 Unfortunately , recent studies indicate that such advanced methods may suffer from adversarial attacks, i.e., they may lose effectiveness when only a small fraction of links are purposely changed. However, little is known what's the difference between adversarial nodes and clean nodes, and what's the preference of each attack method, in terms of network structure. In this paper , we theoretically investigate three well-known adversarial attack methods, i.e., Nettack, Meta Attack, and GradArgmax , and find that different attack methods have their specific attack preferences on changing network structure .
<coherence>  Unfortunately , recent studies indicate that such advanced methods may suffer from adversarial attacks, i.e., they may lose effectiveness when only a small fraction of links are purposely changed. However, little is known what's the difference between adversarial nodes and clean nodes, and what's the preference of each attack method, in terms of network structure. In this paper , we theoretically investigate three well-known adversarial attack methods, i.e., Nettack, Meta Attack, and GradArgmax , and find that different attack methods have their specific attack preferences on changing network structure .
 Unfortunately , recent studies indicate that such advanced methods may suffer from adversarial attacks, i.e., they may lose effectiveness when only a small fraction of links are unexpectedly changed. This paper investigates three well-known adversarial attack methods, i.e., Nettack, Meta Attack, and GradArgmax , and find that different attack methods have their specific attack preferences on changing network structure .