Single-node attacks for fooling graph neural networks

Graph neural networks (GNNs) have shown broad applicability in a variety of domains. These domains, e.g., social and product recommendations, are fertile ground for malicious users behavior. In this paper, we show that GNNs vulnerable to the extremely limited (and thus quite realistic) scenarios single-node adversarial attack, where perturbed node cannot be chosen by attacker. That is, an attacker can force GNN classify any target label, only slightly perturbing features or neighbor list another single arbitrary graph, even when not being able select specific node. When adversary is allowed node, these attacks more effective. We demonstrate empirically our attack effective across various common types (e.g., GCN, GraphSAGE, GAT, GIN) robustly optimized Robust SM GAL, LAT-GCN), outperforming previous different real-world datasets both targeted non-targeted attacks. Our code available at https://github.com/benfinkelshtein/SINGLE .