  Node injection attacks on Graph Neural Networks (GNNs) have received
increasing attention recently, due to their ability to degrade GNN performance
with high attack success rates. However, our study indicates that these attacks
often fail in practical scenarios, since defense/detection methods can easily
identify and remove the injected nodes. To address this, we devote to
camouflage node injection attack, making injected nodes appear normal and
imperceptible to defense/detection methods. Unfortunately, the non-Euclidean
structure of graph data and the lack of intuitive prior present great
challenges to the formalization, implementation, and evaluation of camouflage.
In this paper, we first propose and define camouflage as distribution
similarity between ego networks of injected nodes and normal nodes. Then for
implementation, we propose an adversarial CAmouflage framework for Node
injection Attack, namely CANA, to improve attack performance under
defense/detection methods in practical scenarios. A novel camouflage metric is
further designed under the guide of distribution similarity. Extensive
experiments demonstrate that CANA can significantly improve the attack
performance under defense/detection methods with higher camouflage or
imperceptibility. This work urges us to raise awareness of the security
vulnerabilities of GNNs in practical applications.
