Minimum-Budget Topology Attack Paradigm

• The minimum-budget topology attack paradigm is defined by leveraging key graph invariants, such as girth and connectivity, to determine the minimal adversarial resources needed for a successful attack.
• It applies to diverse domains like decentralized learning, hardware obfuscation, and GNN security, where attacks are executed through minimal edge flips, node corruptions, or oracle-free queries.
• Empirical results show that attack success sharply increases once adversarial budgets exceed topology-determined thresholds, driving corresponding defense strategies based on network structure normalization.

A minimum-budget topology attack is defined as an adversarial strategy that achieves a specified impact on a system governed by network structure, while incurring the smallest possible adversarial resource expenditure constrained by the topology. In networked learning, hardware obfuscation, adversarial machine learning, and network inference, this paradigm has emerged as a rigorous method to analyze both the power and limitations of graph-based attacks under explicit resource or information constraints. These attacks are fundamentally determined not just by the adversary’s capabilities but by the combinatorial structure of the underlying graph—the feasible paths, cycles, and connectivity—directly dictating the minimum adversarial budget, commonly measured in edge flips, node corruptions, or oracle queries, necessary for successful compromise or inference.

1. Topological Foundations and Formal Definitions

The minimum-budget topology attack paradigm characterizes scenarios in which the topology of an underlying graph or network, together with explicitly bounded resources (budget), completely determines the possibility and cost of a successful attack.

Generic setup

• Let $G = (V, E)$ be an undirected (or directed) graph representing the substrate (e.g., communication network, circuit netlist, or data exchange structure).
• The attacker's budget $b$ is a quantitative resource constraint: number of edges that can be perturbed, nodes that can be corrupted, embedding queries that can be made, or key bits guessed.
• Attack feasibility is encoded as a constrained combinatorial or algebraic problem: e.g., reconstructing hidden data, extracting a secret key, or forcing a misclassification, with a minimal set of actions.
• The minimum required budget is determined by the topology of $G$ (e.g., girth, motifs, connectivity, cycles), producing precise lower and upper bounds for attack feasibility.

2. Paradigmatic Instances Across Domains

(a) Decentralized Learning and Reconstruction (Privacy Attacks)

Key instance: Topology-based reconstruction in multi-party summation protocols (Dekker et al., 2023). Here, in a decentralized network $G=(V,E)$, each user possesses private data. Adversaries are honest-but-curious nodes $C\subseteq V$ (budget $b=|C|$). The central theorem establishes that an exact reconstruction of any honest user’s secret is possible if and only if $G$ contains a cycle of length at most $2b$. Thus, the girth (length $L$ of the shortest cycle) sets a threshold: if $b < L/2$, no attack of budget $b$0 can succeed. For acyclic networks ($b$1), reconstruction is information-theoretically impossible regardless of $b$2.

(b) Oracle-less Logic Circuit Attacks

Key instance: Topology-guided attacks on locked netlists (Zhang et al., 2020). An adversary uses zero functional queries (“oracle-less") and instead relies on topology—performing subgraph isomorphism to locate duplicated "unit functions" across the netlist and infer secret keys by matching patterns. The paradigm is exemplified by attacks that succeed with vanishing oracle/computational resources, purely because topological repetitions are present; security can be restored by uniform insertion of key-gates to eliminate unique matches, thereby “budget-exhausting” any such topology-only attack.

(c) GNN Robustness and Sparse Adversarial Edge Attacks

Key instance: For node classification in GNNs, conventional fixed-budget $b$3 topology attacks set a uniform per-node or global perturbation limit (Liu et al., 2023, Zhu et al., 2023). The minimum-budget topology attack instead adapts the budget per node, seeking the smallest number of edge modifications required to alter a node’s classification (Zhang et al., 2024, Hojny et al., 2024). This yields not just a successful misclassification, but a fine-grained per-node robustness certificate (the $b$4 adversarial distance), and an explicit attack path reflecting local structural vulnerabilities.

(d) Cyber-Security and Layered Trees

Key instance: Budget-constrained prize maximization in layered-security trees (Agnarsson et al., 2016, Agnarsson et al., 2015). The minimum-budget attack finds the smallest total penetration cost needed to extract value above a “game-over” threshold by navigating the optimal rooted subtree, where each traversal incurs edge and node costs correlated to underlying security layers.

(e) Network Topology Inference via Virtual Embedding

Key instance: Dictionary-based attacks reconstructing hidden network topologies via a minimum number of adaptive VNet embedding queries (Pignolet et al., 2013). Here, the request complexity—the total number of (yes/no) queries required—can be minimized in terms of discovered graph motifs, with tight bounds $b$5 for trees and controlled by motif-dictionary structure for more complex topologies.

3. Topology-Dependent Attack Thresholds and Theorems

Minimum-budget topology attacks are quantitatively governed by structural graph invariants that serve as attack thresholds:

• Girth Bound ($b$6): In decentralized learning, if the adversarial budget $b$7 is less than half the girth ($b$8), reconstruction is impossible; otherwise, attack probability increases with $b$9 (Dekker et al., 2023).
• Motif Dictionary Complexity ($G$0): In network inference, the maximum ratio of dictionary search cost to new nodes covered determines overall request complexity (Pignolet et al., 2013).
• Rooted Tree Structure: In layered-security, only specific trees (paths, stars, 3-caterpillars, 4-spiders) admit globally optimal security under any budget assignment (Agnarsson et al., 2016).
• Key-Stub Uniqueness: In logic locking, the success of topology-guided attacks depends on the existence of unique matchings of small unit functions; security can be fully restored by design adjustments that eliminate unique matches (Zhang et al., 2020).

A summary of study-specific attack feasibility criteria is provided below:

Domain	Topological Threshold	Minimal Feasible Attack
Decentralized Learning (Dekker et al., 2023)	$G$1 (girth $G$2)	$G$3 colluders, $G$4 enables attack
Logic Locking (Zhang et al., 2020)	Unique match of unit function exists	One subgraph-isomorphism
GNNs (Zhang et al., 2024)	Node connectivity, neighborhood degrees	$G$5-minimal edge set for flip
Layered Security (Agnarsson et al., 2016)	Tree type (path, star, etc.)	Optimal subtree assignment
Network Inference (Pignolet et al., 2013)	Motif dictionary coverage	Word-motif search cost

4. Algorithms and Attack Workflows

Attack algorithms under this paradigm explicitly exploit the interplay of resource constraint and topology:

• Projected Gradient Descent with Dynamic Budget (Zhang et al., 2024): Iteratively seeks the minimal number of edge perturbations to force misclassification by adaptively shrinking or enlarging the allowed budget per node until success, efficiently solving a discrete non-convex constraint problem.
• Subgraph Isomorphism Matching (Zhang et al., 2020): Recursively matches hypothesized key-dependent subgraphs systematically across the netlist, relying on unique structural repetition to infer keys.
• Motif-Dictionary and Adaptive Querying (Pignolet et al., 2013): Employs a dictionary of graph motifs and parses the substrate by sequential embedding tests, minimizing requests per newly-discovered motif instance.
• Dynamic-Programming Over Trees (Agnarsson et al., 2015, Agnarsson et al., 2016): For layered trees, dynamic programming or PTAS solves the maximum-subtree-or-prize problem under a cost budget, exhibiting tractable behavior for restricted tree types or under cost rounding.

A shared feature is the explicit tie between feasible adversarial action and a computable property (cycle length, subgraph count, request complexity) of the underlying graph.

5. Empirical Success Rates, Complexity, and Defenses

Results across domains consistently show that attack feasibility exhibits sharp threshold effects at the topology-determined budget:

• Decentralized Learning (Dekker et al., 2023): On random 18-node subgraphs, $G$6 colluders yield an exact reconstruction probability of $G$7 (mean 8.8 summed rounds per adversary), sharply increasing for $G$8.
• Logic Locking (Zhang et al., 2020): Topology-guided attacks achieve $G$9 key recovery in minutes on 128-bit benchmark circuits without any functional queries, but can be rendered ineffective (SR ≈ 0%) by uniform locking of repeated structures.
• GNNs (Zhang et al., 2024): Adaptive minimum-budget attacks (MiBTack) reach $G=(V,E)$0 target misclassification with strictly fewer total perturbations than any fixed-budget method, providing node-level robustness metrics. For example, on Cora/GCN, MiBTack achieves 0% accuracy (full compromise) with 330 edge flips versus 357/384 for competitors, and avoids redundant perturbations.

Defenses, in turn, are often topology-driven—eliminating cycles of length $G=(V,E)$1, uniformizing local structures, or increasing per-node adversarial distance—rather than relying solely on local obfuscation or noise.

6. Assumptions, Limitations, and Extensions

Minimum-budget topology attack analyses generally assume:

• Static, known underlying graph topology, or controlled logic/circuit structure.
• Attacker resources precisely measured and bounded (flip count, colluders, requests).
• Protocols or models expose only structurally necessary outputs (sum values, circuit descriptors, classification logits).
• Honest-but-curious (in learning) or zero-oracle (hardware) adversaries.

Primary limitations include:

• For some settings, the structural conditions (e.g., girth bounds) are known to be sufficient but not always necessary for security, implying possible topological “gaps.”
• Realistic defense mechanisms (differential privacy, probabilistic obfuscation, dynamic sampling) may interact with topology in subtle, unquantified ways.
• Attack complexity may still be exponential in general graphs without strong motif-based decompositions; practical algorithms focus on well-structured or sparsely connected networks.
• Extensions to richer operations (beyond sum, e.g., products, comparisons), on-line/active adversaries, and partial observability remain open research problems.

Suggested extensions lead towards composable, topology-aware formal security theories; quantification of residual uncertainty (entropy) under partial attack; and combined usage of topology and instance-dependent defenses (e.g., topology-aware differential privacy) (Dekker et al., 2023).

7. Impact, Related Methodologies, and Future Directions

The minimum-budget topology attack paradigm formalizes and quantifies a class of adversarial strategies whose effectiveness is dictated by the combinatorial properties of network graphs. It has provided decisive insights into:

• The sharpness of privacy and security thresholds in decentralized protocols,
• The (in)security of hardware obfuscation schemes under zero-query attacks,
• The ability to measure and visualize per-node adversarial robustness in complex learning systems,
• The design and verification of defenses that exploit global as well as local topological structure,
• Network inference through minimally adaptive, motif-driven querying.

Its methodology—mapping adversarial resource requirements to explicit topological invariants—has motivated a substantial cross-domain transfer of techniques (from learning theory to circuit design to network inference) and continues to guide both offensive and defensive research. Ongoing work seeks to extend the paradigm to temporally dynamic networks, compositional and hierarchical topologies, and adaptive or proactive defense strategies, charting a path for robust systems design grounded in provable, topology-aware guarantees.