Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

HGAttack: Transferable Heterogeneous Graph Adversarial Attack

He Zhao, Zhiwei Zeng, Yongwei Wang, Deheng Ye, Chunyan Miao

TL;DR

HGAttack addresses the vulnerability of heterogeneous Graph Neural Networks (HGNNs) to adversarial perturbations under a gray-box setting. It constructs a heterogeneous surrogate using meta-path induced graphs and per-path GCNs, fused via inter-path attention, and applies a semantics-aware gradient-based perturbation under a constrained budget $Δ$ to degrade target HGNN predictions. Experiments on ACM, IMDB, and DBLP show HGAttack consistently reduces target model performance beyond strong baselines, with memory efficiency gains from decomposing the global graph into subgraphs. The work provides actionable insights into attack strategies for HGNNs and highlights avenues for designing more robust heterogeneous graph models.

Abstract

Heterogeneous Graph Neural Networks (HGNNs) are increasingly recognized for their performance in areas like the web and e-commerce, where resilience against adversarial attacks is crucial. However, existing adversarial attack methods, which are primarily designed for homogeneous graphs, fall short when applied to HGNNs due to their limited ability to address the structural and semantic complexity of HGNNs. This paper introduces HGAttack, the first dedicated gray box evasion attack method for heterogeneous graphs. We design a novel surrogate model to closely resemble the behaviors of the target HGNN and utilize gradient-based methods for perturbation generation. Specifically, the proposed surrogate model effectively leverages heterogeneous information by extracting meta-path induced subgraphs and applying GNNs to learn node embeddings with distinct semantics from each subgraph. This approach improves the transferability of generated attacks on the target HGNN and significantly reduces memory costs. For perturbation generation, we introduce a semantics-aware mechanism that leverages subgraph gradient information to autonomously identify vulnerable edges across a wide range of relations within a constrained perturbation budget. We validate HGAttack's efficacy with comprehensive experiments on three datasets, providing empirical analyses of its generated perturbations. Outperforming baseline methods, HGAttack demonstrated significant efficacy in diminishing the performance of target HGNN models, affirming the effectiveness of our approach in evaluating the robustness of HGNNs against adversarial attacks.

HGAttack: Transferable Heterogeneous Graph Adversarial Attack

TL;DR

HGAttack addresses the vulnerability of heterogeneous Graph Neural Networks (HGNNs) to adversarial perturbations under a gray-box setting. It constructs a heterogeneous surrogate using meta-path induced graphs and per-path GCNs, fused via inter-path attention, and applies a semantics-aware gradient-based perturbation under a constrained budget to degrade target HGNN predictions. Experiments on ACM, IMDB, and DBLP show HGAttack consistently reduces target model performance beyond strong baselines, with memory efficiency gains from decomposing the global graph into subgraphs. The work provides actionable insights into attack strategies for HGNNs and highlights avenues for designing more robust heterogeneous graph models.

Abstract

Heterogeneous Graph Neural Networks (HGNNs) are increasingly recognized for their performance in areas like the web and e-commerce, where resilience against adversarial attacks is crucial. However, existing adversarial attack methods, which are primarily designed for homogeneous graphs, fall short when applied to HGNNs due to their limited ability to address the structural and semantic complexity of HGNNs. This paper introduces HGAttack, the first dedicated gray box evasion attack method for heterogeneous graphs. We design a novel surrogate model to closely resemble the behaviors of the target HGNN and utilize gradient-based methods for perturbation generation. Specifically, the proposed surrogate model effectively leverages heterogeneous information by extracting meta-path induced subgraphs and applying GNNs to learn node embeddings with distinct semantics from each subgraph. This approach improves the transferability of generated attacks on the target HGNN and significantly reduces memory costs. For perturbation generation, we introduce a semantics-aware mechanism that leverages subgraph gradient information to autonomously identify vulnerable edges across a wide range of relations within a constrained perturbation budget. We validate HGAttack's efficacy with comprehensive experiments on three datasets, providing empirical analyses of its generated perturbations. Outperforming baseline methods, HGAttack demonstrated significant efficacy in diminishing the performance of target HGNN models, affirming the effectiveness of our approach in evaluating the robustness of HGNNs against adversarial attacks.
Paper Structure (16 sections, 8 equations, 2 figures, 6 tables, 1 algorithm)

This paper contains 16 sections, 8 equations, 2 figures, 6 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Related Work
  3. Heterogeneous Graph Neural Networks
  4. Adversarial Attacks on Graph Data
  5. Methodology
  6. Preliminaries
  7. HGAttack: An Overview
  8. Heterogeneous Surrogate Model
  9. Generate Perturbations
  10. Experiments
  11. Experimental Settings
  12. Attacking Results
  13. Emperical Analysis
  14. Ablation Studies
  15. Efficiency
  16. ...and 1 more sections

Figures (2)

  • Figure 1: Overview of our HGAttack method. Our heterogeneous surrogate model first decomposes the input graph into meta-path induced graphs. Different GCNs are applied to learn different semantic embeddings and fused into the final embeddings through inter-meta path attention. The attack module searches for perturbations via gradient information with our semantics-aware mechanism. The perturbations are used to update the input graph and then iteratively generate perturbations until it reaches the budget size.
  • Figure 2: Histograms illustrating degree distributions of neighbor-type nodes and adversarial nodes across three datasets, with node degree on the X-axis and density on the Y-axis.