Imperceptible Adversarial Attacks on Discrete-Time Dynamic Graph Models
Abstract
Real-world graphs such as social networks, communication networks, and rating networks are constantly evolving over time.
Many architectures have been developed to learn effective node representations using both graph structure and its dynamics.
While the robustness of static graph models is well-studied, the vulnerability of the dynamic graph models to adversarial attacks is underexplored.
In this work, we design a novel attack on discrete-time dynamic graph models where we desire to perturb the input graph sequence in a manner that preserves the structural evolution of the graph.
To this end, we motivate a novel Time-Aware Perturbation (TAP) constraint, which ensures that perturbations introduced at each time step are restricted to only a small fraction of the number of changes in the graph since the previous time step.
We present a theoretically-grounded Projected Gradient
Descent approach for dynamic graphs to ﬁnd the effective perturbations under the
TAP constraint.
Experiments on dynamic link prediction show that our approach is up to 4 x more effective than the baseline methods for attacking these models under the novel constraint.
TD-PGD also outperforms the existing baselines on the node classiﬁcation task by up to 6 x and is 2 x more efﬁcient in running time than the best-performing baseline.
Introduction
Graph Neural Networks (GNNs) have been shown to be vulnerable to adversarial perturbations [2, 10, 15, 23, 39, 45].
This has raised major concerns against their use in important industrial applications such as friend/product recommendation [33, 36, 43] and fraud detection [14, 44].
However, these advancements in designing attack and defense mechanisms have predominantly focused on GNN models for static, non-evolving graphs.
In reality, the graph structure evolves with time as new interactions happen and new connections are formed [18, 21].
GNN models that incorporate the temporal information are shown to outperform their static counterparts in modeling dynamic networks on tasks such as predicting link existence in the future [7, 13, 16, 30, 34].
However, the vulnerability of dynamic graph models to adversarial perturbations is less studied.
The design of adversarial attacks for dynamic graphs is challenging for two reasons — (1) Attacks must simultaneously optimize both the edge(s) to perturb and when to perturb them, and more importantly, (2) Attacks must preserve the original graph evolution after perturbation in order to be less detectable.
In particular, attacks that disturb original graph evolution are not desired since they can be detected as anomalies by defense mechanisms, e.g. graph anomaly detection methods [1]. Therefore, it is crucial Method Dynamic White
box Evasion Targeted Evolution-aware
[Table] [Table] to formulate adversarial attacks over snapshots such that they do not signiﬁcantly alter the original change in the graph
In this work, we introduce a novel T ime-
A ware P erturbation (TAP) constraint to formulate imperceptible attacks on discrete-time dynamic graphs.
This constraint asserts that the number of modiﬁcations added at a timestep should only be a small fraction of the actual number of changes with respect to the preceding timestep.
We theoretically show that perturbations made under TAP constraint preserves the rate of change both in the structural and the embedding spaces.
To ﬁnd effective attacks under this proposed constraint, we consider a targeted, white-box, and evasion setting.
As noted in Table 1, prior works are unable to conduct attacks on dynamic graphs under this setting.
Thus, we present a theoretically-grounded Projected Gradient Descent approach for dynamic graphs (TD-PGD) following the TAP constraint.
Experiments on 4 datasets and 3 dynamic graph models (victim models) show that the proposed TD-PGD is up to 4 x more effective than the baseline attacks on dynamic link prediction and node classiﬁcation tasks.
We further propose a new metric — Embedding Variability (EV), as a measure to assess the relative variability in the perturbed embedding space.
Our contributions can be summarized as follows:
We introduce a novel Time-Aware Perturbation (TAP) constraint to make less detectable perturbations in discrete-time dynamic graphs. 2.
We show theoretically that the proposed TAP constraint preserves the original rate of the structural change and embedding change in the dynamic graphs. 3.
We present a theoretically-grounded PGD-based white-box attack to ﬁnd effective imperceptible attacks on dynamic graphs under the novel TAP constraint.
We show that TD-PGD outperforms the baselines across 4 different datasets and 3 victim models on both dynamic link prediction and node classiﬁcation tasks.
Related Work
Representation Learning for Dynamic Graphs.
GNNs have been combined with sequential modeling architectures [16] to model dynamic graphs.
For instance, discrete-time graphs have been modeled by using GNNs and RNNs together in a pipeline [27, 28] or an embedded manner [7, 30].
Attention-based models have also been proposed to jointly encode the graph structure and its dynamics [34].
For continuous-time graphs, both RNN [20, 24, 37, 38] and attention-based models [31, 40] have been proposed such that embeddings are updated in real time, upon an occurrence of a new event such as the addition/deletion of an edge.
Adversarial attacks on graphs.
Static GNNs are known to be vulnerable to adversarial attacks in different settings [15].
White-box attacks are studied assuming complete knowledge of the underlying model [39, 42].
Limiting the model knowledge, gray-box [45] and black-box attacks [10] have also been proposed.
In comparison, the literature on adversarial attacks for dynamic graphs is scarce.
Time-aware Gradient Attack (TGA)
[9] is a white-box evasion attack which greedily selects the perturbations across time under a budget constraint.
In addition, attacks to poison training data [8] and black-box attacks using RL approaches [11] have also been proposed.
Imperceptible perturbations.
The most common strategy to formulate imperceptible attacks on graphs is to bound the total number of perturbations.
Various strategies, in addition to the budget constraint, have been developed to make the attacks imperceptible for static graphs.
These include rewiring the perturbed edges [25, 26] , only perturbing the low degree nodes [23], and preserving the degree/feature distribution statistics [45].
In the case of dynamic graphs, perturbations must preserve the temporal ﬂow to be imperceptible.
Traditional anomaly detection algorithms ﬂag an instance to be anomalous if distance between consecutive snapshots crosses a threshold [1].
In particular,
Graph Edit Distance and Hamming distance between adjacency matrices have been used to monitor communication networks [5, 35].
Neural approaches have looked at the consecutive change in the embedding space to detect anomalies without feature extraction [6, 13].
Methodology
Problem Let G 1 , G 2 , ··· , G T be the original graph snapshots and G (cid:48) 1 , G (cid:48) 2 ··· , G (cid:48) T be the corresponding perturbed snapshots.
Note that G i =
( X i , A i ) where X i , A
i are the node features and the adjacency matrix for snapshot i , respectively.
Also, let M be a victim dynamic graph model that we want to attack and let f M be a function that generates the corresponding node embeddings of G t given G 1: t − 1 .
Let y task be the actual labels for a given task (for dynamic link prediction, these correspond to binary labels representing link existence in the future snapshot).
Then, the objective of the attacker is to introduce structural perturbations S t =
A (cid:48) t − A t at each timestep t < T such that the model inference at timestep T for the target entities E tg deteriorates.
More formally, the attacker solves the following optimization problem:
[Equation]
such that C (
[Equation]
T − 1 ) holds (1) for some constraint function C on the perturbed adjacency matrices A (cid:48) t for each time t .
Here, (cid:98) y task denotes the predicted labels for the given task and L task is a task-speciﬁc loss, for example, a binary cross entropy (CE) loss for link prediction.
The constraint function C is designed to ensure imperceptibility of the adversarial perturbations.
In the literature, a budget constraint has been widely used to enforce imperceptibility in graphs [10] and computer vision [12].
However, this constraint only bounds the total amount of perturbations that can be introduced by an attacker.
When the input is dynamic, as in the case of dynamic graphs, the perturbations should be constrained in the context of how the input evolves.
However, since the budget constraint completely ignores the graph dynamics, it could lead to a drastic change in the evolution trend of the graph, violating the imperceptibility requirement.
For instance, with the budget constraint, all the perturbations can be made at a single time step, leading to an anomalous spike, which would be easily detected as a possible attack by graph anomaly detection methods for dynamic graphs [1, 5, 35].
Thus, a constraint is desired which would ensure that the perturbations do not disrupt the evolving trend of the dynamic graphs.
3.1 Time-Aware Perturbation (TAP) Constraint
The simplest measure to study evolution is to consider the change in the input between consecutive time steps.
Thus, for a discrete-time input { x t } , this corresponds to considering the discrete-time differential norm at time t , given by d x t = (cid:107) x
t − x t − 1 (cid:107) .
Then, we propose
Proposition 1 The number of perturbations introduced to input x at time step t must not be more than a fraction (cid:15) times the differential at t , i.e. TAP ( (cid:15) ) :
= (cid:107) x (cid:48)
t − x t (cid:107) ≤ (cid:15)d x t ∀ t .
For the case of dynamic graphs, when the graph structure evolves (for example, in social networks and transaction networks [30, 34]), this constraint becomes (cid:107) A (cid:48) t − A t (cid:107) 1 ≤ (cid:15)d A t .
Alternatively, a dynamic graph may also involve a temporally-evolving signal at each node [22, 29, 32], in which case, this constraint becomes (cid:107) X (cid:48)
t − X t (cid:107) 1 ≤ (cid:15)d X t .
In this work, we focus on dynamic graph structures such that the constraint C (in Equation 1) for the perturbations is a TAP constraint.
The optimization problem for the attacker, thus, becomes
[Equation]
(2) such that ∀ t ∈ (1 ,T ) : (cid:107) A (cid:48) t − A t (cid:107) (cid:107) [Equation] ≤
[Equation]
(cid:48)
[Equation]
where (cid:15),ε 1 are given parameters for this optimization.
We use (cid:107)·(cid:107) to denote the 1 -norm of the matrix ﬂattened into a vector, unless otherwise mentioned.
Implications.
We show that TAP constraint has the following implications on the perturbations:
Perturbations made under TAP constraint preserves the average rate of structural change
Theorem 1 Let d A = 1 T (cid:80) t
d A t ,d A (cid:48)
=
1 T (cid:80) t d A (cid:48) t .
Then, d A (cid:48) ≤ αd A
+ β, (3) for some constants α,β ∈ R ≥ 0 .
Proof.
By the deﬁnition of the perturbation matrix S τ , d A (cid:48) t = (cid:107) A (cid:48)
t − A (cid:48)
t − 1 (cid:107) = (cid:107) ( A t + S t ) − ( A t − 1 + S t − 1 ) (cid:107) .
Then, using triangle inequality, we get d A (cid:48) t ≤ (cid:107)
A t + S t (cid:107) + (cid:107)
A t − 1 + S t − 1 (cid:107) .
Again using triangle inequality, d A (cid:48) t ≤ (cid:107)
A t (cid:107) + (cid:107) S t (cid:107) + (cid:107)
A t − 1 (cid:107) + (cid:107) S t − 1 (cid:107) .
Now, since (cid:107) S τ (cid:107) ≤ (cid:15)d A t and (cid:107)
A τ (cid:107) is a constant, we get d A (cid:48) t ≤ (cid:15)d A t
+ (cid:15)d A t − 1 + C , for some constant C .
d
[Equation] + C ) ≤ 2 (cid:15) 1 T (cid:80) t
d A t + C .
Hence, we get that d A (cid:48) ≤ αd A + β , for some constants α,β ≥ 0 .
Perturbations made under TAP constraint preserves the rate of embedding change.
Theorem 2 Let d Z t = (cid:107) Z t − Z t − 1 (cid:107) 1 .
Then, for some constants γ,δ ∈ R ≥ 0 , d
[Equation]
Proof.
Note that Z t = f
( A t ; A t − 1 , ··· , A 1 ) .
Thus, we consider a stacked vector of ﬂattened matrices q ≤ τ = ( q τ , q τ − 1 , ··· , q 1 , 0 , 0 , ··· , 0 ) , where q i is the ﬂattened vector of A i and we prepend ( t − τ ) {+
+} s to make all vectors q ≤ i of ﬁxed dimension t .
Then, by Cauchy’s Mean
Value Theorem in several variables, we have Z t − Z t − 1 ≤ ∇ f · ( q ≤ t − q ≤ t − 1 ) , which gives us (cid:107)
Z t − Z t − 1 (cid:107) ≤ (cid:107)∇ f (cid:107) (cid:107) q ≤ t − q ≤ t − 1 (cid:107) by Cauchy-Schwarz inequality.
We note that (cid:107) q ≤ t − q ≤ t − 1 (cid:107) {+
 = (cid:107)+} ( q t − q t − 1 , q t − 1 − q t − 2 , ··· , q 2 − q 1 , q 1 (cid:107) 1 = (cid:80) t (cid:107) q t − q t − 1 (cid:107) 1 = (cid:80) t (cid:107) q t − q t − 1 (cid:107) 1 = T d A .
Thus, we have (cid:107) Z t − Z t − 1 (cid:107) F ≤ Cd A for some constant C ≥ 0 .
Using Theorem 1, we get d Z (cid:48) ≤ Cd A (cid:48) ≤
Ad A + B , for A =
Cα,B = Cβ .
By mean-value theorem, we also have d Z t ≥ (cid:107)∇ f t − 1 (cid:107) (cid:107) q ≤ t − q ≤ t − 1 (cid:107) ≥ C 2 d A .
Hence, d Z (cid:48) ≤ γd Z + δ for some constants γ,δ ≥ 0 .
3.2 Attack methods under TAP constraint
While the TAP constraint allows us to limit the effect of the perturbations on the graph’s evolution, it is not clear how one can efﬁciently ﬁnd perturbations that maximize a loss function under this constraint.
To this end, we present two algorithms to solve the optimization problem of Equation 2.
Greedy.
A greedy strategy can be adopted to ﬁnd effective perturbations under our TAP constraint.
In this approach, perturbations are selected in a greedy manner based on their gradient values with respect to the downstream loss.
However, this does not scale well as one needs to ﬁnd gradient values corresponding to all the perturbations, which would be O ( T |V| ) , where V denotes the set of nodes.
Thus, inspired by [9], we ﬁnd the perturbations in two steps — ﬁrst, we ﬁnd the top-gradient perturbation at each time step and then, select the one that reduces the prediction probability the most.
In particular, we greedily select the perturbations with the lowest probability such that TAP ( (cid:15) ) is not violated for any time-step.
We defer the full algorithm to Appendix A.
Projected Gradient Descent for Dynamic Graphs (TD-PGD).
Since the constrained optimization in Equation 2 has a general continuous objective, a greedy approach is only sub-optimal (even for a simpler convex objective) with no theoretical guarantees.
A more standard approach to do optimization under a convex constraint is to use projected gradient descent (PGD) [3, 4].
Since our problem is in discrete-space, we ﬁrst relax it into continuous space, ﬁnd the solution using PGD and then, randomly round it to obtain a valid solution for the discrete problem.
In particular, we relax the perturbation matrix S t into a continuous vector s t and show that a closed-form projection operator exists for the TAP ( (cid:15) ) constraint.
Algorithm 1 demonstrates the steps involved in this approach (TD-PGD), following the result of Theorem 3.
Theorem 3 Suppose S denotes the feasible perturbation space for the constraints (cid:107) A (cid:48)
t − A t (cid:107) / (cid:107)
A t − A t − 1 (cid:107) ≤ (cid:15) for all 1 < t < T and (cid:107) A (cid:48) 1 − A 1 (cid:107) ≤ ε 1 .
Then, one can project a vector a t onto S using
Require: TAP variables ε t (from Theorem 3), Initial perturbation vector s (0) , Loss function L task , actual labels y task , Target entities E tg , Time steps T , Initial learning rate η 0 , Iterations N
Ensure: Perturbation vector s ( i ) preserves TAP ( (cid:15) ) at every time step t 1: for i = 1 to N do 2:
Gradient descent : a ( i ) =
s ( i − 1) − η i ∇L task ( {G t ⊕ s
( i − 1) t ; ∀ t } , y task , E tg ) 3:
Projection : For all t ∈ [1 ,T − 1] : s ( i ) t = Π S ( a ( i ) t ) according to Equation4: S t ∼ Bernoulli ( s ( N ) t ) such that S t ≤ ε t for all t the following projection operator: [Equation] 5) where ε t =
(cid:15)d A t = (cid:15) (cid:107)
A t − A t − 1 (cid:107) for t > 1 , and P [0 , 1] ( x ) = x if x ∈ [0 , 1] , 0 if x < 0 , and 1 if x > 1 .
Proof.
Please see Appendix B for the proof.
Following [42], we use the bisection method [3] to solve the equation 1 T P [0 , 1] ( a t − µ t ) =
ε t in µ t for µ t ∈ [min( a t − 1) , max( a t )] .
This converges in the logarithmic rate, i.e. it takes O (log 2 [(max( a t ) − min( a t − 1)) /ξ ]) time for ξ -error tolerance.
Experimental Setup
Datasets.
We use 3 datasets for dynamic link prediction — Radoslaw 1 , UCI 1 , and Reddit 2 .
Radoslaw and UCI are email communication networks, where two users are connected if they have an email communication at a given time.
Reddit is a hyperlink network with directed connections between subreddits if there is a hyperlink from one to the other [19].
For node classiﬁcation, we use one publicly-available dataset, DBLP [--
-]-5 [41].
This is a co-author network with node attributes as word2vec representations of the author’s papers.
There are 5 node labels representing the different ﬁelds that the authors belong to.
Please refer to Appendix C for more details regarding the datasets.
Attack Methods.
We consider 4 attack methods to ﬁnd adversarial perturbations in our setting.
TD-PGD : Algorithm 1 shows the proposed approach of projected gradient descent with a valid
projection operator for the TAP constraint.
TGA ( (cid:15) ) :
Greedily selects the perturbation with the highest gradient value of the loss.
D EGREE :
Flips the edges (adds or deletes if already there) attached with the highest degree nodes in the graph at each time step while making at most (cid:15)d
A t perturbations.
R ANDOM : Randomly ﬂip (add or delete) at most (cid:15)d
A t edges at each time step t .
Victim Models.
We test the performance of the above on 3 discrete-time dynamic graph models.
GC-LSTM [7] embeds GCN into an LSTM to encode the sequence of graphs.
E VOLVE GCN [30] uses a recurrent model (RNN-LSTM) to evolve the weights of a GCN.
We use the E VOLVE GCN-O version for our experiments.
D Y SAT [34] is an attention-based architecture utilizing joint structural and temporal self-attention.
Metrics.
We use the relative drop, as deﬁned below, to evaluate the efﬁcacy of the attack methods. Rel. Drop (%) =
Perturbed performance − Original performance Original performance
[Equation]
where performance is evaluated using ROC-AUC for dynamic link prediction and using Accuracy for node classiﬁcation.
In order to evaluate the detectability of the attack methods, we propose a novel metric
Embedding
Variability (EV) to compare the consecutive embedding difference for the perturbed graph and that for the original graph.
Consecutive embedding difference has been used to identify anomalies in the data [13].
Here, we measure how the range of this difference changes due to the perturbation.
In particular, we consider
[Equation]
This measures the relative variability of the consecutive change in the embedding space.
For the attacks to be less detectable, this metric should be close to 0 .
Note that we do not directly optimize for this metric in our constraint.
Results
We compare the performance of different attack methods for the 3 victim models on link prediction and node classiﬁcation tasks.
For all the experiments, we vary (cid:15) from 0 to 1 and ﬁx ε 1 =
min t> 1 ε t :=
(cid:15)d A t .
5.1 Dynamic Link Prediction
In this section, we show the attack performance on the task of dynamic link prediction [30, 34].
The task here is to predict whether a link ( u,v ) will appear or not at the future timestep.
The objective of the attacker, thus, is to introduce perturbations in the past time steps to make the model mispredict link’s existence in future.
We test the victim models on the ﬁnal snapshot for a set of target links.
We consider 3 different sets of 100 positive and 100 negative random targets and show the mean relative
ROC-AUC drop with error bars.
Figure 1 shows the performance of different attack methods on this task across different datasets and models.
TD-PGD outperforms the other baselines in all cases, except in GC-LSTM model trained on Reddit .
Moreover, TD-PGD is able to drop the AUC by upto 4 times the baselines and lead to ∼ 100% drop in the AUC, completely ﬂipping the prediction.
We also note that TD-PGD often has a continuously decreasing slope and its performance saturates much later than the other baselines.
The second best baseline is often TGA ( (cid:15) ) but in many cases, it is only as good as random.
One can also note that E VOLVE GCN shows a larger drop than the other 2 models across all datasets.
This may pertain to the lower model complexity of E VOLVE GCN compared to others.
Detectability of the attack methods: Here, we use the EV metric, as deﬁned in Section 4, to assess how detectable the attack methods are under our constraint.
Table 2 compares the attack performance of the best method TD-PGD at (cid:15)
= 0 .
5 and the corresponding variability in the embeddings, as given by Equation 7.
One can note that the median value of EV is close to zero in all cases, exceeding 0 .
2 only in a couple of cases. In particular, we ﬁnd that one can drop the performance by over 95% while changing the range of consecutive embedding distance by a factor of ≈ 1 ± 0 . 1 in over 50% [Table]
TD [Figure] PGD
TGA [Figure] [Figure] d)
[Figure]
of the targets.
{+Moreover, 90% of the targets have an embedding variability of less than 1 . 
+}
across different models and datasets.
This shows that TAP allows for undetectable yet effective attacks.
5.2 Node Classiﬁcation
In this section, we compare the attack performance on the task of semi-supervised node classiﬁcation [30].
In this task, the objective is to predict node labels of a set of nodes while knowing the labels of the remaining nodes.
In our experiments, we consider a 60 − 20 − 20 split on the data.
The objective of the attacker is to introduce perturbations at each snapshot under the TAP constraint such that
the
CE loss for the target node is maximized.
Figure 2 shows the effect of structural perturbations on node classiﬁcation task by different attack strategies for the 3 models.
Due to sparsity of edges in DBLP -5, randomly chosen targets only allow for a very small number of perturbations under the TAP constraint.
Therefore, we consider the performance on 50 top-degree nodes for each class.
Results show that TD-PGD outperforms the [Figure]
[Figure]
5.3 Running Time
Figure 3 compares the running time per target for different attack methods on the largest dataset,
Reddit .
The times are averaged over 200 targets from 3 different seeds and error bars note the standard deviation.
TGA ( (cid:15) ) is the most expensive method in terms of time and scales almost linearly with (cid:15) (capped at 300 s).
TD-PGD takes around half the time than TGA ( (cid:15) ) and remains almost constant with increase in the parameter (cid:15) .
Conclusion
Our work has shown that dynamic graph models can be attacked in an imperceptible manner.
We introduce a novel Time-Aware Perturbation (TAP) constraint to devise imperceptible perturbations in discrete-time dynamic graphs, preserving the graph evolution within a factor.
We hope that our work serves as a ﬁrst step towards opening exciting research avenues on studying attacks and defense mechanisms for both discrete and continuous-time dynamic graphs.
Some limitations of our current exposition can be noted.
First, the proposed method TD-PGD is not memory-efﬁcient as it stores a perturbation vector corresponding to each perturbation Second, randomly rounding the solution to discrete space may lead to suboptimal perturbations.
Future work can study more effective and efﬁcient methods to attack dynamic graphs under TAP constraint.
Acknowledgements
This research/material is based upon work supported in part by the Defense Advanced Research
{+Projects Agency (DARPA) under Agreement No. HR
+}
(subcontract No. PO70745), NSF
ITE-2137724, NSF ITE-2230692, Microsoft AI for Health, IDEaS at Georgia Institute of Technology, and Adobe Inc.
Any opinions, ﬁndings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reﬂect the position or policy of DARPA,
DoD, NSF and SRI International and no ofﬁcial endorsement should be inferred.
We also thank the members of CLAWS research group and the anonymous reviewers for their constructive feedback
Appendix A Greedy approach
Require: TAP variables ε t (from Equation 5), Initial perturbation vector s (0) , Loss function L task ,
Probability function p M predicting link existence probability, actual labels y task , Target entities
E tg , Time steps T .
do 3: do 6: grads [ v ] ∂ L task ( G (cid:48) 1: T − 1 ) /∂
( n tg ,v ) v V .
Pick the ﬁrst v in the descending order of grads such that ( n tg ,v ) (cid:60) S .
8: s t .append (( n tg ,v )) .
9: probs .append ( p M ( G (cid:48)
t ⊕ s t ))
Pick s τ in the descending order of probs such that (cid:107) S t ⊕ s τ (cid:107) ≤ ε t .
11: if no τ found then 12: break 13:
G (cid:48)
← G ⊕ s
S t .append ( s t ) .
B Proof of Theorem
Suppose S denotes the feasible perturbation space for the constraints (cid:107) A (cid:48)
t − A t (cid:107) / (cid:107)
A t − A t − 1 (cid:107) ≤ (cid:15) for all 1 < t < T and (cid:107) A (cid:48) 1 − A 1 (cid:107) ≤ ε 1 .
Then, one can project a vector a t onto S using the following projection operator:
[Equation]
1] ( a t ) ≤ ε t (8) where ε t =
(cid:15)d A t = (cid:15) (cid:107)
A t − A t − 1 (cid:107) for t > 1 , and P [0 , 1] ( x ) = x if x ∈ [0 , 1] , 0 if x < 0 , and 1 if x > 1 .
Proof.
Let the perturbation vector be s =
[ s 1 , s 2 , ··· , s T − 1 ] T .
Then, for all t ∈ [2 ,T − 1] , since s t =
A t − A t − 1 , our constraint becomes (cid:107) s t (cid:107) ≤ (cid:15)d A t ≤ (cid:15) (cid:107)
A t − A t − 1 (cid:107) =: ε t , which reduces to 1 T s t ≤ ε t .
For t = 1 , we have (cid:107) A (cid:48)
( V 1 ) − A 1 ( V 1 ) (cid:107) ≤ ε 1 , which also becomes 1 T s 1 ≤ ε 1 .
Hence, we have the constraint 1 T s t ≤ ε t for all t .
By deﬁnition, then, projection operator must be Π S ( a ) =
argmin s ∈S 1 2 (cid:107) s − a (cid:107) 2 , where S = { s ∈ [0 , 1] n | 1 T s t ≤ ε t ∀ t } .
This reduces to the following optimization problem:
[Equation]
[Equation]
such that ∀ t ∈ [1 ,T [Equation] [Equation] s t ≤ ε t where I [0 , 1] ( x )[-= 
-]
{+= 
+}
if x ∈ [0 , 1] n and ∞ otherwise.
This can be solved by the Lagrangian method.
We note that the Lagrangian function of the above optimization problem is L ( s , a ,µ )
= (cid:80) t ∈ [1 ,T ] (cid:16) 12 (cid:107) s [Table] − a t (cid:107)
+ I [0 , 1] ( s [Table] ) + µ t ( [Table]
s t −
[Table] t ) (cid:17) . ∂ L /∂ s t =
= ⇒ s t = a t − µ t .
However, if s t,i < 0 or s t,i > 1 for any i , then L = ∞ .
Thus, the minimizer to the above function is s ∗ t = P [0 , 1] ( a t − µ t ) , where P [0 , 1] ( x ) =
x if x ∈ [0 , 1] , {+
+} if x < 0 and 1 if x > 1 .
In addition, the solution must satisfy the following KKT conditions ∀ t :
( 1 ) µ t [Equation] [Equation] [Equation]
[Equation]
[Equation]
[Equation]
s [Equation] t . If µ t > 0 , then we must have 1 T P [0 , 1] ( a t − µ t ) = ε t .
Otherwise if µ t = 0 , then 1 T P [0 , 1] ( a t ) ≤ ε t .
C Data statistics and pre-processing
Table 3 shows the statistics of the datasets used in this paper.
DBLP -5 is the node classiﬁcation dataset with 5 labels while the others are dynamic link prediction datasets with varying sizes.
The datasets span over differing periods of time.
We split each of them into ﬁnite number of timesteps to keep a large enough number of time steps while maintaining a realistic period of splitting.
Radoslaw is split using a 3 -week period in 13 snapshots while the 13 snapshots in UCI denote a 2 -week period.
The Reddit dataset is spanned over 3 years, thus we use a 2 -month split to obtain the 20 snapshots.
We use the publicly available pre-processed data for DBLP -5 [41].
For datasets with no node features, i.e. , Radoslaw , UCI , and Reddit , we use uniformly random features with dimension 10 .
The pre-processed DBLP -5 has 100 node features for each node.
[Table]
D Additional details on experimental setup D.1 Setup
We consider a targeted setting with single targets, that are selected using either a random sampling or a degree-biased sampling.
Each target is attacked one-by-one and the total performance of an attacker is measured using either an ROC-AUC or an Accuracy over the set of sampled targets.
D.2 Hyperparameters
For TD-PGD optimization, we used ADAM optimizer [17] with the initial learning rate of 10 .
The initial perturbation vector s (0) was initialized with all ones, thus, giving each perturbation an equal chance at the start.
The algorithm was run for 50 iterations.
We use Binary Cross Entropy loss for training dynamic link prediction and Weighted Cross Entropy for node classiﬁcation.
Further, we stop the greedy search if the time taken exceeds 300 s, which is at least 3 times that of TD-PGD.
D.3 Victim Model training
Table 4 shows the performance on the test set of the victim models on different datasets.
The performance is evaluated using ROC-AUC for the dynamic link prediction and using Accuracy for the node classiﬁcation tasks.
The test set for dynamic link prediction task denotes the edges and non-edges in the ﬁnal snapshot, while for node classiﬁcation, we use a 20% held-out set of nodes as the test set for noting the performance and attacking.
D.4 Implementation
We use the TorchGeometric-Temporal 3 implementation of E VOLVE GCN and GC-LSTM to train these models.
For D Y SAT, we use the pytorch implementation 4 .
We adapt the ofﬁcial code of
Dataset
[Table]
TGA 5 to implement the greedy approach.
For TD-PGD implementation, we adapt the DeepRobustimplementation for dynamic graphs under TAP constraint.
D.5 Potential negative societal impacts.
Our work has demonstrated the vulnerability of dynamic graph models under a practical TAP constraint.
This means that these models are not suitable for deployment in environments where adversarial attacks under a TAP constraint are realistic.
If these models are deployed in such a setting, adversarial attacks proposed in this work can be used by an adversary to hamper the predictions.
However, it must be noted that none of the models used in this work are known to be deployed in the real-world. Secondly, TAP constraint with a large (cid:15) may not be realistic in many applications. Thus, our study has an overall positive impact on the society as it allows practitioners to test the robustness of their models under a practical constraint before deploying in vulnerable environments. Although our attacks can be adopted by adversaries for negative use, it is important to put it out in the community so that the model designers are made aware of these attacks that are speciﬁcally designed to evade detection.