Abstract
Graph neural networks (GNNs) have shown broad applicability in a variety ofdomains. These domains, e.g., social networks and product recommendations, arefertile ground for malicious users and behavior. In this paper, we show thatGNNs are vulnerable to the extremely limited (and thus quite realistic)scenarios of a single-node adversarial attack, where the perturbed node cannotbe chosen by the attacker. That is, an attacker can force the GNN to classifyany target node to a chosen label, by only slightly perturbing the features orthe neighbor list of another single arbitrary node in the graph, even when notbeing able to select that specific attacker node. When the adversary is allowedto select the attacker node, these attacks are even more effective. Wedemonstrate empirically that our attack is effective across various common GNNtypes (e.g., GCN, GraphSAGE, GAT, GIN) and robustly optimized GNNs (e.g.,Robust GCN, SM GCN, GAL, LAT-GCN), outperforming previous attacks acrossdifferent real-world datasets both in a targeted and non-targeted attacks. Ourcode is available at https://github.com/benfinkelshtein/SINGLE .