Single-Node Attack for Fooling Graph Neural Networks
  Graph neural networks (GNNs) have shown broad applicability in a variety of
domains. Some of these domains, such as social networks and product
recommendations, are fertile ground for malicious users and behavior. In this
paper, we show that GNNs are vulnerable to the extremely limited scenario of a
single-node adversarial example, where the node cannot be picked by the
attacker. That is, an attacker can force the GNN to classify any target node to
a chosen label by only slightly perturbing another single arbitrary node in the
graph, even when not being able to pick that specific attacker node. When the
adversary is allowed to pick a specific attacker node, the attack is even more
effective. We show that this attack is effective across various GNN types, such
as GraphSAGE, GCN, GAT, and GIN, across a variety of real-world datasets, and
as a targeted and a non-targeted attack. Our code is available at
https://github.com/benfinkelshtein/SINGLE .
