GraphTextack: A Realistic Black-Box Node Injection Attack on LLM-Enhanced GNNs

Large Language Models (LLMs) have recently been integrated into Graph Neural Networks (GNNs) to improve learning on text-attributed graphs (TAGs), combining semantic-rich node features with structural information. However, this integration introduces dual vulnerabilities: GNNs are sensitive to structural perturbations, while LLM-derived features are vulnerable to prompt injection and adversarial phrasing. While existing adversarial attacks largely perturb structure or text independently, we find that uni-modal attacks cause only modest degradation in LLM-enhanced GNNs. Moreover, many existing attacks assume unrealistic capabilities, such as white-box access or direct modification of graph data. To address these gaps, we propose GraphTextack, the first black-box, multi-modal node injection attack designed specifically for LLM-enhanced GNNs. GraphTextack injects nodes with carefully crafted structure and semantics to degrade model performance, operating under a realistic threat model without relying on model internals or surrogate models. To navigate the combinatorial, non-differentiable search space of connectivity and feature assignments, GraphTextack introduces a novel evolutionary optimization framework with a multi-objective fitness function that balances local prediction disruption and global graph influence. Extensive experiments on multiple benchmark datasets and state-of-the-art LLM-enhanced GNN models show that GraphTextack significantly outperforms strong baselines, achieving higher drop in accuracy and lower runtime on average.