  Graph Neural Network (GNN) has achieved remarkable success in various graph
learning tasks, such as node classification, link prediction and graph
classification. The key to the success of GNN lies in its effective structure
information representation through neighboring aggregation. However, the
attacker can easily perturb the aggregation process through injecting fake
nodes, which reveals that GNN is vulnerable to the graph injection attack.
Existing graph injection attack methods primarily focus on damaging the
classical feature aggregation process while overlooking the neighborhood
aggregation process via label propagation. To bridge this gap, we propose the
label-propagation-based global injection attack (LPGIA) which conducts the
graph injection attack on the node classification task. Specifically, we
analyze the aggregation process from the perspective of label propagation and
transform the graph injection attack problem into a global injection label
specificity attack problem. To solve this problem, LPGIA utilizes a label
propagation-based strategy to optimize the combinations of the nodes connected
to the injected node. Then, LPGIA leverages the feature mapping to generate
malicious features for injected nodes. In extensive experiments against
representative GNNs, LPGIA outperforms the previous best-performing injection
attack method in various datasets, demonstrating its superiority and
transferability.
