  Graph neural network (GNN) has achieved great success on graph representation
learning. Challenged by large scale private data collected from user-side, GNN
may not be able to reflect the excellent performance, without rich features and
complete adjacent relationships. Addressing the problem, vertical federated
learning (VFL) is proposed to implement local data protection through training
a global model collaboratively. Consequently, for graph-structured data, it is
a natural idea to construct a GNN based VFL framework, denoted as GVFL.
However, GNN has been proved vulnerable to adversarial attacks. Whether the
vulnerability will be brought into the GVFL has not been studied. This is the
first study of adversarial attacks on GVFL. A novel adversarial attack method
is proposed, named Graph-Fraudster. It generates adversarial perturbations
based on the noise-added global node embeddings via the privacy leakage and the
gradient of pairwise node. Specifically, first, Graph-Fraudster steals the
global node embeddings and sets up a shadow model of the server for the attack
generator. Second, noise is added into node embeddings to confuse the shadow
model. At last, the gradient of pairwise node is used to generate attacks with
the guidance of noise-added node embeddings. Extensive experiments on five
benchmark datasets demonstrate that Graph-Fraudster achieves the
state-of-the-art attack performance compared with baselines in different GNN
based GVFLs. Furthermore, Graph-Fraudster can remain a threat to GVFL even if
two possible defense mechanisms are applied. Additionally, some suggestions are
put forward for the future work to improve the robustness of GVFL. The code and
datasets can be downloaded at https://github.com/hgh0545/Graph-Fraudster.
