EvA: Evolutionary Attacks on Graphs

2025-07-10

AI Summary

Graph Neural Networks (GNNs) exhibit high sensitivity to structural perturbations, yet existing gradient-based relaxation methods struggle to optimize discrete edge modifications and are incompatible with black-box models or non-differentiable objectives. This paper proposes the first efficient evolutionary algorithm framework specifically designed for graph structure attacks, directly searching over the discrete space of edge additions and deletions without requiring differentiable surrogate losses. The method natively supports arbitrary black-box GNNs and non-differentiable attack goals—such as undermining robustness certification or conformal prediction sets. Leveraging query-driven black-box optimization and a linear-memory-complexity search strategy, it significantly improves optimization efficiency. Extensive experiments demonstrate that our approach achieves an average additional accuracy drop of approximately 11% across multiple benchmarks, outperforming state-of-the-art attacks.

Technology Category

• Machine Learning: Graph-based Machine Learning
• Search and Optimization: Evolutionary Computation
• Computer Vision: Adversarial Attacks & Robustness

Application Category

• Graph Algorithms and Modeling for the Web: Graph neural networks and deep learning approaches for Web-related graphs
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems

Abstract

Even a slight perturbation in the graph structure can cause a significant drop in the accuracy of graph neural networks (GNNs). Most existing attacks leverage gradient information to perturb edges. This relaxes the attack's optimization problem from a discrete to a continuous space, resulting in solutions far from optimal. It also restricts the adaptability of the attack to non-differentiable objectives. Instead, we introduce a few simple yet effective enhancements of an evolutionary-based algorithm to solve the discrete optimization problem directly. Our Evolutionary Attack (EvA) works with any black-box model and objective, eliminating the need for a differentiable proxy loss. This allows us to design two novel attacks that reduce the effectiveness of robustness certificates and break conformal sets. The memory complexity of our attack is linear in the attack budget. Among our experiments, EvA shows $sim$11% additional drop in accuracy on average compared to the best previous attack, revealing significant untapped potential in designing attacks.

Problem

• Perturbing graph structure reduces GNN accuracy
• Existing attacks use suboptimal gradient-based methods
• Evolutionary Attack (EvA) solves discrete optimization directly

Innovation

• Evolutionary algorithm for discrete optimization
• Black-box attack without differentiable proxy
• Linear memory complexity in attack budget