GraphZOOM: subgraph black-box attack against inductive graph neural networks

Inductive Graph Neural Networks (GNNs) have exhibited outstanding predictive performance across applications like social network analysis and protein structure prediction by leveraging graph topology. Adversarial attack is one of the main black-box methods to verify the robustness of prediction models. The primary research objective of adversarial attacks is to construct nuanced feature perturbations that can effectively validate the prediction boundaries of the model. This paper proposes GraphZOOM, a novel black-box attack method applied in inductive GNNs. GraphZOOM uses zero-order optimization to solve the two problems of node selection and feature perturbation against attacks in GNNs, and constructs a perturbed subgraph on a target node to realize an attack mode. The adversarial attack algorithm is evaluated in terms of perturbation accuracy and feature similarity. GraphZOOM can substantially degrade the model’s predictive performance with minimal alterations to the graph.