Abstract: Graph vertical federated learning(GVFL) is a distributed machine learning approach that integrates graph data with vertical federated learning,widely applied in fields such as financial services,healthcare,and social networks.This method not only preserves privacy but also leverages data diversity to significantly enhance model performance.However,studies indicate that GVFL is vulnerable to adversarial attacks.Existing adversarial attack methods targeting graph neural networks(GNN),such as Gradient Maximization Attack and Simplified Gradient Attack,still face challenges when applied in the GVFL framework.These challenges include low attack success rates,poor stealth,and inapplicability under defense conditions.To address these issues,this paper proposes a novel adversarial attack method for GVFL,termed Node and Feature Adversarial Attack(NFAttack).NFAttack designs node and feature attack strategies to conduct efficient attacks from multiple dimensions.The node attack strategy evaluates node importance using degree centrality metrics and disrupts high-centrality nodes by connecting a certain number of fake nodes to form adversarial edges.Meanwhile,the feature attack strategy introduces hybrid noise-composed of random noise and gradient noise-into node features,thereby affecting classification results.Experiments conducted on six datasets and three GNN models demonstrate that NFAttack achieves an average attack success rate of 80%,approximately 30% higher than other me-thods.Furthermore,NFAttack maintains strong attack performance even under various federated learning defense mechanisms.

Key words: Vertical federal learning, Graph neural network, Graph data, Node classification, Adversarial attack