The goal of network representation learning is to learn low-dimensional node embeddings that capture the graph structure and are useful for solving downstream tasks. However, despite the proliferation of such methods, there is currently no study of their robustness to adversarial attacks. We provide the first adversarial vulnerability analysis on the widely used family of methods based on random walks. We derive efficient adversarial perturbations that poison the network structure and have a negative effect on both the quality of the embeddings and the downstream tasks. We further show that our attacks are transferable since they generalize to many models, and are successful even when the attacker is restricted.
Brief Summary:
The authors present a novel adversarial attack on node embedding method based on random walks. They focus on perturbing the structure of the network. Because the bi-level optimization problem can be highly challenging, they refer to factorize a random walk matrix which is proved equivalent to DeepWalk. The experimental results show that their approach can effectively mislead the node embedding from multi-classification. 
Quality:
This paper is well-written except for some minor spelling mistakes
Clarity:
This paper is quite clear and easy to follow.
Originality:
This work follow the proposal Qiu et al.(WSDM'18)'s proof and present a novel approach to calculate the loss when the network changes by A'.
Pros:
1. Detailed proofs presented in appendix
2. They present 6 questions and answer them with effective experiments.
3. They present a new way to attack node embedding by factorizing a equivalent matrix.
Cons:
1. I have noticed that Zügner et al.(KDD'18) present an adversarial attack method on GCN for graph data. I think it is reachable by the day the authors submitted this paper. This is opposite to the first sentence "Since this is the first work considering adversarial attacks on node embeddings there are no known
baselines" said in Section 4.
2. The author present the time analysis of their approach but the efficiency result of their approach is not presented.
3. To enforce misclassification of the target node t, the author set the candidate flip edges as edges around t. Does this mean only the node's local edges can mislead the target node from downstream tasks? I think the authors should consider more candidate edges but this may lead to larger time complexity.
4. Figure. 4 tells that low-degree nodes are easier to mis-classify. If the baseline method B_{rnd} randomly select edges to flip among the local area of node t, I think the result should be similar to the proposed approach on low-degree nodes because the flipped edges should be the same. 
== I have read the rebuttal. Thanks for the response.