{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,2]],"date-time":"2026-04-02T15:49:14Z","timestamp":1775144954326,"version":"3.50.1"},"reference-count":48,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2023,8,9]],"date-time":"2023-08-09T00:00:00Z","timestamp":1691539200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2023,8,9]],"date-time":"2023-08-09T00:00:00Z","timestamp":1691539200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"name":"National Key Research and Development Program of China","award":["2020YFC1523300"],"award-info":[{"award-number":["2020YFC1523300"]}]},{"name":"Construction Project for Innovation Platform of Qinghai Province","award":["2022ZJT02"],"award-info":[{"award-number":["2022ZJT02"]}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Complex Intell. Syst."],"published-print":{"date-parts":[[2024,2]]},"abstract":"<jats:title>Abstract<\/jats:title><jats:p>In recent years, Graph Neural Networks (GNNs) have achieved excellent applications in classification or prediction tasks. Recent studies have demonstrated that GNNs are vulnerable to adversarial attacks. Graph Modification Attack (GMA) and Graph Injection Attack (GIA) are commonly attack strategies. Most graph adversarial attack methods are based on GMA, which has a clear drawback: the attacker needs high privileges to modify the original graph, making it difficult to execute in practice. GIA can perform attacks without modifying the original graph. However, many GIA models fail to take care of attack invisibility, i.e., fake nodes can be easily distinguished from the original nodes. To solve the above issue, we propose an imperceptible graph injection attack, named IMGIA. Specifically, IMGIA uses the normal distribution sampling and mask learning to generate fake node features and links respectively, and then uses the homophily unnoticeability constraint to improve the camouflage of the attack. Our extensive experiments on three benchmark datasets demonstrate that IMGIA performs better than the existing state-of-the-art GIA methods. As an example, IMGIA shows an improvement in performance with an average increase in effectiveness of 2%.<\/jats:p>","DOI":"10.1007\/s40747-023-01200-6","type":"journal-article","created":{"date-parts":[[2023,8,9]],"date-time":"2023-08-09T08:01:57Z","timestamp":1691568117000},"page":"869-883","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":7,"title":["Imperceptible graph injection attack on graph neural networks"],"prefix":"10.1007","volume":"10","author":[{"given":"Yang","family":"Chen","sequence":"first","affiliation":[]},{"given":"Zhonglin","family":"Ye","sequence":"additional","affiliation":[]},{"given":"Zhaoyang","family":"Wang","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0957-1603","authenticated-orcid":false,"given":"Haixing","family":"Zhao","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2023,8,9]]},"reference":[{"key":"1200_CR1","doi-asserted-by":"publisher","first-page":"108461","DOI":"10.1016\/j.asoc.2022.108461","volume":"118","author":"A Amara","year":"2022","unstructured":"Amara A, Hadj T, Ben AM (2022) Cross-network representation learning for anchor users on multiplex heterogeneous social network. Appl Soft Comput 118:108461","journal-title":"Appl Soft Comput"},{"key":"1200_CR2","doi-asserted-by":"publisher","first-page":"206","DOI":"10.1109\/TIFS.2022.3219342","volume":"18","author":"X Yin","year":"2023","unstructured":"Yin X, Lin W, Sun K, Wei C, Chen Y (2023) A$$^2$$s$$^2$$-GNN: Rigging GNN-based social status by adversarial attacks in signed social networks. IEEE Trans Inf Forensics Secur 18:206\u2013220","journal-title":"IEEE Trans Inf Forensics Secur"},{"issue":"1","key":"1200_CR3","doi-asserted-by":"publisher","first-page":"233","DOI":"10.1007\/s11192-021-04196-3","volume":"127","author":"C Pornprasit","year":"2022","unstructured":"Pornprasit C, Liu X, Kiattipadungkul P, Kertkeidkachorn N (2022) Enhancing citation recommendation using citation network embedding. Scientometrics 127(1):233\u2013264","journal-title":"Scientometrics"},{"issue":"4","key":"1200_CR4","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3494567","volume":"16","author":"H Wu","year":"2022","unstructured":"Wu H, Ng MK (2022) Hypergraph convolution on nodes-hyperedges network for semi-supervised node classification. ACM Trans Knowl Discov Data 16(4):1\u201319","journal-title":"ACM Trans Knowl Discov Data"},{"issue":"11","key":"1200_CR5","doi-asserted-by":"publisher","first-page":"8747","DOI":"10.1002\/int.22966","volume":"37","author":"Y Pang","year":"2022","unstructured":"Pang Y, Huang T, Wang Z, Li J, Hosseini P (2022) Graph decipher: a transparent dual-attention graph neural network to understand the message-passing mechanism for the node classification. Int J Intell Syst 37(11):8747\u20138769","journal-title":"Int J Intell Syst"},{"key":"1200_CR6","first-page":"235","volume":"591","author":"L Xiao","year":"2022","unstructured":"Xiao L, Xu P, Jing L, Akujuobi U, Zhang X (2022) Semantic guide for semi-supervised few-shot multi-label node classification. Inf Sci Int J 591:235\u2013250","journal-title":"Inf Sci Int J"},{"issue":"4","key":"1200_CR7","doi-asserted-by":"publisher","first-page":"920","DOI":"10.1109\/TBDATA.2021.3140205","volume":"8","author":"Y Xie","year":"2022","unstructured":"Xie Y, Lv S, Qian Y, Wen C, Liang J (2022) Active and semi-supervised graph neural networks for graph classification. IEEE Trans Big Data 8(4):920\u2013932","journal-title":"IEEE Trans Big Data"},{"key":"1200_CR8","doi-asserted-by":"publisher","first-page":"4883","DOI":"10.1109\/TSP.2022.3205476","volume":"70","author":"S Doshi","year":"2022","unstructured":"Doshi S, Chepuri SP (2022) Graph neural networks with parallel neighborhood aggregations for graph classification. IEEE Trans Signal Process 70:4883\u20134896","journal-title":"IEEE Trans Signal Process"},{"issue":"9","key":"1200_CR9","doi-asserted-by":"publisher","first-page":"2579","DOI":"10.1093\/bioinformatics\/btac112","volume":"38","author":"Z Wang","year":"2022","unstructured":"Wang Z, Liu M, Luo Y, Xu Z, Xie Y, Wang L, Cai L, Qi Q, Yuan Z, Yang T (2022) Advanced graph and sequence neural networks for molecular property prediction and drug discovery. Bioinformatics 38(9):2579\u20132586","journal-title":"Bioinformatics"},{"key":"1200_CR10","unstructured":"Kipf TN, Welling M (2016) Semi-supervised classification with graph convolutional networks. arXiv:1609.02907"},{"key":"1200_CR11","unstructured":"Veli\u010dkovi\u0107 P, Cucurull G, Casanova A, Romero A, Lio P, Bengio Y (2017) Graph attention networks. arXiv:1710.10903"},{"key":"1200_CR12","unstructured":"Hamilton W, Ying Z, Leskovec J (2017) Inductive representation learning on large graphs. Adv Neural Inf Process Syst 30"},{"key":"1200_CR13","doi-asserted-by":"crossref","unstructured":"Yang S, Doan BG, Montague P, DeVel O (2022) Transferable graph backdoor attack. In: Proceedings of the 25th international symposium on research in attacks, intrusions and defenses. p 321\u2013332","DOI":"10.1145\/3545948.3545976"},{"key":"1200_CR14","unstructured":"Liu Z, Luo Y, Wu L, Liu Z, Li SZ (2022) Towards reasonable budget allocation in untargeted graph structure attacks via gradient debias. In: Oh AH, Agarwal A, Belgrave D, Cho K (eds) Advances in neural information processing systems"},{"key":"1200_CR15","doi-asserted-by":"crossref","unstructured":"Chen Y, Ye Z, Zhao H, Meng L, Wang Z, Yang Y (2022) A practical adversarial attack on graph neural networks by attacking single node structure. In: 2022 IEEE 24th international conferences on high performance computing & communications. IEEE, p 143\u2013152","DOI":"10.1109\/HPCC-DSS-SmartCity-DependSys57074.2022.00052"},{"issue":"2","key":"1200_CR16","doi-asserted-by":"publisher","first-page":"380","DOI":"10.1002\/acs.3529","volume":"37","author":"Z Zhang","year":"2023","unstructured":"Zhang Z, Song X, Sun X, Stojanovic V (2023) Hybrid-driven-based fuzzy secure filtering for nonlinear parabolic partial differential equation systems with cyber attacks. Int J Adapt Control Signal Process 37(2):380\u2013398","journal-title":"Int J Adapt Control Signal Process"},{"key":"1200_CR17","doi-asserted-by":"crossref","unstructured":"Song X, Wu N, Shuai S, Stojanovic V (2023) Switching-like event-triggered state estimation for reaction-diffusion neural networks against dos attacks. Neural Process Lett","DOI":"10.1007\/s11063-023-11189-1"},{"key":"1200_CR18","unstructured":"Chen J, Wu Y, Xu X, Chen Y, Zheng H, Xuan Q (2018) Fast gradient attack on network embedding. arXiv:1809.02797"},{"key":"1200_CR19","doi-asserted-by":"crossref","unstructured":"Z\u00fcgner D, Akbarnejad A, G\u00fcnnemann S (2018) Adversarial attacks on neural networks for graph data. In: Proceedings of the 24th ACM SIGKDD international conference on knowledge discovery & data mining. p 2847\u20132856","DOI":"10.1145\/3219819.3220078"},{"key":"1200_CR20","doi-asserted-by":"crossref","unstructured":"Sharma K, Trivedi R, Sridhar R, Kumar S (2022) Imperceptible adversarial attacks on discrete-time dynamic graph models. In: NeurIPS 2022 temporal graph learning workshop","DOI":"10.1145\/3580305.3599517"},{"key":"1200_CR21","doi-asserted-by":"crossref","unstructured":"Ju M, Fan Y, Zhang C, Ye Y (2022) Let graph be the go board: gradient-free node injection attack for graph neural networks via reinforcement learning. arXiv:2211.10782","DOI":"10.1609\/aaai.v37i4.25558"},{"key":"1200_CR22","doi-asserted-by":"publisher","unstructured":"Chen J, Huang G, Zheng H, Yu S, Jiang W, Cui C (2021) Graph-fraudster: adversarial attacks on graph neural network based vertical federated learning. https:\/\/doi.org\/10.48550\/arXiv.2110.06468","DOI":"10.48550\/arXiv.2110.06468"},{"key":"1200_CR23","doi-asserted-by":"crossref","unstructured":"Z\u00fcgner D, G\u00fcnnemann S (2019) Adversarial attacks on graph neural networks via meta learning. In: International conference on learning representations (ICLR)","DOI":"10.24963\/ijcai.2019\/872"},{"key":"1200_CR24","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2022.109042","volume":"133","author":"X Lin","year":"2023","unstructured":"Lin X, Zhou C, Wu J, Yang H, Wang H, Cao Y, Wang B (2023) Exploratory adversarial attacks on graph neural networks for semi-supervised node classification. Pattern Recogn 133:109042. https:\/\/doi.org\/10.1016\/j.patcog.2022.109042","journal-title":"Pattern Recogn"},{"key":"1200_CR25","doi-asserted-by":"crossref","unstructured":"Chen Y, Ye Z, Zhao H, Wang Y et al (2023) Feature-based graph backdoor attack in the node classification task. Int J Intell Syst 2023","DOI":"10.1155\/2023\/5418398"},{"key":"1200_CR26","doi-asserted-by":"publisher","DOI":"10.1145\/3567420","author":"TT Nguyen","year":"2022","unstructured":"Nguyen TT, Quach KND, Nguyen TT, Huynh TT, Vu VH, Le Nguyen P, Jo J, Nguyen QVH (2022) Poisoning GNN-based recommender systems with generative surrogate-based attacks. ACM Trans Inf Syst. https:\/\/doi.org\/10.1145\/3567420","journal-title":"ACM Trans Inf Syst"},{"key":"1200_CR27","doi-asserted-by":"publisher","DOI":"10.1007\/s11063-022-11094-z","author":"Y Li","year":"2022","unstructured":"Li Y, Liao J, Liu C, Wang Y, Li L (2022) Node similarity preserving graph convolutional network based on full-frequency information for node classification. Neural Process Lett. https:\/\/doi.org\/10.1007\/s11063-022-11094-z","journal-title":"Neural Process Lett"},{"issue":"4","key":"1200_CR28","doi-asserted-by":"publisher","first-page":"2997","DOI":"10.1007\/s11063-022-10750-8","volume":"54","author":"J Zhuang","year":"2022","unstructured":"Zhuang J, Hasan MA (2022) How does bayesian noisy self-supervision defend graph convolutional networks? Neural Process Lett 54(4):2997\u20133018","journal-title":"Neural Process Lett"},{"key":"1200_CR29","unstructured":"Wang X, Eaton J, Hsieh C-J, Wu SF (2018) Attack graph convolutional networks by adding fake nodes. arXiv:1810.10751"},{"issue":"5","key":"1200_CR30","doi-asserted-by":"publisher","first-page":"1363","DOI":"10.1007\/s10618-020-00696-7","volume":"34","author":"J Wang","year":"2020","unstructured":"Wang J, Luo M, Suya F, Li J, Yang Z, Zheng Q (2020) Scalable attack on graph data by injecting vicious nodes. Data Min Knowl Discov 34(5):1363\u20131389. https:\/\/doi.org\/10.1007\/s10618-020-00696-7","journal-title":"Data Min Knowl Discov"},{"key":"1200_CR31","doi-asserted-by":"publisher","unstructured":"Sun Y, Wang S, Tang X, Hsieh T-Y, Honavar V (2020) Adversarial attacks on graph neural networks via node injections: a hierarchical reinforcement learning approach. In: Proceedings of the web conference 2020. WWW \u201920. p 673\u2013683. https:\/\/doi.org\/10.1145\/3366423.3380149","DOI":"10.1145\/3366423.3380149"},{"key":"1200_CR32","doi-asserted-by":"crossref","unstructured":"Sharma AK, Kukreja R, Kharbanda M, Chakraborty T (2023) Node injection for class-specific network poisoning. arXiv:2301.12277","DOI":"10.1016\/j.neunet.2023.07.025"},{"issue":"4","key":"1200_CR33","doi-asserted-by":"publisher","first-page":"3321","DOI":"10.1007\/s11063-022-10764-2","volume":"54","author":"J Dai","year":"2022","unstructured":"Dai J, Zhu W, Luo X (2022) A targeted universal attack on graph convolutional network by using fake nodes. Neural Process Lett 54(4):3321\u20133337. https:\/\/doi.org\/10.1007\/s11063-022-10764-2","journal-title":"Neural Process Lett"},{"key":"1200_CR34","doi-asserted-by":"publisher","DOI":"10.1145\/3381028","author":"A Boukerche","year":"2020","unstructured":"Boukerche A, Zheng L, Alfandi O (2020) Outlier detection: methods, models, and classification. ACM Comput Surv. https:\/\/doi.org\/10.1145\/3381028","journal-title":"ACM Comput Surv"},{"key":"1200_CR35","unstructured":"Chen Y, Yang H, Zhang Y, KAILI M, Liu T, Han B, Cheng J (2022) Understanding and improving graph injection attack by promoting unnoticeability. In: International conference on learning representations"},{"key":"1200_CR36","unstructured":"Liu Z, Wang G, Luo Y, Li SZ (2022) What does the gradient tell when attacking the graph structure. arXiv:2208.12815"},{"key":"1200_CR37","unstructured":"Fang J, Wen H, Wu J, Xuan Q, Zheng Z, Tse CK (2022) Gani: global attacks on graph neural networks via imperceptible node injections. arXiv:2210.12598"},{"key":"1200_CR38","doi-asserted-by":"crossref","unstructured":"Wu B, Yang X, Pan S, Yuan X (2021) Adapting membership inference attacks to GNN for graph classification: approaches and implications. arXiv:2110.08760","DOI":"10.1109\/ICDM51629.2021.00182"},{"key":"1200_CR39","doi-asserted-by":"publisher","unstructured":"Lin L, Blaser E, Wang H (2022) Graph structural attack by perturbing spectral distance. In: Zhang A, Rangwala H (eds) KDD \u201922: the 28th ACM SIGKDD conference on knowledge discovery and data mining, Washington, DC, USA, August 14\u201318, 2022. p 989\u2013998. https:\/\/doi.org\/10.1145\/3534678.3539435","DOI":"10.1145\/3534678.3539435"},{"key":"1200_CR40","doi-asserted-by":"crossref","unstructured":"Liu Z, Luo Y, Wu L, Li S, Liu Z, Li SZ (2022) Are gradients on graph structure reliable in gray-box attacks? In: Association for computing machinery, vol 9. p 1360\u20131368","DOI":"10.1145\/3511808.3557238"},{"key":"1200_CR41","doi-asserted-by":"publisher","unstructured":"Liu Z, Luo Y, Zang Z, Li SZ (2022) Surrogate representation learning with isometric mapping for gray-box graph adversarial attacks. p 591\u2013598. https:\/\/doi.org\/10.1145\/3488560.3498481","DOI":"10.1145\/3488560.3498481"},{"key":"1200_CR42","doi-asserted-by":"publisher","unstructured":"Tao S, Cao Q, Shen H, Huang J, Wu Y, Cheng X (2021) Single node injection attack against graph neural networks. In: Proceedings of the 30th ACM international conference on information; knowledge management. p 1794\u20131803. https:\/\/doi.org\/10.1145\/3459637.3482393","DOI":"10.1145\/3459637.3482393"},{"key":"1200_CR43","doi-asserted-by":"crossref","unstructured":"Wang Z, Hao Z, Wang Z, Su H, Zhu J (2021) Cluster attack: query-based adversarial attacks on graphs with graph-dependent priors. arXiv:2109.13069","DOI":"10.24963\/ijcai.2022\/108"},{"key":"1200_CR44","doi-asserted-by":"crossref","unstructured":"Zou X, Zheng Q, Dong Y, Guan X, Kharlamov E, Lu J, Tang J (2021) TDGIA: Effective Injection Attacks on Graph Neural Networks. arXiv:2106.06663","DOI":"10.1145\/3447548.3467314"},{"key":"1200_CR45","doi-asserted-by":"crossref","unstructured":"Tao S, Cao Q, Shen H, Wu Y, Hou L, Cheng X (2022) Adversarial camouflage for node injection attack on graphs. arXiv:2208.01819","DOI":"10.1016\/j.ins.2023.119611"},{"key":"1200_CR46","doi-asserted-by":"crossref","unstructured":"Jiang C, He Y, Chapman R, Wu H (2022) Camouflaged poisoning attack on graph neural networks. In: Proceedings of the 2022 international conference on multimedia retrieval. p 451\u2013461","DOI":"10.1145\/3512527.3531373"},{"key":"1200_CR47","unstructured":"Wu F, Souza A, Zhang T, Fifty C, Yu T, Weinberger K (2019) Simplifying graph convolutional networks. In: Proceedings of the 36th international conference on machine learning. p 6861\u20136871"},{"key":"1200_CR48","doi-asserted-by":"crossref","unstructured":"Zhu D, Zhang Z, Cui P, Zhu W (2019) Robust graph convolutional networks against adversarial attacks. In: Proceedings of the 25th ACM SIGKDD international conference on knowledge discovery & data mining. p 1399\u20131407","DOI":"10.1145\/3292500.3330851"}],"container-title":["Complex &amp; Intelligent Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s40747-023-01200-6.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s40747-023-01200-6\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s40747-023-01200-6.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,2,10]],"date-time":"2024-02-10T22:24:46Z","timestamp":1707603886000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s40747-023-01200-6"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,8,9]]},"references-count":48,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2024,2]]}},"alternative-id":["1200"],"URL":"https:\/\/doi.org\/10.1007\/s40747-023-01200-6","relation":{},"ISSN":["2199-4536","2198-6053"],"issn-type":[{"value":"2199-4536","type":"print"},{"value":"2198-6053","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,8,9]]},"assertion":[{"value":"8 February 2023","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"15 July 2023","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"9 August 2023","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare no conflicts of interest.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}}]}}