mlsanityData to 14 Oct 2026

Heterogeneous Graph Backdoor Attack

arXiv 2506.00191 ↗First posted 30 May 2025cs.CR cs.AI cs.LGcited by 0

Not on the map. Why?

Abstract (arXiv)

Heterogeneous Graph Neural Networks (HGNNs) excel in modeling complex, multi-typed relationships across diverse domains, yet their vulnerability to backdoor attacks remains unexplored. To address this gap, we conduct the first investigation into the susceptibility of HGNNs to existing graph backdoor attacks, revealing three critical issues: (1) high attack budget required for effective backdoor injection, (2) inefficient and unreliable backdoor activation, and (3) inaccurate attack effectiveness evaluation. To tackle these issues, we propose the Heterogeneous Graph Backdoor Attack (HGBA), the first backdoor attack specifically designed for HGNNs, introducing a novel relation-based trigger mechanism that establishes specific connections between a strategically selected trigger node and poisoned nodes via the backdoor metapath. HGBA achieves efficient and stealthy backdoor injection with minimal structural modifications and supports easy backdoor activation through two flexible strategies: Self-Node Attack and Indiscriminate Attack. Additionally, we improve the ASR measurement protocol, enabling a more accurate assessment of attack effectiveness. Extensive experiments demonstrate that HGBA far surpasses multiple state-of-the-art graph backdoor attacks in black-box settings, efficiently attacking HGNNs with low attack budgets. Ablation studies show that the strength of HBGA benefits from our trigger node selection method and backdoor metapath selection strategy. In addition, HGBA shows superior robustness against node feature perturbations and multiple types of existing graph backdoor defense mechanisms. Finally, extension experiments demonstrate that the relation-based trigger mechanism can effectively extend to tasks in homogeneous graph scenarios, thereby posing severe threats to broader security-critical domains.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 37 of its 86 references that are in the map. First posted on arXiv 30 May 2025.

Builds on

37 of 86 references.

References · 37

  1. 2016Semi-Supervised Classification with Graph Convolutional Networkscited by 11,361
  2. 2017Graph Attention Networkscited by 8,923
  3. 2017Inductive Representation Learning on Large Graphscited by 6,320
  4. 2017Modeling Relational Data with Graph Convolutional Networkscited by 1,694
  5. 2016Revisiting Semi-Supervised Learning with Graph Embeddingscited by 976
  6. 2018Link Prediction Based on Graph Neural Networkscited by 832
  7. 2019Heterogeneous Graph Attention Networkcited by 734
  8. 2020TUDataset: A collection of benchmark datasets for learning with graphscited by 728
  9. 2019GraphSAINT: Graph Sampling Based Inductive Learning Methodcited by 618
  10. 2020Heterogeneous Graph Transformercited by 582
  11. 2019Graph Transformer Networkscited by 523
  12. 2020Graph Neural Networks in Recommender Systems: A Surveycited by 494
25 more
  1. 2020MAGNN: Metapath Aggregated Graph Neural Network for Heterogeneous Graph Embeddingcited by 304
  2. 2019A Fair Comparison of Graph Neural Networks for Graph Classificationcited by 244
  3. 2020GNNGuard: Defending Graph Neural Networks against Adversarial Attackscited by 195
  4. 2021Are we really making much progress? Revisiting, benchmarking, and refining heterogeneous graph neural networkscited by 176
  5. 2021GraphSMOTE: Imbalanced Node Classification on Graphs with Graph Neural Networkscited by 147
  6. 2021A Survey of Graph Neural Networks for Recommender Systems: Challenges, Methods, and Directionscited by 144
  7. 2020Backdoor Attacks to Graph Neural Networkscited by 128
  8. 2020Graph Backdoorcited by 112
  9. 2020Heterogeneous Graph Neural Networks for Malicious Account Detectioncited by 96
  10. 2021A Review on Graph Neural Network Methods in Financial Applicationscited by 78
  11. 2022Simple and Efficient Heterogeneous Graph Neural Networkcited by 71
  12. 2019DEMO-Net: Degree-specific Graph Neural Networks for Node and Graph Classificationcited by 59
  13. 2021Graph Learning based Recommender Systems: A Reviewcited by 59
  14. 2023Unnoticeable Backdoor Attacks on Graph Neural Networkscited by 45
  15. 2021Explainability-based Backdoor Attacks Against Graph Neural Networkscited by 42
  16. 2021Heterogeneous Global Graph Neural Networks for Personalized Session-based Recommendationcited by 22
  17. 2024Rethinking Graph Backdoor Attacks: A Distribution-Preserving Perspectivecited by 22
  18. 2021Adversarial Active Learning based Heterogeneous Graph Neural Network for Fake News Detectioncited by 21
  19. 2022Transferable Graph Backdoor Attackcited by 19
  20. 2022Motif-Backdoor: Rethinking the Backdoor Attack on Graph Neural Networks via Motifscited by 19
  21. 2024Distributed Backdoor Attacks on Federated Graph Learning and Certified Defensescited by 15
  22. 2023Graph Mining for Cybersecurity: A Surveycited by 5
  23. 2024Disambiguated Node Classification with Graph Neural Networkscited by 4
  24. 2023Benchmarking Toxic Molecule Classification using Graph Neural Networks and Few Shot Learningcited by 1
  25. 2024E-SAGE: Explainability-based Defense Against Backdoor Attacks on Graph Neural Networkscited by 1

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2025HeteroBA: A Structure-Manipulating Backdoor Attack on Heterogeneous Graphs
  2. 2025HeteroHBA: A Generative Structure-Manipulating Backdoor Attack on Heterogeneous Graphs
  3. 2026Universal Graph Backdoor Defense: A Feature-based Homophily Perspective
  4. 2025Stealthy Dual-Trigger Backdoors: Attacking Prompt Tuning in LM-Empowered Graph Foundation Models
  5. 2024Effective backdoor attack on graph neural networks in link prediction tasks
  6. 2025Boosting Graph Robustness Against Backdoor Attacks: An Over-Similarity Perspective
  7. 2024Graph Neural Backdoor: Fundamentals, Methodologies, Applications, and Future Directions
  8. 2025Towards Effective, Stealthy, and Persistent Backdoor Attacks Targeting Graph Foundation Models