  The success of graph neural networks stimulates the prosperity of graph
mining and the corresponding downstream tasks including graph anomaly detection
(GAD). However, it has been explored that those graph mining methods are
vulnerable to structural manipulations on relational data. That is, the
attacker can maliciously perturb the graph structures to assist the target
nodes to evade anomaly detection. In this paper, we explore the structural
vulnerability of two typical GAD systems: unsupervised FeXtra-based GAD and
supervised GCN-based GAD. Specifically, structural poisoning attacks against
GAD are formulated as complex bi-level optimization problems. Our first major
contribution is then to transform the bi-level problem into one-level
leveraging different regression methods. Furthermore, we propose a new way of
utilizing gradient information to optimize the one-level optimization problem
in the discrete domain. Comprehensive experiments demonstrate the effectiveness
of our proposed attack algorithm BinarizedAttack.
