Enhanced targeted attacks on Graph Neural Networks via Average Gradient and Perturbation Optimization

Graph Neural Networks (GNNs) are vulnerable to adversarial attacks that cause performance degradation by adding small perturbations to the graph. Gradient-based attacks are among the most widely used methods and have demonstrated strong performance across various attack scenarios. However, most gradient attacks use greedy strategies to generate perturbations, which tend to fall into local optima, leading to underperformance of the attack. To address the above problem, we propose an attack (Average Gradient and Perturbation Optimization Attack, AGPOA) on GNNs, which consists of an average gradient calculation and a perturbation optimization module. In the average gradient calculation module, we compute the average of the gradient information over all moments to guide the attack to generate perturbed edges, which stabilizes the direction of the attack update and gets rid of undesirable local maxima. We use a perturbation optimization module to limit the attack budget and further improve performance. Furthermore, we demonstrate the theoretical superiority of AGPOA over traditional gradient-based attack methods through attack loss variance. The experimental results show that AGPOA improves the misclassification rate by 2%–8% compared to other state-of-the-art models in the node classification task.