Unveiling the Threat of Fraud Gangs to Graph Neural Networks: Multi-Target Graph Injection Attacks Against GNN-Based Fraud Detectors

TL;DR

This work reveals vulnerabilities of GNN-based fraud detectors to coordinated, gang-level evasion. It introduces MonTi, a transformer-based, one-shot graph-injection attack that jointly generates attack-node attributes and edges while adaptively allocating budgets across targets, candidates, and attack nodes. Across five real-world graphs and multiple victim-surrogate pairings, MonTi achieves superior multi-target misclassification rates and demonstrates efficiency advantages over prior baselines. The results underscore the practical risk of organized fraud groups and motivate defenses such as community-aware robust training and extended adversarial defenses for fraud detectors.

Abstract

Graph neural networks (GNNs) have emerged as an effective tool for fraud detection, identifying fraudulent users, and uncovering malicious behaviors. However, attacks against GNN-based fraud detectors and their risks have rarely been studied, thereby leaving potential threats unaddressed. Recent findings suggest that frauds are increasingly organized as gangs or groups. In this work, we design attack scenarios where fraud gangs aim to make their fraud nodes misclassified as benign by camouflaging their illicit activities in collusion. Based on these scenarios, we study adversarial attacks against GNN-based fraud detectors by simulating attacks of fraud gangs in three real-world fraud cases: spam reviews, fake news, and medical insurance frauds. We define these attacks as multi-target graph injection attacks and propose MonTi, a transformer-based Multi-target one-Time graph injection attack model. MonTi simultaneously generates attributes and edges of all attack nodes with a transformer encoder, capturing interdependencies between attributes and edges more effectively than most existing graph injection attack methods that generate these elements sequentially. Additionally, MonTi adaptively allocates the degree budget for each attack node to explore diverse injection structures involving target, candidate, and attack nodes, unlike existing methods that fix the degree budget across all attack nodes. Experiments show that MonTi outperforms the state-of-the-art graph injection attack methods on five real-world graphs.

Figures (5)

• Figure 1: An example of a multi-target graph injection attack against a GNN-based fraud detector: a fraud gang injects attack nodes to induce misclassification of their fraud nodes.
• Figure 2: Overview of MonTi. Given the original graph and the target set, MonTi selects candidate nodes among $K$-hop neighbors of target nodes utilizing a learnable scoring function. Then, MonTi calculates the intermediate node representations of target, candidate, and attack nodes by the adversarial structure encoding transformer. Based on those intermediate representations, adversarial attributes and edges for injection are simultaneously generated.
• Figure 3: The t-SNE visualization of the changes in the latent representations of target nodes computed by GAGA on GossipCop-S, incurred by G-NIA (Left) and MonTi (Right).
• Figure 4: Multi-target attack performance of MonTi on GossipCop-S using GCN as the surrogate model with varying node (Left) and edge budgets (Right).
• Figure 5: The t-SNE visualization of the changes in the latent representations of target nodes computed by GAGA on GossipCop-S, incurred by G-NIA (Upper) and MonTi (Lower). A blue circle and an orange diamond corresponding to the same target node are connected. For each figure, we also provide misclassification rates of GAGA for the corresponding target set before and after the attack, the size of the target set, and $B = \lvert \mathcal{N}^{(1)} \cup \mathcal{T} \rvert$. While G-NIA induces only minor changes in the representations of target nodes, MonTi significantly shifts the representations.