Heterogeneous Graph Neural Networks (HGNNs) are increasingly recognized for
their performance in areas like the web and e-commerce, where resilience
against adversarial attacks is crucial. However, existing adversarial attack
methods, which are primarily designed for homogeneous graphs, fall short when
applied to HGNNs due to their limited ability to address the structural and
semantic complexity of HGNNs. This paper introduces HGAttack, the first
dedicated gray box evasion attack method for heterogeneous graphs. We design a
novel surrogate model to closely resemble the behaviors of the target HGNN and
utilize gradient-based methods for perturbation generation. Specifically, the
proposed surrogate model effectively leverages heterogeneous information by
extracting meta-path induced subgraphs and applying GNNs to learn node
embeddings with distinct semantics from each subgraph. This approach improves
the transferability of generated attacks on the target HGNN and significantly
reduces memory costs. For perturbation generation, we introduce a
semantics-aware mechanism that leverages subgraph gradient information to
autonomously identify vulnerable edges across a wide range of relations within
a constrained perturbation budget. We validate HGAttack's efficacy with
comprehensive experiments on three datasets, providing empirical analyses of
its generated perturbations. Outperforming baseline methods, HGAttack
demonstrated significant efficacy in diminishing the performance of target HGNN
models, affirming the effectiveness of our approach in evaluating the
robustness of HGNNs against adversarial attacks.

HGAttack 是针对异构图设计的首个灰盒逃避攻击方法，通过设计一种新颖的代理模型，利用梯度方法实现扰动生成，提高了生成攻击在目标 HGNN 上的可转移性并显著降低了内存成本。在三个数据集上的综合实验证实了 HGAttack 的有效性。

HGAttack: 可转移的异构图对抗攻击

HGAttack: Transferable Heterogeneous Graph Adversarial Attack

We introduce ShortcutGen, a new data poisoning attack that generates
sample-dependent, error-minimizing perturbations by learning a generator. The
key novelty of ShortcutGen is the use of a randomly-initialized discriminator,
which provides spurious shortcuts needed for generating poisons. Different from
recent, iterative methods, our ShortcutGen can generate perturbations with only
one forward pass in a label-free manner, and compared to the only existing
generative method, DeepConfuse, our ShortcutGen is faster and simpler to train
while remaining competitive. We also demonstrate that integrating a simple
augmentation strategy can further boost the robustness of ShortcutGen against
early stopping, and combining augmentation and non-augmentation leads to new
state-of-the-art results in terms of final validation accuracy, especially in
the challenging, transfer scenario. Lastly, we speculate, through uncovering
its working mechanism, that learning a more general representation space could
allow ShortcutGen to work for unseen data.

介绍了用于数据污染的 ShortcutGen 方法，该方法使用深度学习自动生成错误最小化的扰动，并演示出增强策略能够进一步增强其鲁棒性。