{"id":"5c06fa65-151f-451c-8974-d475d244e562","arxiv_id":"2502.01936","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"A query-based graph injection attack that selects edges from the victim's neighborhood and generates node features with a Bayesian search, outperforming prior attacks on six datasets while preserving homophily.","lead":"QUGIA adds fake nodes to a graph to fool graph neural networks, using only query access to the model's outputs. Unlike prior attacks, it needs no surrogate model, and it preserves homophily so that homophily-based defenses do not catch it.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Reported 'test accuracies' exceed plausible clean accuracies (e.g., ogbn-arxiv 0.943 at 1% injection vs known GCN clean ~0.72), so Tables 1-2 do not report raw test accuracy; the headline outperformance claim is uninterpretable until the metric is defined.","rationale":"I read the paper as proposing a black-box graph injection attack with two claimed contributions: neighbor-based edge selection and a Bayesian-flavored feature search. For the central claim to hold, the reported performance comparisons must be accurate and interpretable. The numbers in Tables 1-2 are not standard test accuracies: for ogbn-arxiv, published GCN test accuracy is around 0.72, but Table 1 reports attacked accuracies of 0.94-0.98 for QUGIA and baselines at 1-5% injection. Since the attack is evasion and non-targeted, it cannot increase clean accuracy; hence the table metric must be something like retention of initially correct target nodes. If so, the phrase 'test set classification accuracy' is misleading, no clean baseline is reported, and the magnitude of the claimed improvements cannot be assessed. This concern outweighs the reader's identified issue: Eqs. (11)-(14) do not implement a conjugate Dirichlet update (s_i is a smoothed empirical importance, not an observation count), but even if that were corrected, the evaluation would remain uninterpretable. I still agree with the conditional disposition: the method is interesting, genuinely surrogate-free and query-based, and the homophily analysis is plausible, but the authors must clarify the metric, add clean-accuracy rows, and provide the missing supplementary material and code before the empirical claim can be accepted.","tokens_in":13641,"tokens_out":12664,"duration_ms":133763,"concrete_test":"Ask the authors to add a clean-accuracy row to Tables 1-2 and state the exact definition of the reported value. A quick computational check: run the standard GRB-Cora split with a GCN, record clean test accuracy (expected about 0.84-0.86); if the clean value is not near 1.0 while Table 1 reports attacked values near 0.99, the table cannot be raw accuracy. Independently, recompute Table 1 for Cora at a=0.03 by evaluating QUGIA's released (or reconstructed) outputs on the raw test set; if the resulting accuracy differs from the reported 0.881 by more than the mismatch between clean and reported performance, the metric inconsistency is confirmed.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section 4.3 says Tables 1-2 report 'test set classification accuracy' and 'lower values indicate stronger attack performance.' Under standard splits, clean GCN test accuracy is roughly 0.81-0.84 for Cora and 0.72 for ogbn-arxiv, yet Table 1 lists attacked accuracies such as 0.988 for Cora (TDGIA, 1%) and 0.983 for Arxiv (TDGIA, 1%), with QUGIA at 0.943 for Arxiv at 1%. An evasion attack cannot raise accuracy above clean accuracy, so these numbers cannot be raw test accuracy. The most plausible reading is that the reported values are retention rates on an initially-correct victim subset (i.e., 1 - attack success rate) or some other normalized quantity, but neither the main text nor the missing supplementary defines this. Without a clean-accuracy row or an explicit metric definition, cross-dataset comparisons and the claimed 5-10 percentage point gains cannot be interpreted; a drop from 0.99 to 0.90 means something very different from a drop from 0.72 to 0.63. This concern is more load-bearing than the non-conjugate Dirichlet update in Eqs. (11)-(14): even a perfectly conjugate Bayesian update would not make the evaluation interpretable.","agreement_with_reader":"disagree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper proposes QUGIA, a black-box graph injection attack that selects victim nodes by the number of first-order test-set neighbors and generates injected node features via a search procedure described as Bayesian optimization with a Dirichlet-categorical model. The method is evaluated on six datasets against six GNN models, with and without homophily-based defenses, and is claimed to outperform existing node-injection attacks while implicitly preserving homophily. The paper's contributions are presented as a query-based, surrogate-free attack framework with a novel neighbor-perspective edge-generation strategy and a Bayesian-inspired feature-generation component.","tokens_in":13942,"tokens_out":7483,"duration_ms":69303,"significance":"If the empirical results are reproducible under a correctly specified evaluation metric, the paper makes a useful contribution to practical black-box graph attacks by removing the surrogate-model dependency and by proposing a topology-based victim selection principle. The method is simple, does not require gradients, and the two-component design (edge generation plus feature generation) is clearly articulated. The authors have chosen an underexplored setting (query-based, surrogate-free GIA) and provide a plausible qualitative argument for why attacking high-|p| nodes should be effective. However, the current presentation has serious gaps in the evaluation protocol and in the algorithmic description, so the significance cannot be fully assessed until these issues are resolved.","major_comments":[{"comment":"The reported 'test set classification accuracy' values are not consistent with any known clean accuracies for these datasets. For example, QUGIA at 1% injection on ogbn-arxiv reports 0.943, while standard GCN clean test accuracy is around 0.72; even the weakest baseline TDGIA at 1% reports 0.983. Since an evasion attack cannot increase accuracy above the clean value, these numbers cannot be raw test accuracy. The metric must be defined explicitly (e.g., accuracy on initially-correct test nodes, or 1 - attack success rate, or subset accuracy), and clean accuracies should be included for reference. Without this, the cross-dataset comparisons and the claimed improvements of 5-10 percentage points are uninterpretable.","section":"Section 4.3, Tables 1 and 2"},{"comment":"The while loop condition is `while t < T and ∃j ∈ (p_u ∪ {u}), f(j) ≠ Y_j do`. If the victim node and its test neighbors are initially correctly classified (the common case), the existential quantifier is false and the feature-optimization loop is skipped entirely. This contradicts the paper's statement that QUGIA optimizes the injected node features (Section 3.3). The condition should presumably be `while t < T and f(u) = Y_u` (or similar). As written, the algorithm degenerates to random initialization without any optimization, which cannot explain the reported attack results. Please correct the pseudocode and ensure consistency with the description.","section":"Algorithm 1, line 4"},{"comment":"The update in Eq. (11) is not the standard Dirichlet-categorical conjugate update. In a conjugate model, the posterior concentration parameter is updated by adding the observed category count (0 or 1), not by adding a ratio s_i = (q_i+0.001)/(v_i+0.001). The quantities q and v defined in Eqs. (13)–(14) are heuristic importance and access counters, so the algorithm is better described as a heuristic explore-exploit search with a momentum term than as Bayesian inference. The manuscript should either provide a correct Bayesian derivation or reframe the method without the Bayesian claim. This matters because feature generation is the core contribution and the 'Bayesian' label is central to the positioning of the work.","section":"Section 3.2, Eqs. (11)–(14)"},{"comment":"The values of K (number of flipped feature dimensions), A and B (decay parameters in Eq. (7)), T (maximum iterations), and k (number of neighbor connections in edge generation) are never stated in the main text. These hyperparameters control the search budget, exploration rate, and topology of injected edges. Without them or a sensitivity analysis, the method is not reproducible and the reported results cannot be independently verified. Please provide the settings in the main text or make the supplementary containing them available.","section":"Section 3.2 and Algorithm 1"}],"minor_comments":[{"comment":"The method is called 'QUAGIA' in the table headers, whereas the text uses 'QUGIA'. Please unify the terminology.","section":"Tables 1 and 2"},{"comment":"The matrix notation is slightly unclear; please define A_I, O_I, and V_I explicitly and ensure the dimensions match.","section":"Section 2.2, Eq. (2)"},{"comment":"The symbol ∨ is used without definition; state whether it denotes a concatenation, element-wise OR, or set union.","section":"Section 3.2, Eq. (10)"},{"comment":"The tables report 'mean and variance', but the format '0.988±0.001' suggests standard deviation. Please state clearly which one is shown.","section":"Section 4.3"},{"comment":"No ablation results are presented in the main text; the reader is only referred to a supplementary that is not available. Please include at least one ablation table in the main paper.","section":"Section 4.6"},{"comment":"The selection of victim nodes in descending order of |p_u| is motivated informally. Please provide a reference or a small experiment showing that this choice outperforms random selection or degree-based selection.","section":"Section 3.1"},{"comment":"For the OGB-arxiv dataset, the splitting scheme is not described; since the paper focuses on evasion attacks in an inductive setting, please specify the split and the exact test set.","section":"Section 4.1"}],"recommendation":"major_revision","confidential_remarks":"The evaluation-metric issue is the most serious concern; if the metric is clarified and the algorithm bug is fixed, the paper may be salvageable. I also note that the supplementary material and code are not available for review, which makes it impossible to verify the sensitivity analyses and the source of the table values. The paper would benefit from a clear statement of the reported metric and from a careful revision of the algorithmic pseudocode."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things to know about this paper. First, the core idea is genuinely useful: a query-based graph injection attack that doesn't rely on a surrogate model, with edge selection driven by the victim's neighborhood and feature search guided by a Bayesian-style update. That combination is new relative to TDGIA, AGIA, and G2A2C, and the homophily-preservation motivation is sensible. Second, the evaluation as presented is broken. Tables 1 and 2 report \"test set classification accuracy,\" but the numbers are impossibly high. On ogbn-arxiv, clean GCN accuracy is around 0.72; Table 1 lists attacked accuracies of 0.98 for TDGIA at 1% injection and 0.943 for QUGIA. An evasion attack cannot raise accuracy above the clean baseline. So the reported quantity is not raw test accuracy—it might be accuracy on an initially-correct subset, a retention rate, or something else, but the paper never says. Without a clean-accuracy row and a metric definition, the claimed 5–10 percentage point gains cannot be interpreted, and cross-dataset comparisons are meaningless. This is the load-bearing problem, bigger than the Dirichlet issue.\n\nThe Bayesian derivation is also shaky. Equations (11)–(14) are described as a conjugate Dirichlet-categorical update, but the update adds an importance ratio to the concentration parameter, which is not the standard conjugate form. It works more like a heuristic momentum-based search. That's okay if the paper said so, but it doesn't. Key hyperparameters (K, A, B, T) appear only in the text and are absent from the experiments; ablations and per-model results are deferred to a missing supplementary. No code is released. The homophily evaluation uses the same node-similarity measure the method is designed to preserve, which is mildly circular but not fatal.\n\nWhat the paper does well: the query-based, surrogate-free setting is the right direction; the neighbor-perspective edge selection is a small but novel departure from degree-based heuristics; and the authors fairly acknowledge HAO's trade-off. The empirical tables, if the metric is clarified, would show consistent drops across six datasets and six models.\n\nWho is this for? Researchers working on GIA robustness and black-box attacks. They might benefit from the method's design ideas, but not from the current numbers. The paper deserves serious peer review because the problem is important and the approach is novel enough to warrant referee time—but it needs major revision: define the metric, include clean-accuracy baselines, fix or rename the Bayesian update, provide code, and move the missing ablations into the main text. I'd send it to review but prepare a likely reject-and-resubmit outcome.","headline":"Interesting attack idea, but the reported 'test accuracy' numbers exceed clean accuracy on standard splits, so the headline claims are uninterpretable until the metric is defined.","tokens_in":14470,"tokens_out":1943,"would_cite":false,"duration_ms":21909,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Query-based attack outperforms GNN defenses and undefended models","keywords":["graph injection attack","black-box attack","query-based attack","homophily preservation","Bayesian optimization","graph neural network robustness","node injection","unnoticeable attack"],"falsifier":"A controlled experiment that replaces the Dirichlet-categorical update in Equations (11)–(14) with uniform random selection of feature dimensions, holding the query budget and all other components fixed, would settle the claim: if the random version achieves the same accuracy drop, the Bayesian component is not load-bearing and the method's advantage comes from the neighbor-based edge generation or budget allocation.","tokens_in":13434,"feed_emoji":"🎯","tokens_out":6437,"duration_ms":51334,"temperature":0.7,"pith_summary":"QUGIA is a black-box graph injection attack that aims to degrade the accuracy of graph neural networks by adding malicious nodes, without knowing the target model's architecture or parameters. The paper claims that QUGIA outperforms existing attack methods on six datasets while remaining unnoticed by homophily-based defenses, and that it does so by avoiding surrogate models entirely. Its central idea is to generate injected-node features through a Bayesian optimization framework and to choose connection edges from the perspective of the victim node's neighbors. A sympathetic reader would care because previous attacks either rely on surrogate models, which transfer poorly, or sacrifice attack strength against undefended models in order to evade defenders.","feed_headline":"Query-based attack outperforms GNN defenses and undefended models","feed_subtitle":"Injects nodes via neighbor-based edges and Bayesian search, beating prior attacks on defended and undefended GNNs.","key_machinery":"The central machinery is a two-stage injection pipeline: neighbor-based edge generation and Bayesian feature optimization. Edge generation connects an injected node to the victim and to k randomly selected first-order test neighbors of the victim, expanding the attack from a single node to the victim's neighborhood. Feature generation treats the injected node's feature vector as a sparse perturbation of the victim's features, flipping at most K dimensions toward their boundary values, and uses a Dirichlet prior over a categorical distribution to decide which dimensions to flip. The categorical distribution's concentration parameters are updated by an importance-ratio rule that accumulates reward when a flipped dimension improves the attack loss, with exploration controlled by the power decay λ_t = A·B^t.","core_discovery":"The central claim is that QUGIA delivers stronger graph injection attacks on both defended and undefended GNN models by eliminating surrogate-model dependence and implicitly preserving homophily. The method first sorts victim nodes in descending order of their first-order test-neighbor count, connects each injected node to the victim and to k randomly chosen test neighbors, and then optimizes the injected node's features with a Dirichlet-categorical Bayesian search. The search starts from the victim's feature vector, flips at most K dimensions toward their extreme values, and uses a power-decay exploration schedule together with an importance-ratio update to concentrate future flips on dimensions that improved the attack loss. In Tables 1 and 2, QUGIA reports the lowest test accuracy among all baselines on all six datasets at most budgets, with gains of up to about 10 percentage points over the best baseline, and its homophily distribution remains close to the clean graph.","pith_inferences":["The paper's Bayesian update in Equations (11)–(14) does not follow the standard conjugate Dirichlet-categorical posterior; the importance ratio s_i is a heuristic. If so, QUGIA's feature search is effectively a momentum-based random search, and its reported advantage may depend on the hyperparameters A, B, K, and T rather than principled Bayesian inference.","The neighbor-based edge selection rule could be seen as a proxy for attacking nodes with high influence; a natural extension is to weight neighbors by centrality or PageRank instead of selecting them randomly, which may further improve budget efficiency.","The claim of unnoticeability rests on the homophily distribution only; a testable extension is to evaluate against more diverse detection metrics, such as feature-statistics outliers or graph autoencoder reconstruction error, to see whether the attack remains stealthy.","Because the method uses only query feedback, it could in principle be applied in an online or adaptive setting where the target model changes between queries, which the paper does not explore."],"forward_implications":["If QUGIA's claims hold, black-box graph attacks can be effective without surrogate models, removing a key practical barrier in adversarial graph learning.","Homophily-preserving attacks can evade defenders like Guard and RGAT without explicitly optimizing a homophily constraint, so defenders may need new detection signals beyond homophily distribution.","The neighbor-based edge selection suggests that attacking high-neighborhood-count victims yields better budget allocation, a heuristic that could transfer to other graph injection attack methods.","The Bayesian feature search demonstrates a query-efficient way to optimize discrete feature flips, which could apply to other black-box graph perturbation problems.","The reported gains of up to 10 percentage points over AGIA+HAO on defended models indicate a substantial practical improvement if reproducible."],"supporting_citations":[{"why":"Provides the Bayesian-optimization inspiration and the idea of searching for unnoticeable perturbations around an initial successful sample, which QUGIA adapts to start from the victim's features.","marker":"[Lee et al., 2022]"},{"why":"Introduces TDGIA, the state-of-the-art node-injection baseline, and motivates the low-degree victim selection that QUGIA contrasts with its neighbor-based strategy.","marker":"[Zou et al., 2021]"},{"why":"Introduces the AGIA/ATDGIA injection baselines and the HAO homophily-preserving objective that QUGIA compares against, and supplies the defended-model evaluation setup.","marker":"[Chen et al., 2022]"},{"why":"Provides G2A2C, the query-based reinforcement-learning injection attack that serves as the main surrogate-free baseline under the same query budget.","marker":"[Ju et al., 2023]"},{"why":"Supplies the GRB-redefined Cora and Citeseer datasets used to evaluate continuous-feature performance.","marker":"[Zheng et al., 2021]"},{"why":"Supplies the arXiv dataset from OGB used as a large-scale evaluation benchmark.","marker":"[Hu et al., 2020]"}],"fun_headline_variants":["New GNN attack beats defenses without surrogate models","Query-based injection attack outperforms on defended and clean GNNs","Unnoticeable graph injection attack bypasses defenses and tops baselines","No-surrogate attack: QUGIA outperforms prior GNN attackers","Graph injection attack that fools defenders and undefended models"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the feature-optimization routine performs genuine Bayesian inference, but the update rule in Equations (11)–(14) adds an importance ratio to the Dirichlet concentration parameter rather than counting observed categories, so the novelty could reduce to a heuristic random search whose performance depends on hand-tuned hyperparameters.","fun_headline_variants_meta":{"raw":{"variants":["New GNN attack beats defenses without surrogate models","Query-based injection attack outperforms on defended and clean GNNs","Unnoticeable graph injection attack bypasses defenses and tops baselines","No-surrogate attack: QUGIA outperforms prior GNN attackers","Graph injection attack that fools defenders and undefended models"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000746,"raw_usage":{"total_tokens":3333,"prompt_tokens":964,"completion_tokens":2369,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":580,"completion_tokens_details":{"reasoning_tokens":2283}},"tokens_in":580,"tokens_out":2369,"duration_ms":15352,"temperature":1.0,"reasoning_tokens":2283,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-09T13:54:57.474836+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"A controlled experiment that replaces the Dirichlet-categorical update in Equations (11)–(14) with uniform random selection of feature dimensions, holding the query budget and all other components fixed, would settle the claim: if the random version achieves the same accuracy drop, the Bayesian component is not load-bearing and the method's advantage comes from the neighbor-based edge generation or budget allocation.","supporting_citations":[{"cited_title":"Query-efficient and scalable black-box adversarial attacks on discrete sequential data via bayesian optimization","cited_arxiv_id":null,"evidence_quote":"Provides the Bayesian-optimization inspiration and the idea of searching for unnoticeable perturbations around an initial successful sample, which QUGIA adapts to start from the victim's features."},{"cited_title":"Tdgia: Effective injection attacks on graph neural networks","cited_arxiv_id":null,"evidence_quote":"Introduces TDGIA, the state-of-the-art node-injection baseline, and motivates the low-degree victim selection that QUGIA contrasts with its neighbor-based strategy."},{"cited_title":"Understanding and improving graph injection at- tack by promoting unnoticeability","cited_arxiv_id":null,"evidence_quote":"Introduces the AGIA/ATDGIA injection baselines and the HAO homophily-preserving objective that QUGIA compares against, and supplies the defended-model evaluation setup."},{"cited_title":"Graph robustness benchmark: Benchmarking the adver- sarial robustness of graph machine learning","cited_arxiv_id":null,"evidence_quote":"Supplies the GRB-redefined Cora and Citeseer datasets used to evaluate continuous-feature performance."}],"review_version":1}