Query-based Adversarial Attacks on Graph with Fake Nodes
  While deep neural networks have achieved great success on the graph analysis,
recent works have shown that they are also vulnerable to adversarial attacks
where fraudulent users can fool the model with a limited number of queries.
Compared with adversarial attacks on image classification, performing
adversarial attack on graphs is challenging because of the discrete and
non-differential nature of a graph. To address these issues, we proposed
Cluster Attack, a novel adversarial attack by introducing a set of fake nodes
to the original graph which can mislead the classification on certain victim
nodes. Specifically, we query the victim model for each victim node to acquire
their most adversarial feature, which is related to how the fake node's feature
will affect the victim nodes. We further cluster the victim nodes into several
subgroups according to their most adversarial features such that we can reduce
the searching space. Moreover, our attack is performed in a practical and
unnoticeable manner: (1) We protect the predicted labels of nodes which we are
not aimed for from being changed during attack. (2) We attack by introducing
fake nodes into the original graph without changing existing links and
features. (3) We attack with only partial information about the attacked graph,
i.e., by leveraging the information of victim nodes along with their neighbors
within $k$-hop instead of the whole graph. (4) We perform attack with a limited
number of queries about the predicted scores of the model in a black-box
manner, i.e., without model architecture and parameters. Extensive experiments
demonstrate the effectiveness of our method in terms of the success rate of
attack.
