Heterogeneous Graph Backdoor Attack

2025-05-30

AI Summary

This work systematically identifies three critical vulnerabilities of heterogeneous graph neural networks (HGNNs) under graph backdoor attacks: high injection cost, unreliable trigger activation, and inaccurate attack success rate (ASR) evaluation. To address these, we propose HGBA—the first dedicated backdoor attack framework for HGNNs. HGBA introduces a relation-aware trigger mechanism that leverages backdoor metapaths to establish directed connections between triggers and poisoned nodes; designs two activation strategies—self-node and agnostic—to enhance stealth and adaptability; and revises the ASR evaluation protocol for greater fidelity. Extensive experiments demonstrate that HGBA achieves highly efficient and stealthy injection under low resource budgets, significantly outperforming state-of-the-art methods in ASR. It exhibits strong robustness against feature perturbations and mainstream defenses. Moreover, its core mechanisms are generalizable to homogeneous graph settings.

Technology Category

• Machine Learning: Graph-based Machine Learning
• Reasoning under Uncertainty: Graphical Models
• Data Mining & Knowledge Management: Graph Mining, Social Network Analysis & Community

Application Category

• Graph Algorithms and Modeling for the Web: Graph neural networks and deep learning approaches for Web-related graphs
• Search and Retrieval-Augmented AI: Web evaluation methodologies and metrics
• Semantics and Knowledge: Methods to enhance, augment, integrate or synergize semantic models such as knowledge graphs and LLMs

Abstract

Heterogeneous Graph Neural Networks (HGNNs) excel in modeling complex, multi-typed relationships across diverse domains, yet their vulnerability to backdoor attacks remains unexplored. To address this gap, we conduct the first investigation into the susceptibility of HGNNs to existing graph backdoor attacks, revealing three critical issues: (1) high attack budget required for effective backdoor injection, (2) inefficient and unreliable backdoor activation, and (3) inaccurate attack effectiveness evaluation. To tackle these issues, we propose the Heterogeneous Graph Backdoor Attack (HGBA), the first backdoor attack specifically designed for HGNNs, introducing a novel relation-based trigger mechanism that establishes specific connections between a strategically selected trigger node and poisoned nodes via the backdoor metapath. HGBA achieves efficient and stealthy backdoor injection with minimal structural modifications and supports easy backdoor activation through two flexible strategies: Self-Node Attack and Indiscriminate Attack. Additionally, we improve the ASR measurement protocol, enabling a more accurate assessment of attack effectiveness. Extensive experiments demonstrate that HGBA far surpasses multiple state-of-the-art graph backdoor attacks in black-box settings, efficiently attacking HGNNs with low attack budgets. Ablation studies show that the strength of HBGA benefits from our trigger node selection method and backdoor metapath selection strategy. In addition, HGBA shows superior robustness against node feature perturbations and multiple types of existing graph backdoor defense mechanisms. Finally, extension experiments demonstrate that the relation-based trigger mechanism can effectively extend to tasks in homogeneous graph scenarios, thereby posing severe threats to broader security-critical domains.

Problem

• HGNNs' vulnerability to backdoor attacks is unexplored
• Existing attacks require high budget and are unreliable
• Current evaluation methods inaccurately measure attack effectiveness

Innovation

• Relation-based trigger mechanism for HGNNs
• Minimal structural modifications for stealthy injection
• Improved ASR measurement for accurate assessment