Node Classification on CORA (Miss-classification rate Δ=1-5 and Avg. Rank)
13.2Miss-classification Rate (Δ=1)L1D-RND
Evaluation results
| Method | Links | ||||||
|---|---|---|---|---|---|---|---|
| L1D-RNDAttack Scenario=Evasion, Victim Model=GCN2026.05 | 13.2 | 22.53 | 29.2 | 32.93 | 32.13 | 7 | |
| L1D-RNDAttack Scenario=Poison, Victim Model=GCN2026.05 | 15.47 | 23.33 | 30.27 | 33.47 | 34.67 | 7 | |
| L1D-RNDAttack Scenario=Evasion, Victim Model=GSAGE2026.05 | 15.87 | 34 | 38.93 | 40.93 | 41.87 | 6.27 | |
| L1D-RNDAttack Scenario=Poison, Victim Model=GSAGE2026.05 | 18.13 | 33.73 | 40.4 | 42.67 | 44.4 | 6.93 | |
| L1D-RNDAttack Scenario=Evasion, Victim Model=GIN2026.05 | 20.13 | 37.07 | 42.67 | 43.2 | 43.73 | 6.6 | |
| SGAAttack Scenario=Evasion, Victim Model=GSAGE2026.05 | 21.47 | 33.47 | 43.2 | 46.67 | 49.47 | 4.6 | |
| NETTACKAttack Scenario=Evasion, Victim Model=GSAGE2026.05 | 22 | 41.87 | 55.6 | 60.93 | 63.73 | 1.53 | |
| SGAAttack Scenario=Evasion, Victim Model=GIN2026.05 | 22.4 | 34.67 | 38.93 | 44.4 | 51.2 | 4.6 | |
| FGAAttack Stage=Evasion, Victim Model=GSAGE2026.05 | 22.4 | 29.07 | 37.87 | 50.27 | 55.33 | 3 | |
| SGAAttack Stage=Evasion, Victim Model=GSAGE2026.05 | 22.53 | 35.2 | 41.73 | 47.87 | 48.13 | 3.8 | |
| SGAAttack Scenario=Poison, Victim Model=GSAGE2026.05 | 22.67 | 40.93 | 51.07 | 57.07 | 60.53 | 4.13 | |
| FGAAttack Scenario=Evasion, Victim Model=GSAGE2026.05 | 22.93 | 31.07 | 39.2 | 49.47 | 55.33 | 3 | |
| L1D-RNDAttack Scenario=Poison, Victim Model=GIN2026.05 | 23.07 | 38 | 42.4 | 43.73 | 45.33 | 7 | |
| GOttackAttack Scenario=Evasion, Victim Model=GSAGE2026.05 | 23.2 | 35.33 | 40.4 | 48.27 | 51.73 | 3.67 | |
| FGAAttack Stage=Evasion, Victim Model=GIN2026.05 | 23.2 | 32.8 | 44.13 | 49.07 | 55.07 | 2.53 | |
| SGAAttack Stage=Evasion, Victim Model=GIN2026.05 | 23.2 | 32.53 | 42 | 44.13 | 50.67 | 3.8 | |
| FGAAttack Scenario=Evasion, Victim Model=GIN2026.05 | 23.47 | 31.07 | 42.4 | 50.67 | 55.47 | 3.6 | |
| PGDAttack Scenario=Evasion, Victim Model=GSAGE2026.05 | 24 | 33.47 | 40.27 | 43.2 | 46.13 | 5 | |
| SGAAttack Stage=Poison, Victim Model=GSAGE2026.05 | 24.13 | 42.67 | 50.93 | 58.8 | 62.67 | 3.67 | |
| NETTACKAttack Stage=Evasion, Victim Model=GIN2026.05 | 24.4 | 41.47 | 52.67 | 59.2 | 61.87 | 1.67 | |
| NETTACKAttack Stage=Evasion, Victim Model=GSAGE2026.05 | 24.4 | 47.33 | 56.8 | 61.87 | 64.8 | 1.47 | |
| PGDAttack Stage=Evasion, Victim Model=GSAGE2026.05 | 24.93 | 34.93 | 40.67 | 43.33 | 48.13 | 3.6 | |
| PGDAttack Scenario=Evasion, Victim Model=GIN2026.05 | 25.07 | 36.27 | 41.6 | 43.6 | 47.6 | 4.93 | |
| PR-BCD (NA)Attack Scenario=Evasion, Victim Model=GSAGE2026.05 | 25.07 | 35.47 | 43.07 | 45.73 | 51.07 | 3.93 | |
| GOttackAttack Scenario=Evasion, Victim Model=GIN2026.05 | 25.33 | 37.73 | 44.8 | 48.67 | 51.73 | 3.27 | |
| PR-BCDAttack Stage=Evasion, Victim Model=GSAGE2026.05 | 25.47 | 36.8 | 44.93 | 51.6 | 51.87 | 3.13 | |
| PGDAttack Stage=Evasion, Victim Model=GIN2026.05 | 25.87 | 36.8 | 43.73 | 46.13 | 49.2 | 3.93 | |
| FGAAttack Scenario=Evasion, Victim Model=PNA2026.05 | 26.13 | 40.4 | 43.2 | 55.33 | 62.8 | 3.87 | |
| SGAAttack Scenario=Evasion, Victim Model=GCN2026.05 | 26.27 | 44.67 | 55.33 | 58.13 | 60.67 | 5.13 | |
| FGAAttack Stage=Poison, Victim Model=GSAGE2026.05 | 26.27 | 40.13 | 47.73 | 59.73 | 66.67 | 2.8 | |
| NETTACKAttack Scenario=Evasion, Victim Model=GIN2026.05 | 26.53 | 45.2 | 53.87 | 59.2 | 65.2 | 1.27 | |
| FGAAttack Scenario=Poison, Victim Model=GSAGE2026.05 | 26.67 | 38.13 | 48.67 | 59.07 | 63.87 | 2.67 | |
| PGDAttack Scenario=Evasion, Victim Model=PNA2026.05 | 26.8 | 40.27 | 39.47 | 45.47 | 48.4 | 5.93 | |
| PR-BCD (NA)Attack Scenario=Evasion, Victim Model=PNA2026.05 | 26.8 | 43.07 | 47.2 | 48.13 | 52.13 | 4.6 | |
| NETTACKAttack Scenario=Poison, Victim Model=GSAGE2026.05 | 27.07 | 48.27 | 59.6 | 65.33 | 70.93 | 1.53 | |
| FGAAttack Stage=Evasion, Victim Model=GCN2026.05 | 27.2 | 46.8 | 56.4 | 61.87 | 64.13 | 2.8 | |
| PR-BCD (NA)Attack Scenario=Evasion, Victim Model=GIN2026.05 | 27.47 | 40.53 | 48.27 | 52.8 | 54.13 | 3.73 | |
| GOttackAttack Scenario=Poison, Victim Model=GSAGE2026.05 | 27.47 | 43.87 | 51.2 | 53.47 | 59.73 | 3.67 | |
| FGAAttack Scenario=Evasion, Victim Model=GCN2026.05 | 27.87 | 46.13 | 55.73 | 60.93 | 64.67 | 3.4 | |
| PR-BCDAttack Stage=Evasion, Victim Model=GIN2026.05 | 27.87 | 41.47 | 47.33 | 54.13 | 58.27 | 3.07 | |
| SGAAttack Stage=Poison, Victim Model=GIN2026.05 | 28 | 50.67 | 55.6 | 57.73 | 68.53 | 3.4 | |
| GOttackAttack Scenario=Evasion, Victim Model=GCN2026.05 | 28.53 | 49.33 | 56.13 | 60.53 | 62.13 | 2.87 | |
| NETTACKAttack Scenario=Evasion, Victim Model=PNA2026.05 | 28.53 | 49.87 | 59.6 | 66 | 68.8 | 1.53 | |
| SGAAttack Stage=Evasion, Victim Model=GCN2026.05 | 28.53 | 44.53 | 54.67 | 58.27 | 61.6 | 4 | |
| FGAAttack Stage=Evasion, Victim Model=PNA2026.05 | 28.67 | 40.8 | 41.87 | 52.8 | 61.73 | 2.67 | |
| PGDAttack Scenario=Poison, Victim Model=GSAGE2026.05 | 28.8 | 38.93 | 44.67 | 48.8 | 53.6 | 5 | |
| PR-BCD (NA)Attack Scenario=Poison, Victim Model=GSAGE2026.05 | 28.8 | 42.53 | 50.13 | 54 | 61.47 | 4.07 | |
| PGDAttack Scenario=Poison, Victim Model=GIN2026.05 | 29.07 | 43.6 | 48.93 | 53.6 | 54.8 | 5.53 | |
| PR-BCDAttack Stage=Evasion, Victim Model=PNA2026.05 | 29.2 | 39.73 | 48.27 | 53.33 | 55.07 | 3.73 | |
| FGAAttack Stage=Poison, Victim Model=GCN2026.05 | 29.2 | 49.07 | 57.47 | 62.13 | 64 | 2.53 | |
| NETTACKAttack Stage=Poison, Victim Model=GSAGE2026.05 | 29.2 | 52.4 | 60.27 | 66.67 | 70.67 | 1.4 | |
| PGDAttack Scenario=Evasion, Victim Model=GCN2026.05 | 29.33 | 48 | 54.93 | 59.6 | 59.2 | 4.93 | |
| SGAAttack Scenario=Poison, Victim Model=GCN2026.05 | 29.33 | 48.13 | 55.87 | 60 | 63.73 | 4.93 | |
| NETTACKAttack Stage=Evasion, Victim Model=GCN2026.05 | 29.33 | 49.87 | 57.07 | 62.13 | 63.33 | 2 | |
| NETTACKAttack Scenario=Evasion, Victim Model=GCN2026.05 | 29.6 | 49.6 | 56.8 | 62.13 | 63.73 | 2.2 | |
| PGDAttack Stage=Evasion, Victim Model=GCN2026.05 | 29.6 | 47.07 | 55.87 | 57.2 | 59.07 | 3.87 | |
| SGAAttack Stage=Poison, Victim Model=GCN2026.05 | 29.87 | 50.53 | 55.87 | 60.8 | 62.4 | 3.87 | |
| PGDAttack Stage=Poison, Victim Model=GSAGE2026.05 | 29.87 | 42 | 49.07 | 55.47 | 57.2 | 3.93 | |
| FGAAttack Scenario=Poison, Victim Model=GCN2026.05 | 30 | 50 | 56.27 | 60.53 | 65.07 | 2.93 | |
| FGAAttack Stage=Poison, Victim Model=GIN2026.05 | 30 | 48.27 | 59.47 | 69.47 | 71.6 | 2 | |
| PGDAttack Stage=Poison, Victim Model=GCN2026.05 | 30.27 | 50 | 56.13 | 58.13 | 59.47 | 4.27 | |
| PGDAttack Stage=Poison, Victim Model=GIN2026.05 | 30.8 | 46 | 51.47 | 55.47 | 59.2 | 4.4 | |
| PR-BCDAttack Stage=Evasion, Victim Model=GCN2026.05 | 31.07 | 50.93 | 58.8 | 61.6 | 66 | 2.33 | |
| PR-BCDAttack Stage=Poison, Victim Model=GSAGE2026.05 | 31.2 | 44 | 52.93 | 60.53 | 62.93 | 3.2 | |
| SGAAttack Scenario=Poison, Victim Model=GIN2026.05 | 31.33 | 45.33 | 54 | 62.4 | 69.33 | 3.87 | |
| PGDAttack Scenario=Poison, Victim Model=PNA2026.05 | 31.47 | 43.6 | 49.07 | 53.87 | 57.47 | 6 | |
| GOttackAttack Scenario=Evasion, Victim Model=PNA2026.05 | 31.6 | 41.47 | 49.33 | 52.13 | 50.53 | 4.07 | |
| PGDAttack Stage=Evasion, Victim Model=PNA2026.05 | 31.6 | 38.13 | 45.6 | 46.93 | 46.8 | 4.33 | |
| SGAAttack Scenario=Evasion, Victim Model=PNA2026.05 | 31.73 | 40.27 | 46.67 | 44.4 | 50.53 | 4.27 | |
| PGDAttack Scenario=Poison, Victim Model=GCN2026.05 | 31.73 | 48.8 | 55.6 | 59.33 | 58.53 | 5.47 | |
| SGAAttack Stage=Evasion, Victim Model=PNA2026.05 | 31.73 | 41.2 | 43.6 | 49.33 | 57.87 | 3.07 | |
| FGAAttack Scenario=Poison, Victim Model=GIN2026.05 | 31.87 | 46.27 | 58.4 | 66.13 | 72.27 | 2.73 | |
| PR-BCD (NA)Attack Scenario=Evasion, Victim Model=GCN2026.05 | 32.13 | 53.87 | 59.2 | 63.2 | 65.73 | 2.47 | |
| PR-BCD (NA)Attack Scenario=Poison, Victim Model=GCN2026.05 | 32.8 | 53.87 | 57.6 | 60.67 | 63.73 | 3 | |
| L1D-RNDAttack Scenario=Evasion, Victim Model=PNA2026.05 | 33.2 | 41.6 | 47.2 | 45.2 | 53.07 | 3.73 | |
| GOttackAttack Scenario=Poison, Victim Model=GCN2026.05 | 33.33 | 51.47 | 57.73 | 61.07 | 63.2 | 2.6 | |
| NETTACKAttack Scenario=Poison, Victim Model=GCN2026.05 | 33.47 | 51.87 | 58.67 | 62.13 | 63.07 | 2.07 | |
| NETTACKAttack Stage=Poison, Victim Model=GCN2026.05 | 33.47 | 52.4 | 58.93 | 62 | 63.33 | 1.67 | |
| PR-BCD (NA)Attack Scenario=Poison, Victim Model=GIN2026.05 | 33.87 | 50.67 | 57.07 | 61.07 | 66.8 | 4.33 | |
| NETTACKAttack Stage=Evasion, Victim Model=PNA2026.05 | 33.87 | 55.07 | 59.73 | 62.27 | 64.13 | 1.2 | |
| NETTACKAttack Scenario=Poison, Victim Model=GIN2026.05 | 34.13 | 55.07 | 64.93 | 69.6 | 71.87 | 1.47 | |
| PR-BCDAttack Stage=Poison, Victim Model=GCN2026.05 | 34.13 | 52.4 | 58 | 60.93 | 64.4 | 2.67 | |
| PR-BCDAttack Stage=Poison, Victim Model=GIN2026.05 | 34.67 | 49.73 | 59.2 | 63.2 | 69.33 | 3.67 | |
| GOttackAttack Scenario=Poison, Victim Model=GIN2026.05 | 34.93 | 46.4 | 54.13 | 57.87 | 66.67 | 3.07 | |
| PGDAttack Stage=Poison, Victim Model=PNA2026.05 | 35.47 | 46 | 51.73 | 54.53 | 56 | 4.47 | |
| NETTACKAttack Scenario=Poison, Victim Model=PNA2026.05 | 35.6 | 59.6 | 64.67 | 73.33 | 74.93 | 1.53 | |
| PR-BCD (NA)Attack Scenario=Poison, Victim Model=PNA2026.05 | 36.13 | 50.8 | 56 | 59.47 | 59.33 | 4.93 | |
| FGAAttack Scenario=Poison, Victim Model=PNA2026.05 | 36.67 | 46.93 | 58.8 | 64.67 | 71.2 | 2.6 | |
| L1D-RNDAttack Scenario=Poison, Victim Model=PNA2026.05 | 37.47 | 44 | 48.13 | 50.4 | 57.2 | 5.67 | |
| PR-BCDAttack Stage=Poison, Victim Model=PNA2026.05 | 37.6 | 50 | 54.53 | 63.07 | 63.2 | 4.07 | |
| GOttackAttack Scenario=Poison, Victim Model=PNA2026.05 | 38.67 | 52.93 | 59.87 | 63.33 | 64.53 | 3.6 | |
| NETTACKAttack Stage=Poison, Victim Model=GIN2026.05 | 38.93 | 53.33 | 62 | 67.87 | 70.8 | 1.53 | |
| SGAAttack Stage=Poison, Victim Model=PNA2026.05 | 39.07 | 49.73 | 55.33 | 60.4 | 68.13 | 3.13 | |
| NETTACKAttack Stage=Poison, Victim Model=PNA2026.05 | 40.27 | 60.4 | 66.8 | 68.53 | 73.07 | 1.2 | |
| FGAAttack Stage=Poison, Victim Model=PNA2026.05 | 40.67 | 52.27 | 52.67 | 65.07 | 69.2 | 2.13 | |
| SGAAttack Scenario=Poison, Victim Model=PNA2026.05 | 41.47 | 50.27 | 56.53 | 60.53 | 68 | 3.67 |