Cross-Attack Generalization of Temporal Graph Neural Networks under Strategic Adversarial Drift
Keywords:
Transaction Graphs, adversarial robustness, fraud detection, dynamic graphs, unforeseen attacks, invarianceAbstract
Temporal graph neural networks are the standard detector architecture for fraud in continuous-time transaction and interaction streams, and the most effective recent defences train them against a simulated adversary so that the decision boundary anticipates strategic evasion. Those defences are trained and evaluated under a single threat model, so what they establish is robustness along the axis the defender has already chosen. This paper measures what happens when the adversary changes tactic rather than intensity. We place four evasion primitives—edge injection, attribute manipulation, event pacing and identity substitution—inside one perturbation space over the event stream, instantiate six attack families in it, and score every defence on a cross-attack robustness matrix in which three families are visible during training and three are held out. A first-order analysis shows that adversarial training constrains the loss gradient only inside the span of the families it sees, leaving out-of-family sensitivity free whenever the operator blocks are misaligned. Experiments on two real dynamic graphs and a synthetic anti-money-laundering stream match the prediction: single-family adversarial training gains up to +49.1 F1 points on its own family while surrendering up to 59.1 points on another, and the average fraction of its in-family gain that reaches other families is 0.02. We then introduce CAGE, which couples simplex-sampled composite perturbations with an attack-agnostic embedding-smoothness term and a block-isotropic gradient penalty. CAGE raises worst-case F1 by +18.8 points over an undefended detector and by +10.0 points over the strongest alternative defence on each stream, with a transfer ratio of 1.47.
Keywords—
References
[1] S. Kumar, X. Zhang, and J. Leskovec, “Predicting dynamic embedding trajectory in temporal interaction networks,” in Proc. 25th ACM SIGKDD Int. Conf. Knowledge Discovery & Data Mining, 2019, pp. 1269–1278.
[2] R. Trivedi, M. Farajtabar, P. Biswal, and H. Zha, “DyRep: Learning representations over dynamic graphs,” in Proc. Int. Conf. Learning Representations, 2019.
[3] D. Xu, C. Ruan, E. Korpeoglu, S. Kumar, and K. Achan, “Inductive representation learning on temporal graphs,” in Proc. Int. Conf. Learning Representations, 2020.
[4] E. Rossi, B. Chamberlain, F. Frasca, D. Eynard, F. Monti, and M. Bronstein, “Temporal graph networks for deep learning on dynamic graphs,” arXiv preprint arXiv:2006.10637, 2020.
[5] W. Cong, S. Zhang, J. Kang, B. Yuan, H. Wu, X. Zhou, H. Tong, and M. Mahdavi, “Do we really need complicated model architectures for temporal networks?” in Proc. Int. Conf. Learning Representations, 2023.
[6] J. Perdomo, T. Zrnic, C. Mendler-Dünner, and M. Hardt, “Performative prediction,” in Proc. Int. Conf. Machine Learning, 2020, pp. 7599–7609.
[7] M. Hardt, N. Megiddo, C. Papadimitriou, and M. Wootters, “Strategic classification,” in Proc. ACM Conf. Innovations in Theoretical Computer Science, 2016, pp. 111–122.
[8] H. Fan, Y. Jiao, M. Wang, J. Chen, and S. Yang, “Fraud learns too: Continual graph learning under strategic adversarial drift in dynamic networks,” Scientific Reports, 2026, doi: 10.1038/s41598-026-60997-7.
[9] A. Souza, D. Mesquita, S. Kaski, and V. Garg, “Provably expressive temporal graph networks,” in Advances in Neural Information Processing Systems, vol. 35, 2022, pp. 32257–32269.
[10] F. Poursafaei, S. Huang, K. Pelrine, and R. Rabbany, “Towards better evaluation for dynamic link prediction,” in Advances in Neural Information Processing Systems, vol. 35, 2022.
[11] D. Zügner, A. Akbarnejad, and S. Günnemann, “Adversarial attacks on neural networks for graph data,” in Proc. 24th ACM SIGKDD Int. Conf. Knowledge Discovery & Data Mining, 2018, pp. 2847–2856.
[12] D. Zügner and S. Günnemann, “Adversarial attacks on graph neural networks via meta learning,” in Proc. Int. Conf. Learning Representations, 2019.
[13] H. Dai, H. Li, T. Tian, X. Huang, L. Wang, J. Zhu, and L. Song, “Adversarial attack on graph structured data,” in Proc. Int. Conf. Machine Learning, 2018, pp. 1115–1124.
[14] N. Entezari, S. A. Al-Sayouri, A. Darvishzadeh, and E. E. Papalexakis, “All you need is low (rank): Defending against adversarial attacks on graphs,” in Proc. 13th ACM Int. Conf. Web Search and Data Mining, 2020, pp. 169–177.
[15] S. Geisler, T. Schmidt, H. Şirin, D. Zügner, A. Bojchevski, and S. Günnemann, “Robustness of graph neural networks at scale,” in Advances in Neural Information Processing Systems, vol. 34, 2021.
[16] F. Mujkanovic, S. Geisler, S. Günnemann, and A. Bojchevski, “Are defenses for graph neural networks robust?” in Advances in Neural Information Processing Systems, vol. 35, 2022, pp. 8954–8968.
[17] K. Sharma, R. Trivedi, R. Sridhar, and S. Kumar, “Temporal dynamics-aware adversarial attacks on discrete-time dynamic graph models,” in Proc. 29th ACM SIGKDD Conf. Knowledge Discovery and Data Mining, 2023, pp. 2023–2035.
[18] D. Lee, J. Lee, and K. Shin, “Spear and shield: Adversarial attacks and defense methods for model-based link prediction on continuous-time dynamic graphs,” in Proc. AAAI Conf. Artificial Intelligence, vol. 38, 2024, pp. 13374–13382.
[19] I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” in Proc. Int. Conf. Learning Representations, 2015.
[20] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” in Proc. Int. Conf. Learning Representations, 2018.
[21] F. Tramèr and D. Boneh, “Adversarial training and robustness for multiple perturbations,” in Advances in Neural Information Processing Systems, vol. 32, 2019.
[22] P. Maini, E. Wong, and Z. Kolter, “Adversarial robustness against the union of multiple perturbation models,” in Proc. Int. Conf. Machine Learning, 2020.
[23] Fang, Q., & Liu, W. (2026). Neuro-symbolic pedagogical alignment (NSPA) for long-horizon classroom discourse analysis: Mitigating dialect bias via counterfactual preference optimization. Computers and Education: Artificial Intelligence, 100664.
[24] Xing, S., Wang, Y., & Liu, W. (2025). Self-adapting CPU scheduling for mixed database workloads via hierarchical deep reinforcement learning. Symmetry, 17(7), 1109.
[25] Ji, E., Wang, Y., Xing, S., & Jin, J. (2025). Hierarchical reinforcement learning for energy-efficient API traffic optimization in large-scale advertising systems. IEEE Access.
[26] Wang, Y., & Xing, S. (2025). AI-driven CPU resource management in cloud operating systems. Journal of Computer and Communications, 13(06), 135-149.
[27] Xing, S., & Wang, Y. (2025). Cross-modal attention networks for multi-modal anomaly detection in system software. IEEE Open Journal of the Computer Society.
[28] D. Kang, Y. Sun, D. Hendrycks, T. Brown, and J. Steinhardt, “Testing robustness against unforeseen adversaries,” arXiv preprint arXiv:1908.08016, 2019.
[29] C. Laidlaw, S. Singla, and S. Feizi, “Perceptual adversarial robustness: Defense against unseen threat models,” in Proc. Int. Conf. Learning Representations, 2021.
[30] F. Croce and M. Hein, “Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks,” in Proc. Int. Conf. Machine Learning, 2020.
[31] M. Arjovsky, L. Bottou, I. Gulrajani, and D. Lopez-Paz, “Invariant risk minimization,” arXiv preprint arXiv:1907.02893, 2019.
[32] Y. Shi, J. Seely, P. H. S. Torr, N. Siddharth, A. Hannun, N. Usunier, and G. Synnaeve, “Gradient matching for domain generalization,” in Proc. Int. Conf. Learning Representations, 2022.
[33] Chen, T., Shang, W., & Guo, Z. (2024). Xsla: An SLA-aware heterogeneous XPU scheduling framework for edge AI inference. World Journal of Information Technology, 2(2), 48–59.
[34] Zou, J., Qin, Y., & Rhee, M. (2024). Beyond model scale: A task-aware reliability benchmark for large language models in clinical decision support. Innovation and Technology Studies, 1(1), 39–47.
[35] Fang, Q. (2024). Bias-aware large language models for equitable educational feedback and assessment. Trends in Social Sciences and Humanities Research, 2(1), 41–50.
[36] Qin, Y., Zou, J., & Rhee, M. (2022). An AI-driven intelligent transaction execution framework for internet finance platforms: Cost-sensitive real-time integrity interdiction. Eurasia Journal of Science and Technology, 4(2), 36–44.
[37] Wang, Y., & Zhang, C. (2023). AERIS: Adaptive executor scoped resource management for privacy preserving data processing in Apache Spark. Eurasia Journal of Science and Technology, 5(2), 25-33.
[38] Zhao, W., & Wang, B. (2022). CAPA: A prediction‑driven autoscaling framework for SLO‑aware cloud‑native machine learning inference. Journal of Computer Science and Electrical Engineering, 4(1), 8-16.
[39] Guo, Z., Chen, T., & Shang, W. (2022). Class‑conditional intermediate‑domain adversarial adaptation for cross‑device acoustic scene classification. Journal of Computer Science and Electrical Engineering, 4(1), 26-35
[40] Shen, A. (2023). Compute-efficient scaling of large sequential recommendation models under dynamic user behavior. World Journal of Information Technology, 1(1), 62–71.
[41] Fang, Q. (2024). True-EWS: Trustworthy early warning with equalized conformal guarantees for equitable student support in U.S. education. Educational Research and Human Development, 1(2), 44–54.
[42] Shen, A., & Huang, S. (2022). A systems-aware framework for intelligent large-scale recommendation models. Journal of Computer Science and Electrical Engineering, 4(1), 36–44.
Downloads
Published
Issue
Section
License
Copyright (c) 2026 Software Engineering and Artificial Intelligence Systems
This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.
