Awesome Graph Adversarial Learning Literature

A curated list of adversarial attacks and defenses papers on graph-structured data.

Papers are sorted by their uploaded dates in descending order.

If you want to add new entries, please make PRs with the same format.

This list serves as a complement to the survey below.

Adversarial Attack and Defense on Graph Data: A Survey (Updated in Oct 2022. More than 110 papers reviewed).

Arxiv Version (Latest)

@article{sun2018adversarial,
  title={Adversarial Attack and Defense on Graph Data: A Survey},
  author={Sun, Lichao and Dou, Yingtong and Yang, Carl and Kai Zhang and Wang, Ji and Yixin Liu and Yu, Philip S. and He, Lifang and Li, Bo},
  journal={arXiv preprint arXiv:1812.10528},
  year={2018}
}

TKDE Version

@article{sun2022adversarial,
  title={Adversarial attack and defense on graph data: A survey},
  author={Sun, Lichao and Dou, Yingtong and Yang, Carl and Zhang, Kai and Wang, Ji and Philip, S Yu and He, Lifang and Li, Bo},
  journal={IEEE Transactions on Knowledge and Data Engineering},
  year={2022},
  publisher={IEEE}
}

If you feel this repo is helpful, please cite the survey above.

How to Search?

Search keywords like conference name (e.g., NeurIPS), task name (e.g., Link Prediction), model name (e.g., DeepWalk), or method name (e.g., Robust) over the webpage to quickly locate related papers.

Quick Links

Attack papers sorted by year: | 2023 | 2022 | 2021 | 2020 | 2019 | 2018 | 2017 |

Defense papers sorted by year: | 2023 | 2022 | 2021 | 2020 | 2019 | 2018 |

Attack

Attack Papers 2023 [Back to Top]

Year	Title	Type	Target Task	Target Model	Venue	Paper	Code
2023	Revisiting Robustness in Graph Machine Learning	Attack	Node Classification	GCN, SGC, APPNP, GAT, GATv2, GraphSAGE, LP	ICLR'23	Link	Link
2023	Unnoticeable Backdoor Attacks on Graph Neural Networks	Attack	Node classification, Graph classification	GCN, GraphSage, and GAT	ArXiv	Link	Link
2023	Attacking Fake News Detectors via Manipulating News Social Engagement	Attack	Fake News Detection	GAT, GCN, and GraphSAGE)	WWW'23	Link	Link
2023	HyperAttack: Multi-Gradient-Guided White-box Adversarial Structure Attack of Hypergraph Neural Networks	Attack	Node Classification	HGNNs	ArXiv	Link
2023	Turning Strengths into Weaknesses: A Certified Robustness Inspired Attack Framework against Graph Neural Networks	Attack	Node Classification	GCN	CVPR'23	Link
2023	Adversary for Social Good: Leveraging Attribute-Obfuscating Attack to Protect User Privacy on Social Networks	Attack	Attribute Protection On Social Networks	GNNs	SecureComm 2022	Link
2023	Node Injection for Class-specific Network Poisoning	Attack	Node Classification	GCN	arXiv	Link	Link
2023	GUAP: Graph Universal Attack Through Adversarial Patching	Attack	Node Classification	GCN	arXiv	Link	Link

Attack Papers 2022 [Back to Top]

Year	Title	Type	Target Task	Target Model	Venue	Paper	Code
2022	GANI: Global Attacks on Graph Neural Networks via Imperceptible Node Injections	Attack	Node Classification	GCN/SGC/Jaccard/SimPGCN	Arxiv	Link
2022	Motif-Backdoor: Rethinking the Backdoor Attack on Graph Neural Networks via Motifs	Attack	Graph Classification	GCN/SAGPool/GIN/	Arxiv	Link
2022	Towards Reasonable Budget Allocation in Untargeted Graph Structure Attacks via Gradient Debias	Attack	Node Classification	GCN/GAT/GraphSAGE	NeurIPS 2022	Link	Link
2022	Imperceptible Adversarial Attacks on Discrete-Time Dynamic Graph Models	Attack	Dynamic Link Prediction/Node Classification	GC-LSTM/EVOLVEGCN/DYSAT	NeurIPS 2022 Workshop TGL	Link
2022	A2S2-GNN: Rigging GNN-Based Social Status by Adversarial Attacks in Signed Social Networks	Attack	Classification in unsigned or undirected graphs	GNNs	IEEE Transactions on Information Forensics and Security	Link
2022	Let Graph be the Go Board: Gradient-free Node Injection Attack for Graph Neural Networks via Reinforcement Learning	Attack	Node Classification	GCN/SGC/GAT/APPNP	AAAI23	Link	Link
2022	QuerySnout: Automating the Discovery of Attribute Inference Attacks against Query-Based Systems	Attack	Query-based systems attribute inference	Diffix/TableBuilder/SimpleQBS	CCS 2022	Link	Link
2022	Are Defenses for Graph Neural Networks Robust?	Attack	Node Classification	GNN, GCN, Jaccard GCN, SVD GCN, GNNGuard, RGCN, ProGNN, GRAND, Soft Median GDC	NeurIPS 2022	Link	Link
2022	Poisoning GNN-based Recommender Systems with Generative Surrogate-based Attacks	Attack	Promotion/Recommendation/Re-producing	GNN	ACM TIS	Link
2022	Dealing with the unevenness: deeper insights in graph-based attack and defense	Attack	Set-Cover problem	GCN, RGCN, GCN-Jaccard, Pro-GNN	Machine Learning	Link
2022	Membership Inference Attacks Against Robust Graph Neural Network	Attack	Membership Inference	GCN	CSS 2022	Link
2022	Sparse Vicious Attacks on Graph Neural Networks	Attack	Link prediction	GNN	arXiv	Link	Link
2022	Model Inversion Attacks against Graph Neural Networks	Attack	Node Classification	GCN, GAT and GraphSAGE	TKDE	Link	Link
2022	Exploratory Adversarial Attacks on Graph Neural Networks for Semi-Supervised Node Classification	Attack	Semi-Supervised Node Classification	GNN	Pattern Recognition	Link
2022	Adversarial Inter-Group Link Injection Degrades the Fairness of Graph Neural Networks	Attack	node classification	GNN	IEEE ICDM 2022	Link	Link
2022	Resisting Graph Adversarial Attack via Cooperative Homophilous Augmentation	Attack	semi-Supervised Node Classification	GNN	ECML PKDD 2022	Link
2022	What Does the Gradient Tell When Attacking the Graph Structure	Attack	Node Classification	GCN, GraphSage and H2GCN	arXiv	Link
2022	Robust Node Classification on Graphs: Jointly from Bayesian Label Transition and Topology-based Label Propagation	Attack	Node Classification	GNNs	CIKM 2022	Link	Link
2022	Revisiting Item Promotion in GNN-based Collaborative Filtering: A Masked Targeted Topological Attack Perspective	Attack	Collaborative filtering	LightGCN	arXiv	Link
2022	Link-Backdoor: Backdoor Attack on Link Prediction via Node Injection	Attack	Link Prediction	GAE, VGAE, GIC, ARGA, ARVGA	arXiv	Link	Link
2022	Graph Structural Attack by Perturbing Spectral Distance	Attack	node classification	two-layer GCN	KDD 2022	Link
2022	Are Gradients on Graph Structure Reliable in Gray-box Attacks?	Attack	node classification tasks	GraphSage	CIKM 2022	Link
2022	Adversarial Camouflage for Node Injection Attack on Graphs	Attack	semi-supervised information retrieval task	GNNs	arXiv	Link
2022	CLUSTER ATTACK: Query-based Adversarial Attacks on Graphs with Graph-Dependent Priors	Attack	node classification	GNNs	IJCAI 2022	Link
2022	IoT-based Android Malware Detection Using Graph Neural Network With Adversarial Defense	Attack	Malware Detection	GNN	IEEE Internet of Things	Link
2022	Private Graph Extraction via Feature Explanations	Attack	node classification	2-layer GCN	arXiv	Link
2022	Towards Secrecy-Aware Attacks Against Trust Prediction in Signed Graphs	Attack	trust prediction in signed graphs	SGCN, SNEA	arXiv	Link
2022	Camouflaged Poisoning Attack on Graph Neural Networks	Attack	node classification	GCN	ICMR 2022	Link
2022	LOKI: A Practical Data Poisoning Attack Framework against Next Item Recommendations	Attack	Next Item Recommendations	BPRMF, FPMC, GRU4REC, TransRec	TKDE 2022	Link
2022	Poisoning GNN-based Recommender Systems with Generative Surrogate-based Attacks	Attack	Promotion/Recommendation/Re-producing	GNNs	ACM Transactions on Information Systems 2022	Link
2022	Transferable Graph Backdoor Attack	Attack	Graph Classification	GNNs	RAID 2022	Link
2022	Cluster Attack: Query-based Adversarial Attacks on Graphs with Graph-Dependent Priors	Attack	Node Classification	GNNs	IJCAI 2022	Link	Link
2022	Adversarial Robustness of Graph-based Anomaly Detection	Attack	Anomaly Detection	GNNs	Arxiv	Link
2022	Adversarial Attack Framework on Graph Embedding Models with Limited Knowledge	Attack	Node Classification	GNNs	Preprint

graph-adversarial-learning-literature