A Supplementary Materials

It conducts adversarial attacks on global node classification of a single graph. The attack performance is evaluated by the decrease of node classification accuracy. We also include equal number of randomly selected disconnected links that servers as negative samples. We use both positive and negative examples for evaluation. The Gaussian distribution is common in nature.