Pith. sign in

REVIEW 4 major objections 7 minor 1 cited by

Query-Based and Unnoticeable Graph Injection Attack from Neighborhood Perspective

T0 review · 4 major / 7 minor · reviewed 2026-08-09 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Query-based attack outperforms GNN defenses and undefended models

desk verdict Interesting attack idea, but the reported 'test accuracy' numbers exceed clean accuracy on standard splits, so the headline claims are uninterpretable until the metric is defined. read the letter →

arxiv 2502.01936 v1 pith:6FCXKSBL submitted 2025-02-04 cs.LG cs.CR

Chang Liu , Hai Huang , Yujie Xing , Xingquan Zuo This is my paper · ORCID
classification cs.LGcs.CR
keywords graphinjectionattackblack-boxquery-basedhomophilypreservationBayesianoptimizationneuralnetworkrobustnessnodeunnoticeable
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

QUGIA is a black-box graph injection attack that aims to degrade the accuracy of graph neural networks by adding malicious nodes, without knowing the target model's architecture or parameters. The paper claims that QUGIA outperforms existing attack methods on six datasets while remaining unnoticed by homophily-based defenses, and that it does so by avoiding surrogate models entirely. Its central idea is to generate injected-node features through a Bayesian optimization framework and to choose connection edges from the perspective of the victim node's neighbors. A sympathetic reader would care because previous attacks either rely on surrogate models, which transfer poorly, or sacrifice attack strength against undefended models in order to evade defenders.

What carries the argument

The central machinery is a two-stage injection pipeline: neighbor-based edge generation and Bayesian feature optimization. Edge generation connects an injected node to the victim and to k randomly selected first-order test neighbors of the victim, expanding the attack from a single node to the victim's neighborhood. Feature generation treats the injected node's feature vector as a sparse perturbation of the victim's features, flipping at most K dimensions toward their boundary values, and uses a Dirichlet prior over a categorical distribution to decide which dimensions to flip. The categorical distribution's concentration parameters are updated by an importance-ratio rule that accumulates reward when a flipped dimension improves the attack loss, with exploration controlled by the power decay λ_t = A·B^t.

What would settle it

A controlled experiment that replaces the Dirichlet-categorical update in Equations (11)–(14) with uniform random selection of feature dimensions, holding the query budget and all other components fixed, would settle the claim: if the random version achieves the same accuracy drop, the Bayesian component is not load-bearing and the method's advantage comes from the neighbor-based edge generation or budget allocation.

Watch

Extended reading notes

Core claim

The central claim is that QUGIA delivers stronger graph injection attacks on both defended and undefended GNN models by eliminating surrogate-model dependence and implicitly preserving homophily. The method first sorts victim nodes in descending order of their first-order test-neighbor count, connects each injected node to the victim and to k randomly chosen test neighbors, and then optimizes the injected node's features with a Dirichlet-categorical Bayesian search. The search starts from the victim's feature vector, flips at most K dimensions toward their extreme values, and uses a power-decay exploration schedule together with an importance-ratio update to concentrate future flips on dimensions that improved the attack loss. In Tables 1 and 2, QUGIA reports the lowest test accuracy among all baselines on all six datasets at most budgets, with gains of up to about 10 percentage points over the best baseline, and its homophily distribution remains close to the clean graph.

Load-bearing premise

The load-bearing premise is that the feature-optimization routine performs genuine Bayesian inference, but the update rule in Equations (11)–(14) adds an importance ratio to the Dirichlet concentration parameter rather than counting observed categories, so the novelty could reduce to a heuristic random search whose performance depends on hand-tuned hyperparameters.

Editorial extensions

If this is right

  • If QUGIA's claims hold, black-box graph attacks can be effective without surrogate models, removing a key practical barrier in adversarial graph learning.
  • Homophily-preserving attacks can evade defenders like Guard and RGAT without explicitly optimizing a homophily constraint, so defenders may need new detection signals beyond homophily distribution.
  • The neighbor-based edge selection suggests that attacking high-neighborhood-count victims yields better budget allocation, a heuristic that could transfer to other graph injection attack methods.
  • The Bayesian feature search demonstrates a query-efficient way to optimize discrete feature flips, which could apply to other black-box graph perturbation problems.
  • The reported gains of up to 10 percentage points over AGIA+HAO on defended models indicate a substantial practical improvement if reproducible.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper's Bayesian update in Equations (11)–(14) does not follow the standard conjugate Dirichlet-categorical posterior; the importance ratio s_i is a heuristic. If so, QUGIA's feature search is effectively a momentum-based random search, and its reported advantage may depend on the hyperparameters A, B, K, and T rather than principled Bayesian inference.
  • The neighbor-based edge selection rule could be seen as a proxy for attacking nodes with high influence; a natural extension is to weight neighbors by centrality or PageRank instead of selecting them randomly, which may further improve budget efficiency.
  • The claim of unnoticeability rests on the homophily distribution only; a testable extension is to evaluate against more diverse detection metrics, such as feature-statistics outliers or graph autoencoder reconstruction error, to see whether the attack remains stealthy.
  • Because the method uses only query feedback, it could in principle be applied in an online or adaptive setting where the target model changes between queries, which the paper does not explore.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 7 minor

Summary. This paper proposes QUGIA, a black-box graph injection attack that selects victim nodes by the number of first-order test-set neighbors and generates injected node features via a search procedure described as Bayesian optimization with a Dirichlet-categorical model. The method is evaluated on six datasets against six GNN models, with and without homophily-based defenses, and is claimed to outperform existing node-injection attacks while implicitly preserving homophily. The paper's contributions are presented as a query-based, surrogate-free attack framework with a novel neighbor-perspective edge-generation strategy and a Bayesian-inspired feature-generation component.

Significance. If the empirical results are reproducible under a correctly specified evaluation metric, the paper makes a useful contribution to practical black-box graph attacks by removing the surrogate-model dependency and by proposing a topology-based victim selection principle. The method is simple, does not require gradients, and the two-component design (edge generation plus feature generation) is clearly articulated. The authors have chosen an underexplored setting (query-based, surrogate-free GIA) and provide a plausible qualitative argument for why attacking high-|p| nodes should be effective. However, the current presentation has serious gaps in the evaluation protocol and in the algorithmic description, so the significance cannot be fully assessed until these issues are resolved.

major comments (4)
  1. [Section 4.3, Tables 1 and 2] The reported 'test set classification accuracy' values are not consistent with any known clean accuracies for these datasets. For example, QUGIA at 1% injection on ogbn-arxiv reports 0.943, while standard GCN clean test accuracy is around 0.72; even the weakest baseline TDGIA at 1% reports 0.983. Since an evasion attack cannot increase accuracy above the clean value, these numbers cannot be raw test accuracy. The metric must be defined explicitly (e.g., accuracy on initially-correct test nodes, or 1 - attack success rate, or subset accuracy), and clean accuracies should be included for reference. Without this, the cross-dataset comparisons and the claimed improvements of 5-10 percentage points are uninterpretable.
  2. [Algorithm 1, line 4] The while loop condition is `while t < T and ∃j ∈ (p_u ∪ {u}), f(j) ≠ Y_j do`. If the victim node and its test neighbors are initially correctly classified (the common case), the existential quantifier is false and the feature-optimization loop is skipped entirely. This contradicts the paper's statement that QUGIA optimizes the injected node features (Section 3.3). The condition should presumably be `while t < T and f(u) = Y_u` (or similar). As written, the algorithm degenerates to random initialization without any optimization, which cannot explain the reported attack results. Please correct the pseudocode and ensure consistency with the description.
  3. [Section 3.2, Eqs. (11)–(14)] The update in Eq. (11) is not the standard Dirichlet-categorical conjugate update. In a conjugate model, the posterior concentration parameter is updated by adding the observed category count (0 or 1), not by adding a ratio s_i = (q_i+0.001)/(v_i+0.001). The quantities q and v defined in Eqs. (13)–(14) are heuristic importance and access counters, so the algorithm is better described as a heuristic explore-exploit search with a momentum term than as Bayesian inference. The manuscript should either provide a correct Bayesian derivation or reframe the method without the Bayesian claim. This matters because feature generation is the core contribution and the 'Bayesian' label is central to the positioning of the work.
  4. [Section 3.2 and Algorithm 1] The values of K (number of flipped feature dimensions), A and B (decay parameters in Eq. (7)), T (maximum iterations), and k (number of neighbor connections in edge generation) are never stated in the main text. These hyperparameters control the search budget, exploration rate, and topology of injected edges. Without them or a sensitivity analysis, the method is not reproducible and the reported results cannot be independently verified. Please provide the settings in the main text or make the supplementary containing them available.
minor comments (7)
  1. [Tables 1 and 2] The method is called 'QUAGIA' in the table headers, whereas the text uses 'QUGIA'. Please unify the terminology.
  2. [Section 2.2, Eq. (2)] The matrix notation is slightly unclear; please define A_I, O_I, and V_I explicitly and ensure the dimensions match.
  3. [Section 3.2, Eq. (10)] The symbol ∨ is used without definition; state whether it denotes a concatenation, element-wise OR, or set union.
  4. [Section 4.3] The tables report 'mean and variance', but the format '0.988±0.001' suggests standard deviation. Please state clearly which one is shown.
  5. [Section 4.6] No ablation results are presented in the main text; the reader is only referred to a supplementary that is not available. Please include at least one ablation table in the main paper.
  6. [Section 3.1] The selection of victim nodes in descending order of |p_u| is motivated informally. Please provide a reference or a small experiment showing that this choice outperforms random selection or degree-based selection.
  7. [Section 4.1] For the OGB-arxiv dataset, the splitting scheme is not described; since the paper focuses on evasion attacks in an inductive setting, please specify the split and the exact test set.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: QUGIA's attack performance is evaluated empirically against external baselines, and no load-bearing claim reduces by construction to its own inputs.

full rationale

The paper's central claim is that QUGIA outperforms state-of-the-art graph injection attackers on six datasets. This claim rests on Table 1 and Table 2, which compare test-set classification accuracy against external baselines (TDGIA, ATDGIA, AGIA, HAO variants, G2A2C). The attack method itself is a query-based heuristic: features are initialized from victim node features and updated by a search procedure using a Dirichlet-inspired importance weighting, while edges are chosen from victim neighborhoods. These are algorithmic design choices, not fitted parameters later renamed as predictions, and there is no derivation chain in which a stated output is equivalent to a stated input by construction. The homophily analysis in Section 4.5 measures node similarity to show that QUGIA preserves homophily; this is a self-consistency check of a design goal, not a prediction derived from the method's own equations, and it does not support the headline outperformance claim by itself. No load-bearing self-citation appears: the cited prior works on GIA, HAO, TDGIA, and G2A2C are external foundations, and the authors do not invoke their own prior uniqueness theorems or ansatze to force the result. Concerns about the non-standard conjugate update in Equations (11)-(14) and about the unusually high accuracy values in Tables 1-2 are correctness, reproducibility, and interpretability risks, not circularity: even if the Bayesian update is heuristic or the metric is mislabeled, the comparison to baselines is still an external empirical test rather than a self-referential reduction. Accordingly, no circular step meets the standard of quoting an equation or fitted parameter that makes the claimed result true by definition.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The method introduces no new physical or mathematical entities, but it adds several free hyperparameters and a heuristic 'posterior' update that is not justified by the invoked conjugate-prior theory.

free parameters (5)
  • K = not reported (deferred to supplementary)
    Number of feature dimensions flipped per iteration; defines perturbation sparsity and search space size.
  • A and B = not reported
    Control exploration rate via lambda_t = A * B^t; balance exploration and exploitation in the search.
  • gamma = 0.05
    CW loss confidence; set to keep perturbed nodes close to the decision boundary.
  • k = not reported
    Number of random neighbors of the victim connected to each injected node in edge generation.
  • T = not reported
    Maximum iterations per injected node in Algorithm 1.
assumptions (5)
  • domain assumption Neighboring nodes in homophilous graphs are likely to have similar features or labels; preserving similarity between injected and victim nodes preserves homophily.
    Used in Section 3.1 to justify both the neighbor-based edge selection and the claim of unnoticeability.
  • domain assumption First-order neighbors are the dominant influence; influence diminishes with distance.
    Section 3.1 limits the attack area to Vu union N1(u).
  • standard math Dirichlet is a conjugate prior for the categorical distribution, so the posterior expectation can be computed.
    Invoked in Section 3.2, but the actual update uses a nonstandard heuristic, so this axiom does not justify the stated equations.
  • ad hoc to paper Attacking nodes with many first-order test neighbors (descending |p_u|) is more effective than attacking low-degree nodes.
    Section 3.1 reverses the low-degree heuristic of [Li et al. 2023; Zou et al. 2021] without empirical justification; the algorithm orders attacks by descending |p_u|.
  • domain assumption The attacker can query the model to obtain logits for all nodes in p_u union {u}.
    Equation (5) sums the CW loss over p_u, requiring per-node output scores; this assumes a score-based API rather than a label-only API.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Query-Based and Unnoticeable Graph Injection Attack from Neighborhood Perspective." pith.science (2026). https://pith.science/paper/6FCXKSBL

@misc{pith2026250201936,
  author       = {Pith},
  title        = {Pith review of: Query-Based and Unnoticeable Graph Injection Attack from Neighborhood Perspective},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/6FCXKSBL}},
  note         = {Machine review of arXiv:2502.01936}
}
read the original abstract

The robustness of Graph Neural Networks (GNNs) has become an increasingly important topic due to their expanding range of applications. Various attack methods have been proposed to explore the vulnerabilities of GNNs, ranging from Graph Modification Attacks (GMA) to the more practical and flexible Graph Injection Attacks (GIA). However, existing methods face two key challenges: (i) their reliance on surrogate models, which often leads to reduced attack effectiveness due to structural differences and prior biases, and (ii) existing GIA methods often sacrifice attack success rates in undefended settings to bypass certain defense models, thereby limiting their overall effectiveness. To overcome these limitations, we propose QUGIA, a Query-based and Unnoticeable Graph Injection Attack. QUGIA injects nodes by first selecting edges based on victim node connections and then generating node features using a Bayesian framework. This ensures that the injected nodes are similar to the original graph nodes, implicitly preserving homophily and making the attack more unnoticeable. Unlike previous methods, QUGIA does not rely on surrogate models, thereby avoiding performance degradation and achieving better generalization. Extensive experiments on six real-world datasets with diverse characteristics demonstrate that QUGIA achieves unnoticeable attacks and outperforms state-of-the-art attackers. The code will be released upon acceptance.

Figures

Figures reproduced from arXiv: 2502.01936 by the authors.

Figure 1
Figure 1. QUGIA consists of two components: edge generation and node generation. Edge generation first connects injected nodes to the [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Node similarity distributions under different attacks for the [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. PEANUT: Perturbations by Eigenvector Alignment for Attacking Graph Neural Networks Under Topology-Driven Message Passing

    cs.LG 2026-03 conditional novelty 6.0 of 10

    Injecting virtual nodes along the dominant eigenvector of a GNN's own output embeddings degrades task performance in a single black-box query, with no gradients or surrogate models.

Reference graph

Works this paper leans on

26 extracted references · 22 canonical work pages · cited by 1 Pith paper

  1. [1]

    Understanding and improving graph injection at- tack by promoting unnoticeability

    [Chen et al., 2022] Yongqiang Chen, Han Yang, Yonggang Zhang, MA KAILI, Tongliang Liu, Bo Han, and James Cheng. Understanding and improving graph injection at- tack by promoting unnoticeability. In International Con- ference on Learning Representations,

    work page 2022

  2. [5]

    Open graph benchmark: Datasets for machine learning on graphs

    [Hu et al., 2020] Weihua Hu, Matthias Fey, Marinka Zitnik, Yuxiao Dong, Hongyu Ren, Bowen Liu, Michele Catasta, and Jure Leskovec. Open graph benchmark: Datasets for machine learning on graphs. Advances in neural informa- tion processing systems, 33:22118–22133,

    2020

  3. [10]

    Revisiting graph adversarial attack and defense from a data distribution perspective

    [Li et al., 2023] Kuan Li, Yang Liu, Xiang Ao, and Qing He. Revisiting graph adversarial attack and defense from a data distribution perspective. In The Eleventh Interna- tional Conference on Learning Representations,

    work page 2023

  4. [11]

    Simple black-box ad- versarial attacks on deep neural networks

    [Narodytska and Kasiviswanathan, 2017] Nina Narodytska and Shiva Prasad Kasiviswanathan. Simple black-box ad- versarial attacks on deep neural networks. In CVPR Work- shops, volume 2,

    work page 2017

  5. [12]

    Collective classification in network data

    [Sen et al., 2008] Prithviraj Sen, Galileo Namata, Mustafa Bilgic, Lise Getoor, Brian Galligher, and Tina Eliassi-Rad. Collective classification in network data. AI magazine , 29(3):93–93,

    2008

  6. [14]

    Single node injection attack against graph neural networks

    [Tao et al., 2021] Shuchang Tao, Qi Cao, Huawei Shen, Jun- jie Huang, Yunfan Wu, and Xueqi Cheng. Single node injection attack against graph neural networks. In Pro- ceedings of the 30th ACM International Conference on In- formation & Knowledge Management , pages 1794–1803,

    work page 2021

  7. [15]

    Graph attention networks

    [Veliˇckovi´c et al., 2018] Petar Veliˇckovi´c, Guillem Cucurull, Arantxa Casanova, Adriana Romero, Pietro Li `o, and Yoshua Bengio. Graph attention networks. In Interna- tional Conference on Learning Representations,

    2018

  8. [16]

    BRUSLEATTACK: A QUERY- EFFICIENT SCORE- BASED BLACK-BOX SPARSE ADVERSARIAL ATTACK

    [V oet al., 2024] Quoc Viet V o, Ehsan Abbasnejad, and Damith Ranasinghe. BRUSLEATTACK: A QUERY- EFFICIENT SCORE- BASED BLACK-BOX SPARSE ADVERSARIAL ATTACK. In The Twelfth International Conference on Learning Representations,

    work page 2024

Show all 26 references
  1. [18]

    Cluster attack: Query-based adversarial attacks on graphs with graph-dependent priors

    [Wang et al., 2021] Zhengyi Wang, Zhongkai Hao, Ziqiao Wang, Hang Su, and Jun Zhu. Cluster attack: Query-based adversarial attacks on graphs with graph-dependent priors. arXiv preprint arXiv:2109.13069,

    2021 arXiv

  2. [19]

    Topol- ogy attack and defense for graph neural networks: An op- timization perspective

    [Xu et al., 2019] Kaidi Xu, Hongge Chen, Sijia Liu, Pin-Yu Chen, Tsui-Wei Weng, Mingyi Hong, and Xue Lin. Topol- ogy attack and defense for graph neural networks: An op- timization perspective. arXiv,

    2019

  3. [20]

    Revisiting semi-supervised learning with graph embeddings

    [Yang et al., 2016] Zhilin Yang, William Cohen, and Ruslan Salakhudinov. Revisiting semi-supervised learning with graph embeddings. In International conference on ma- chine learning, pages 40–48. PMLR,

    2016

  4. [22]

    Mini- mum topology attacks for graph neural networks

    [Zhang et al., 2023] Mengmei Zhang, Xiao Wang, Chuan Shi, Lingjuan Lyu, Tianchi Yang, and Junping Du. Mini- mum topology attacks for graph neural networks. In Pro- ceedings of the ACM Web Conference 2023 , pages 630– 640,

    2023

  5. [23]

    Graph robustness benchmark: Benchmarking the adver- sarial robustness of graph machine learning

    [Zheng et al., 2021] Qinkai Zheng, Xu Zou, Yuxiao Dong, Yukuo Cen, Da Yin, Jiarong Xu, Yang Yang, and Jie Tang. Graph robustness benchmark: Benchmarking the adver- sarial robustness of graph machine learning. In Thirty- fifth Conference on Neural Information Processing Sys- te...

    2021

  6. [24]

    Tdgia: Effective injection attacks on graph neural networks

    [Zou et al., 2021] Xu Zou, Qinkai Zheng, Yuxiao Dong, Xinyu Guan, Evgeny Kharlamov, Jialiang Lu, and Jie Tang. Tdgia: Effective injection attacks on graph neural networks. In Proceedings of the 27th ACM SIGKDD Con- ference on Knowledge Discovery & Data Mining , pages 2461–2471,

    2021

  7. [25]

    Adversarial attacks on neural net- works for graph data

    [Z¨ugner et al., 2018] Daniel Z ¨ugner, Amir Akbarnejad, and Stephan G ¨unnemann. Adversarial attacks on neural net- works for graph data. In Proceedings of the 24th ACM SIGKDD international conference on knowledge discov- ery & data mining, pages 2847–2856,

    2018

  8. [26]

    Adversarial attacks on graph neural networks via meta learning

    [Z¨ugner and G¨unnemann, 2019] Daniel Z¨ugner and Stephan G¨unnemann. Adversarial attacks on graph neural networks via meta learning. In International Conference on Learn- ing Representations, 2019

    2019

  9. [2008]

    Adversarial attacks on graph neural networks via node injections: A hierar- chical reinforcement learning approach

    [Sun et al., 2020] Yiwei Sun, Suhang Wang, Xianfeng Tang, Tsung-Yu Hsieh, and Vasant Honavar. Adversarial attacks on graph neural networks via node injections: A hierar- chical reinforcement learning approach. In Proceedings of the Web Conference 2020, pages 673–683,

    2020

  10. [2016]

    Gnnguard: Defending graph neural networks against ad- versarial attacks

    [Zhang and Zitnik, 2020] Xiang Zhang and Marinka Zitnik. Gnnguard: Defending graph neural networks against ad- versarial attacks. Advances in neural information process- ing systems, 33:9263–9275,

    2020

  11. [2017]

    Query-efficient and scalable black-box adversarial attacks on discrete sequential data via bayesian optimization

    [Lee et al., 2022] Deokjae Lee, Seungyong Moon, Junhyeok Lee, and Hyun Oh Song. Query-efficient and scalable black-box adversarial attacks on discrete sequential data via bayesian optimization. In International Conference on Machine Learning, pages 12478–12497. PMLR,

    2022

  12. [2018]

    Combining neural networks with personalized pagerank for classification on graphs

    [Gasteiger et al., 2019] Johannes Gasteiger, Aleksandar Bo- jchevski, and Stephan G ¨unnemann. Combining neural networks with personalized pagerank for classification on graphs. In International Conference on Learning Repre- sentations,

    2019

  13. [2019]

    Adversarial attack on graph structured data

    [Dai et al., 2018] Hanjun Dai, Hui Li, Tian Tian, Xin Huang, Lin Wang, Jun Zhu, and Le Song. Adversarial attack on graph structured data. In International conference on ma- chine learning, pages 1115–1124. PMLR,

    2018

  14. [2020]

    Could graph neural networks learn better molecular representa- tion for drug discovery? a comparison study of descriptor- based and graph-based models

    [Jiang et al., 2021] Dejun Jiang, Zhenxing Wu, Chang-Yu Hsieh, Guangyong Chen, Ben Liao, Zhe Wang, Chao Shen, Dongsheng Cao, Jian Wu, and Tingjun Hou. Could graph neural networks learn better molecular representa- tion for drug discovery? a comparison study of descriptor- base...

    2021

  15. [2021]

    Let graph be the go board: gradient-free node injection attack for graph neural networks via reinforce- ment learning

    [Ju et al., 2023] Mingxuan Ju, Yujie Fan, Chuxu Zhang, and Yanfang Ye. Let graph be the go board: gradient-free node injection attack for graph neural networks via reinforce- ment learning. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 37, pages 4383–4390,

    2023

  16. [2022]

    Sparse and imperceivable adversarial attacks

    [Croce and Hein, 2019] Francesco Croce and Matthias Hein. Sparse and imperceivable adversarial attacks. In Proceed- ings of the IEEE/CVF international conference on com- puter vision, pages 4724–4732,

    2019

  17. [2023]

    Kipf and Max Welling

    [Kipf and Welling, 2017] Thomas N. Kipf and Max Welling. Semi-supervised classification with graph convolutional networks. In International Conference on Learning Rep- resentations,

    2017

  18. [2024]

    Scalable attack on graph data by injecting vicious nodes.Data Min- ing and Knowledge Discovery, 34:1363–1389,

    [Wang et al., 2020] Jihong Wang, Minnan Luo, Fnu Suya, Jundong Li, Zijiang Yang, and Qinghua Zheng. Scalable attack on graph data by injecting vicious nodes.Data Min- ing and Knowledge Discovery, 34:1363–1389,

    2020

Pith tools

Reviewed August 9, 2026 · model on record in the stance chip above.