Task and Model Agnostic Adversarial Attack on Graph Neural Networks

Adversarial attacks on Graph Neural Networks (GNNs) reveal their security vulnerabilities, limiting adoption in safety-critical applications. However, existing attack strategies rely the knowledge of either GNN model being used or predictive task attacked. Is this necessary? For example, a graph may be for multiple downstream tasks unknown to practical attacker. It is thus important test vulnerability GNNs adversarial perturbations and task-agnostic setting. In work, we study problem show that Gnns remain vulnerable even when are unknown. The proposed algorithm, TANDIS (Targeted Attack via Neighborhood DIStortion) shows distortion node neighborhoods effective drastically compromising prediction performance. Although neighborhood an NP-hard problem, designs heuristic through novel combination Isomorphism Network with deep Q-learning. Extensive experiments real datasets that, average, up 50% more than state-of-the-art techniques, while 1000 times faster.