Research map / Adversarial robustness and security / Attacks on text and graphs
Spear and Shield: Adversarial Attacks and Defense Methods for Model-Based Link Prediction on Continuous-Time Dynamic Graphs
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes T-Spear, a poisoning edge-injection attack on TGNN link prediction in continuous-time dynamic graphs under four unnoticeability constraints, and ense, a robust training defense combining temporal edge filtering with a temporal smoothness regularizer.
Problem
Vulnerability of temporal graph neural networks (TGNNs) to adversarial edge perturbations for link prediction on continuous-time dynamic graphs (CTDGs), where existing attacks and defenses are designed for static graphs or discrete-time snapshots.
Approach
Before victim training, inject temporal edges between recently active node pairs with the lowest TGN edge scores, sampled at original-edge timestamps, selected via batched Hungarian assignment to limit per-node perturbations; defend by filtering low-score edges with an annealed threshold and adding a cosine-based temporal smoothness loss on node embeddings.
Key results
- T-Spear at perturbation rate 0.3 degrades MRR by an average of 18.9% across 4 victim models and 4 datasets, outperforming the best baseline Struct-PR (-16.4%).
- ense surpasses naive TGN under T-Spear attack by up to 11.2% average performance gain (MRR, Wikipedia/MOOC/UCI).
- Attacks transfer: perturbations crafted on a TGN surrogate also degrade JODIE, TGAT, and DySAT.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| poison the TGN training graph with T-Spear edges at p=0.3 | TGN · Wikipedia | MRR: 80.5 $\pm$ 0.5 -> 60.0 $\pm$ 1.6 | Hurt |
| poison the TGN training graph with T-Spear edges at p=0.3 | TGN · MOOC | MRR: 61.8 $\pm$ 2.1 -> 48.2 $\pm$ 1.3 | Hurt |
| poison the TGN training graph with T-Spear edges at p=0.3 | TGN · UCI | MRR: 44.2 $\pm$ 0.4 -> 41.6 $\pm$ 0.3 | Hurt |
| poison the TGN training graph with T-Spear edges at p=0.3 | TGN · Bitcoin-OTC | MRR: 48.3 $\pm$ 0.7 -> 45.2 $\pm$ 1.4 | Hurt |
| use T-Spear instead of the strongest listed baseline attack | TGN · Wikipedia, p=0.3 | MRR: 65.3 $\pm$ 1.1 -> 60.0 $\pm$ 1.6 | Hurt |
| use T-Spear instead of the strongest listed baseline attack | TGN · MOOC, p=0.3 | MRR: 50.3 $\pm$ 1.4 -> 48.2 $\pm$ 1.3 | Hurt |
| use T-Spear instead of the strongest listed baseline attack | TGN · UCI, p=0.3 | MRR: 44.2 $\pm$ 0.9 -> 41.6 $\pm$ 0.3 | Hurt |
| use T-Spear instead of the strongest listed baseline attack | TGN · Bitcoin-OTC, p=0.3 | MRR: 46.2 $\pm$ 0.7 -> 45.2 $\pm$ 1.4 | Hurt |
| add ense edge filtering and temporal smoothness | TGN · Wikipedia, T-Spear, p=0.3 | MRR: 60.0 $\pm$ 1.6 -> 76.1 $\pm$ 0.3 | Helped |
| add ense edge filtering and temporal smoothness | TGN · MOOC, T-Spear, p=0.3 | MRR: 48.2 $\pm$ 1.3 -> 53.9 $\pm$ 1.1 | Helped |
| add ense edge filtering and temporal smoothness | TGN · UCI, T-Spear, p=0.3 | MRR: 41.6 $\pm$ 0.3 -> 45.4 $\pm$ 0.8 | Helped |
| add ense edge filtering and temporal smoothness | TGN · Bitcoin-OTC, T-Spear, p=0.3 | MRR: 45.2 $\pm$ 1.4 -> 47.2 $\pm$ 1.4 | Helped |
Surprising findings
- Naive low-K edge selection causes node overlap and degree spikes, which motivated the Hungarian-based batch selection.
- Cosine-similarity filtering (TGN-Cosine) and SVD defenses often fail to beat the undefended TGN, and TGN-Cosine is sometimes worse than naive TGN.
Limitations
- Evaluated only on four datasets and four TGNN victims with a fixed time window W=1200 and a single dataset-level hyperparameter setting.
- Attack is poisoning-only with limited-knowledge threat model; white-box or evasion settings are not studied.
Experimental setup
Datasets: Wikipedia MOOC UCI Bitcoin-OTC
Benchmarks: Wikipedia MOOC UCI Bitcoin-OTC
Metrics: MRR Hit@10 AUROC
Baselines: Random PA Jaccard Struct-D Struct-PR TGN-SVD TGN-Cosine
Builds on: TGN GNNGuard GCN-SVD TGL
Closest papers by meaning
- MemFreezing: A Novel Adversarial Attack on Temporal Graph Neural Networks under Limited Future Knowledge (ICML 2025 · similarity 0.89)
- Value at Adversarial Risk: A Graph Defense Strategy against Cost-Aware Attacks (AAAI 2024 · similarity 0.88)
- Practicable Black-Box Evasion Attacks on Link Prediction in Dynamic Graphs—a Graph Sequential Embedding Method (AAAI 2025 · similarity 0.87)
- A Simple and Yet Fairly Effective Defense for Graph Neural Networks (AAAI 2024 · similarity 0.86)
- Node-Time Conditional Prompt Learning in Dynamic Graphs (ICLR 2025 · similarity 0.85)
- Highly Imperceptible Black-Box Graph Injection Attacks with Reinforcement Learning (AAAI 2025 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.