{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,7]],"date-time":"2026-05-07T10:15:28Z","timestamp":1778148928562,"version":"3.51.4"},"reference-count":48,"publisher":"Association for Computing Machinery (ACM)","issue":"5","license":[{"start":{"date-parts":[[2020,6,21]],"date-time":"2020-06-21T00:00:00Z","timestamp":1592697600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/501100004963","name":"Seventh Framework Programme","doi-asserted-by":"publisher","award":["291763"],"award-info":[{"award-number":["291763"]}],"id":[{"id":"10.13039\/501100004963","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Technical University of Munich - Institute for Advanced Study"},{"DOI":"10.13039\/501100001659","name":"Deutsche Forschungsgemeinschaft","doi-asserted-by":"publisher","award":["GU 1409\/2-1"],"award-info":[{"award-number":["GU 1409\/2-1"]}],"id":[{"id":"10.13039\/501100001659","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Knowl. Discov. Data"],"published-print":{"date-parts":[[2020,10,31]]},"abstract":"<jats:p>\n            Deep learning models for graphs have achieved strong performance for the task of node classification. Despite their proliferation, little is known about their robustness to adversarial attacks. Yet, in domains where they are likely to be used, e.g., the web, adversaries are common. Can deep learning models for graphs be easily fooled? In this work, we present a study of adversarial attacks on attributed graphs, specifically focusing on models exploiting ideas of graph convolutions. In addition to attacks at test time, we tackle the more challenging class of poisoning\/causative attacks, which focus on the training phase of a machine learning model. We generate adversarial perturbations targeting the\n            <jats:italic>node\u2019s features<\/jats:italic>\n            and the\n            <jats:italic>graph structure<\/jats:italic>\n            , thus, taking the dependencies between instances in account. Moreover, we ensure that the perturbations remain\n            <jats:italic>unnoticeable<\/jats:italic>\n            by preserving important data characteristics. To cope with the underlying discrete domain, we propose an efficient algorithm N\n            <jats:sc>ettack<\/jats:sc>\n            exploiting incremental computations. Our experimental study shows that accuracy of node classification significantly drops even when performing only few perturbations. Even more, our attacks are transferable: the learned attacks generalize to other state-of-the-art node classification models and unsupervised approaches, and likewise are successful even when only limited knowledge about the graph is given. For the first time, we successfully identify important patterns of adversarial attacks on graph neural networks (GNNs) \u2014 a first step towards being able to detect adversarial attacks on GNNs.\n          <\/jats:p>","DOI":"10.1145\/3394520","type":"journal-article","created":{"date-parts":[[2020,6,22]],"date-time":"2020-06-22T02:39:58Z","timestamp":1592793598000},"page":"1-31","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":87,"title":["Adversarial Attacks on Graph Neural Networks"],"prefix":"10.1145","volume":"14","author":[{"given":"Daniel","family":"Z\u00fcgner","sequence":"first","affiliation":[{"name":"Technical University of Munich, Germany"}]},{"given":"Oliver","family":"Borchert","sequence":"additional","affiliation":[{"name":"Technical University of Munich, Germany"}]},{"given":"Amir","family":"Akbarnejad","sequence":"additional","affiliation":[{"name":"Technical University of Munich, Germany"}]},{"given":"Stephan","family":"G\u00fcnnemann","sequence":"additional","affiliation":[{"name":"Technical University of Munich, Germany"}]}],"member":"320","published-online":{"date-parts":[[2020,6,21]]},"reference":[{"key":"e_1_2_1_1_1","volume-title":"Proceedings of the International Workshop on Link Discovery. 36--43","author":"Lada"},{"key":"e_1_2_1_2_1","volume-title":"Two samples test for discrete power-law distributions. Arxiv Preprint Arxiv:1503.00643","author":"Bessi Alessandro","year":"2015"},{"key":"e_1_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2013.57"},{"key":"e_1_2_1_4_1","volume-title":"Proceedings of the 32nd AAAI Conference on Artificial Intelligence. 2738--2745","author":"Bojchevski Aleksandar","year":"2018"},{"key":"e_1_2_1_5_1","volume-title":"Proceedings of the International Conference on Learning Representations.","author":"Bojchevski Aleksandar","year":"2018"},{"key":"e_1_2_1_6_1","volume-title":"Proceedings of the 36th International Conference on Machine Learning.","author":"Bojchevski Aleksandar","year":"2019"},{"key":"e_1_2_1_7_1","volume-title":"Proceedings of the Advances in Neural Information Processing Systems. 8319--8330","author":"Bojchevski Aleksandar","year":"2019"},{"key":"e_1_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1145\/3097983.3098156"},{"key":"e_1_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2018.2807452"},{"key":"e_1_2_1_10_1","series-title":"Adaptive Computation and Machine Learning Series","volume-title":"Semi-Supervised Learning","author":"Chapelle Olivier"},{"key":"e_1_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134083"},{"key":"e_1_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1137\/070710111"},{"key":"e_1_2_1_13_1","volume-title":"Proceedings of the International Conference on Machine Learning.","author":"Dai Hanjun","year":"2018"},{"key":"e_1_2_1_14_1","volume-title":"Proceedings of the 30th International Conference on Neural Information Processing Systems. 3837--3845","author":"Defferrard Micha\u00ebl","year":"2016"},{"key":"e_1_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.14778\/3055540.3055554"},{"key":"e_1_2_1_16_1","volume-title":"Proceedings of the International Conference on Machine Learning. 1263--1272","author":"Gilmer Justin"},{"key":"e_1_2_1_17_1","volume-title":"Proceedings of the International Conference on Learning Representations.","author":"Goodfellow Ian J.","year":"2015"},{"key":"e_1_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-66399-9_4"},{"key":"e_1_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1145\/2939672.2939754"},{"key":"e_1_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.5555\/3294771.3294869"},{"key":"e_1_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1137\/1.9781611974348.56"},{"key":"e_1_2_1_22_1","volume-title":"Proceedings of the International Conference on Learning Representations.","author":"Thomas"},{"key":"e_1_2_1_23_1","volume-title":"Proceedings of the International Conference on Learning Representations.","author":"Klicpera Johannes","year":"2019"},{"key":"e_1_2_1_24_1","volume-title":"Proceedings of the 30th International Conference on Neural Information Processing Systems. 1885--1893","author":"Li Bo","year":"2016"},{"key":"e_1_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1561\/1500000016"},{"key":"e_1_2_1_26_1","unstructured":"Ben London and Lise Getoor. 2014. Collective classification of network data. Data Classification: Algorithms and Applications. 399--416. https:\/\/books.google.de\/books?id&equals;qm_SBQAAQBAJ8lpg&equals;PP18ots&equals;CSL_pk0IqH8dq&equals;Data%20Classification%3A%20Algorithms%20and%20Applications%2020148lr8hl&equals;de8pg&equals;PR16#v&equals;onepage8q&equals;Data%20Classification:%20Algorithms%20and%20Applications%202014&f&equals;&equals;false.  Ben London and Lise Getoor. 2014. Collective classification of network data. Data Classification: Algorithms and Applications. 399--416. https:\/\/books.google.de\/books?id&equals;qm_SBQAAQBAJ8lpg&equals;PP18ots&equals;CSL_pk0IqH8dq&equals;Data%20Classification%3A%20Algorithms%20and%20Applications%2020148lr8hl&equals;de8pg&equals;PR16#v&equals;onepage8q&equals;Data%20Classification:%20Algorithms%20and%20Applications%202014&f&equals;&equals;false."},{"key":"e_1_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1214\/aoms\/1177730491"},{"key":"e_1_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1023\/A:1009953814988"},{"key":"e_1_2_1_29_1","volume-title":"Proceedings of the 29th AAAI Conference on Artificial Intelligence. 2871--2877","author":"Mei Shike","year":"2015"},{"key":"e_1_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.11648\/j.ajtas.20160504.19"},{"key":"e_1_2_1_31_1","volume-title":"Proceedings of the 2017 IEEE Conference on Computer Vision and Pattern Recognition.","author":"Monti Federico"},{"key":"e_1_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1103\/PhysRevE.67.026126"},{"key":"e_1_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1093\/acprof:oso\/9780199206650.001.0001"},{"key":"e_1_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2016.36"},{"key":"e_1_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1145\/2623330.2623732"},{"key":"e_1_2_1_37_1","volume-title":"Proceedings of the 31st AAAI Conference on Artificial Intelligence. 2485--2491","author":"Pham Trang","year":"2017"},{"key":"e_1_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1609\/aimag.v29i3.2157"},{"key":"e_1_2_1_39_1","volume-title":"Proceedings of the International Conference on Learning Representations.","author":"Szegedy Christian","year":"2014"},{"key":"e_1_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.procs.2014.05.229"},{"key":"e_1_2_1_41_1","volume-title":"Proceedings of the International Conference on Machine Learning. 642--650","author":"Torkamani Mohamad Ali","year":"2013"},{"key":"e_1_2_1_42_1","volume-title":"The space of transferable adversarial examples. Arxiv Preprint Arxiv:1704.03453","author":"Tram\u00e8r Florian","year":"2017"},{"key":"e_1_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2020.2978386"},{"key":"e_1_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1145\/1390156.1390306"},{"key":"e_1_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.1093\/biomet\/87.4.954"},{"key":"e_1_2_1_46_1","volume-title":"Proceedings of the AAAI Conference on Artificial Intelligence. 2628--2635","author":"Zhao Mengchen","year":"2018"},{"key":"e_1_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.1145\/3219819.3220078"},{"key":"e_1_2_1_48_1","volume-title":"Proceedings of the International Conference on Learning Representations.","author":"Z\u00fcgner Daniel","year":"2019"},{"key":"e_1_2_1_49_1","doi-asserted-by":"publisher","DOI":"10.1145\/3292500.3330905"}],"container-title":["ACM Transactions on Knowledge Discovery from Data"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3394520","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3394520","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T21:31:30Z","timestamp":1750195890000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3394520"}},"subtitle":["Perturbations and their Patterns"],"short-title":[],"issued":{"date-parts":[[2020,6,21]]},"references-count":48,"journal-issue":{"issue":"5","published-print":{"date-parts":[[2020,10,31]]}},"alternative-id":["10.1145\/3394520"],"URL":"https:\/\/doi.org\/10.1145\/3394520","relation":{},"ISSN":["1556-4681","1556-472X"],"issn-type":[{"value":"1556-4681","type":"print"},{"value":"1556-472X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2020,6,21]]},"assertion":[{"value":"2019-03-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2020-04-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2020-06-21","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}