GCIA: A Black-Box Graph Injection Attack Method Via Graph Contrastive Learning

Adversarial attacks on Graph Neural Networks (GNNs) have become a significant security concern. Graph Injection Attack (GIA) enables an attacker to perturb GNN models by injecting a small number of fake nodes, however, existing GIA methods often require either extensive knowledge of the dataset and the target model or a large number of queries to execute the attack. To fully utilize the unsupervised knowledge, we propose a Graph Contrastive Learning (GCL) approach to extract essential information from graph data to improve the attacker's success rate on the initial query and reduce the number of queries. Specifically, the proposed Graph Contrastive Learning based Graph Injection Attack (GCIA) consists of a node encoder, a reward predictor, and a fake node generator. The node encoder generates low-dimensional embedding for nodes by aggregating the neighborhood features. The reward predictor maps the node embedding to query results, while the fake node generator uses gradient optimization to produce fake nodes with attack capabilities based on the node encoder and reward predictor. Extensive results show that the proposed GCIA method achieves 91.2% first query success rate on the Reddit dataset, and improves the success rate to over 99.7% after 10 queries. Source code is publicly available at: https://github.com/Gmrider13/GCIA.