LiSA: Leveraging Link Recommender to Attack Graph Neural Networks via Subgraph Injection

2025-02-13

AI Summary

This work addresses the vulnerability of Graph Neural Networks (GNNs) to subgraph injection attacks in realistic settings. We propose a novel black-box adversarial attack paradigm: by injecting isolated malicious subgraphs, the attack leverages a link recommendation module as a bridge to stealthily induce users to establish connections between target nodes and the injected subgraphs—thereby degrading node classification accuracy. Our key innovation lies in the first formal modeling of link recommendation systems as attack intermediaries, coupled with a dual-agent collaborative framework that employs two surrogate models and bilevel optimization to jointly optimize link misdirection and classification performance degradation. Extensive experiments on multiple real-world graph datasets demonstrate significant improvements over baselines: induced user connection rates increase by 37%–62%, while node classification accuracy drops by an average of 28.5%.

Technology Category

• Machine Learning: Graph-based Machine Learning
• Computer Vision: Adversarial Attacks & Robustness
• Multiagent Systems: Adversarial Agents

Application Category

• Graph Algorithms and Modeling for the Web: Graph neural networks and deep learning approaches for Web-related graphs
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Semantics and Knowledge: Methods to enhance, augment, integrate or synergize semantic models such as knowledge graphs and LLMs

Abstract

Graph Neural Networks (GNNs) have demonstrated remarkable proficiency in modeling data with graph structures, yet recent research reveals their susceptibility to adversarial attacks. Traditional attack methodologies, which rely on manipulating the original graph or adding links to artificially created nodes, often prove impractical in real-world settings. This paper introduces a novel adversarial scenario involving the injection of an isolated subgraph to deceive both the link recommender and the node classifier within a GNN system. Specifically, the link recommender is mislead to propose links between targeted victim nodes and the subgraph, encouraging users to unintentionally establish connections and that would degrade the node classification accuracy, thereby facilitating a successful attack. To address this, we present the LiSA framework, which employs a dual surrogate model and bi-level optimization to simultaneously meet two adversarial objectives. Extensive experiments on real-world datasets demonstrate the effectiveness of our method.

Problem

• Adversarial attacks on Graph Neural Networks
• Subgraph injection to deceive systems
• Link recommender and node classifier vulnerabilities

Innovation

• Injects isolated subgraph for GNN deception
• Uses dual surrogate model optimization
• Misleads link recommender to degrade accuracy