GRAPHTEXTACK: A Realistic Black-Box Node Injection Attack on LLM-Enhanced GNNs

2025-11-15

AI Summary

Existing adversarial attacks against LLM-augmented Graph Neural Networks (GNNs) predominantly rely on white-box assumptions or unimodal perturbations, rendering them impractical in realistic black-box settings. Method: We propose the first black-box, multimodal, poisoning-based node-injection attack: without accessing the target model’s parameters or gradients, it jointly optimizes both the structural connections and textual semantic features of injected nodes via a multi-objective evolutionary algorithm, effectively navigating the non-differentiable combinatorial search space to balance local prediction disruption and global graph-topological impact. Contribution/Results: Evaluated on five text-attributed graph datasets and two state-of-the-art LLM-GNN architectures, our method consistently outperforms 12 strong baselines, establishing— for the first time—the feasibility and effectiveness of black-box adversarial attacks against multimodal graph models.

Technology Category

• Machine Learning: Large Multimodal Models (LMMs)
• Computer Vision: Adversarial Attacks & Robustness
• Search and Optimization: Adversarial Search

Application Category

• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs
• Semantics and Knowledge: Methods to enhance, augment, integrate or synergize semantic models such as knowledge graphs and LLMs
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems

Abstract

Text-attributed graphs (TAGs), which combine structural and textual node information, are ubiquitous across many domains. Recent work integrates Large Language Models (LLMs) with Graph Neural Networks (GNNs) to jointly model semantics and structure, resulting in more general and expressive models that achieve state-of-the-art performance on TAG benchmarks. However, this integration introduces dual vulnerabilities: GNNs are sensitive to structural perturbations, while LLM-derived features are vulnerable to prompt injection and adversarial phrasing. While existing adversarial attacks largely perturb structure or text independently, we find that uni-modal attacks cause only modest degradation in LLM-enhanced GNNs. Moreover, many existing attacks assume unrealistic capabilities, such as white-box access or direct modification of graph data. To address these gaps, we propose GRAPHTEXTACK, the first black-box, multi-modal{, poisoning} node injection attack for LLM-enhanced GNNs. GRAPHTEXTACK injects nodes with carefully crafted structure and semantics to degrade model performance, operating under a realistic threat model without relying on model internals or surrogate models. To navigate the combinatorial, non-differentiable search space of connectivity and feature assignments, GRAPHTEXTACK introduces a novel evolutionary optimization framework with a multi-objective fitness function that balances local prediction disruption and global graph influence. Extensive experiments on five datasets and two state-of-the-art LLM-enhanced GNN models show that GRAPHTEXTACK significantly outperforms 12 strong baselines.

Problem

• Proposes black-box node injection attack on LLM-GNN models
• Addresses dual vulnerabilities in structural and textual components
• Navigates combinatorial search space via evolutionary optimization framework

Innovation

• Black-box node injection attack on LLM-GNN models
• Evolutionary optimization for structure and semantics crafting
• Multi-objective fitness balancing local and global disruption