HeteroHBA: A Generative Structure-Manipulating Backdoor Attack on Heterogeneous Graphs

TL;DR

HeteroHBA targets backdoor vulnerabilities in heterogeneous graph neural networks by jointly learning instance-adaptive triggers and connection patterns. It uses a saliency-guided candidate pool, GraphTrojanNet to generate stealthy trigger features and edges, and a bilevel optimization framework with AdaIN and MMD-based distribution alignment, followed by a post-generation refinement (IDA-AT). Extensive experiments on ACM, DBLP, and IMDB show superior attack success and resilience to heterogeneity-aware defenses like Cluster-based Structural Defense (CSD), while preserving clean performance. The work highlights practical backdoor risks in heterogeneous graph learning and motivates stronger, heterogeneity-aware defenses.

Abstract

Heterogeneous graph neural networks (HGNNs) have achieved strong performance in many real-world applications, yet targeted backdoor poisoning on heterogeneous graphs remains less studied. We consider backdoor attacks for heterogeneous node classification, where an adversary injects a small set of trigger nodes and connections during training to force specific victim nodes to be misclassified into an attacker-chosen label at test time while preserving clean performance. We propose HeteroHBA, a generative backdoor framework that selects influential auxiliary neighbors for trigger attachment via saliency-based screening and synthesizes diverse trigger features and connection patterns to better match the local heterogeneous context. To improve stealthiness, we combine Adaptive Instance Normalization (AdaIN) with a Maximum Mean Discrepancy (MMD) loss to align the trigger feature distribution with benign statistics, thereby reducing detectability, and we optimize the attack with a bilevel objective that jointly promotes attack success and maintains clean accuracy. Experiments on multiple real-world heterogeneous graphs with representative HGNN architectures show that HeteroHBA consistently achieves higher attack success than prior backdoor baselines with comparable or smaller impact on clean accuracy; moreover, the attack remains effective under our heterogeneity-aware structural defense, CSD. These results highlight practical backdoor risks in heterogeneous graph learning and motivate the development of stronger defenses.

Figures (8)

• Figure 1: Overall Backdoor Attack Process on a Heterogeneous Graph.
• Figure 2: HeteroHBA Algorithm Description
• Figure 3: Degree distributions of different node types.
• Figure 4: Alignment ablation results on IMDB. Left-to-right: w/o AdaIN+MMD, w/o MMD, w/o AdaIN, AdaIN+MMD.
• Figure 5: Hyperparameter Sensitivity Analysis: Attack Success Rate.