Research map / Adversarial robustness and security / Attacks on text and graphs

MemFreezing: A Novel Adversarial Attack on Temporal Graph Neural Networks under Limited Future Knowledge

ICML 2025 · Adversarial robustness and security › Attacks on text and graphs · approach: Graph neural network robustness

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes MemFreezing, an adversarial attack on memory-based temporal graph neural networks that, using only graph knowledge up to the attack time, injects fake events to freeze victim node memories (cross-freezing) and propagate the frozen state to simulated future neighbors.

Problem

Adversarial attacks on temporal graph neural networks usually assume full knowledge of the future graph; in realistic settings attackers only know the graph up to the attack time, and existing attacks' effects decay as the graph evolves and cannot reach unseen nodes.

Approach

Instead of maximizing prediction loss, push victim node memories into a stable "frozen state" by grouping root and support nodes that mutually reinforce each other's memories (cross-freezing), and simulate future neighbors so the frozen state propagates through memory updates to unseen nodes.

Key results

• On WIKI with TGN at 5% budget, MemFreezing lowers accumulated edge-prediction accuracy from 0.93 (vanilla) to 0.75 by t50, while baseline attacks return to near-clean accuracy (e.g., FakeNode 0.94 at t50).
• The noise injected by MemFreezing persists over ten timestamps with cosine similarity above 0.92 in the victim nodes' memories.
• Under defenses, MemFreezing causes an average accumulated accuracy drop of over 10% by t50, whereas baseline attacks drop only about 1.1%.

Measured effects reported in the paper

Surprising findings

• Attacks on JODIE are less effective because its memory decay mechanism introduces information outside node memory.
• MemFreezing does not cause the largest accuracy drop at t0 compared to baselines, but its effect grows over time.

Limitations

• Attacks on JODIE are weaker due to its memory decay mechanism.
• Future neighbor simulation effectiveness may degrade on extremely random and irregular graphs (discussed in appendix).

Experimental setup

Datasets: Wikipedia Reddit Reddit-body Reddit-title Wiki-Talk-Temporal

Benchmarks: Wikipedia Reddit Reddit-body Reddit-title Wiki-Talk-Temporal

Metrics: accumulated accuracy accumulated ROC-AUC

Baselines: FakeNode TDGIA Meta-Attack-Heuristic Adv_train Lip_reg GNNGuard

Builds on: TGN JODIE Roland FakeNode TDGIA

Closest papers by meaning

• Spear and Shield: Adversarial Attacks and Defense Methods for Model-Based Link Prediction on Continuous-Time Dynamic Graphs (AAAI 2024 · similarity 0.89)
• Value at Adversarial Risk: A Graph Defense Strategy against Cost-Aware Attacks (AAAI 2024 · similarity 0.86)
• MemPoison: Uncovering Persistent Memory Threats and Structural Blind Spots in LLM Agents (NeurIPS 2026 · similarity 0.85)
• Highly Imperceptible Black-Box Graph Injection Attacks with Reinforcement Learning (AAAI 2025 · similarity 0.85)
• If You Want to Be Robust, Be Wary of Initialization (NeurIPS 2024 · similarity 0.84)
• Enhancing Robustness of Graph Neural Networks on Social Media with Explainable Inverse Reinforcement Learning (NeurIPS 2024 · similarity 0.84)