Research map / Graph learning / GNN architectures
Intruding with Words: Towards Understanding Graph Injection Attacks at the Text Level
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Explores graph injection attacks that inject raw text (not embeddings) into text-attributed graphs, proposing three text-level GIA designs (ITGIA, VTGIA, WTGIA), with WTGIA combining word-frequency BoW embeddings and LLM text generation.
Problem
Existing graph injection attacks on text-attributed graphs inject node embeddings rather than actual text, which is unrealistic, can yield uninterpretable features, and is easily detected; the paper asks whether coherent, interpretable injected text can still attack GNNs effectively.
Approach
Three text-level GIAs: inverting optimized embeddings back to text (ITGIA), prompting LLMs to generate malicious text (VTGIA), and WTGIA which optimizes binary bag-of-words embeddings via row-wise constrained FGSM and then asks an LLM to generate text containing specified words and avoiding prohibited ones (via logit masking), revealing a performance–interpretability trade-off.
Key results
- WTGIA with binary BoW embeddings achieves attack performance comparable to embedding-level row-wise FGSM, while producing coherent text; for example, GCN accuracy on Cora is reduced to roughly the embedding-level range (Table of WTGIA results).
- ITGIA performs poorly after inversion (average cosine similarity 0.14 on Cora without HAO), and transfers badly to BoW (WTGIA transfers to BoW reducing accuracy to 35.33 on Cora with AGIA-style variant).
- LLM-based predictors without neighbors (zero-shot Clean w/o Nei.) reach 89.80 on PubMed, and WTGIA with neighbors reaches 74.81 on Cora zero-shot, showing defenders can counter text-level GIAs.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add HAO to ITGIA (ablation) | ITGIA · Cora | attack victim accuracy: 74.16 ± 1.76 -> 65.67 ± 1.48 | Helped |
| Add HAO to ITGIA (ablation) | ITGIA · CiteSeer | attack victim accuracy: 68.17 ± 0.94 -> 64.79 ± 1.30 | Helped |
| Add HAO to ITGIA (ablation) | ITGIA · PubMed | attack victim accuracy: 65.13 ± 1.67 -> 66.40 ± 2.33 | Mixed |
| Use HAO during embedding generation (ablation) | ITGIA · Cora | average cosine similarity: 0.14 -> 0.67 | Helped |
| Use HAO during embedding generation (ablation) | ITGIA · CiteSeer | average cosine similarity: 0.11 -> 0.56 | Helped |
| Use HAO during embedding generation (ablation) | ITGIA · PubMed | average cosine similarity: 0.06 -> 0.59 | Helped |
| Transfer ITGIA text to BoW embeddings instead of GTR | ITGIA · Cora | attack victim accuracy: 67.83 ± 0.75 -> 84.04 ± 0.78 | Hurt |
| Transfer WTGIA text from BoW to GTR embeddings | WTGIA · Cora | attack victim accuracy: 35.33 ± 1.29 -> 83.77 ± 1.11 | Hurt |
| Use topic requirements in the WTGIA prompt (ablation) | WTGIA · Cora, CiteSeer, and PubMed | attack victim accuracy | Hurt |
| Mask prohibited words during LLM generation (ablation) | WTGIA · Cora, CiteSeer, and PubMed | attack victim accuracy | Helped |
| Increase the sparsity budget (ablation) | WTGIA · Cora, CiteSeer, and PubMed | attack victim accuracy | Mixed |
| Use Riemannian gradient descent instead of PGD (ablation) | ITGIA · Text-level GIA experiments | attack performance | No clear effect |
Surprising findings
- Defenders can largely neutralize text-level GIAs by switching to a different text embedding (e.g., GTR instead of BoW), where WTGIA's advantage largely vanishes.
- LLM-based predictors that ignore neighborhoods can serve as a secure fallback, matching or exceeding attacked GCN performance on PubMed.
Limitations
- Evaluation limited to three small citation TAGs (Cora, CiteSeer, PubMed) and a 3-layer GCN/EGNNGuard defender.
- Interpretability vs. attack strength trade-off: stronger attacks require denser use of prohibited-word patterns that reduce text coherence.
- Results depend on proprietary GPT-3.5 and a single open LLM (Llama-3-8B) for generation.
Experimental setup
Datasets: Cora CiteSeer PubMed
Benchmarks: Cora CiteSeer PubMed
Metrics: classification accuracy under attack average cosine similarity use rate
Baselines: SeqGIA MetaGIA TDGIA ATDGIA AGIA VTGIA ITGIA
Builds on: Vec2Text TDGIA AFGSM EGNNGuard TAPE
Closest papers by meaning
- Highly Imperceptible Black-Box Graph Injection Attacks with Reinforcement Learning (AAAI 2025 · similarity 0.87)
- Value at Adversarial Risk: A Graph Defense Strategy against Cost-Aware Attacks (AAAI 2024 · similarity 0.85)
- Clean-Label Graph Backdoor Attack in the Node Classification Task (AAAI 2025 · similarity 0.85)
- Spear and Shield: Adversarial Attacks and Defense Methods for Model-Based Link Prediction on Continuous-Time Dynamic Graphs (AAAI 2024 · similarity 0.84)
- Stronger and Transferable Node Injection Attacks (AAAI 2024 · similarity 0.84)
- Generalization Principles for Inference over Text-Attributed Graphs with Large Language Models (ICML 2025 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.