HeTa: Relation-wise Heterogeneous Graph Foundation Attack Model

TL;DR

HeTa is a novel attack model for heterogeneous graph neural networks that leverages shared vulnerabilities across models and graphs, enabling efficient, transferable, and adaptable perturbations to evaluate and improve their robustness.

Contribution

The paper introduces HeTa, a relation-wise foundation attack model that uses a surrogate to identify shared attack units, facilitating generalizable and quick perturbations across different HGNNs and graphs.

Findings

HeTa achieves strong attack performance across various HGNNs.

The attack model demonstrates high transferability to unseen HGs.

Shared vulnerability patterns exist across different HGNNs from a relation-aware perspective.

Abstract

Heterogeneous Graph Neural Networks (HGNNs) are vulnerable, highlighting the need for tailored attacks to assess their robustness and ensure security. However, existing HGNN attacks often require complex retraining of parameters to generate specific perturbations for new scenarios. Recently, foundation models have opened new horizons for the generalization of graph neural networks by capturing shared semantics across various graph distributions. This leads us to ask:Can we design a foundation attack model for HGNNs that enables generalizable perturbations across different HGNNs, and quickly adapts to new heterogeneous graphs (HGs)? Empirical findings reveal that, despite significant differences in model design and parameter space, different HGNNs surprisingly share common vulnerability patterns from a relation-aware perspective. Therefore, we explore how to design foundation HGNN attack criteria by mining shared attack units. In this paper, we propose a novel relation-wise heterogeneous graph foundation attack model, HeTa. We introduce a foundation surrogate model to align heterogeneity and identify the importance of shared relation-aware attack units. Building on this, we implement a serialized relation-by-relation attack based on the identified relational weights. In this way, the perturbation can be transferred to various target HGNNs and easily fine-tuned for new HGs. Extensive experiments exhibit powerful attack performances and generalizability of our method.