Abstract Graph neural networks (GNNs) which apply the deep neural networks to graph data have achieved signifificant performance for the task of semisupervised node classifification. However, only few work has addressed the adversarial robustness of GNNs. In this paper, we fifirst present a novel gradient-based attack method that facilitates the diffificulty of tackling discrete graph data. When comparing to current adversarial attacks on GNNs, the results show that by only perturbing a small number of edge perturbations, including addition and deletion, our optimization-based attack can lead to a noticeable decrease in classifification performance. Moreover, leveraging our gradientbased attack, we propose the fifirst optimizationbased adversarial training for GNNs. Our method yields higher robustness against both different gradient based and greedy attack methods without sacrifificing classifification accuracy on original graph