  Graph-structured data exist in numerous applications in real life. As a
state-of-the-art graph neural network, the graph convolutional network (GCN)
plays an important role in processing graph-structured data. However, a recent
study reported that GCNs are also vulnerable to adversarial attacks, which
means that GCN models may suffer malicious attacks with unnoticeable
modifications of the data. Among all the adversarial attacks on GCNs, there is
a special kind of attack method called the universal adversarial attack, which
generates a perturbation that can be applied to any sample and causes GCN
models to output incorrect results. Although universal adversarial attacks in
computer vision have been extensively researched, there are few research works
on universal adversarial attacks on graph structured data. In this paper, we
propose a targeted universal adversarial attack against GCNs. Our method
employs a few nodes as the attack nodes. The attack capability of the attack
nodes is enhanced through a small number of fake nodes connected to them.
During an attack, any victim node will be misclassified by the GCN as the
attack node class as long as it is linked to them. The experiments on three
popular datasets show that the average attack success rate of the proposed
attack on any victim node in the graph reaches 83% when using only 3 attack
nodes and 6 fake nodes. We hope that our work will make the community aware of
the threat of this type of attack and raise the attention given to its future
defense.
