Research map / Graph learning / Graph self-supervised learning
Unveiling the Threat of Fraud Gangs to Graph Neural Networks: Multi-Target Graph Injection Attacks Against GNN-Based Fraud Detectors
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes MonTi, a transformer-based one-time graph injection attack that injects all attack nodes at once with adaptive degree budgets, targeting GNN-based fraud detectors under multi-target fraud-gang scenarios.
Problem
Adversarial vulnerability of GNN-based fraud detectors to multi-target graph injection attacks, where fraud nodes organized into gangs try to evade detection by camouflaging collusively.
Approach
A transformer encoder (adversarial structure encoding) jointly processes target, candidate, and attack nodes so attributes and edges of all injected nodes are generated simultaneously, with adaptive per-node degree budgets via Gumbel-Top-k edge selection.
Key results
- On GossipCop with GCN surrogate and CARE-GNN/PC-GNN/GAGA victims, MonTi reaches 88.40%, 89.36%, and 41.34% misclassification versus at most 60.67%, 66.25%, 25.76% for the best baseline (GNIA).
- On the InsR dataset with GCN as victim in the same-type setting, MonTi achieves 99.47% misclassification versus 83.28% for TDGIA.
- On single-target attacks, MonTi achieves 96.4% on OGB-Products and 85.3% on PubMed, the highest among compared methods.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use MonTi instead of the strongest reported baseline | GCN-based attack on GCOP · GCOP; victim GCN | misclassification rate (%): 75.12$\pm$0.11 -> 92.60$\pm$0.34 | Helped |
| Use MonTi instead of GNIA | GraphSAGE-based attack on GCOP · GCOP; victim GraphSAGE | misclassification rate (%): 67.70$\pm$2.05 -> 97.05$\pm$0.15 | Helped |
| Use MonTi instead of GNIA | GAT-based attack on Yelp · Yelp; victim GAT | misclassification rate (%): 55.51$\pm$11.72 -> 93.27$\pm$7.84 | Helped |
| Use MonTi instead of GNIA | CARE-GNN attack on Yelp · Yelp; victim CARE-GNN | misclassification rate (%): 32.45$\pm$1.13 -> 31.92$\pm$0.53 | Hurt |
| Use MonTi instead of TDGIA | GAT-based attack on Insurance · Insurance; victim GAT | misclassification rate (%): 96.60$\pm$0.59 -> 100.00$\pm$0.00 | Helped |
| Use MonTi instead of GSquare | PC-GNN attack on Insurance · Insurance; victim PC-GNN | misclassification rate (%): 20.08$\pm$0.04 -> 20.64$\pm$0.30 | Helped |
| Use MonTi instead of GSquare | Single-target GCN attack · PubMed | misclassification rate (%): 82.0$\pm$0.0 -> 85.3$\pm$1.1 | Helped |
| Replace generated attributes with random attributes (ablation) | MonTi with GCN surrogate · GCOP; CARE-GNN victim | misclassification rate (%): 88.78 -> 78.18 | Hurt |
| Replace generated edges with random edges (ablation) | MonTi with GCN surrogate · GCOP; GAGA victim | misclassification rate (%): 43.70 -> 39.33 | Hurt |
| Remove positional encodings (ablation) | MonTi with GCN surrogate · GCOP; PC-GNN victim | misclassification rate (%): 89.90 -> 86.98 | Hurt |
| Select candidates randomly (ablation) | MonTi with GCN surrogate · GCOP; CARE-GNN victim | misclassification rate (%): 88.78 -> 88.25 | Hurt |
| Fix the degree budget per attack node (ablation) | MonTi with GCN surrogate · GCOP; GAGA victim | misclassification rate (%): 43.70 -> 42.17 | Hurt |
Surprising findings
- Fraud detectors such as CARE-GNN and PC-GNN are more robust than vanilla GNNs against the baseline attacks on several datasets, although the proposed method still breaks them.
- Existing baselines such as G-Square and Cluster Attack ran out of memory or did not finish within 5 days on some datasets.
Limitations
- Assumes single-relational graphs; multi-relational fraud graphs are left to future work.
- Insurance dataset is private and cannot be released in detail.
- Black-box setting relies on a surrogate model; baselines like Cluster Attack needed adaptation to surrogate gradients.
Experimental setup
Datasets: GossipCop YelpChi Insurance fraud graph (InsR) OGB-Products PubMed
Benchmarks: GossipCop Yelp InsR OGB-Products PubMed
Metrics: misclassification rate F1 AUC runtime memory usage
Baselines: GNIA TDGIA Cluster Attack G-Square Random NIPA AFGSM Nettack
Builds on: TDGIA GNIA C&W loss Gumbel-Top-k
Closest papers by meaning
- DiG-In-GNN: Discriminative Feature Guided GNN-Based Fraud Detector against Inconsistencies in Multi-Relation Fraud Graph (AAAI 2024 · similarity 0.89)
- Dynamic Neighborhood Modeling via Node-Subgraph Contrastive Learning for Graph-Based Fraud Detection (AAAI 2025 · similarity 0.87)
- Partitioning Message Passing for Graph Fraud Detection (ICLR 2024 · similarity 0.87)
- Highly Imperceptible Black-Box Graph Injection Attacks with Reinforcement Learning (AAAI 2025 · similarity 0.87)
- Provably Powerful Graph Neural Networks for Directed Multigraphs (AAAI 2024 · similarity 0.87)
- DGA-GNN: Dynamic Grouping Aggregation GNN for Fraud Detection (AAAI 2024 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.