Research map / Graph learning / GNN architectures
Are Your Models Still Fair? Fairness Attacks on Graph Neural Networks via Node Injections
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes NIFA, a gray-box poisoning attack that injects nodes into a graph (instead of editing existing edges) to increase GNN group unfairness on SP and EO metrics.
Problem
Existing fairness attacks on GNNs require manipulating connectivity or features between existing nodes, which is often infeasible in practice; node-injection-based fairness attacks are under-explored.
Approach
Injects nodes that connect only to high-uncertainty (Bayesian GCN MC-dropout variance) target nodes from a single sensitive group (homophily-increase principle), then optimizes injected node features with a surrogate GCN via classification, SP/EO fairness, and feature-constraint losses in an iterative loop.
Key results
- On Pokec-z, GCN's Delta_SP and Delta_EO rise from 7.13% and 5.10% to 17.36% and 15.59% after injecting 1% of labeled nodes, with accuracy only dropping from 71.22% to 70.50%.
- On fairness-aware FairVGNN (Pokec-z), Delta_EO increases from 2.59% to 9.28%.
- NIFA outperforms utility attacks (AFGSM, TDGIA, G2A2C) and fairness attacks (FA-GNN, FATE, G-FairAttack) on the reported fairness metrics for GCN on DBLP (Delta_EO 20.33% vs. best baseline 8.74%).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| inject nodes using NIFA | GCN · Pokec-z | ΔSP: 7.13$\pm$1.21 -> 17.36$\pm$1.16 | Helped |
| inject nodes using NIFA | GCN · Pokec-z | ΔEO: 5.10$\pm$1.28 -> 15.59$\pm$1.08 | Helped |
| inject nodes using NIFA | GCN · Pokec-n | ΔSP: 0.88$\pm$0.62 -> 10.10$\pm$2.10 | Helped |
| inject nodes using NIFA | GCN · Pokec-n | ΔEO: 2.44$\pm$1.37 -> 9.85$\pm$1.97 | Helped |
| inject nodes using NIFA | GCN · DBLP | ΔSP: 3.84$\pm$0.34 -> 13.49$\pm$2.83 | Helped |
| inject nodes using NIFA | GCN · DBLP | ΔEO: 1.91$\pm$0.75 -> 20.33$\pm$3.82 | Helped |
| add uncertainty-based target selection (rather than random targets) (ablation) | NIFA · Pokec-z, Pokec-n, and DBLP | fairness attack performance | Helped |
| add same-sensitive-group-only connections for injected nodes (ablation) | NIFA · Pokec-z, Pokec-n, and DBLP | fairness attack performance | Helped |
| use iterative surrogate and feature training (ablation) | NIFA · Pokec-z, Pokec-n, and DBLP | fairness attack performance | Helped |
| select targets by low degree instead of uncertainty (ablation) | NIFA · Pokec-z | ΔSP: 17.36 vs 15.76 | Hurt |
| select targets by low degree instead of uncertainty (ablation) | NIFA · Pokec-n | ΔSP: 10.10 vs 12.39 | Helped |
| select targets by low degree instead of uncertainty (ablation) | NIFA · DBLP | ΔSP: 13.49 vs 6.30 | Hurt |
Surprising findings
- Degree-based target selection (lowest-degree nodes) achieves competitive attack performance, showing uncertainty is not the only effective criterion.
- Removing the iterative training strategy only slightly decreases attack performance.
Limitations
- Requires gray-box access to labels and sensitive attributes; black-box setting left to future work.
- Only handles binary sensitive attributes and attacks group fairness based on sensitive attributes, not structural fairness.
- FATE and G-FairAttack could not run on Pokec-z and Pokec-n due to scalability (OOM / timeout), so baseline comparisons are limited on those datasets.
Experimental setup
Datasets: Pokec-z Pokec-n DBLP
Benchmarks: Pokec-z Pokec-n DBLP
Metrics: accuracy Delta_SP Delta_EO graph statistics (Gini, assortativity, triangle count, etc.)
Baselines: AFGSM TDGIA G2A2C FA-GNN FATE G-FairAttack
Builds on: Monte Carlo dropout TDGIA FATE FA-GNN
Closest papers by meaning
- Adversarial Attacks on Fairness of Graph Neural Networks (ICLR 2024 · similarity 0.91)
- Stronger and Transferable Node Injection Attacks (AAAI 2024 · similarity 0.88)
- Chasing Fairness in Graphs: A GNN Architecture Perspective (AAAI 2024 · similarity 0.88)
- FairSIN: Achieving Fairness in Graph Neural Networks through Sensitive Information Neutralization (AAAI 2024 · similarity 0.87)
- Highly Imperceptible Black-Box Graph Injection Attacks with Reinforcement Learning (AAAI 2025 · similarity 0.87)
- Deceptive Fairness Attacks on Graphs via Meta Learning (ICLR 2024 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.