A Supplementary Materials

A.1 Comparison with Existing Meta Learning-based Adversarial Attack Techniques Meta-Self [125] is a poisoning attack model for node classification by leveraging meta-learning to generate attacks, i.e., using meta-gradients to solve the bilevel optimization problem. It conducts adversarial attacks on global node classification of a single graph. It aims to solve a bilevel optimization problem: (1) training classification on graphs and (2) attacking graphs. It gradually improves attack performance by using meta learning to iteratively solve the above two problems. The GMA model utilizes meta learning to find good attack starting points in two graphs.