Blindfolded Attackers Still Threatening: Strict Black-Box Adversarial Attacks on Graphs

Adversarial attacks on graphs have attracted considerable research interests. Existing works assume the attacker is either (partly) aware of victim model, or able to send queries it. These assumptions are, however, unrealistic. To bridge gap between theoretical graph and real-world scenarios, in this work, we propose a novel more realistic setting: strict black-box attack, which has no knowledge about model at all not allowed any queries. design such an attack strategy, first generic filter unify different families graph-based models. The strength can then be quantified by change before after attack. By maximizing change, are find effective regardless underlying model. solve optimization problem, also relaxation technique approximation theories reduce difficulty as well computational expense. Experiments demonstrate that, even with exposure Macro-F1 drops 6.4% node classification 29.5% classification, significant result compared existent works.