Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

HeteroBA: A Structure-Manipulating Backdoor Attack on Heterogeneous Graphs

Honglin Gao, Xiang Li, Lan Zhao, Gaoxi Xiao

TL;DR

This work tackles backdoor vulnerabilities in heterogeneous graph neural networks by introducing HeteroBA, a targeted node-classification backdoor that injects trigger nodes with distribution-matched features and connects them via two strategies to primary and auxiliary nodes. The methodology splits into a Feature Generator, using KDE and Bernoulli sampling to mimic existing trigger-type features, and an Edge Generator, employing attention-based and clustering-based schemes to select influential auxiliary nodes for trigger propagation, guided by a surrogate SimpleHGN model. Empirical evaluation across three real-world datasets and multiple HGNN architectures demonstrates high attack success rates with minimal impact on clean accuracy, while a quantitative Stealthiness Score shows triggers blend well with the graph. The findings highlight vulnerabilities in HGNNs and underscore the need for robust defenses against backdoor threats in multi-relational graph settings, with future work extending to additional tasks and defense strategies.

Abstract

Heterogeneous graph neural networks (HGNNs) have recently drawn increasing attention for modeling complex multi-relational data in domains such as recommendation, finance, and social networks. While existing research has been largely focused on enhancing HGNNs' predictive performance, their robustness and security, especially under backdoor attacks, remain underexplored. In this paper, we propose a novel Heterogeneous Backdoor Attack (HeteroBA) framework for node classification tasks on heterogeneous graphs. HeteroBA inserts carefully crafted trigger nodes with realistic features and targeted structural connections, leveraging attention-based and clustering-based strategies to select influential auxiliary nodes for effective trigger propagation, thereby causing the model to misclassify specific nodes into a target label while maintaining accuracy on clean data. Experimental results on three datasets and various HGNN architectures demonstrate that HeteroBA achieves high attack success rates with minimal impact on the clean accuracy. Our method sheds light on potential vulnerabilities in HGNNs and calls for more robust defenses against backdoor threats in multi-relational graph scenarios.

HeteroBA: A Structure-Manipulating Backdoor Attack on Heterogeneous Graphs

TL;DR

This work tackles backdoor vulnerabilities in heterogeneous graph neural networks by introducing HeteroBA, a targeted node-classification backdoor that injects trigger nodes with distribution-matched features and connects them via two strategies to primary and auxiliary nodes. The methodology splits into a Feature Generator, using KDE and Bernoulli sampling to mimic existing trigger-type features, and an Edge Generator, employing attention-based and clustering-based schemes to select influential auxiliary nodes for trigger propagation, guided by a surrogate SimpleHGN model. Empirical evaluation across three real-world datasets and multiple HGNN architectures demonstrates high attack success rates with minimal impact on clean accuracy, while a quantitative Stealthiness Score shows triggers blend well with the graph. The findings highlight vulnerabilities in HGNNs and underscore the need for robust defenses against backdoor threats in multi-relational graph settings, with future work extending to additional tasks and defense strategies.

Abstract

Heterogeneous graph neural networks (HGNNs) have recently drawn increasing attention for modeling complex multi-relational data in domains such as recommendation, finance, and social networks. While existing research has been largely focused on enhancing HGNNs' predictive performance, their robustness and security, especially under backdoor attacks, remain underexplored. In this paper, we propose a novel Heterogeneous Backdoor Attack (HeteroBA) framework for node classification tasks on heterogeneous graphs. HeteroBA inserts carefully crafted trigger nodes with realistic features and targeted structural connections, leveraging attention-based and clustering-based strategies to select influential auxiliary nodes for effective trigger propagation, thereby causing the model to misclassify specific nodes into a target label while maintaining accuracy on clean data. Experimental results on three datasets and various HGNN architectures demonstrate that HeteroBA achieves high attack success rates with minimal impact on the clean accuracy. Our method sheds light on potential vulnerabilities in HGNNs and calls for more robust defenses against backdoor threats in multi-relational graph scenarios.

Paper Structure

This paper contains 32 sections, 18 equations, 3 figures, 6 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Related Work
  3. Heterogeneous Graph Neural Networks
  4. Backdoor Attack on Homogeneous Graph
  5. Attacks on Heterogeneous Graph Neural Networks
  6. Preliminaries and problem formulation
  7. Preliminaries
  8. Problem definition
  9. Methodology
  10. Feature generator
  11. Continuous Feature Generation
  12. Binary Feature Generation
  13. Edge Generator
  14. Attention-based strategy
  15. Clustering-based Strategy
  16. ...and 17 more sections

Figures (3)

  • Figure 1: Overall Backdoor Attack Process on a Heterogeneous Graph.
  • Figure 2: Attention distribution and Embedding Clustering
  • Figure 3: Comparison of attack success rates for HeteroBA-A and HeteroBA-C under different poison rates.