Entropy-Driven Black-box Transferable Adversarial Attack Method for Graph Neural Networks

WU Tao; JI Qionghui; XIAN Xingping; QIAO Shaojie; WANG Chao; CUI Canyixing

doi:10.11999/JEIT250303

Article Contents

Article Navigation > Journal of Electronics & Information Technology > 2025 >

WU Tao, JI Qionghui, XIAN Xingping, QIAO Shaojie, WANG Chao, CUI Canyixing. Entropy-Driven Black-box Transferable Adversarial Attack Method for Graph Neural Networks[J]. Journal of Electronics & Information Technology. doi: 10.11999/JEIT250303

Citation:

WU Tao, JI Qionghui, XIAN Xingping, QIAO Shaojie, WANG Chao, CUI Canyixing. Entropy-Driven Black-box Transferable Adversarial Attack Method for Graph Neural Networks[J]. Journal of Electronics & Information Technology. doi: 10.11999/JEIT250303

Citation:

PDF( 3524 KB)

Entropy-Driven Black-box Transferable Adversarial Attack Method for Graph Neural Networks

doi: 10.11999/JEIT250303 cstr: 32379.14.JEIT250303

1.
School of Cyber Security and Information Law, Chongqing University of Posts and Telecommunications, Chongqing 400065, China
2.
School of Software Engineering, Chengdu University of Information Technology, Chengdu 610225, China
3.
School of Computer and Information Science, Chongqing Normal University, Chongqing 401331, China

Funds: The National Natural Science Foundation of China (62376047, 62106030), Key Project of Innovation and Development Fund of Chongqing Natural Science Foundation (CSTB2023NSCQ-LZX0003), Key Project of Science and Technology Program of Chongqing Education Commission (KJZD-K202300603, KJZD-K202500604)

Received Date: 2025-04-25
Rev Recd Date: 2025-09-10

Available Online: 2025-09-16

Abstract

Abstract

Objective Graph Neural Networks (GNNs) achieve state-of-the-art performance in modeling complex graph-structured data and are increasingly applied in diverse domains. However, their vulnerability to adversarial attacks raises significant concerns for deployment in security-critical applications. Understanding and improving GNN robustness under adversarial conditions is therefore crucial to ensuring safe and reliable use. Among adversarial strategies, transfer-based black-box attacks have attracted considerable attention. Yet existing approaches face inherent limitations. First, they rely heavily on gradient information derived from surrogate models, while insufficiently exploiting critical structural cues embedded in graphs. This reliance often leads to overfitting to the surrogate, thereby reducing the transferability of adversarial samples. Second, most methods adopt a global perspective in perturbation selection, which hinders their ability to identify local substructures that decisively influence model predictions, ultimately resulting in suboptimal attack efficiency. Methods Motivated by the intrinsic structural characteristics of graph data, the latent association between information entropy and node vulnerability is investigated, and an entropy-guided adversarial attack framework is proposed. For homogeneous GNNs, a transferable black-box attack method, termed NEAttack, is designed. This method exploits node entropy to capture the structural complexity of node-level neighborhood subgraphs. By measuring neighborhood entropy, reliance on surrogate model gradients is reduced and perturbation selection is made more efficient. Based on this framework, the approach is further extended to heterogeneous graphs, leading to the development of GEHAttack, an entropy-based adversarial method that employs graph-level entropy to account for the semantic and relational diversity inherent in heterogeneous graph data. Results and Discussions The effectiveness and generalizability of the proposed methods are evaluated through extensive experiments on multiple datasets and model architectures. For homogeneous GNNs, NEAttack is assessed against six representative baselines on four datasets (Cora, CoraML, Citeseer, and PubMed) and three GNN models (Graph Convolutional Network (GCN), Graph Attention Network (GAT), Simplified Graph Convolution (SGC)). As reported in (Table 3) and (Table 4), NEAttack consistently outperforms existing approaches. In terms of accuracy, average improvements of 10.25%, 17.89%, 6.68%, and 12.6% are achieved on Cora, CoraML, Citeseer, and PubMed, respectively. For the F1-score, the corresponding gains are 9.41%, 16.83%, 6.21%, and 17.24%. Random Attack and Delete Internal, Connect External (DICE), which rely on randomness, exhibit stable but weak transferability, leading to only minor reductions in model performance. Meta-Self and Projected Gradient Descent (PGD) generate effective adversarial samples in white-box scenarios but show poor transfer performance due to overfitting to surrogate models. AtkSE and GraD perform better but remain affected by overfitting, while their computational cost increases sharply with data scale. For heterogeneous GNNs, GEHAttack is compared with four baselines on three datasets (ACM, IMDB, and DBLP) and six Heterogeneous Graph Neural Network (HGNN) models (Heterogeneous Graph Attention Network (HAN), Heterogeneous Graph Transformer (HGT), Simple Heterogeneous Graph Neural Network (SimpleHGN), Relational Graph Convolutional Network (RGCN), Robust Heterogeneous (RoHe), and Fast Robust Heterogeneous Graph Convolutional Network (FastRo-HGCN)). As shown in (Table 5 and Table 6), GEHAttack exhibits clear advantages. On the ACM dataset, compared with the HG Baseline, GEHAttack improves the average Micro-F1 and Macro-F1 scores of HAN, HGT, SimpleHGN, and RGCN by 3.93% and 3.46%, respectively. On the more robust RoHe and FastRo models, the corresponding improvements are 2.75% and 1.65%. Similar improvements are also observed on the IMDB and DBLP datasets, confirming the robustness and transferability of GEHAttack. Conclusions This study presents a unified entropy-oriented adversarial attack framework for both homogeneous and heterogeneous GNNs in black-box transfer settings. By leveraging the relationship between entropy and structural vulnerability, the proposed NEAttack and GEHAttack methods address the key limitations of gradient-dependent approaches and enable more efficient perturbation generation. Extensive evaluations across diverse datasets and models demonstrate their superiority in both performance and adaptability, providing new insights into advancing adversarial robustness research on graph-structured data.
- Graph Neural Networks (GNNs),
- Adversarial attacks,
- Black-box attacks,
- Information entropy,
- Model robustness

FullText(HTML)

References(34)

References

[1]	吴涛, 曹新汶, 先兴平, 等. 图神经网络对抗攻击与鲁棒性评测前沿进展[J]. 计算机科学与探索, 2024, 18(8): 1935–1959. doi: 10.3778/j.issn.1673-9418.2311117. WU Tao, CAO Xinwen, XIAN Xingping, et al. Advances of adversarial attacks and robustness evaluation for graph neural networks[J]. Journal of Frontiers of Computer Science & Technology, 2024, 18(8): 1935–1959. doi: 10.3778/j.issn.1673-9418.2311117.
[2]	MU Jiaming, WANG Binghui, LI Qi, et al. A hard label black-box adversarial attack against graph neural networks[C]. Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, Virtual Event, 2021: 108–125. doi: 10.1145/3460120.3484796. (查阅网上资料,未找到本条文献出版地信息,请确认).
[3]	ZÜGNER D, AKBARNEJAD A, and GÜNNEMANN S. Adversarial attacks on neural networks for graph data[C]. Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, London, UK, 2018: 2847–2856. doi: 10.1145/3219819.3220078.
[4]	ZÜGNER D and GÜNNEMANN S. Adversarial attacks on graph neural networks via meta learning[C]. 7th International Conference on Learning Representations, New Orleans, USA, 2019.
[5]	SHANG Yu, ZHANG Yudong, CHEN Jiansheng, et al. Transferable structure-based adversarial attack of heterogeneous graph neural network[C]. Proceedings of the 32nd ACM International Conference on Information and Knowledge Management, Birmingham, UK, 2023: 2188–2197. doi: 10.1145/3583780.3615095.
[6]	XU Kaidi, CHEN Hongge, LIU Sijia, et al. Topology attack and defense for graph neural networks: An optimization perspective[C]. Proceedings of the 28th International Joint Conference on Artificial Intelligence, Macao, China, 2019: 3961–3967. doi: 10.24963/ijcai.2019/550.
[7]	ZHANG Jianping, WU Weibin, HUANG J T, et al. Improving adversarial transferability via neuron attribution-based attacks[C]. Proceedings of the 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition, New Orleans, USA, 2022: 14973–14982. doi: 10.1109/CVPR52688.2022.01457.
[8]	WU Jun, TAN Yuejin, DENG Hongzhong, et al. Heterogeneity of scale-free networks[J]. Systems Engineering-Theory & Practice, 2007, 27(5): 101–105. doi: 10.1016/S1874-8651(08)60036-8.
[9]	WANG Bing, TANG Huanwen, GUO Chonghui, et al. Entropy optimization of scale-free networks’ robustness to random failures[J]. Physica A: Statistical Mechanics and its Applications, 2006, 363(2): 591–596. doi: 10.1016/j.physa.2005.08.025.
[10]	蔡萌, 杜海峰, 费尔德曼. 一种基于最大流的网络结构熵[J]. 物理学报, 2014, 63(6): 060504. doi: 10.7498/aps.63.060504. CAI Meng, DU Haifeng, and FELDMAN M W. A new network structure entropy based on maximum flow[J]. Acta Physica Sinica, 2014, 63(6): 060504. doi: 10.7498/aps.63.060504.
[11]	黄丽亚, 霍宥良, 王青, 等. 基于K-阶结构熵的网络异构性研究[J]. 物理学报, 2019, 68(1): 018901. doi: 10.7498/aps.68.20181388. HUANG Liya, HUO Youliang, WANG Qing, et al. Network heterogeneity based on K-order structure entropy[J]. Acta Physica Sinica, 2019, 68(1): 018901. doi: 10.7498/aps.68.20181388.
[12]	CARLINI N and WAGNER D. Towards evaluating the robustness of neural networks[C]. 2017 IEEE Symposium on Security and Privacy, San Jose, USA, 2017: 39–57. doi: 10.1109/SP.2017.49.
[13]	WU Tao, YANG Nan, CHEN Long, et al. ERGCN: Data enhancement-based robust graph convolutional network against adversarial attacks[J]. Information Sciences, 2022, 617: 234–253. doi: 10.1016/j.ins.2022.10.115.
[14]	MCCALLUM A K, NIGAM K, RENNIE J, et al. Automating the construction of internet portals with machine learning[J]. Information Retrieval, 2000, 3(2): 127–163. doi: 10.1023/A:1009953814988.
[15]	GILES C L, BOLLACKER K D, and LAWRENCE S. CiteSeer: An automatic citation indexing system[C]. Proceedings of the Third ACM Conference on Digital Libraries, Pittsburgh, USA, 1998: 89–98. doi: 10.1145/276675.276685.
[16]	SEN P, NAMATA G, BILGIC M, et al. Collective classification in network data[J]. AI Magazine, 2008, 29(3): 93–106. doi: 10.1609/aimag.v29i3.2157.
[17]	WANG Xiao, LIU Nian, HAN Hui, et al. Self-supervised heterogeneous graph neural network with co-contrastive learning[C]. Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining, Virtual Event, Singapore, 2021: 1726–1736. doi: 10.1145/3447548.3467415. (查阅网上资料,未找到本条文献出版地信息,请确认).
[18]	FU Xinyu, ZHANG Jiani, MENG Ziqiao, et al. MAGNN: Metapath aggregated graph neural network for heterogeneous graph embedding[C]. Proceedings of The Web Conference 2020, Taipei, China, 2020: 2331–2341. doi: 10.1145/3366423.3380297.
[19]	HAN Hui, ZHAO Tianyu, YANG Cheng, et al. OpenHGNN: An open source toolkit for heterogeneous graph neural network[C]. Proceedings of the 31st ACM International Conference on Information & Knowledge Management, Atlanta, USA, 2022: 3993–3997. doi: 10.1145/3511808.3557664.
[20]	MALIK H A M, ABID F, WAHIDDIN M R, et al. Robustness of dengue complex network under targeted versus random attack[J]. Complexity, 2017, 2017(1): 2515928. doi: 10.1155/2017/2515928.
[21]	WANIEK M, MICHALAK T P, WOOLDRIDGE M J, et al. Hiding individuals and communities in a social network[J]. Nature Human Behaviour, 2018, 2(2): 139–147. doi: 10.1038/s41562-017-0290-3.
[22]	LIU Zihan, LUO Yun, WU Lirong, et al. Are gradients on graph structure reliable in gray-box attacks?[C]. Proceedings of the 31st ACM International Conference on Information & Knowledge Management, Atlanta, USA, 2022: 1360–1368. doi: 10.1145/3511808.3557238.
[23]	LIU Zihan, LUO Yun, WU Lirong, et al. Towards reasonable budget allocation in untargeted graph structure attacks via gradient debias[C]. Proceedings of the 36th International Conference on Neural Information Processing Systems, New Orleans, USA, 2022: 2028.
[24]	ZHANG Mengmei, WANG Xiao, ZHU Meiqi, et al. Robust heterogeneous graph neural networks against adversarial attacks[C]. Proceedings of the 36th AAAI Conference on Artificial Intelligence, Virtual Event, 2022: 4363–4370. doi: 10.1609/aaai.v36i4.20357. (查阅网上资料,未找到本条文献出版地信息,请确认).
[25]	ZHANG Sixiao, CHEN Hongxu, SUN Xiangguo, et al. Unsupervised graph poisoning attack via contrastive loss back-propagation[C]. Proceedings of the ACM Web Conference 2022, Virtual Event, France, 2022: 1322–1330. doi: 10.1145/3485447.3512179. (查阅网上资料,未找到本条文献出版地信息,请确认).
[26]	WANG Haosen, XU Can, SHI Chenglong, et al. Unsupervised heterogeneous graph rewriting attack via node clustering[C]. Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, Barcelona, Spain, 2024: 3057–3068. doi: 10.1145/3637528.3671716.
[27]	KIPF T N and WELLING M. Semi-supervised classification with graph convolutional networks[C]. 5th International Conference on Learning Representations, Toulon, France, 2017.
[28]	VELIČKOVIĆ P, CUCURULL G, CASANOVA A, et al. Graph attention networks[J]. arXiv preprint arXiv: 1710.10903, 2017. doi: 10.48550/arXiv.1710.10903. (查阅网上资料,请作者核对文献类型及格式是否正确).
[29]	WU F, SOUZA A, ZHANG Tianyi, et al. Simplifying graph convolutional networks[C]. Proceedings of the 36th International Conference on Machine Learning, Long Beach, USA, 2019: 6861–6871.
[30]	WANG Xiao, JI Houye, SHI Chuan, et al. Heterogeneous graph attention network[C]. The World Wide Web Conference, San Francisco, USA, 2019: 2022–2032. doi: 10.1145/3308558.3313562.
[31]	HU Ziniu, DONG Yuxiao, WANG Kuansan, et al. Heterogeneous graph transformer[C]. Proceedings of The Web Conference 2020, Taipei, China, 2020: 2704–2710. doi: 10.1145/3366423.3380027.
[32]	LV Qingsong, DING Ming, LIU Qiang, et al. Are we really making much progress? Revisiting, benchmarking and refining heterogeneous graph neural networks[C]. Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining, Singapore, Singapore, 2021: 1150–1160. doi: 10.1145/3447548.3467350.
[33]	SCHLICHTKRULL M, KIPF T N, BLOEM P, et al. Modeling relational data with graph convolutional networks[C]. 15th International Conference on The Semantic Web, Heraklion, Greece, 2018: 593–607. doi: 10.1007/978-3-319-93417-4_38.
[34]	YAN Yeyu, ZHAO Zhongying, YANG Zhan, et al. A fast and robust attention-free heterogeneous graph convolutional network[J]. IEEE Transactions on Big Data, 2024, 10(5): 669–681. doi: 10.1109/TBDATA.2024.3375152.