Hasil untuk "Toxicology. Poisons"

Idorenyin U. Umoren, Nnanake-Abasi O. Offiong, Niibari W. Vite

This study evaluated the antioxidant and neuroprotective effects of ethanol leaf extract and fractions of Launaea taraxacifolia against aluminum chloride-induced neurotoxicity in rats. Sixty-six female Wistar rats were divided into eleven groups, receiving either control treatment, aluminum chloride, donepezil, or different doses/fractions of the plant extract for 21 days. Aluminum chloride significantly reduced antioxidant enzyme activities (SOD, CAT, GPx) and increased lipid peroxidation (MDA). Co-treatment with the ethanol extract, dichloromethane, ethylacetate, and n-butanol fractions restored antioxidant defenses and reduced MDA levels, whereas the n-hexane and aqueous fractions showed little effect. These findings indicate that Launaea taraxacifolia contains bioactive compounds with protective effects against oxidative stress and neuronal injury, supporting its potential as a natural neuroprotective agent.

Yuhang Ma, Jie Wang, Zheng Yan

Large Language Models (LLMs) have advanced Graph Neural Networks (GNNs) by enriching node representations with semantic features, giving rise to LLM-enhanced GNNs that achieve notable performance gains. However, the robustness of these models against poisoning attacks, which manipulate both graph structures and textual attributes during training, remains unexplored. To bridge this gap, we propose a robustness assessment framework that systematically evaluates LLM-enhanced GNNs under poisoning attacks. Our framework enables comprehensive evaluation across multiple dimensions. Specifically, we assess 24 victim models by combining eight LLM- or Language Model (LM)-based feature enhancers with three representative GNN backbones. To ensure diversity in attack coverage, we incorporate six structural poisoning attacks (both targeted and non-targeted) and three textual poisoning attacks operating at the character, word, and sentence levels. Furthermore, we employ four real-world datasets, including one released after the emergence of LLMs, to avoid potential ground truth leakage during LLM pretraining, thereby ensuring fair evaluation. Extensive experiments show that LLM-enhanced GNNs exhibit significantly higher accuracy and lower Relative Drop in Accuracy (RDA) than a shallow embedding-based baseline across various attack settings. Our in-depth analysis identifies key factors that contribute to this robustness, such as the effective encoding of structural and label information in node representations. Based on these insights, we outline future research directions from both offensive and defensive perspectives, and propose a new combined attack along with a graph purification defense. To support future research, we release the source code of our framework at~\url{https://github.com/CyberAlSec/LLMEGNNRP}.

Guowei Guan, Yurong Hao, Jiaming Zhang et al.

Multimodal large language models (MLLMs) are pushing recommender systems (RecSys) toward content-grounded retrieval and ranking via cross-modal fusion. We find that while cross-modal consensus often mitigates conventional poisoning that manipulates interaction logs or perturbs a single modality, it also introduces a new attack surface where synchronised multimodal poisoning can reliably steer fused representations along stable semantic directions during fine-tuning. To characterise this threat, we formalise cross-modal interactive poisoning and propose VENOMREC, which performs Exposure Alignment to identify high-exposure regions in the joint embedding space and Cross-modal Interactive Perturbation to craft attention-guided coupled token-patch edits. Experiments on three real-world multimodal datasets demonstrate that VENOMREC consistently outperforms strong baselines, achieving 0.73 mean ER@20 and improving over the strongest baseline by +0.52 absolute ER points on average, while maintaining comparable recommendation utility.

Navid khosravi, Homa Talabaki, Hosna Zohdi

Introduction: Aluminum phosphide (AlP) is a highly toxic pesticide with a high mortality rate due to the lack of a specific antidote. Its toxicity is primarily mediated through the generation of phosphine gas, leading to severe oxidative stress, mitochondrial dysfunction, and multi-organ failure. Recent studies suggest that glucose-6-phosphate dehydrogenase (G6PD) deficiency may offer a protective effect by modulating oxidative stress pathways.Case Reports: We report three cases of patients with confirmed AlP poisoning who were also diagnosed with G6PD deficiency. All patients presented to Razi hospital in Qaem Shahr, Mazandaran, Iran in February, July and December 2023 respectively with severe metabolic acidosis, hemolysis, hematuria, and systemic toxicity. They received intensive supportive care, including antioxidant therapy (N-acetylcysteine, vitamin C), magnesium sulfate, methylprednisolone, and aggressive hemodynamic support. Despite the usual high fatality rate associated with AlP poisoning, all three patients survived without major complications, suggesting a potential protective role of G6PD deficiency.Discussion: G6PD deficiency impairs the pentose phosphate pathway, reducing NADPH availability, which may limit oxidative damage induced by phosphine gas. This paradoxical effect could contribute to improved outcomes in AlP poisoning. Early recognition and aggressive supportive management were crucial in achieving positive clinical outcomes.Conclusion: These cases suggest that G6PD deficiency may confer a protective advantage in AlP poisoning by altering oxidative stress responses. Further research is warranted to explore the underlying mechanisms and potential therapeutic implications for AlP toxicity management.

Shiqi Zheng, Yanchao Han, Weijie Wu et al.

Abstract Histone deacetylase (HDAC) plays an essential role in plant growth, development, and maturation. Although the biological function of HDAC in model plants (such as Arabidopsis and rice) has been studied relatively thoroughly, the research on HDACs in lotus seed has not been reported yet. In this study, 14 HDACs were determined in lotus seed, including eight in the RPD3/HDA1 subfamily, one in the SIR2 subfamily, and five in the HD2 subfamily. Bioinformatics analysis showed that NnHDA3 has a high similarity with MaHDA6. Similarly, NnHDA8 and MaHDA1, NnSRT1 and AtSRT2, NnHDA8 and AtHDA15, NnHDA2 and OsHDA706, and OsHDA710 and NnHDA3 have a conservative domain structure. The mRNA expression of NnHDA6, NnHDA8, and NnHDT5 in pulp positively correlated with maturity and starch content. On the contrary, the expression of NnHDA6 and NnHDT5 negatively correlated with chlorophyll content. During prolonged storage, NnHDA3 and NnHDT4 increased first and then decreased in pulp positively related to starch content. However, the expression of NnSRT1 in peel decreased first and then increased, and it is higher in peel than in pulp. Based on the above results, we speculate that NnHDA3 may be involved in the maturation and senescence of lotus seeds. NnHDA2 and NnSRT1 are involved in the metabolism of chlorophyll and starch during lotus seed ripening. Our results provide the first insight into the histone deacetylase in lotus seed ripening.

Stanley Wu, Ronik Bhaskar, Anna Yoo Jeong Ha et al.

Today's text-to-image generative models are trained on millions of images sourced from the Internet, each paired with a detailed caption produced by Vision-Language Models (VLMs). This part of the training pipeline is critical for supplying the models with large volumes of high-quality image-caption pairs during training. However, recent work suggests that VLMs are vulnerable to stealthy adversarial attacks, where adversarial perturbations are added to images to mislead the VLMs into producing incorrect captions. In this paper, we explore the feasibility of adversarial mislabeling attacks on VLMs as a mechanism to poisoning training pipelines for text-to-image models. Our experiments demonstrate that VLMs are highly vulnerable to adversarial perturbations, allowing attackers to produce benign-looking images that are consistently miscaptioned by the VLM models. This has the effect of injecting strong "dirty-label" poison samples into the training pipeline for text-to-image models, successfully altering their behavior with a small number of poisoned samples. We find that while potential defenses can be effective, they can be targeted and circumvented by adaptive attackers. This suggests a cat-and-mouse game that is likely to reduce the quality of training data and increase the cost of text-to-image model development. Finally, we demonstrate the real-world effectiveness of these attacks, achieving high attack success (over 73%) even in black-box scenarios against commercial VLMs (Google Vertex AI and Microsoft Azure).

Sangwon Jang, June Suk Choi, Jaehyeong Jo et al.

Text-to-image diffusion models have achieved remarkable success in generating high-quality contents from text prompts. However, their reliance on publicly available data and the growing trend of data sharing for fine-tuning make these models particularly vulnerable to data poisoning attacks. In this work, we introduce the Silent Branding Attack, a novel data poisoning method that manipulates text-to-image diffusion models to generate images containing specific brand logos or symbols without any text triggers. We find that when certain visual patterns are repeatedly in the training data, the model learns to reproduce them naturally in its outputs, even without prompt mentions. Leveraging this, we develop an automated data poisoning algorithm that unobtrusively injects logos into original images, ensuring they blend naturally and remain undetected. Models trained on this poisoned dataset generate images containing logos without degrading image quality or text alignment. We experimentally validate our silent branding attack across two realistic settings on large-scale high-quality image datasets and style personalization datasets, achieving high success rates even without a specific text trigger. Human evaluation and quantitative metrics including logo detection show that our method can stealthily embed logos.

Ankit Gangwal, Mauro Conti, Tommaso Pauselli

Federated Learning (FL) enables multiple users to collaboratively train a global model in a distributed manner without revealing their personal data. However, FL remains vulnerable to model poisoning attacks, where malicious actors inject crafted updates to compromise the global model's accuracy. We propose a novel defense mechanism, Kernel-based Trust Segmentation (KeTS), to counter model poisoning attacks. Unlike existing approaches, KeTS analyzes the evolution of each client's updates and effectively segments malicious clients using Kernel Density Estimation (KDE), even in the presence of benign outliers. We thoroughly evaluate KeTS's performance against the six most effective model poisoning attacks (i.e., Trim-Attack, Krum-Attack, Min-Max attack, Min-Sum attack, and their variants) on four different datasets (i.e., MNIST, Fashion-MNIST, CIFAR-10, and KDD-CUP-1999) and compare its performance with three classical robust schemes (i.e., Krum, Trim-Mean, and Median) and a state-of-the-art defense (i.e., FLTrust). Our results show that KeTS outperforms the existing defenses in every attack setting; beating the best-performing defense by an overall average of >24% (on MNIST), >14% (on Fashion-MNIST), >9% (on CIFAR-10), >11% (on KDD-CUP-1999). A series of further experiments (varying poisoning approaches, attacker population, etc.) reveal the consistent and superior performance of KeTS under diverse conditions. KeTS is a practical solution as it satisfies all three defense objectives (i.e., fidelity, robustness, and efficiency) without imposing additional overhead on the clients. Finally, we also discuss a simple, yet effective extension to KeTS to handle consistent-untargeted (e.g., sign-flipping) attacks as well as targeted attacks (e.g., label-flipping).

Tong Zhang, Kuofeng Gao, Jiawang Bai et al.

Recent studies have shown that Contrastive Language-Image Pre-training (CLIP) models are threatened by targeted data poisoning and backdoor attacks due to massive training image-caption pairs crawled from the Internet. Previous defense methods correct poisoned image-caption pairs by matching a new caption for each image. However, the matching process relies solely on the global representations of images and captions, overlooking fine-grained features of visual and textual features. It may introduce incorrect image-caption pairs and harm the CLIP pre-training. To address their limitations, we propose an Optimal Transport-based framework to reconstruct image-caption pairs, named OTCCLIP. We propose a new optimal transport-based distance measure between fine-grained visual and textual feature sets and re-assign new captions based on the proposed optimal transport distance. Additionally, to further reduce the negative impact of mismatched pairs, we encourage the inter- and intra-modality fine-grained alignment by employing optimal transport-based objective functions. Our experiments demonstrate that OTCCLIP can successfully decrease the attack success rates of poisoning attacks. Also, compared to previous methods, OTCCLIP significantly improves CLIP's zero-shot and linear probing performance trained on poisoned datasets.

Shixuan Guan, Kai Li

Blockchain address poisoning is an emerging phishing attack that crafts "similar-looking" transfer records in the victim's transaction history, which aims to deceive victims and lure them into mistakenly transferring funds to the attacker. Recent works have shown that millions of Ethereum users were targeted and lost over 100 million US dollars. Ethereum crypto wallets, serving users in browsing transaction history and initiating transactions to transfer funds, play a central role in deploying countermeasures to mitigate the address poisoning attack. However, whether they have done so remains an open question. To fill the research void, in this paper, we design experiments to simulate address poisoning attacks and systematically evaluate the usability and security of 53 popular Ethereum crypto wallets. Our evaluation shows that there exist communication failures between 12 wallets and their transaction activity provider, which renders them unable to download the users' transaction history. Besides, our evaluation also shows that 16 wallets pose a high risk to their users due to displaying fake token phishing transfers. Moreover, our further analysis suggests that most wallets rely on transaction activity providers to filter out phishing transfers. However, their phishing detection capability varies. Finally, we found that only three wallets throw an explicit warning message when users attempt to transfer to the phishing address, implying a significant gap within the broader Ethereum crypto wallet community in protecting users from address poisoning attacks. Overall, our work shows that more efforts are needed by the Ethereum crypto wallet developer community to achieve the highest usability and security standard. Our bug reports have been acknowledged by the developer community, who are currently developing mitigation solutions.

Ethan B. Russo, Venetia L. Whiteley

Cannabinoid hyperemesis syndrome presents as a complex of symptoms and signs encompassing nausea, vomiting, abdominal pain, and hot water bathing behavior, most typically in a heavy cannabis user. Its presentation is frequently associated with hypothalamic-pituitary-adrenal axis activation with stress and weight loss. Recent investigation has identified five statistically significant mutations in patients distinct from those of frequent cannabis users who lack the symptoms, affecting the TRPV1 receptor, two dopamine genes, the cytochrome P450 2C9 enzyme that metabolizes tetrahydrocannabinol, and the adenosine triphosphate-binding cassette transporter. The syndrome is associated with escalating intake of high potency cannabis, or alternatively, other agonists of the cannabinoid-1 receptor including synthetic cannabinoids. Some patients develop environmental triggers in scents or foods that suggest classical conditioned responses. Various alternative “causes” are addressed and refuted in the text, including exposure to pesticides, neem oil or azadirachtin. Nosological confusion of cannabinoid hyperemesis syndrome has arisen with cyclic vomiting syndrome, whose presentation and pathophysiology are clearly distinct. The possible utilization of non-intoxicating antiemetic cannabis components in cannabis for treatment of cannabinoid hyperemesis syndrome is addressed, along with future research suggestions in relation to its genetic foundation and possible metabolomic signatures.

Yijie WANG, Wei LI, Jie ZHAO et al.

BackgroundThe staff in centers for disease control and prevention (CDC) were at a great risk for psychological distress when they were faced with outbreak-related prevention and control work and routine tasks during the COVID-19 period. Psychological resilience and burnout are two key influencing factors on psychological distress. ObjectiveTo explore the status and mechanisms of psychological resilience, burnout, and psychological distress among CDC staff. MethodsFrom September to October 2022, a cross-sectional survey was conducted in all CDC staff in Beijing, and 2228 CDC staff from 17 units (including 1 municipality-level CDC and 16 district-level CDCs) participated the questionnaire survey. The basic information questionnaire, Connor-Davidson Resilience Scale (CD-RISC-10) Chinese version, Maslach Burnout Inventory-General Survey (MBI-GS) Chinese version, and the 10-item Kessler Psychological Distress Scale (Kessler10) Chinese version were selected in our study. Mann-Whitney U test or Kruskal-Wallis H test was used to analyze the differences in the scores of psychological resilience, burnout, and psychological distress by demographic and sociological characteristics. The correlations among the three elements were analyzed by Spearman correlation analysis. Potential influencing factors of psychological distress of the CDC staff were evaluated by multiple linear regression. A potential mediating effect of psychological resilience-burnout-psychological distress was analyzed by the mediation package of R 4.2.0, and validated by Bootstrap method. ResultsOf 2228 questionnaires distributed, 2022 valid questionnaires were collected, and the recovery rate was 90.75%. The median (P25, P75) psychological distress score of CDC staff was 13.00 (8.00, 24.00), and the number of participants with psychological distress levels of 1, 2, 3, and 4 was 358 (17.71%), 546 (27.00%), 362 (17.90%), and 756 (37.39%), respectively. The median (P25, P75) psychological resilience score was 24.00 (20.00, 30.00) and the median (P25, P75) burnout score was 38.00 (25.00, 50.00). The results of the multiple linear regression showed that psychological resilience, burnout, caring for the elderly, having a chronic disease, and monthly income had independent influences on psychological distress (P<0.05), and emotional exhaustion, cynicism, and reduced personal accomplishment (reversed) in the case of burnout had a great effect on psychological distress (P<0.05). After controlling general demographic characteristic variables, total burnout score exerted a partial mediation effect on the relationship between psychological resilience and psychological distress, with a mediation effect value of −0.439 (95%CI: −0.483, −0.397), and a total mediation effect contribution rate of 60.89%. The two dimensions of burnout (emotional exhaustion and cynicism) played a partial mediating role between psychological resilience and psychological distress, with mediating effect contribution rates of 42.44% and 41.41%, respectively. ConclusionPsychological distress among CDC staff in Beijing was prominent during COVID-19. Psychological resilience can act directly on psychological distress or indirectly on psychological distress through burnout. Both emotional exhaustion and cynicism dimensions of burnout have a partial mediating role between psychological resilience and psychological distress. Increasing psychological resilience and decreasing burnout may reduce the occurrence of psychological distress.

Miet Shah, Advait Kulkarni, Murtuza Ghiya et al.

Introduction: Amlodipine is a commonly prescribed anti-hypertensive drug. Its inadvertent exposure and intentional overdose is the leading cause of drug overdose seen in the practice of cardiovascular medicine. It can lead to profound hypotension, refractory shock, acute renal failure and end organ damage.Case reports: A case series of three patients with serious calcium channel blocker (CCBs) overdose, out of which two survived and one succumbed despite aggressive treatment is presented here.Discussion: Our 3 patients presented with giddiness caused by hypotension attributable to generalized vasodilatation due to direct effect on vascular smooth muscle; and negative effect on the cardiac pacemaker and myocardial contractility. Hyperglycemia due to reduced insulin release and lactic acidosis also contributes to reduced dromotropic effect. Abdominal pain and vomiting seen in our patients has been ascribed to reduced gastrointestinal motility and stasis of gastric contents. Oliguric renal failure with features of fluid overload seen is attributable to prolonged hypotension and reduced effective circulatory volume. An unusual finding in our cases was non-cardiogenic pulmonary edema. We attribute this to capillary leak syndrome as a result of generalized vasodilatation, resulting in excessive pulmonary capillary transudation.Conclusion: Thus, management of CCB poisoning can be challenging. Outcome can be improved by early and aggressive intensive care, fluid resuscitation, inotropic support, calcium infusion, glucagon infusion, hyperinsulinemia-euglycemia therapy and other supportive measures. The pulmonary edema can complicate fluid resuscitation, and one might need to stop IV fluids and give diuretics, ventilatory support and increase inotropes in such a scenario.

Ling MAO

The most important revision of the Consensus of Chinese experts on pneumoconiosis treatment (2024) is to attach importance to antifibrotic treatment, and recommend tetrandrine and nintedanib for the treatment of silicosis and coal worker's pneumoconiosis, especially in patients with rapidly progressing silicosis. The second most important revision is a positive attitude towards lung transplantation which is recommended for patients with end-stage pneumoconiosis who do not respond to medically optimized conservative treatment as early as possible. In addition, new updates also include the addition of the application of metagenomic next-generation sequencing (mNGS) in pneumoconiosis with pulmonary infection, the diagnosis and treatment of pneumoconiosis with nontuberculous mycobacteriosis (NTM), and high-flow nasal cannula oxygen therapy (HFNC) in pneumoconiosis with respiratory failure therapies. The evidence and recommendations of the current version are assessed by the Grading of Recommendations, Assessment, Development, and Evaluation (GRADE) system.

Zeyu Zhang, Jianxun Lian, Chen Ma et al.

Trending topics have become a significant part of modern social media, attracting users to participate in discussions of breaking events. However, they also bring in a new channel for poisoning attacks, resulting in negative impacts on society. Therefore, it is urgent to study this critical problem and develop effective strategies for defense. In this paper, we propose TrendSim, an LLM-based multi-agent system to simulate trending topics in social media under poisoning attacks. Specifically, we create a simulation environment for trending topics that incorporates a time-aware interaction mechanism, centralized message dissemination, and an interactive system. Moreover, we develop LLM-based human-like agents to simulate users in social media, and propose prototype-based attackers to replicate poisoning attacks. Besides, we evaluate TrendSim from multiple aspects to validate its effectiveness. Based on TrendSim, we conduct simulation experiments to study four critical problems about poisoning attacks on trending topics for social benefit.

Ismail Lotfi, Marwa Qaraqe, Ali Ghrayeb et al.

The vehicular Metaverse represents an emerging paradigm that merges vehicular communications with virtual environments, integrating real-world data to enhance in-vehicle services. However, this integration faces critical security challenges, particularly in the data collection layer where malicious sensing IoT (SIoT) devices can compromise service quality through data poisoning attacks. The security aspects of the Metaverse services should be well addressed both when creating the digital twins of the physical systems and when delivering the virtual service to the vehicular Metaverse users (VMUs). This paper introduces vehicular Metaverse guard (VMGuard), a novel four-layer security framework that protects vehicular Metaverse systems from data poisoning attacks. Specifically, when the virtual service providers (VSPs) collect data about physical environment through SIoT devices in the field, the delivered content might be tampered. Malicious SIoT devices with moral hazard might have private incentives to provide poisoned data to the VSP to degrade the service quality (QoS) and user experience (QoE) of the VMUs. The proposed framework implements a reputation-based incentive mechanism that leverages user feedback and subjective logic modeling to assess the trustworthiness of participating SIoT devices. More precisely, the framework entails the use of reputation scores assigned to participating SIoT devices based on their historical engagements with the VSPs. Ultimately, we validate our proposed model using comprehensive simulations. Our key findings indicate that our mechanism effectively prevents the initiation of poisoning attacks by malicious SIoT devices. Additionally, our system ensures that reliable SIoT devices, previously missclassified, are not barred from participating in future rounds of the market.

Didem Şöhretoğlu, Gülin Renda, Randolph Arroo et al.

Abstract α‐Glucosidase (AG) inhibitors, one of the classes of oral antidiabetics used to treat type 2 diabetes mellitus, delay digestion and absorption of glucose, which in turn, has a lowering effect on postprandial blood glucose and insulin levels. Natural products are a great source for the development of new AG inhibitory drug candidates. We aim to summarize advances in natural AG inhibitors according to their secondary metabolite groups in the last decade. Their mechanisms of action and structure–activity relationships will especially be discussed.

Alun Myden, Susanne A. Stalford, Adrian Fowkes et al.

Integrated approaches to testing and assessments (IATAs) have been proposed as a method to organise new approach methodologies in order to replace traditional animal testing for chemical safety assessments. To capture the mechanistic aspects of toxicity assessments, IATAs can be framed around the adverse outcome pathway (AOP) concept. To utilise AOPs fully in this context, a sufficient number of pathways need to be present to develop fit for purpose IATAs. In silico approaches can support IATA through the provision of predictive models and also through data integration to derive conclusions using a weight-of-evidence approach. To examine the maturity of a developmental and reproductive toxicity (DART) AOP network derived from the literature, an assessment of its coverage was performed against a novel toxicity dataset. A dataset of diverse compounds, with data from studies performed according to OECD test guidelines TG-421 and TG-422, was curated to test the performance of an in silico model based on the AOP network – allowing for the identification of knowledge gaps within the network. One such gap in the knowledge was filled through the development of an AOP stemming from the molecular initiating event ‘glutathione reaction with an electrophile’ leading to male fertility toxicity. The creation of the AOP provided the mechanistic rationale for the curation of pre-existing structural alerts to relevant key events. Integrating this new knowledge and associated alerts into the DART AOP network will improve its coverage of DART-relevant chemical space. In addition, broadening the coverage of AOPs for a particular regulatory endpoint may facilitate the development of, and confidence in, robust IATAs.

Luigi Ranno, Yong Zen Tan, Chi Siang Ong et al.

Lead (Pb2+) toxification in society is one of the most concerning public health crisis that remains unaddressed. The exposure to Pb2+ poisoning leads to a multitude of enduring health issues, even at the part-per-billion scale (ppb). Yet, public action dwarfs its impact. Pb2+ poisoning is estimated to account for 1 million deaths per year globally, which is in addition to its chronic impact on children. With their ring-shaped cavities, crown ethers are uniquely capable of selectively binding to specific ions. In this work, for the first time, the synergistic integration of highly-scalable silicon photonics, with crown ether amine conjugation via Fischer esterification in an environmentally-friendly fashion is demonstrated. This realises a photonic platform that enables the in-situ, highly-selective and quantitative detection of various ions. The development dispels the existing notion that Fischer esterification is restricted to organic compounds, laying the ground for subsequent amine conjugation for various crown ethers. In this work, the platform is engineered for Pb2+ detection, demonstrating a large dynamic detection range of 1 - 262000 ppb with high selectivity against a wide range of relevant ions. These results indicate the potential for the pervasive implementation of the technology to safeguard against ubiquitous lead poisoning in our society.

Yuwei Han, Yuni Lai, Yulin Zhu et al.

Graph Neural Networks (GNNs) have become widely used in the field of graph mining. However, these networks are vulnerable to structural perturbations. While many research efforts have focused on analyzing vulnerability through poisoning attacks, we have identified an inefficiency in current attack losses. These losses steer the attack strategy towards modifying edges targeting misclassified nodes or resilient nodes, resulting in a waste of structural adversarial perturbation. To address this issue, we propose a novel attack loss framework called the Cost Aware Poisoning Attack (CA-attack) to improve the allocation of the attack budget by dynamically considering the classification margins of nodes. Specifically, it prioritizes nodes with smaller positive margins while postponing nodes with negative margins. Our experiments demonstrate that the proposed CA-attack significantly enhances existing attack strategies