Transferable Hypergraph Attack via Injecting Nodes into Pivotal Hyperedges

TL;DR

Facing adversarial threats to hypergraph neural networks (HGNNs), the paper identifies a common vulnerability arising from significant differences in hyperedge pivotality along information aggregation paths. It proposes TH-Attack, a transferable hypergraph attack built from a pivotal hyperedge recognizer and a pivotal-edge feature inverter that injects malicious nodes into selected hyperedges to disrupt propagation; the inverter optimizes a cosine-based divergence with a soft threshold $t$ and a regularization weight $\lambda$. The method achieves black-box transferability across multiple HGNNs and six real-world datasets, outperforming state-of-the-art hypergraph injection and modification attacks, especially at low budgets $\eta$. Ablation studies confirm the essential roles of pivotal-edge identification, the cosine-distance loss, and the malicious feature generation in driving performance degradation.

Abstract

Recent studies have demonstrated that hypergraph neural networks (HGNNs) are susceptible to adversarial attacks. However, existing methods rely on the specific information mechanisms of target HGNNs, overlooking the common vulnerability caused by the significant differences in hyperedge pivotality along aggregation paths in most HGNNs, thereby limiting the transferability and effectiveness of attacks. In this paper, we present a novel framework, i.e., Transferable Hypergraph Attack via Injecting Nodes into Pivotal Hyperedges (TH-Attack), to address these limitations. Specifically, we design a hyperedge recognizer via pivotality assessment to obtain pivotal hyperedges within the aggregation paths of HGNNs. Furthermore, we introduce a feature inverter based on pivotal hyperedges, which generates malicious nodes by maximizing the semantic divergence between the generated features and the pivotal hyperedges features. Lastly, by injecting these malicious nodes into the pivotal hyperedges, TH-Attack improves the transferability and effectiveness of attacks. Extensive experiments are conducted on six authentic datasets to validate the effectiveness of TH-Attack and the corresponding superiority to state-of-the-art methods.

Figures (5)

• Figure 1: An illustration of motivation. (a) In HGNNs, the pivotality of hyperedges along the information aggregation paths varies significantly. (b) Attacking hyperedges with high pivotality significantly impacts HGNN performance, resulting in incorrect predictions for nodes that depend on this hyperedge for feature information.
• Figure 2: Framework of TH-Attack. (a) A hypergraph constructed from a regular graph as input for the model. (b) We propose a hyperedge recognizer via pivotality assessment to identify pivotal hyperedges. (c) Generating malicious nodes using a feature inverter based on pivotal hyperedges. (d) By injecting malicious nodes into the pivotal hyperedge to obtain an attacked hypergraph, which serves as input for different HGNNs and disrupts the performance of HGNNs.
• Figure 3: The information aggregation paths of HGNNs.
• Figure 4: The Accuracy of TH-Attack compared to baselines under different $\eta$ against HGNN.
• Figure 5: The Accuracy of TH-Attack under different $\lambda$ and $t$ against HGNN.

Theorems & Definitions (2)

• Theorem 1
• Theorem 2