With the success of the graph embedding model in both academic and industry areas, the robustness of graph embedding against adversarial attack inevitably becomes a crucial problem in graph learning. Existing works usually perform the attack in a white-box fashion: they need to access the predictions/labels to construct their adversarial loss. However, the inaccessibility of predictions/labels makes the white-box attack impractical to a real graph learning system. This paper promotes current frameworks in a more general and flexible sense -- we demand to attack various kinds of graph embedding models with black-box driven. We investigate the theoretical connections between graph signal processing and graph embedding models and formulate the graph embedding model as a general graph signal process with a corresponding graph filter. Therefore, we design a generalized adversarial attacker: GF-Attack. Without accessing any labels and model predictions, GF-Attack can perform the attack directly on the graph filter in a black-box fashion. We further prove that GF-Attack can perform an effective attack without knowing the number of layers of graph embedding models. To validate the generalization of GF-Attack, we construct the attacker on four popular graph embedding models. Extensive experiments validate the effectiveness of GF-Attack on several benchmark datasets.

本文提出了一种黑盒驱动下的广义对抗攻击器GF-Attack，它可以直接攻击图滤波器，而不需要访问标签或模型预测。作者通过将图嵌入模型形式化为具有相应图滤波器的一般图信号过程来探究图信号处理与图嵌入模型之间的理论联系，并证明GF-Attack可以在不知道图嵌入模型层数的情况下执行有效的攻击。作者在四种流行的图嵌入模型上构建攻击器，并在多个基准数据集上进行了广泛的实验证明了GF-Attack的有效性。

基于有限知识的图嵌入模型对抗攻击框架