Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Leveraging Vulnerabilities in Temporal Graph Neural Networks via Strategic High-Impact Assaults

Dong Hyun Jeon, Lijing Zhu, Haifang Li, Pengze Li, Jingna Feng, Tiehang Duan, Houbing Herbert Song, Cui Tao, Shuteng Niu

TL;DR

This work addresses the robustness of temporal graph neural networks to adversarial perturbations by introducing High Impact Attack (HIA), a restricted black-box framework that uses a data-driven surrogate to identify high-impact nodes and applies a hybrid edge injection/deletion strategy under a budget Δ = δ|E|. By combining dynamic growth, global centrality, and community context into an Impact score and leveraging a surrogate-based priors, HIA effectively degrades link-prediction performance across five real-world datasets and four TGNNs, achieving up to a 35.55% mean reciprocal rank decrease. The findings reveal fundamental vulnerabilities in current STDGMs and underscore the need for defenses that account for both structural and temporal dynamics, including adversarial training and dynamic graph purification. The proposed approach provides a scalable, transferable attack methodology and offers concrete directions for designing more robust TGNNs and evaluating defenses in realistic, streaming scenarios.

Abstract

Temporal Graph Neural Networks (TGNNs) have become indispensable for analyzing dynamic graphs in critical applications such as social networks, communication systems, and financial networks. However, the robustness of TGNNs against adversarial attacks, particularly sophisticated attacks that exploit the temporal dimension, remains a significant challenge. Existing attack methods for Spatio-Temporal Dynamic Graphs (STDGs) often rely on simplistic, easily detectable perturbations (e.g., random edge additions/deletions) and fail to strategically target the most influential nodes and edges for maximum impact. We introduce the High Impact Attack (HIA), a novel restricted black-box attack framework specifically designed to overcome these limitations and expose critical vulnerabilities in TGNNs. HIA leverages a data-driven surrogate model to identify structurally important nodes (central to network connectivity) and dynamically important nodes (critical for the graph's temporal evolution). It then employs a hybrid perturbation strategy, combining strategic edge injection (to create misleading connections) and targeted edge deletion (to disrupt essential pathways), maximizing TGNN performance degradation. Importantly, HIA minimizes the number of perturbations to enhance stealth, making it more challenging to detect. Comprehensive experiments on five real-world datasets and four representative TGNN architectures (TGN, JODIE, DySAT, and TGAT) demonstrate that HIA significantly reduces TGNN accuracy on the link prediction task, achieving up to a 35.55% decrease in Mean Reciprocal Rank (MRR) - a substantial improvement over state-of-the-art baselines. These results highlight fundamental vulnerabilities in current STDG models and underscore the urgent need for robust defenses that account for both structural and temporal dynamics.

Leveraging Vulnerabilities in Temporal Graph Neural Networks via Strategic High-Impact Assaults

TL;DR

This work addresses the robustness of temporal graph neural networks to adversarial perturbations by introducing High Impact Attack (HIA), a restricted black-box framework that uses a data-driven surrogate to identify high-impact nodes and applies a hybrid edge injection/deletion strategy under a budget Δ = δ|E|. By combining dynamic growth, global centrality, and community context into an Impact score and leveraging a surrogate-based priors, HIA effectively degrades link-prediction performance across five real-world datasets and four TGNNs, achieving up to a 35.55% mean reciprocal rank decrease. The findings reveal fundamental vulnerabilities in current STDGMs and underscore the need for defenses that account for both structural and temporal dynamics, including adversarial training and dynamic graph purification. The proposed approach provides a scalable, transferable attack methodology and offers concrete directions for designing more robust TGNNs and evaluating defenses in realistic, streaming scenarios.

Abstract

Temporal Graph Neural Networks (TGNNs) have become indispensable for analyzing dynamic graphs in critical applications such as social networks, communication systems, and financial networks. However, the robustness of TGNNs against adversarial attacks, particularly sophisticated attacks that exploit the temporal dimension, remains a significant challenge. Existing attack methods for Spatio-Temporal Dynamic Graphs (STDGs) often rely on simplistic, easily detectable perturbations (e.g., random edge additions/deletions) and fail to strategically target the most influential nodes and edges for maximum impact. We introduce the High Impact Attack (HIA), a novel restricted black-box attack framework specifically designed to overcome these limitations and expose critical vulnerabilities in TGNNs. HIA leverages a data-driven surrogate model to identify structurally important nodes (central to network connectivity) and dynamically important nodes (critical for the graph's temporal evolution). It then employs a hybrid perturbation strategy, combining strategic edge injection (to create misleading connections) and targeted edge deletion (to disrupt essential pathways), maximizing TGNN performance degradation. Importantly, HIA minimizes the number of perturbations to enhance stealth, making it more challenging to detect. Comprehensive experiments on five real-world datasets and four representative TGNN architectures (TGN, JODIE, DySAT, and TGAT) demonstrate that HIA significantly reduces TGNN accuracy on the link prediction task, achieving up to a 35.55% decrease in Mean Reciprocal Rank (MRR) - a substantial improvement over state-of-the-art baselines. These results highlight fundamental vulnerabilities in current STDG models and underscore the urgent need for robust defenses that account for both structural and temporal dynamics.

Paper Structure

This paper contains 34 sections, 16 equations, 3 figures, 6 tables.

Table of Contents

  1. Introduction
  2. Related Work
  3. Targeting Influential Nodes
  4. Adversarial Attacks on Temporal Graphs
  5. Problem Formulation
  6. Attacker Model.
  7. Discussion of Assumptions:
  8. Graph Attack Overview
  9. Dynamic Graph Adversarial Attack
  10. Proposed Model: HIA
  11. Surrogate Model
  12. Strategic Node Selection
  13. High-Attraction Nodes
  14. Bridge Nodes
  15. Community-Aware Targeting
  16. ...and 19 more sections

Figures (3)

  • Figure 1: Comparison between HIA and traditional methods, highlighting HIA's hybrid approach, strategic node targeting, and improved stealth. Traditional methods are often easily detectable and rely on single-mode perturbations and random node selection.
  • Figure 2: Overview of the HIA Strategy. The diagram illustrates the three core components: (A) Train Surrogate Model: A spatio-temporal dynamic graph is input to a surrogate TGNN, which learns temporal node embeddings. (B) Identify High-Impact Nodes: The surrogate model computes node importance scores and identifies communities. High-degree (red circles) and high-betweenness (blue circles) nodes within communities are targeted. (C) Hybrid Perturbation Attack: Using a predefined perturbation rate, the attack performs edge injection and deletion based on edge likelihood scores from the surrogate. Low-likelihood edges are injected (thick blue lines), and high-likelihood edges, especially those connected to high-impact nodes, are deleted (thick dashed red lines). The result is the perturbed graph.
  • Figure 3: MRR vs. Perturbation Rate on HIA. As the perturbation rate increases, both MRR and Hit@10 decrease, demonstrating the attack’s effectiveness. The decline stabilizes beyond 30%, indicating diminishing returns in performance degradation.