Original: Query-based Adversarial Attacks on Graph with Fake Nodes
Revised: Query-based Adversarial Attacks on Graph with Fake Nodes

Original: Anonymous Authors

Original: Abstract
Revised: Abstract

Original: While deep neural networks have achieved great success on the graph  analysis, recent works have shown that they arealso vulnerable to adversarial attacks where fraudulent users can fool the model with a limited number of queries.
Revised: While deep neural networks have achieved great success on the graph data analysis, recent works have shown that they are vulnerable to adversarial attacks where fraudulent users can fool the model with a limited number of queries.

Original: Compared with adversarial attacks on image classiﬁcation, performing adversarial attack on graphs is challenging because of the discrete and non-differential nature of a graph.
Revised: Compared with adversarial attacks on image classiﬁcation, performing adversarial attack on graphs is challenging because of the discrete and non-differential nature of a graph.

Original: To address these issues, we proposed Cluster Attack, a novel adversarial attack by introducing a set of fake nodes to the original graph which can mislead the classiﬁcation on certain victim nodes.
Revised: To address these issues, we proposed Cluster Attack, a novel adversarial attack by introducing a set of fake nodes to the original graph which can mislead the classiﬁcation on certain victim nodes.

Original: Moreover, our attack is performed in a practical and unnoticeable manner.
Revised: Moreover, our attack is performed in a practical and unnoticeable manner.

Original: Extensive experiments demonstrate the effectiveness of our method in terms of the success rate of attack.
Revised: Extensive experiments demonstrate the effectiveness of our method in terms of the success rate of attack.

Original: 1. Introduction
Revised: 1. Introduction

Original: Recent research in Graph Neural Networks (GNNs) has shown a promising performance on various applications to graph data including the recommendation systems (Ying et al., 2018), social networks (Qiu et al., 2018), electronic commerce (Chen et al., 2019), etc.
Revised: Recent research in Graph Neural Networks (GNNs) has shown a promising performance on various applications to graph data including the recommender systems (Ying et al., 2018), social networks (Qiu et al., 2018), electronic commerce (Chen et al., 2019), etc.

Original: Just like other types of deep learning models, recent studies have shown that GNNs are vulnerable to adversarial attack (Dai et al., 2018; Z ¨ ugner et al., 2018).
Revised: Just like other types of deep learning models, recent studies have shown that GNNs are vulnerable to adversarial attack (Dai et al., 2018; Z ¨ ugner et al., 2018).

Original: The performance of a well-trained GNN can be signiﬁcantly degenerated by adversarial manipulations, which are carefully crafted inputs with small perturbations added.
Revised: The performance of a well-trained GNN can be signiﬁcantly degenerated by adversarial manipulations, which are carefully crafted inputs with small perturbations added.

Original: In this work we consider a more practical scenario in adversarial attack on graph data, which aims to mislead the predicted labels of certain victim nodes without sacriﬁcing the prediction on other nodes signiﬁcantly.
Revised: In this work we consider a more practical scenario in adversarial attack on graph data, which aims to mislead the predicted labels of certain victim nodes without sacriﬁcing the prediction on other nodes signiﬁcantly.

Original: In our setting, we consider to protect the neighbors of victim nodes within
Revised: In our setting, Accepted by the ICML 2021 workshop on A Blessing in Disguise: The Prospects and Perils of Adversarial Machine Learning

Original: [Figure]
Revised: [Figure]

Original:  k -hop from being misclassiﬁed.
Revised: we consider to protect the neighbors of victim nodes within k -hop from being misclassiﬁed.

Original: Moreover, we choose to introduce extra fake nodes into the original graph instead of directly modifying the original graph, since it is more practical in real-world scenario.
Revised: Moreover, we choose to introduce extra fake nodes into the original graph instead of directly modifying the original graph, since it is more practical in real-world scenario.

Original: It is also noted that in the practical scenarios, we can only access part of the graph.
Revised: It is also noted that in the practical scenarios, we can only access part of the graph.

Original: In our setting, we can only access partial information of the graph data by observe the nodes being attacked with their neighbor nodes within k -hop.
Revised: In our setting, we can only access partial information of the graph data by observe the nodes being attacked with their neighbor nodes within k -hop.

Original: As a more challenging setup, we have no access to to the model parameters.
Revised: As a more challenging setup, we have no access to to the model parameters.

Original: We can only have a limited number of queries on the victim model about the predicted scores of certain nodes when performing adversarial attack.
Revised: We can only have a limited number of queries on the victim model about the predicted scores of certain nodes when performing adversarial attack.

Original: To tackle the discrete optimization problem, we propose our
Revised: To tackle the discrete optimization problem, we propose our

Original: Cluster Attack , which attacks by divide the victim nodes into several clusters according to their most adversarial feature s, which can be approximately computed within limited queries.
Revised: Cluster Attack , which attacks by divide the victim nodes into several clusters according to their most adversarial feature s, which can be approximately computed within limited queries.

Original: Our contribution can be summarized as follows:
Revised: Our contribution can be summarized as follows:

Original: • We propose a practical threat model on graph adversarial attack.
Revised: • We propose a practical threat model on graph adversarial attack.

Original: We perform query-based adversarial attack on graph with partial information about the graph with non-targeted nodes protected.
Revised: We perform query-based adversarial attack on graph with partial information about the graph with non-targeted nodes protected.

Original: • We propose Cluster Attack , an effective and efﬁcient adversarial attack on graph structured data which attacks by divide victim nodes into several smaller clusters.
Revised: • We propose Cluster Attack , an effective and efﬁcient adversarial attack on graph structured data which attacks by divide victim nodes into several smaller clusters.

Original: 2. Related Works
Revised: 2. Related Works

Original: In recent years, many methods were proposed to perform adversarial attack on graph.
Revised: In recent years, many methods were proposed to perform adversarial attack on graph.

Original: For greedy methods, NETTACK (Z¨ugner et al., 2018) proposed to attack the graph by greedily modifying the edges and features of the graph.
Revised: For greedy methods, NETTACK (Z¨ugner et al., 2018) proposed to attack the graph by greedily modifying the edges and features of the graph.

Original: (Wang et al., 2018) proposed to attack by adding fake nodes and then greedily modifying the edges and features.
Revised: (Wang et al., 2018) proposed to attack by adding fake nodes and then greedily modifying the edges and features.

Original: For methods based on reinforcement learning, (Dai et al., 2018) proposed RL-S2V to attack by changing existing edges in the graph, while (Sun et al., 2020) proposed NIPA to attack by adding fake nodes.
Revised: For methods based on reinforcement learning, (Dai et al., 2018) proposed RL-S2V to attack by changing existing edges in the graph, while (Sun et al., 2020) proposed NIPA to attack by adding fake nodes.

Original: (Xu et al., 2019; Wu et al., 2019; Chen et al., 2020b;a) proposed to attack using gradient information.
Revised: (Xu et al., 2019; Wu et al., 2019; Chen et al., 2020b;a) proposed to attack using gradient information.

Original: (Z¨ugner & G¨unnemann, 2019) uses meta-learning to attack.
Revised: (Z¨ugner & G¨unnemann, 2019) uses meta-learning to attack.

Original: (Ma et al., 2019)
Revised: (Ma et al., 2019)

Original: attacks by Rewiring, a special operation on the graph.
Revised: attacks by Rewiring, a special operation on the graph.

Original: (Chang et al., 2019) proposed GF-Attack, a restricted black-box adversarial framework.
Revised: (Chang et al., 2019) proposed GF-Attack, a restricted black-box adversarial framework.

Original: (Ma et al., 2020) proposed a black-box attack strategy manipulating the original graph.
Revised: (Ma et al., 2020) proposed a black-box attack strategy manipulating the original graph.

Original: (Xu et al., 2020) works contemporarily with us which performs white-box attack by adding fake nodes.
Revised: (Xu et al., 2020) works contemporarily with us which performs white-box attack by adding fake nodes.

Original: The above methods are either not adoptable in our setting or having poor performance in our setting.
Revised: The above methods are either not adoptable in our setting or having poor performance in our setting.

Original: 3. Methodology 3.1. Problem Formulation
Revised: 3. Methodology 3.1. Problem Formulation

Original: Given a set of victim nodes Φ A ⊆
Revised: Given a set of victim nodes Φ A ⊆

Original: Φ in the graph, our goal is to perform mild perturbations on the graph G =
Revised: Φ in the graph, our goal is to perform mild perturbations on the graph G =

Original: ( A , X ) , leading to G + =
Revised: ( A , X ) , leading to G + =

Original: ( A + , X + ) , such that the predicted labels of as many nodes as possible in Φ A change.
Revised: ( A + , X + ) , such that the predicted labels of as many nodes as possible in Φ A change.

Original: A + = (cid:20)
Revised: A + = (cid:20)

Original: A
Revised: A

Original: B T
Revised: B T

Original: B
Revised: B

Original: A fake (cid:21) and X
Revised: A fake (cid:21) and X

Original: + = (cid:20) XX fake (cid:21) , where B represents the connections between original nodes and fake nodes.
Revised: + = (cid:20) XX fake (cid:21) , where B represents the connections between original nodes and fake nodes.

Original: Φ + =
Revised: Φ + =

Original: Φ ∪ Φ fake denotes the node set of G + .
Revised: Φ ∪ Φ fake denotes the node set of G + .

Original: Starting from
Revised: Starting from

Original: A fake = 0 , B = 0 , we manipulate A fake , B and X fake , leading to as low classiﬁcation accuracy on Φ A as possible.
Revised: A fake = 0 , B = 0 , we manipulate A fake , B and X fake , leading to as low classiﬁcation accuracy on Φ A as possible.

Original: Our thread model is deﬁned as follows.
Revised: Our thread model is deﬁned as follows.

Original: Adversarial Budget To ensure our perturbation is unnoticeable, we limit the number of new connections between fake nodes and original nodes by ∆ edge .
Revised: Adversarial Budget To ensure our perturbation is unnoticeable, we limit the number of new connections between fake nodes and original nodes by ∆ edge .

Original: The connections between fake nodes, i.e., A fake , are free for us to modify while the connections between original nodes, i.e., A , are not allowed for us to modify.
Revised: The connections between fake nodes, i.e., A fake , are free for us to modify while the connections between original nodes, i.e., A , are not allowed for us to modify.

Original: We can decide X fake at will but cannot change X , the features of original nodes.
Revised: We can decide X fake at will but cannot change X , the features of original nodes.

Original: We limit the number of fake node by the number of rows of
Revised: We limit the number of fake node by the number of rows of

Original: A fake .
Revised: A fake .

Original: Protected Nodes Owing to the non-i.i.d nature of graph data, attacking victim nodes may have side effects on their neighboring nodes which we are not aimed for.
Revised: Protected Nodes Owing to the non-i.i.d nature of graph data, attacking victim nodes may have side effects on their neighboring nodes which we are not aimed for.

Original: While attacking victim nodes, we aim to keep the labels of other nodes which are not targeted unchanged at the same time to make our perturbation unnoticeable.
Revised: While attacking victim nodes, we aim to keep the labels of other nodes which are not targeted unchanged at the same time to make our perturbation unnoticeable.

Original: In our setting, we consider to protect N k (Φ A ) , neighbors of victim nodes within k -hop from being misclassiﬁed.
Revised: In our setting, we consider to protect N k (Φ A ) , neighbors of victim nodes within k -hop from being misclassiﬁed.

Original: Partial Information We can only query the classiﬁcation results of the victim nodes with their neighbors within k -hop and fake nodes.
Revised: Partial Information We can only query the classiﬁcation results of the victim nodes with their neighbors within k -hop and fake nodes.

Original: We can only make connections between victim nodes and fake nodes.
Revised: We can only make connections between victim nodes and fake nodes.

Original: Limited Queries We can totally query K times for the predicted scores of all victim nodes with their neighbors within k -hop.
Revised: Limited Queries We can totally query K times for the predicted scores of all victim nodes with their neighbors within k -hop.

Original: The architecture and parameters about victim model are unknown by the attacker.
Revised: The architecture and parameters about victim model are unknown by the attacker.

Original: We aim to make the classiﬁer misclassify as many nodes in Φ A as possible.
Revised: We aim to make the classiﬁer misclassify as many nodes in Φ A as possible.

Original: We formulate our problem as an optimization problem.
Revised: We formulate our problem as an optimization problem.

Original: Directly optimizing the number of misclassiﬁed nodes is difﬁcult as the objective is discrete.
Revised: Directly optimizing the number of misclassiﬁed nodes is difﬁcult as the objective is discrete.

Original: Thus we try to optimize a substitute loss function as
Revised: Thus we try to optimize a substitute loss function as

Original: [Equation]
Revised: [Equation]

Revised: r ( G + ) ≤ N fake , N e ( G + ) ≤ ∆ edge ,

Original: where G + =
Revised: where G + =

Original: [Equation]
Revised: ( (cid:20) A B T B

Revised: A fake (cid:21) , (cid:20) XX fake (cid:21) ) .

Original: N r ( G + ) denotes the number of rows of matrix
Revised: N r ( G + ) denotes the number of rows of matrix

Original: A fake and is no more than
Revised: A fake and is no more than

Original: N fake , which means that we at most introduce N fake fake nodes into the original graph.
Revised: N fake , which means that we at most introduce N fake fake nodes into the original graph.

Original: N e ( G + ) represents the number of non-zero elements of B and is no more than ∆ edge , which means that we can at most add ∆ edge extra links.
Revised: N e ( G + ) represents the number of non-zero elements of B and is no more than ∆ edge , which means that we can at most add ∆ edge extra links.

Original: (cid:96) ( G + , v ) and (cid:96) N ( G + , v ) represents loss function for every victim node and every protected node, respectively.
Revised: (cid:96) ( G + , v ) and (cid:96) N ( G + , v ) represents loss function for every victim node and every protected node, respectively.

Original: Smaller (cid:96) ( G + , v ) means node v is more likely to be misclassiﬁed by victim model f and smaller (cid:96)
Revised: Smaller (cid:96) ( G + , v ) means node v is more likely to be misclassiﬁed by victim model f and smaller (cid:96)

Original: N ( G + , v ) means the predicted label of node v is less likely to be changed during our attack.
Revised: N ( G + , v ) means the predicted label of node v is less likely to be changed during our attack.

Original: We perform targeted attack, which means the labels of victim nodes have to be misclassiﬁed as the ones which we specify.
Revised: We perform targeted attack, which means the labels of victim nodes have to be misclassiﬁed as the ones which we specify.

Original: Here we choose the C&W loss (Carlini & Wagner, 2016)
Revised: Here we choose the C&W loss (Carlini & Wagner, 2016)

Original: [Equation]
Revised: [Equation]

Original: for our attack, where y t stands for the target label of node v and the attacker succeeds only when node v is misclassiﬁed as y t .
Revised: for our attack, where y t stands for the target label of node v and the attacker succeeds only when node v is misclassiﬁed as y t .

Original: [ f ( G + )] v,y i denotes the output value of node v having label y i .
Revised: [ f ( G + )] v,y i denotes the output value of node v having label y i .

Original: For protected nodes, we have
Revised: For protected nodes, we have

Original: [Equation]
Revised: [Equation]

Original: where y g stands for the ground-truth label of node v provided by victim model.
Revised: where y g stands for the ground-truth label of node v provided by victim model.

Original: Overall loss L ( G + ; Φ A ) is summed over the loss of each victim node along with the loss of eachQuery Adversarial
Revised: Overall loss L ( G + ; Φ A ) is summed over the loss of each victim node along with the loss of each

Original: [Figure]
Revised: [Figure]

Original: protected neighboring node with a trade-off parameter λ .
Revised: protected neighboring node with a trade-off parameter λ .

Original: In practice, we add square root to the loss of each victim node to favor the nodes which are likely to be misclassiﬁed.
Revised: In practice, we add square root to the loss of each victim node to favor the nodes which are likely to be misclassiﬁed.

Original: Optimization of Eq.
Revised: Optimization of Eq.

Original: (1) is challenging due to the discrete nature of G + and large space of possible choices of G + .
Revised: (1) is challenging due to the discrete nature of G + and large space of possible choices of G + .

Original: To tackle the optimization problem, we propose our Cluster
Revised: To tackle the optimization problem, we propose our Cluster

Original: Attack.
Revised: Attack.

Original: 3.2. Cluster Attack
Revised: 3.2. Cluster Attack

Original: In an adversarial scenario, it is often the case that the number of fake nodes we are allowed to add to the graph is much smaller than the number of victim nodes.
Revised: In an adversarial scenario, it is often the case that the number of fake nodes we are allowed to add to the graph is much smaller than the number of victim nodes.

Original: To make use of each fake node better, we have to connect every fake node to several victim nodes.
Revised: To make use of each fake node better, we have to connect every fake node to several victim nodes.

Original: However, due to the structural complexity of the graph, different victim nodes may have very different local structures and the corresponding feature information, especially when our victim nodes are sparsely scattered in the whole graph.
Revised: However, due to the structural complexity of the graph, different victim nodes may have very different local structures and the corresponding feature information, especially when our victim nodes are sparsely scattered in the whole graph.

Original: Consequently, a fake node with certain feature may change the predicted label of one victim node after connecting to it, but may not change another victim node’s.
Revised: Consequently, a fake node with certain feature may change the predicted label of one victim node after connecting to it, but may not change another victim node’s.

Original: Building on the above perspective, we have the insight that, if we connect a fake node to several victim nodes which share a similarity that their predicted labels are all easily changed after they are connected to fake nodes with similar features, then we have more chance of changing the predicted labels of those victim nodes.
Revised: Building on the above perspective, we have the insight that, if we connect a fake node to several victim nodes which share a similarity that their predicted labels are all easily changed after they are connected to fake nodes with similar features, then we have more chance of changing the predicted labels of those victim nodes.

Original: As a result, we can divide the victim nodes into several clusters according to this similarity and for each cluster we assign one fake node to attack.
Revised: As a result, we can divide the victim nodes into several clusters according to this similarity and for each cluster we assign one fake node to attack.

Original: Most Adversarial Feature
Revised: Most Adversarial Feature

Original: In our attack, we use the most adversarial feature , which represents the vulnerability of each victim node, to denote the above similarity of victim nodes.
Revised: In our attack, we use the most adversarial feature , which represents the vulnerability of each victim node, to denote the above similarity of victim nodes.

Original: It’s the feature of the fake node connected to the victim node which minimizes our loss.
Revised: It’s the feature of the fake node connected to the victim node which minimizes our loss.

Original: Formally, for victim node v , consider that we only connect one fake node to and only to v .
Revised: Formally, for victim node v , consider that we only connect one fake node to and only to v .

Original: (To achieve this, we may temporarily remove all the extra edges in G + and temporarily add one edge connecting this victim node and one fake node v f .
Revised: (To achieve this, we may temporarily remove all the extra edges in G + and temporarily add one edge connecting this victim node and one fake node v f .

Original: After the computation, the edges in G + become the same before the computation.)
Revised: After the computation, the edges in G + become the same before the computation.)

Original: x v f is the feature of the newly added fake node v f .
Revised: x v f is the feature of the newly added fake node v f .

Original: The MAF of v is deﬁned as followed
Revised: The MAF of v is deﬁned as followed

Original: [Equation]
Revised: [Equation]

Original: where L ( G + ; Φ A ) is deﬁned in Eq.
Revised: where L ( G + ; Φ A ) is deﬁned in Eq.

Original: The MAF is related to the victim node’s gradient towards adversarial examples.
Revised: The MAF is related to the victim node’s gradient towards adversarial examples.

Original: Direct computation of MAF for every victim node may be extremely time-consuming and intractable with only a limited number of queries.
Revised: Direct computation of MAF for every victim node may be extremely time-consuming and intractable with only a limited number of queries.

Original: Here we propose an greedy algorithm to approximate MAF ( v ) with K t queries for each victim node which is summarized in Algorithm 1.
Revised: Here we propose an greedy algorithm to approximate MAF ( v ) with K t queries for each victim node which is summarized in Algorithm 1.

Original: For convenience and consistency, we use the same notation MAF( v ) to denote approximated MAF of node v computed using
Revised: For convenience and consistency, we use the same notation MAF( v ) to denote approximated MAF of node v computed using

Original: Algorithm 1 in the following sections.
Revised: Algorithm 1 in the following sections.

Original: Algorithm

Original: Input: Graph G += A + , X + ) .
Revised: 1 − x f [ i ] makes L ( G +

Original: Victim node v .

Original: Number of queries K

Original: Output: Approximated most adversarial feature MAF

Original: ) for v 1: initialize Choose one fake node v f and connect it to and only to v , randomly initialize the fake node’s feature x v f .

Original: Keep other fake nodes isolated.

Original: 2: Randomly sample a sequence I t from { 1 , 2 , ..., D } with length K t .

Original: D is the dimension of nodes’ feature.

Original: 3: for i ∈ I t do 4: if x v f [ i ] ← 1 − x v f [ i ] makes L ( G + ; Φ A ) smaller then5: x v f
Revised: Φ A ) smaller then

Original: [ i ] ← 1 − x v f

Original: [ i ] 6: end if 7: end for 8: return MAF( v ) ← x v f

Original: [Table]

Original: [Table]

Original: [Table]
Revised: [Table]

Original: Clustering the Victim Nodes After the computation of most adversarial features, we divide the victim nodes Φ A into N fake clusters C
Revised: Clustering the Victim Nodes After the computation of most adversarial features, we divide the victim nodes Φ A into N fake clusters C

Original: = { C 1 , C 2 , ..., C N fake } according to their MAFs using K-Means algorithm.
Revised: = { C 1 , C 2 , ..., C N fake } according to their MAFs using K-Means algorithm.

Original: Overall Algorithm Figure 2 is an overview of our attack algorithm.
Revised: Overall Algorithm Figure 2 is an overview of our attack algorithm.

Original: We only consider the case that ∆ edge ≥ | Φ A | , otherwise some victim nodes do not have the chance to connect directly to fake nodes.
Revised: We only consider the case that ∆ edge ≥ | Φ A | , otherwise some victim nodes do not have the chance to connect directly to fake nodes.

Original: For now, we keep A fake = 0 during our whole algorithm.
Revised: For now, we keep A fake = 0 during our whole algorithm.

Original: We leave utilizing A fake , the connections between fake nodes, to enhance our attack as our future work.
Revised: We leave utilizing A fake , the connections between fake nodes, to enhance our attack as our future work.

Original: Our method prevents the time-consuming search of the large space of A fake , B , X fake and is thus an efﬁcient method.
Revised: Our method prevents the time-consuming search of the large space of A fake , B , X fake and is thus an efﬁcient method.

Original: 4. Experiments 4.1. Experimental Setup
Revised: 4. Experiments 4.1. Experimental Setup

Original: We do our experiments on Cora and Citeseer(Sen et al., 2008), two benchmark citation networks.
Revised: We do our experiments on Cora and Citeseer(Sen et al., 2008), two benchmark citation networks.

Original: The statistics of the datasets are shown in Table 2.
Revised: The statistics of the datasets are shown in Table 2.

Original: [Table]
Revised: [Table]

Original: For each experimental setting, we run 100 times of experiments and report the average results.
Revised: For each experimental setting, we run 100 times of experiments and report the average results.

Original: Each round we randomly sample | Φ A | nodes in the graph as victim nodes.
Revised: Each round we randomly sample | Φ A | nodes in the graph as victim nodes.

Original: To reduce the variance in the training process of victim model, we retrain the victim GCN model every 5 rounds of attack.
Revised: To reduce the variance in the training process of victim model, we retrain the victim GCN model every 5 rounds of attack.

Original: Number of queries K is set to K = | Φ A |· K t + N fake · K f , where we set K t
Revised: Number of queries K is set to K = | Φ A |· K t + N fake · K f , where we set K t

Original: = D and K f = D .
Revised: = D and K f = D .

Original: D is the dimension of node’s feature.
Revised: D is the dimension of node’s feature.

Original: We set k = 1 in N k
Revised: We set k = 1 in N k

Original: (Φ A ) , which means we can only observe 1 -hop neighbors of victim nodes and we aim to protect those 1 -hop neighbors.
Revised: (Φ A ) , which means we can only observe 1 -hop neighbors of victim nodes and we aim to protect those 1 -hop neighbors.

Original: By default we set trade-off parameter λ = 0 without speciﬁcation.
Revised: By default we set trade-off parameter λ = 0 without speciﬁcation.

Original: We compare our method with baselines including Random
Revised: We compare our method with baselines including Random

Original: Attack, NETTACK (Z¨ugner et al., 2018), NETTACK - Sequential proposed by us which adds fake nodes sequentially,
Revised: Attack, NETTACK (Z¨ugner et al., 2018), NETTACK - Sequential proposed by us which adds fake nodes sequentially,

Original: Fake Node Attack (Wang et al., 2018) and the method which won 1st place in KDD Cup competition on graph adversarial attack (kdd, 2020).
Revised: Fake Node Attack (Wang et al., 2018) and the method which won 1st place in KDD Cup competition on graph adversarial attack (kdd, 2020).

Original: For baselines, we don’t limit the number of queries.
Revised: For baselines, we don’t limit the number of queries.

Original: 4.2. Performance with Different Number of Victim Nodes
Revised: 4.2. Performance with Different Number of Victim Nodes

Original: We evaluate the performance of Cluster Attack along with other baselines with different number of victim nodes.
Revised: We evaluate the performance of Cluster Attack along with other baselines with different number of victim nodes.

Original: Without loss of generality, we uniformly set N fake = 4 , ∆ edge = | Φ A | and let the number of victim nodes varies to see the performance under different N fake : | Φ A | .
Revised: Without loss of generality, we uniformly set N fake = 4 , ∆ edge = | Φ A | and let the number of victim nodes varies to see the performance under different N fake : | Φ A | .

Original: We compare Cluster Attack with other baselines.
Revised: We compare Cluster Attack with other baselines.

Original: The results are shown in Table 1.
Revised: The results are shown in Table 1.

Original: Our algorithm outperforms all baselines in terms of success rates.
Revised: Our algorithm outperforms all baselines in terms of success rates.

Original: 4.3. Other Experiments
Revised: 4.3. Other Experiments

Original: Other experiments demonstrating the effectiveness of our
Revised: Other experiments demonstrating the effectiveness of our

Original: Cluster Attack are shown in appendix, including experiments with different number of fake nodes, experiments with different trade-off parameter, experiments with different number of queries, analysis of cluster attack on victim nodes with different degrees and ablation study.
Revised: Cluster Attack are shown in appendix, including experiments with different number of fake nodes, experiments with different trade-off parameter, experiments with different number of queries, analysis of cluster attack on victim nodes with different degrees and ablation study.

Original: 5. Conclusion
Revised: 5. Conclusion

Original: In this paper, we propose Cluster Attack, an algorithm of adversarial attack on graph structured data.
Revised: In this paper, we propose Cluster Attack, an algorithm of adversarial attack on graph structured data.

Original: We perform querybased black-box adversarial attack on graph by adding fake nodes with partial information about the graph.
Revised: We perform querybased black-box adversarial attack on graph by adding fake nodes with partial information about the graph.

Original: We further consider to protect the predicted labels of neighboring nodes of victim nodes from being changed.
Revised: We further consider to protect the predicted labels of neighboring nodes of victim nodes from being changed.

Original: We propose to attack by clustering the victim nodes according to the similarity in their most adversarial features, which can be approximated by a limited number of queries.
Revised: We propose to attack by clustering the victim nodes according to the similarity in their most adversarial features, which can be approximated by a limited number of queries.

Original: Experimental results demonstrate our method has strong performance.
Revised: Experimental results demonstrate our method has strong performance.

Original: A. Supplemental Material A.1. Performance with Different Number of Fake Nodes.
Revised: A. Supplemental Material A.1. Performance with Different Number of Fake Nodes.

Original: In this section, we evaluate the performance of Cluster Attack along with other baselines with different number of fake nodes.
Revised: In this section [Figure] we evaluate the performance of Cluster Attack along with other baselines with different number of fake nodes.

Original: We ﬁx the number of victim nodes at 10 and vary the number of fake nodes to examine the success rates.
Revised: We ﬁx the number of victim nodes at 10 and vary the number of fake nodes to examine the success rates.

Original: We set ∆ edge = | Φ A | = 10 .
Revised: We set ∆ edge = | Φ A | = 10 .

Original: The success rates are shown in
Revised: The success rates are shown in

Original: Figure 3.
Revised: Figure 3.

Original: We only list the results of NETTACK - Sequential in Figure 3 without NETTACK since we found that NETTACK - Sequential performs better than NETTACK.
Revised: We only list the results of NETTACK - Sequential in Figure 3 without NETTACK since we found that NETTACK - Sequential performs better than NETTACK.

Original: We see that the success rate is higher when there are more fake nodes.
Revised: We see that the success rate is higher when there are more fake nodes.

Original: For Cluster Attack, we conjecture that this is because the number of clusters get larger when there are more fake nodes.
Revised: For Cluster Attack, we conjecture that this is because the number of clusters get larger when there are more fake nodes.

Original: Thus the MAFs of the victim nodes in each cluster are able to be closer to each other and they are easier to be attacked by the same fake node.
Revised: Thus the MAFs of the victim nodes in each cluster are able to be closer to each other and they are easier to be attacked by the same fake node.

Original: Among all methods, our
Revised: Among all methods, our

Original: Cluster Attack achieves the highest success rate.
Revised: Cluster Attack achieves the highest success rate.

Original: [Figure]
Revised: [Figure]

Original: A.2. Performance with Different Trade-Off Parameter λ .
Revised: A.2. Performance with Different Trade-Off Parameter λ .

Original: In this section
Revised: In this section

Original: [Figure]
Revised: [Figure]

Original: we examine the performance of Cluster Attack with different trade-off parameter λ between fake nodes and protected nodes.
Revised: we examine the performance of Cluster Attack with different trade-off parameter λ between fake nodes and protected nodes.

Original: We examine the performance under different λ in Cora dataset.
Revised: We examine the performance under different λ in Cora dataset.

Original: We uniformly set N fake = 4 , ∆ edge = | Φ A | = 10 .
Revised: We uniformly set N fake = 4 , ∆ edge = | Φ A | = 10 .

Original: We choose 2 most competitive baselines, NETTACK - Sequential and Fake Node Attack and adapt their loss function to our trade-off format.
Revised: We choose 2 most competitive baselines, NETTACK - Sequential and Fake Node Attack and adapt their loss function to our trade-off format.

Original: The results are shown in Figure 4.
Revised: The results are shown in Figure 4.

Original: It can be seen from Figure 4 that our algorithm performs the best among all baselines in terms of attack success rates.
Revised: It can be seen from Figure 4 that our algorithm performs the best among all baselines in terms of attack success rates.

Original: When λ goes up, which means that we pay more attention to the protected nodes, the percentage of protected nodes whose labels remain unchanged during attack goes up while the success rates of attack drops.
Revised: When λ goes up, which means that we pay more attention to the protected nodes, the percentage of protected nodes whose labels remain unchanged during attack goes up while the success rates of attack drops.

Original: When λ gets large enough ( λ ≥ 10 ), nearly all protected nodes are successfully protected [Figure] which demonstrates the effectiveness of our trade-off formulation in our loss function
Revised: When λ gets large enough ( λ ≥ 10 ), nearly all protected nodes are successfully protected, which demonstrates the effectiveness of our trade-off formulation in our loss function

Original: Eq.
Revised: Eq.

Original: It shows that to protect the labels of not-targeted nodes from being changed during attack, we can simply set a large λ .
Revised: It shows that to protect the labels of not-targeted nodes from being changed during attack, we can simply set a large λ .

Original: Also, our trade-off formulation between victim nodes and protected nodes in Eq.
Revised: Also, our trade-off formulation between victim nodes and protected nodes in Eq.

Original: (1) not only applies to our
Revised: (1) not only applies to our

Original: Cluster Attack, but also applies to other baselines.
Revised: Cluster Attack, but also applies to other baselines.

Original: [Figure]
Revised: [Figure]

Original: A.3. Performance with Different Number of Queries.
Revised: A.3. Performance with Different Number of Queries.

Original: In this section
Revised: In this section

Original: [Figure]
Revised: [Figure]

Original: we examine the performance of Cluster
Revised: we examine the performance of Cluster

Original: Attack with different number of queries.
Revised: Attack with different number of queries.

Original: We set K t =
Revised: We set K t =

Original: K f = α · D and examine the performance under different α in Cora and Citeseer dataset.
Revised: K f = α · D and examine the performance under different α in Cora and Citeseer dataset.

Original: We uniformly set N fake = 4 , ∆ edge = | Φ A | = 10 .
Revised: We uniformly set N fake = 4 , ∆ edge = | Φ A | = 10 .

Original: The results are shown in Figure 5.
Revised: The results are shown in Figure 5.

Original: The success rate of Cluster Attack drops as the number of queries drops.
Revised: The success rate of Cluster Attack drops as the number of queries drops.

Original: Our algorithm still performs well when the number of queries drops not very much, especially when α ≥ 0 .
Revised: Our algorithm still performs well when the number of queries drops not very much, especially when α ≥ 0 .

Original: It demonstrates that the most adversarial feature can be approximated and the fake nodes’ features can be optimized with a smaller number of queries without a great decrease in the success rate.
Revised: It demonstrates that the most adversarial feature can be approximated and the fake nodes’ features can be optimized with a smaller number of queries without a great decrease in the success rate.

Original: It shows that our Cluster Attack can work in a query-efﬁcient manner.
Revised: It shows that our Cluster Attack can work in a query-efﬁcient manner.

Original: [Figure]
Revised: [Figure]

Original: A.4. Analysis of Cluster Attack on Victim Nodes with Different Degrees.
Revised: A.4. Analysis of Cluster Attack on Victim Nodes with Different Degrees.

Original: In this section [Figure] we evaluate the performance of Cluster Attack on victim nodes with different degrees.
Revised: In this section, we evaluate the performance of Cluster Attack on victim nodes with different degrees.

Original: We uniformly set N fake = 4 , ∆ edge = | Φ A | = 10 .
Revised: We uniformly set N fake = 4 , ∆ edge = | Φ A | = 10 .

Original: The success rates of
Revised: The success rates of

Original: Cluster Attack on victim nodes with different degrees are shown in Figure 6 along with the proportion of sampled victim nodes with each degree.
Revised: Cluster Attack on victim nodes with different degrees are shown in Figure 6 along with the proportion of sampled victim nodes with each degree.

Original: Victim nodes with degrees larger than or equal to 7 are counted together since they only account for a small proportion.
Revised: Victim nodes with degrees larger than or equal to 7 are counted together since they only account for a small proportion.

Original: [Figure]
Revised: [Figure]

Original: It can be seen from Figure 6 that victim nodes with higher degrees are more robust to our attack in general.
Revised: It can be seen from Figure 6 that victim nodes with higher degrees are more robust to our attack in general.

Original: We conjecture that when a victim node has a relatively large number of neighbors, adding one fake node as its neighbor has less impact on it and thus is less likely to change its predicted label.
Revised: We conjecture that when a victim node has a relatively large number of neighbors, adding one fake node as its neighbor has less impact on it and thus is less likely to change its predicted label.

Original: A.5. Ablation Study.
Revised: A.5. Ablation Study.

Original: In this section, we examine the effectiveness of our most adversarial feature (MAF).
Revised: In this section, we examine the effectiveness of our most adversarial feature (MAF).

Original: We uniformly set N fake = 4 , ∆ edge = | Φ A | = 10 .
Revised: We uniformly set N fake = 4 , ∆ edge = | Φ A | = 10 .

Original: We compare the success rate of
Revised: We compare the success rate of

Original: Cluster Attack without MAF, i.e., the victim nodes’ MAFs are randomly set.
Revised: Cluster Attack without MAF, i.e., the victim nodes’ MAFs are randomly set.

Original: The results are shown in Table 3.
Revised: The results are shown in Table 3.

Original: Cluster
Revised: Cluster

Original: Attack without MAF performs worse than normal Cluster
Revised: Attack without MAF performs worse than normal Cluster

Original: Attack with MAF, which demonstrates the effectiveness of our MAF.
Revised: Attack with MAF, which demonstrates the effectiveness of our MAF.

Original: MAF is related to the vulnerability of victim nodes.
Revised: MAF is related to the vulnerability of victim nodes.

Original: Nodes with similar MAFs in a cluster are easier to be affected together by one fake node.
Revised: Nodes with similar MAFs in a cluster are easier to be affected together by one fake node.

Original: Thus the success rate of Cluster Attack with MAF is better than without MAF.
Revised: Thus the success rate of Cluster Attack with MAF is better than without MAF.

Original: [Table]
Revised: [Table]