• ⚔ Attack
  • 2020
  • 2019
  • 2018
  • 2017
• Taxonomies of Attack
• 🛡 Defense
  • 2020
  • 2019
  • 2018
  • 2017
• 🔐 Robustness Certification
• 🚀 Others
• 📃 Survey
• 🔗 Resource
• ⚙ Toolbox

This repository contains 61 Attack-related papers, 66 Defense-related papers, 12 Robustness Certification papers, 2 Other papers, 4 Surveys, ranging from 2017 to 2020. All papers are available for download from Latest Release.

If you find this repository useful, please cite: A Survey of Adversarial Learning on Graph, Arxiv'20, 📝Paper

@article{chen2020survey,
  title={A Survey of Adversarial Learning on Graph},
  author={Chen, Liang and Li, Jintang and Peng, Jiaying and Xie, Tao and Cao, Zengxu and Xu, Kun and He, Xiangnan and Zheng, Zibin},
  journal={arXiv preprint arXiv:2003.05730},
  year={2020}
}

📝61 papers in total

💨 Back to Top

📝34 papers in total

Adversarial Attack on Community Detection by Hiding Individuals 📝WWW Code

Model	CD-ATTACK	Algorithm	Graph generation
Surrogate	GCN	Target Task	Community Detection
Target Model	GCN, Node2vec + K-means, ComE	Baseline	DICE, MBA, RTA
Metric	Hiding performance measure M1 & M2	Dataset	DBLP, Finance

A Restricted Black-box Adversarial Framework Towards Attacking Graph Embedding Models 📝AAAI Code

Model	GF-Attack	Algorithm	Graph signal processing
Surrogate		Target Task	Node Classification
Target Model	GCN, SGC, DeepWalk, LINE	Baseline	Random, Degree, RL-S2V,
Metric	Accuracy	Dataset	Cora, CiteSeer, Pubmed

Graph Universal Adversarial Attacks: A Few Bad Actors Ruin Graph Learning Models 📝Arxiv Code

Model	GUA	Algorithm	Gradient
Surrogate	GCN	Target Task	Node Classification
Target Model	GCN, DeepWalk, Node2Vec, GAT	Baseline	Random, VCA, FGA
Metric	ASR, AML	Dataset	Cora, CiteSeer, Polblogs

Network disruption: maximizing disagreement and polarization in social networks 📝Arxiv Code

Model	Greedy et al.	Algorithm	Greedy algorithm et al.
Surrogate	Friedkin-Johnsen model	Target Task	Network Disruption
Target Model	Friedkin-Johnsen model	Baseline
Metric	Disagreement, Polarization	Dataset	Synthetic networks, Reddit, Twitter

Adversarial Attack on Large Scale Graph 📝Arxiv Code

Model	SGA	Algorithm	Gradient
Surrogate	SGC	Target Task	Node Classification
Target Model	GCN, SGC, GAT, ClusterGCN, GraphSAGE	Baseline	GradArgmax, Nettack
Metric	DAC, Accuracy, Classification Margin	Dataset	Cora, CiteSeer, Pubmed, Reddit

📝17 papers in total

A Unified Framework for Data Poisoning Attack to Graph-based Semi-supervised Learning 📝NeurIPS Code

Model	G-SSL	Algorithm	Gradient based asymptotic linear algorithm
Surrogate		Target Task	Classification, Regression
Target Model	Label propagation & regularization algs	Baseline	Random, PageRank, Degree
Metric	Error rate, RMSE	Dataset	cadata, E2006, mnist17, rcv1

Adversarial Examples on Graph Data: Deep Insights into Attack and Defense 📝IJCAI Code

Model	IG-FGSM, IG-JSMA	Algorithm	Gradient
Surrogate	GCN	Target Task	Node Classification
Target Model	GCN	Baseline	FGSM, JSMA, Nettack
Metric	Classification Margin, Accuracy	Dataset	Cora, CiteSeer, PolBlogs

Topology Attack and Defense for Graph Neural Networks: An Optimization Perspective 📝IJCAI Code

Model	PGD, Min-Max	Algorithm	Gradient
Surrogate	GCN	Target Task	Node Classification
Target Model	GCN	Baseline	DICE, Metattack, Greedy
Metric	Misclassification Rate	Dataset	Cora, CiteSeer

Adversarial Attacks on Graph Neural Networks via Meta Learning 📝ICLR Code

Model	Metattack	Algorithm	Gradient
Surrogate	GCN	Target Task	Node Classification
Target Model	GCN, CLN, DeepWalk	Baseline	DICE, Nettack, First-order
Metric	Misclassification Rate, Accuracy	Dataset	Cora, CiteSeer, PolBlogs, PubMed

Adversarial Attacks on Node Embeddings via Graph Poisoning 📝ICML Code

Model		Algorithm	Gradient & Eigen-perturbation
Surrogate	DeepWalk	Target Task	Node Classification, Link Prediction
Target Model	DeepWalk	Baseline
Metric	F1 Score, Classification Margin	Dataset	Cora, CiteSeer, PolBlogs

Multiscale Evolutionary Perturbation Attack on Community Detection 📝Arxiv

Model	EPA	Algorithm	Genetic algorithm
Surrogate		Target Task	Community Detection
Target Model	GRE, INF, LOU	Baseline	,
Metric	NMI, ARI	Dataset	Synthetic networks, Football, Email, Polblogs

PeerNets Exploiting Peer Wisdom Against Adversarial Attacks 📝ICLR (Poster) Code

📝8 papers in total

Adversarial Attack on Graph Structured Data 📝ICML Code

Model	RL-S2V, GradArgmax, GeneticAlg	Algorithm	Reinforcement learning, Gradient, Genetic algorithm
Surrogate	GCN	Target Task	Node Classification, Graph Classification
Target Model	GCN, GNN	Baseline	Random
Metric	Accuracy	Dataset	Cora, CiteSeer, PolBlogs, Finance

Adversarial Attacks on Neural Networks for Graph Data 📝KDD Code

Model	Nettack	Algorithm	Greedy search & gradient
Surrogate	GCN	Target Task	Node Classification
Target Model	GCN, CLN, DeepWalk	Baseline	Rnd, FGSM
Metric	Classification Margin, Accuracy	Dataset	Cora-ML, CiteSeer, PolBlogs

📝2 papers in total

Adversarial Sets for Regularising Neural Link Predictors 📝UAI Code

💨 Back to Top

📝66 papers in total

💨 Back to Top

📝41 papers in total

Transferring Robustness for Graph Neural Network Against Poisoning Attacks 📝WSDM Code

Model	PA-GNN	Algorithm	Penalized Aggregation, Meta Learning
Defense Type	Structure Based	Target Task	Node Classification
Target Model	GNN	Baseline	GCN, GAT, GCN-Jaccard, RGCN, VPN
Metric	Accuracy	Dataset	Pubmed, Reddit, Yelp

Power up! Robust Graph Convolutional Network against Evasion Attacks based on Graph Powering 📝ICLR OpenReview Code

Model	r-GCN, VPN	Algorithm	Graph Powering
Defense Type	Objective Based	Target Task	Node Classification
Target Model	GCN	Baseline	ManiReg, SemiEmb, LP, DeepWalk, ICA, Planetoid, GCN
Metric	Accuracy, Robustness Merit, Attack Deterioration	Dataset	CiteSeer, Cora, Pubmed

All You Need Is Low (Rank): Defending Against Adversarial Attacks on Graphs 📝WSDM Code

Model	GCN-SVD	Algorithm	SVD
Defense Type	Preprocessing	Target Task	Node Classification
Target Model	GCN	Baseline	GCN
Metric	Accuracy, Classification Margin	Dataset	CiteSeer, Cora-ML, PolBlogs

Robust Detection of Adaptive Spammers by Nash Reinforcement Learning 📝KDD Code

Model	Nash-Detect	Algorithm	A minimax game
Defense Type	Detection Based	Target Task	Spam Detection
Target Model		Baseline	Spam Detector
Metric	Practical Effect, Accuracy	Dataset	YelpChi, YelpNYC, YelpZip

Graph Structure Learning for Robust Graph Neural Networks 📝KDD Code

Model	Pro-GNN	Algorithm	Learns the graph structure and the GNN parameters simultaneously
Defense Type	Hybrid	Target Task	Node Classification
Target Model	GCN	Baseline	GAT, GCN-Jaccard, GCN-SVD
Metric	Accuracy	Dataset	Cora, CiteSeer, Polblogs, Pubmed

On The Stability of Polynomial Spectral Graph Filters 📝ICASSP Code

Model		Algorithm	Polynomial graph filters
Defense Type	Structure Based	Target Task	Graph signal processing
Target Model	GNN	Baseline
Metric	Laplacian distance	Dataset	Barabási-Albert, Sensor network

Transferring Robustness for Graph Neural Network Against Poisoning Attacks 📝WSDM Code

Model	PA-GNN	Algorithm	Penalized Aggregation, Meta Learning
Defense Type	Structure Based	Target Task	Node Classification
Target Model	GNN	Baseline	GCN, GAT, GCN-Jaccard, RGCN, VPN
Metric	Accuracy	Dataset	Pubmed, Reddit, Yelp

On the Robustness of Cascade Diffusion under Node Attacks 📝WWW Code

Model		Algorithm	SEMR
Defense Type		Target Task	Cascade Diffusion
Target Model	IC Model	Baseline	NetShield
Metric	EMR, RNI, RIM	Dataset	Blogs, Minnesota, VK, Advogato, DBLP, BrightKite, ...

Robust Training of Graph Convolutional Networks via Latent Perturbation 📝ECML-PKDD Code

Model	LAT-GCN	Algorithm	Perturbing latent representations
Defense Type	Structure Based	Target Task	Node Classification, Link prediction, Recommendation
Target Model	GCN	Baseline	GCN, ADV-GCN, MIN-MAX GCN, ...
Metric	CPU time, Accuracy, AUC, AP	Dataset	CiteSeer, Cora, PubMed, MovieLens 100k

Enhancing Graph Neural Network-based Fraud Detectors against Camouflaged Fraudsters 📝CIKM Code

Model	CARE-GNN	Algorithm	Reinforcement Learning
Defense Type	Hybrid	Target Task
Target Model	GCN, GAT, RGCN, GraphSAGE	Baseline	GeniePath, Player2Vec, SemiGNN, GraphConsis
Metric	AUC, Recall	Dataset	Yelp, Amazon

DefenseVGAE: Defending against Adversarial Attacks on Graph Data via a Variational Graph Autoencoder 📝Arxiv Code

Model	DefenceVGAE	Algorithm	VGAE
Defense Type	Processing-based	Target Task	Node Classification
Target Model	GCN	Baseline	GCN-Jaccard, GCN-SVD, RGCN
Metric	Accuracy	Dataset	Cora, CiteSeer, PolBlogs

Adversarial Privacy Preserving Graph Embedding against Inference Attack 📝Arxiv Code

Model	APDGE	Algorithm	Adversarial Privacy-Purged
Defense Type	Structure-based	Target Task	Privacy Protection
Target Model	GAE	Baseline	GAE RM, CDSPIA
Metric	Macro F1	Dataset	Yale, Rochester

Iterative Deep Graph Learning for Graph Neural Networks: Better and Robust Node Embeddings 📝NeurIPS Code

Graph Adversarial Networks: Protecting Information against Adversarial Attacks 📝ICLR OpenReview Code

Graph Random Neural Networks for Semi-Supervised Learning on Graphs 📝NeurIPS Code

📝23 papers in total

Topology Attack and Defense for Graph Neural Networks: An Optimization Perspective 📝IJCAI Code

Model		Algorithm	Adversarial Training
Defense Type	Adversarial Training	Target Task	Node Classification
Target Model	GCN	Baseline	GCN
Metric	Misclassification Rate, Accuracy	Dataset	Cora, CiteSeer

Adversarial Examples on Graph Data: Deep Insights into Attack and Defense 📝IJCAI Code

Model	GCN-Jaccard	Algorithm	Drop Edges
Defense Type	Preprocessing	Target Task	Node Classification
Target Model	GCN	Baseline	GCN
Metric	Classification Margin, Accuracy	Dataset	Cora-ML, CiteSeer, PolBlogs

Investigating Robustness and Interpretability of Link Prediction via Adversarial Modifications 📝NAACL Code

Model	CRIAGE	Algorithm	Adversarial Modification
Defense Type	Robustness Evaluation	Target Task	Link Prediction
Target Model	Knowledge Graph Embedding	Baseline
Metric	Hits@K, MRR	Dataset	Nations, Kinship, WN18, YAGO3-10

Robust Graph Convolutional Networks Against Adversarial Attacks 📝KDD Code

Model	RGCN	Algorithm	Gaussian-based Graph Convolution and Attention Mechanism
Defense Type	Structure Based	Target Task	Node Classification
Target Model	GCN	Baseline	GCN, GAT
Metric	Accuracy	Dataset	Cora, CiteSeer, Pubmed

Characterizing Malicious Edges targeting on Graph Neural Networks 📝ICLR OpenReview Code

Model	SL, OD, GGD, LP+GGD, ENS	Algorithm	Link Prediction, Subsampling, Neighbour Analysis
Defense Type	Hybrid	Target Task	Node Classification
Target Model	GNN, GCN	Baseline	LP
Metric	AUC	Dataset	Cora, CiteSeer

Batch Virtual Adversarial Training for Graph Convolutional Networks 📝ICML Code

Model	S-BVAT, O-BVAT	Algorithm	atch Virtual Adversarial Training
Defense Type	Adversarial Training	Target Task	Node Classification
Target Model	GCN	Baseline	LP, DeepWalk, GAT, GPNN, GCN, VAT, ...
Metric	Accuracy	Dataset	Cora, CiteSeer, Pubmed, Nell

Graph Adversarial Training: Dynamically Regularizing Based on Graph Structure 📝TKDE Code

Model	GCN-GATV	Algorithm	raph Adversarial Training, Virtual Adversarial Training
Defense Type	Adversarial Training	Target Task	Node Classification
Target Model	GCN	Baseline	LP, DeepWalk, SemiEmb, Planetoid, GCN, GraphSGAN
Metric	Accuracy	Dataset	Cora, CiteSeer, NELL

Adversarial Training Methods for Network Embedding 📝WWW Code

Model	AdvT4NE	Algorithm	Adversarial Training
Defense Type	Adversarial Training	Target Task	Network embedding
Target Model	Deepwalk	Baseline	GF,DeepWalk, LINE,Node2vec, ...
Metric	Accuracy	Dataset	Cora, CiteSeer, Wiki, CA-GrQc, CA-HepTh

📝1 papers in total

Adversarial Personalized Ranking for Recommendation 📝SIGIR Code

Model	APR, AMF	Algorithm	Adversarial Training based on MF-BPR
Defense Type	Adversarial Training	Target Task	Recommendation
Target Model	MF-BPR	Baseline	ItemPop, MF-BPR, CDAE, NeuMF, IRGAN
Metric	HR, NDCG	Dataset	Yelp, Pinterest, Gowalla

📝1 papers in total

Adversarial Sets for Regularising Neural Link Predictors 📝UAI Code

📝12 papers in total

💨 Back to Top

Efficient Robustness Certificates for Discrete Data: Sparsity - Aware Randomized Smoothing for Graphs, Images and More 📝ICML'20 Code

Certifiable Robustness of Graph Convolutional Networks under Structure Perturbation 📝NeurIPS Code

Certifiable Robustness and Robust Training for Graph Convolutional Networks 📝KDD'19 Code

Certifiable Robustness to Graph Perturbations 📝NeurIPS'19 Code

📝2 papers in total

💨 Back to Top

FLAG: Adversarial Data Augmentation for Graph Neural Networks 📝Arxiv'20 Code

📝4 papers in total

💨 Back to Top

💨 Back to Top

• Awesome Adversarial Learning on Recommender System Link
• Awesome Graph Attack and Defense Papers Link
• Graph Adversarial Learning Literature Link
• A Complete List of All (arXiv) Adversarial Example Papers 🌐Link
• Adversarial Attacks and Defenses Frontiers, Advances and Practice, KDD'20 tutorial, 🌐Link

💨 Back to Top

• DeepRobust Link: A PyTorch adversarial library for attack and defense methods on images and graphs.
• GraphAdv Link: A TensorFlow-based library for adversarial attacks and defense methods on graph.
• GraphGallery Link: A PyTorch and TensorFlow library for geometric graph (adversarial) learning.