cid:15) such that this does not hold for a given threshold B and snapshot dynamics d A .

Revised: Embedding-based anomaly detection strategies have also been proposed that work in an unsupervised manner.

Revised: Yu et al.

Revised: (2018) clusters the embeddings of a sampled edge set at each timestep and ﬂags an edge to be anomalous if its distance in the embedding space from each cluster exceeds a threshold.

Revised: One can note that TDAP-constrained solutions would be effective against such a detector as well since as noted in Theorem 5, embeddings before and after perturbation change only by a small factor of the actual change in the adjacency matrices relative to the previous timestep.

Revised: Thus, the distance of edge embeddings from the cluster centers would change according to the structural evolution at that time.

Revised: We further show this with empirical evidence as below.

Revised: Another embedding-based method uses the norm distance between embeddings in consecutive snapshots to ﬁnd anomalies when the distance exceeds a threshold Goyal et al.

Revised: Theorems 2 and 6 directly note that the embedding distance between consecutive snapshots would be preserved.

Revised: We also show empirical evidence of this preservation via our metric Embedding Variability.

Revised: Note that

Revised: Embedding Variability measures the ratio of the range of the consecutive embedding distance before and after the perturbation.

Original: {+Thus, if the embedding variability is κ , it means the range of d Z τ after perturbation is 
+}
Revised: {+Thus, if the embedding variability is κ , it means the range of d Z τ after perturbation is 
+}

Revised: + κ (or 1 − κ ) times the range of d Z τ before perturbation.

Revised: If the threshold was set to be D , then our perturbation would be anomalous if D ≥ d Z τ ≥ D/

Revised: (1 + κ ) .

Revised: Thus, we can choose an (cid:15) such that the obtained EV (i.e., κ ) does not satisfy the above inequality for a given threshold D and embedding evolution d Z τ .

Revised: In this work, we show how κ varies with different (cid:15) and can be as low as 0 . 04 even for an (cid:15) = 0 .

Revised: L. E MPIRICAL A NALYSIS

Revised: Netwalk.

Revised: In this section, we test the efﬁcacy of Netwalk anomalous scores to detect perturbations made under the TDAP constraint.

Revised: We used the 3 victim representation models (as above) to obtain the embeddings and used the K-Means algorithm with k = 5 for clustering at each time step.

Revised: Perturbations are selected from the TD-PGD algorithm and the edge embeddings are clustered in the original and perturbed embedding space for a ﬁxed set of held-out training edges.

Revised: The anomalous score is then calculated as the average distance of the perturbed edges to the nearest cluster’s centroid in the corresponding embedding space.

Revised: Figure 14 shows anomalous score of the Netwalk algorithm Yu et al.

Revised: (2018) of the perturbed edges in different victim models for different datasets.

Revised: One can note that the anomalous score in the perturbed embedding space almost perfectly overlaps the anomalous score in the original embedding space.

Revised: One exception is Figure 14b where the distance after perturbation increases signiﬁcantly over the original space as (cid:15) increases.

Revised: We also conducted a 2-sample t-test between original and perturbed anomalous scores at each epsilon value for each model and dataset.

Revised: The hypothesis of the two distributions being similar was accepted (i.e., p -value > 0 . 05 ) in all but ﬁve cases.

Revised: These were

Revised: EvolveGCN for Radoslaw at (cid:15) = 0 . 3 , 0 . 5 , 0 . 7 , 0 . 9 and DySAT for Radoslaw at (cid:15) = 0 . 9 .

Revised: Thus, perturbations under the TDAP constraint are not easily detectable by the Netwalk algorithm.

Revised: DynGem.

Revised: DynGem detects anomalies based on the value d Z t at each time t .

Revised: While Embedding

Revised: Variability gives an idea of how different the distribution of d Z t is before and after perturbation, the value can still be arbitrarily low.

Revised: Thus, we conduct a 2 -sample t-test between d Z and d Z (cid:48) for each model-dataset pair at different epsilons, to see if the distributions are different.

Revised: Table 6 show p -values for each case and highlights the cases where the null hypothesis of the two distributions was not rejected (i.e., p -value > 0 . 05 ).

Revised: One can note that the t-test found a difference in d Z in only 40 out of 117 cases across 3 datasets, 3 victim models, and 13 epsilon values.

Revised: M R ANDOMIZED R OUNDING FOR TD-PGD

Revised: We use randomized rounding for TD-PGD in order to efﬁciently obtain a valid discrete perturbation solution from the continuous vector obtained by running N iterations of the PGD loop.

Revised: Inspired by existing works on using PGD for graphs Xu et al.

Revised: (2019b)

Revised: ; Geisler et al.

Revised: (2021), we do randomized rounding for a ﬁxed number of iterations and pick the solution that maximizes the loss while satisfying the constraint.

Revised: Furthermore, to ensure fast convergence, we adopt the top-k heuristic sampling strategy in the ﬁrst iteration Geisler et al.

Revised: Algorithm 4 describes the steps taken in TD-PGD

Revised: [Figure]

Revised: [Table]

Original:  Our work presents the ﬁrst comprehensive study on adversarial attacks on discrete-time dynamic graphs and shows that existing learning models in this domain are vulnerable to even those attacks that can preserve original evolution of graphs
Revised: to obtain a valid discrete solution. Note that in the case of online TD-PGD, this algorithm runs for a single time step t instead of T − 1 . N P OTENTIAL N EGATIVE S OCIETAL I MPACTS Our work presents the ﬁrst comprehensive study on adversarial attacks on discrete-time dynamic graphs and shows that existing learning models in this domain are vulnerable to even those attacks that can preserve original evolution of graphs.

Original: Dynamic graphs can model a large variety of so cially critical data structures ranging from social media epidemiology , ﬁnance, biology and road networks
Revised: Dynamic graphs can model a large variety of socially critical data structures, ranging from social media, epidemiology, ﬁnance, biology, and road networks.

Original: Our work shows that state -of- the -art deep learning prediction models are vulnerable to perturbations under the TDAP constraint
Revised: Our work shows that state-of-the-art deep learning prediction models are vulnerable to perturbations under the TDAP constraint.

Original: This means that these models are not suitable for deployment in environments where adversarial attacks under a TDAP constraint are realistic.
Revised: This means that these models are not suitable for deployment in environments where adversarial attacks under a TDAP constraint are realistic.

Original: If these models are deployed in such a setting adversarial attacks proposed in this work can be used by an adversary to hamper the predictions.
Revised: If these models are deployed in such a setting, adversarial attacks proposed in this work can be used by an adversary to hamper the predictions.

Original: However it must be noted that none of the models used in this work are known to be deployed in the real-world.
Revised: However, it must be noted that none of the models used in this work are known to be deployed in the real-world.

Original: Secondly, TDAP constraint with a large (cid:15) may not be realistic in many applications.
Revised: Secondly, TDAP constraint with a large (cid:15) may not be realistic in many applications.

Original: Thus, our study has an overall positive impact on the society as it allows practitioners to test the robustness of their models under a practical constraint before deploying in vulnerable environments.
Revised: Thus, our study has an overall positive impact on the society as it allows practitioners to test the robustness of their models under a practical constraint before deploying in vulnerable environments.

Original: Although our attacks can be adopted by adversaries for negative use, it is important to put it out in the community so that the model designers are made aware of these attacks that are speciﬁcally designed to evade detection.
Revised: Although our attacks can be adopted by adversaries for negative use, it is important to put it out in the community so that the model designers are made aware of these attacks that are speciﬁcally designed to evade detection.