PEANUT：通过特征对齐扰动攻击图神经网络在拓扑驱动消息传递下的漏洞
PEANUT: Perturbations by Eigenvector Alignment for Attacking Graph Neural Networks Under Topology-Driven Message Passing
AI总结：
本文提出PEANUT攻击，通过注入虚拟节点利用图神经网络对拓扑结构的依赖，展示其在实际部署中的脆弱性，实验表明其有效性。
摘要：
图神经网络（GNN）在处理关系数据任务中表现出色，但微小的图结构扰动会显著改变其输出，引发对实际部署鲁棒性的担忧。本文探讨了GNN通过邻接矩阵或拉普拉斯矩阵显式消耗图拓扑的核心漏洞，并提出PEANUT，一种简单、梯度自由的受限黑盒攻击，通过注入虚拟节点利用此漏洞。PEANUT是一种注入式攻击，比直接修改图结构的攻击更具现实性和实用性，攻击在推理阶段进行，属于逃避攻击，无需长时间迭代优化或参数学习，也不需要注入节点的特征，即使注入节点特征为零也能显著降低GNN性能，凸显了有效设计的连接性在攻击中的重要性。在三个图任务的现实数据集上进行的广泛实验验证了该攻击的有效性，尽管其设计简单。
英文摘要：
Message Passing Neural Networks (MPNNs) have achieved strong performance on tasks involving relational data. However, small perturbations to graph structure can significantly alter their outputs, raising concerns about their robustness in real-world deployment in security critical environments. In this work, we study a core vulnerability in MPNNs that explicitly consume graph topology via the adjacency matrix or Laplacian as part of their message passing mechanism. We show that this design choice exposes an extremely vulnerable attack surface, with significant effects even under minimal perturbation. Building on this observation, we propose PEA, a simple, gradient-free, black-box injection attack that requires only a single query to the target model, capitalizing on this vulnerability by constructing a perturbation aligned with a specific significant eigenvector to induce large output deviations. Unlike graph modification attacks, PEA operates under the realistic assumption that adversaries cannot alter the original graph and are limited to injecting new nodes at inference time. PEA requires no iterative optimization, parameter learning, or surrogate models---which require additional training and remain susceptible to differences in model priors and generalization capabilities---thereby avoiding significant computational overhead and the associated transferability challenges. We evaluate PEA on popular benchmark datasets across three graph learning tasks, showing consistent performance degradation under realistic attack constraints despite its simplicity. Our results reveal a fundamental security weakness in topology-driven message passing architectures and urge an implementation shift, as the worst effects of such attacks can be substantially mitigated through appropriate input filtering.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
