{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,11]],"date-time":"2026-07-11T17:32:55Z","timestamp":1783791175957,"version":"3.55.0"},"publisher-location":"New York, NY, USA","reference-count":55,"publisher":"ACM","license":[{"start":{"date-parts":[[2024,3,4]],"date-time":"2024-03-04T00:00:00Z","timestamp":1709510400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/501100006374","name":"National Science Foundation","doi-asserted-by":"publisher","award":["NSF-2241713"],"award-info":[{"award-number":["NSF-2241713"]}],"id":[{"id":"10.13039\/501100006374","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Natural Science Foundation of Jiangxi Province of China","award":["20232BAB212025"],"award-info":[{"award-number":["20232BAB212025"]}]},{"name":"Cisco Research Award","award":["NSF-2216926"],"award-info":[{"award-number":["NSF-2216926"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2024,3,4]]},"DOI":"10.1145\/3616855.3635826","type":"proceedings-article","created":{"date-parts":[[2024,3,4]],"date-time":"2024-03-04T18:18:12Z","timestamp":1709576292000},"page":"693-701","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":13,"title":["Efficient, Direct, and Restricted Black-Box Graph Evasion Attacks to Any-Layer Graph Neural Networks via Influence Function"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-5616-060X","authenticated-orcid":false,"given":"Binghui","family":"Wang","sequence":"first","affiliation":[{"name":"Illinois Institute of Technology, Chicago, IL, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1591-7172","authenticated-orcid":false,"given":"Minhua","family":"Lin","sequence":"additional","affiliation":[{"name":"The Pennsylvania State University, State College, PA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2985-2701","authenticated-orcid":false,"given":"Tianxiang","family":"Zhou","sequence":"additional","affiliation":[{"name":"Huazhong University of Science and Technology, Wuhan, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8629-4622","authenticated-orcid":false,"given":"Pan","family":"Zhou","sequence":"additional","affiliation":[{"name":"Huazhong University of Science and Technology, Wuhan, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1478-3072","authenticated-orcid":false,"given":"Ang","family":"Li","sequence":"additional","affiliation":[{"name":"University of Maryland, College Park, MD, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6734-0865","authenticated-orcid":false,"given":"Meng","family":"Pang","sequence":"additional","affiliation":[{"name":"Nanchang University, Nanchang, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3228-6544","authenticated-orcid":false,"given":"Hai","family":"Li","sequence":"additional","affiliation":[{"name":"Duke University, Durham, NC, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1486-8412","authenticated-orcid":false,"given":"Yiran","family":"Chen","sequence":"additional","affiliation":[{"name":"Duke University, Durham, NC, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2024,3,4]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"Aleksandar Bojchevski and Stephan G\u00fcnnemann. 2019a. Adversarial Attacks on Node Embeddings via Graph Poisoning. In ICML."},{"key":"e_1_3_2_1_2_1","unstructured":"Aleksandar Bojchevski and Stephan G\u00fcnnemann. 2019b. Certifiable Robustness to Graph Perturbations. In NeurIPS."},{"key":"e_1_3_2_1_3_1","unstructured":"Aleksandar Bojchevski Johannes Klicpera and Stephan G\u00fcnnemann. 2020. Efficient robustness certificates for discrete data: Sparsity-aware randomized smoothing for graphs images and more. In ICML."},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"crossref","unstructured":"Heng Chang Yu Rong Tingyang Xu Wenbing Huang Honglei Zhang Peng Cui Wenwu Zhu and Junzhou Huang. 2020. A Restricted Black-Box Adversarial Framework Towards Attacking Graph Embedding Models.. In AAAI.","DOI":"10.1609\/aaai.v34i04.5741"},{"key":"e_1_3_2_1_5_1","volume-title":"Fast gradient attack on network embedding. arXiv","author":"Chen Jinyin","year":"2018","unstructured":"Jinyin Chen, Yangyang Wu, Xuanheng Xu, Yixian Chen, Haibin Zheng, and Qi Xuan. 2018. Fast gradient attack on network embedding. arXiv (2018)."},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"crossref","unstructured":"Yizheng Chen Yacin Nadji Athanasios Kountouras Fabian Monrose Roberto Perdisci Manos Antonakakis and Nikolaos Vasiloglou. 2017. Practical attacks against graph-based clustering. In CCS.","DOI":"10.1145\/3133956.3134083"},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"crossref","unstructured":"Enyan Dai Minhua Lin Xiang Zhang and Suhang Wang. 2023. Unnoticeable backdoor attacks on graph neural networks. In WWW.","DOI":"10.1145\/3543507.3583392"},{"key":"e_1_3_2_1_8_1","unstructured":"Hanjun Dai Hui Li Tian Tian Xin Huang Lin Wang Jun Zhu and Le Song. 2018b. Adversarial attack on graph structured data. In ICML."},{"key":"e_1_3_2_1_9_1","unstructured":"Quanyu Dai Qiang Li Jian Tang and Dan Wang. 2018a. Adversarial network embedding. In AAAI."},{"key":"e_1_3_2_1_10_1","unstructured":"Micha\u00ebl Defferrard Xavier Bresson and Pierre Vandergheynst. 2016. Convolutional neural networks on graphs with fast localized spectral filtering. In NIPS."},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"crossref","unstructured":"Negin Entezari Saba A Al-Sayouri Amirali Darvishzadeh and Evangelos E Papalexakis. 2020. All you need is low (rank) defending against adversarial attacks on graphs. In WSDM.","DOI":"10.1145\/3336191.3371789"},{"key":"e_1_3_2_1_12_1","unstructured":"Houxiang Fan Binghui Wang Pan Zhou Ang Li Zichuan Xu Cai Fu Hai Li and Yiran Chen. 2021. Reinforcement learning-based black-box evasion attacks to link prediction in dynamic graphs. In HPCC."},{"key":"e_1_3_2_1_13_1","volume-title":"Daniel Z\u00fcgner, Aleksandar Bojchevski, and Stephan G\u00fcnnemann.","author":"Geisler Simon","year":"2021","unstructured":"Simon Geisler, Tobias Schmidt, Hakan cS irin, Daniel Z\u00fcgner, Aleksandar Bojchevski, and Stephan G\u00fcnnemann. 2021. Robustness of graph neural networks at scale. NeurIPS."},{"key":"e_1_3_2_1_14_1","unstructured":"Simon Geisler Daniel Z\u00fcgner and Stephan G\u00fcnnemann. 2020. Reliable graph neural networks via robust aggregation. In NeurIPS."},{"key":"e_1_3_2_1_15_1","unstructured":"Justin Gilmer Samuel S Schoenholz Patrick F Riley Oriol Vinyals and George E Dahl. 2017. Neural message passing for quantum chemistry. In ICML."},{"key":"e_1_3_2_1_16_1","unstructured":"Will Hamilton Zhitao Ying and Jure Leskovec. 2017. Inductive representation learning on large graphs. In NIPS."},{"key":"e_1_3_2_1_17_1","unstructured":"Weihua Hu Matthias Fey Marinka Zitnik Yuxiao Dong Hongyu Ren Bowen Liu Michele Catasta and Jure Leskovec. 2020. Open graph benchmark: Datasets for machine learning on graphs. NeurIPS."},{"key":"e_1_3_2_1_18_1","volume-title":"Venkata Jaya Shankar Ashish Peruri, and Xinhua Zhang","author":"Jin Hongwei","year":"2020","unstructured":"Hongwei Jin, Zhan Shi, Venkata Jaya Shankar Ashish Peruri, and Xinhua Zhang. 2020b. Certified Robustness of Graph Convolution Networks for Graph Classification under Topological Attacks. In NeurIPS."},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"crossref","unstructured":"Wei Jin Yao Ma Xiaorui Liu Xianfeng Tang Suhang Wang and Jiliang Tang. 2020a. Graph structure learning for robust graph neural networks. In KDD.","DOI":"10.1145\/3394486.3403049"},{"key":"e_1_3_2_1_20_1","unstructured":"Thomas N Kipf and Max Welling. 2017. Semi-supervised classification with graph convolutional networks. In ICLR."},{"key":"e_1_3_2_1_21_1","unstructured":"Pang Wei Koh and Percy Liang. 2017. Understanding black-box predictions via influence functions. In ICML."},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"crossref","unstructured":"Jia Li Honglei Zhang Zhichao Han Yu Rong Hong Cheng and Junzhou Huang. 2020. Adversarial attack on community detection by hiding individuals. In WWW.","DOI":"10.1145\/3366423.3380171"},{"key":"e_1_3_2_1_23_1","unstructured":"Minhua Lin Teng Xiao Enyan Dai Xiang Zhang and Suhang Wang. 2023. Certifiably Robust Graph Contrastive Learning. In NeurIPS."},{"key":"e_1_3_2_1_24_1","volume-title":"A unified framework for data poisoning attack to graph-based semi-supervised learning. arXiv preprint arXiv:1910.14147","author":"Liu Xuanqing","year":"2019","unstructured":"Xuanqing Liu, Si Si, Xiaojin Zhu, Yang Li, and Cho-Jui Hsieh. 2019. A unified framework for data poisoning attack to graph-based semi-supervised learning. arXiv preprint arXiv:1910.14147 (2019)."},{"key":"e_1_3_2_1_25_1","unstructured":"Jiaqi Ma Shuangrui Ding and Qiaozhu Mei. 2020. Towards More Practical Adversarial Attacks on Graph Neural Networks. In NeurIPS."},{"key":"e_1_3_2_1_26_1","unstructured":"Jiaming Mu Binghui Wang Qi Li Kun Sun Mingwei Xu and Zhuotao Liu. 2021. A Hard Label Black-box Adversarial Attack Against Graph Neural Networks. In CCS."},{"key":"e_1_3_2_1_27_1","unstructured":"Felix Mujkanovic Simon Geisler Stephan G\u00fcnnemann and Aleksandar Bojchevski. 2022. Are Defenses for Graph Neural Networks Robust?. In NeurIPS."},{"key":"e_1_3_2_1_28_1","volume-title":"Markus Hagenbuchner, and Gabriele Monfardini.","author":"Scarselli Franco","year":"2008","unstructured":"Franco Scarselli, Marco Gori, Ah Chung Tsoi, Markus Hagenbuchner, and Gabriele Monfardini. 2008. The graph neural network model. IEEE Transactions on Neural Networks (2008)."},{"key":"e_1_3_2_1_29_1","volume-title":"Collective classification in network data. AI magazine","author":"Sen Prithviraj","year":"2008","unstructured":"Prithviraj Sen, Galileo Namata, Mustafa Bilgic, Lise Getoor, Brian Galligher, and Tina Rad. 2008. Collective classification in network data. AI magazine (2008)."},{"key":"e_1_3_2_1_30_1","volume-title":"Data poisoning attack against unsupervised node embedding methods. arXiv","author":"Sun Mingjie","year":"2018","unstructured":"Mingjie Sun, Jian Tang, Huichen Li, Bo Li, Chaowei Xiao, Yao Chen, and Dawn Song. 2018. Data poisoning attack against unsupervised node embedding methods. arXiv (2018)."},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1145\/3366423.3380149"},{"key":"e_1_3_2_1_32_1","volume-title":"Indirect Adversarial Attacks via Poisoning Neighbors for Graph Convolutional Networks","author":"Takahashi Tsubasa","unstructured":"Tsubasa Takahashi. 2019. Indirect Adversarial Attacks via Poisoning Neighbors for Graph Convolutional Networks. In IEEE BigData."},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"crossref","unstructured":"Xianfeng Tang Yandong Li Yiwei Sun Huaxiu Yao Prasenjit Mitra and Suhang Wang. 2020. Transferring Robustness for Graph Neural Network Against Poisoning Attacks. In WSDM.","DOI":"10.1145\/3336191.3371851"},{"key":"e_1_3_2_1_34_1","unstructured":"Shuchang Tao Huawei Shen Qi Cao Liang Hou and Xueqi Cheng. 2021. Adversarial Immunization for Certifiable Robustness on Graphs. In WSDM."},{"key":"e_1_3_2_1_35_1","unstructured":"MohamadAli Torkamani and Daniel Lowd. 2013. Convex adversarial collective classification. In ICML."},{"key":"e_1_3_2_1_36_1","unstructured":"Petar Velivc kovi\u0107 Guillem Cucurull Arantxa Casanova Adriana Romero Pietro Lio and Yoshua Bengio. 2018. Graph attention networks. In ICLR."},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"crossref","unstructured":"Binghui Wang and Neil Zhenqiang Gong. 2019. Attacking Graph-based Classification via Manipulating the Graph Structure. In CCS.","DOI":"10.1145\/3319535.3354206"},{"key":"e_1_3_2_1_38_1","doi-asserted-by":"crossref","unstructured":"Binghui Wang Jinyuan Jia Xiaoyu Cao and Neil Gong. 2021. Certified robustness of graph neural networks against adversarial structural perturbation. In KDD.","DOI":"10.1145\/3447548.3467295"},{"key":"e_1_3_2_1_39_1","doi-asserted-by":"crossref","unstructured":"Binghui Wang Youqi Li and Pan Zhou. 2022. Bandits for Structure Perturbation-based Black-box Attacks to Graph Neural Networks with Theoretical Guarantees. In CVPR.","DOI":"10.1109\/CVPR52688.2022.01302"},{"key":"e_1_3_2_1_40_1","doi-asserted-by":"crossref","unstructured":"Binghui Wang Meng Pang and Yun Dong. 2023. Turning Strengths into Weaknesses: A Certified Robustness Inspired Attack Framework against Graph Neural Networks. In CVPR.","DOI":"10.1109\/CVPR52729.2023.01573"},{"key":"e_1_3_2_1_41_1","volume-title":"Christopher Fifty, Tao Yu, and Kilian Q Weinberger.","author":"Wu Felix","year":"2019","unstructured":"Felix Wu, Tianyi Zhang, Amauri Holanda de Souza Jr, Christopher Fifty, Tao Yu, and Kilian Q Weinberger. 2019b. Simplifying graph convolutional networks. In ICML."},{"key":"e_1_3_2_1_42_1","unstructured":"Huijun Wu Chen Wang Yuriy Tyshetskiy Andrew Docherty Kai Lu and Liming Zhu. 2019a. Adversarial examples on graph data: Deep insights into attack and defense. In IJCAI."},{"key":"e_1_3_2_1_43_1","unstructured":"Zhaohan Xi Ren Pang Shouling Ji and Ting Wang. 2021. Graph backdoor. In ({USENIX} Security 21)."},{"key":"e_1_3_2_1_44_1","unstructured":"Kaidi Xu Hongge Chen Sijia Liu Pin-Yu Chen Tsui-Wei Weng Mingyi Hong and Xue Lin. 2019a. Topology attack and defense for graph neural networks: An optimization perspective. In IJCAI."},{"key":"e_1_3_2_1_45_1","unstructured":"Keyulu Xu Weihua Hu Jure Leskovec and Stefanie Jegelka. 2019b. How powerful are graph neural networks?. In ICLR."},{"key":"e_1_3_2_1_46_1","unstructured":"Keyulu Xu Chengtao Li Yonglong Tian Tomohiro Sonobe Ken-ichi Kawarabayashi and Stefanie Jegelka. 2018. Representation learning on graphs with jumping knowledge networks. In ICML."},{"key":"e_1_3_2_1_47_1","unstructured":"Muhan Zhang and Yixin Chen. 2018. Link prediction based on graph neural networks. In NeurIPS."},{"key":"e_1_3_2_1_48_1","volume-title":"Gnnguard: Defending graph neural networks against adversarial attacks. In NeurIPS.","author":"Zhang Xiang","year":"2020","unstructured":"Xiang Zhang and Marinka Zitnik. 2020. Gnnguard: Defending graph neural networks against adversarial attacks. In NeurIPS."},{"key":"e_1_3_2_1_49_1","doi-asserted-by":"crossref","unstructured":"Zaixi Zhang Jinyuan Jia Binghui Wang and Neil Zhenqiang Gong. 2021. Backdoor attacks to graph neural networks. (2021).","DOI":"10.1145\/3450569.3463560"},{"key":"e_1_3_2_1_50_1","volume-title":"NeurIPS","volume":"33","author":"Zhang Zijie","year":"2020","unstructured":"Zijie Zhang, Zeru Zhang, Yang Zhou, Yelong Shen, Ruoming Jin, and Dejing Dou. 2020. Adversarial Attacks on Deep Graph Matching. In NeurIPS, Vol. 33."},{"key":"e_1_3_2_1_51_1","unstructured":"Dingyuan Zhu Ziwei Zhang Peng Cui and Wenwu Zhu. 2019. Robust graph convolutional networks against adversarial attacks. In KDD."},{"key":"e_1_3_2_1_52_1","unstructured":"Xiaojin Zhu Zoubin Ghahramani and John D Lafferty. 2003. Semi-supervised learning using gaussian fields and harmonic functions. In ICML."},{"key":"e_1_3_2_1_53_1","doi-asserted-by":"crossref","unstructured":"Jun Zhuang and Mohammad Al Hasan. 2022. Defending Graph Convolutional Networks against Dynamic Graph Perturbations via Bayesian Self-supervision. In AAAI.","DOI":"10.1609\/aaai.v36i4.20362"},{"key":"e_1_3_2_1_54_1","doi-asserted-by":"crossref","unstructured":"Daniel Z\u00fcgner Amir Akbarnejad and Stephan G\u00fcnnemann. 2018. Adversarial attacks on neural networks for graph data. In KDD.","DOI":"10.1145\/3219819.3220078"},{"key":"e_1_3_2_1_55_1","doi-asserted-by":"crossref","unstructured":"Daniel Z\u00fcgner and Stephan G\u00fcnnemann. 2019. Adversarial attacks on graph neural networks via meta learning. In ICLR.","DOI":"10.24963\/ijcai.2019\/872"}],"event":{"name":"WSDM '24: The 17th ACM International Conference on Web Search and Data Mining","location":"Merida Mexico","acronym":"WSDM '24","sponsor":["SIGMOD ACM Special Interest Group on Management of Data","SIGWEB ACM Special Interest Group on Hypertext, Hypermedia, and Web","SIGKDD ACM Special Interest Group on Knowledge Discovery in Data","SIGIR ACM Special Interest Group on Information Retrieval"]},"container-title":["Proceedings of the 17th ACM International Conference on Web Search and Data Mining"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3616855.3635826","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3616855.3635826","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,22]],"date-time":"2025-08-22T00:54:49Z","timestamp":1755824089000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3616855.3635826"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,3,4]]},"references-count":55,"alternative-id":["10.1145\/3616855.3635826","10.1145\/3616855"],"URL":"https:\/\/doi.org\/10.1145\/3616855.3635826","relation":{},"subject":[],"published":{"date-parts":[[2024,3,4]]},"assertion":[{"value":"2024-03-04","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}