Blackknife: Hard-Label Query-Limited Black-Box Attacks on Heterogeneous Graph Neural Networks

2026-06-28

AI Summary

This work addresses the insufficient robustness of heterogeneous graph neural networks (HGNNs) under strict black-box settings—where model gradients, soft labels, and full graph structures are inaccessible—and proposes Blackknife, the first framework enabling effective black-box attacks using only local one-hop neighborhood structures and a minimal number of hard-label queries. Blackknife generates relation-preserving discrete structural perturbations through relation-aware surrogate modeling, continuous relaxation of edge modifications, and projected gradient optimization. Extensive experiments demonstrate that Blackknife achieves high attack success rates against state-of-the-art HGNN models on ACM, DBLP, and IMDB datasets, remaining effective even under topological defenses, thereby revealing the pronounced vulnerability of HGNNs to locally constrained adversarial attacks.

Abstract

Heterogeneous graph neural networks (HGNNs) have achieved strong performance in modeling complex graph-structured data with multiple node and relation types. However, their robustness under realistic black-box adversarial settings remains insufficiently explored. Existing attacks on HGNNs usually assume access to model gradients, soft prediction scores, or the complete graph structure, which is often unavailable when HGNN-based services are deployed as closed systems. In this paper, we propose Blackknife, a hard-label, query-limited, and structure-limited black-box evasion attack framework for heterogeneous graph neural networks. Blackknife assumes no access to the victim model architecture, parameters, gradients, logits, confidence scores, or the full graph structure. Instead, it only relies on locally observable one-hop heterogeneous structures and a small number of hard-label queries. To generate effective perturbations under these strict constraints, Blackknife first constructs a local relation-aware surrogate model from observable heterogeneous neighborhoods. It then relaxes discrete edge addition and deletion operations into continuous soft weights and optimizes them through projected gradient descent. Finally, the optimized perturbations are discretized into relation-preserving structural rewiring operations and verified using limited hard-label feedback from the victim model. Extensive experiments on three benchmark heterogeneous graph datasets, including ACM, DBLP, and IMDB, demonstrate that Blackknife consistently achieves strong attack success rates against representative HGNN models. The results further show that Blackknife remains effective under topology-based defense strategies, revealing the vulnerability of HGNNs to local structure-limited black-box attacks.

Problem

• heterogeneous graph neural networks
• black-box attack
• hard-label query
• structure-limited
• adversarial robustness

Innovation

• hard-label attack
• heterogeneous graph neural networks
• black-box attack
• query-limited
• structure-limited