Recent studies show that Graph Neural Networks (GNNs) are vulnerable and easily fooled by small perturbations, which has raised considerable concerns for adapting GNNs in various safety-critical applications. In this work, we focus on the emerging but critical attack, namely, Injection Attack (GIA), adversary poisons graph injecting fake nodes instead of modifying existing structures or node at...