HeteroHBA: A Generative Structure-Manipulating Backdoor Attack on Heterogeneous Graphs

TL;DR

HeteroHBA introduces a novel generative backdoor attack on heterogeneous graph neural networks, effectively manipulating node classifications while maintaining stealth and robustness against defenses.

Contribution

It proposes a new generative framework for backdoor attacks on heterogeneous graphs, combining saliency screening, feature synthesis, and distribution alignment for improved effectiveness and stealth.

Findings

Achieves higher attack success rates than prior methods

Maintains high clean accuracy during attacks

Remains effective against heterogeneity-aware defenses

Abstract

Heterogeneous graph neural networks (HGNNs) have achieved strong performance in many real-world applications, yet targeted backdoor poisoning on heterogeneous graphs remains less studied. We consider backdoor attacks for heterogeneous node classification, where an adversary injects a small set of trigger nodes and connections during training to force specific victim nodes to be misclassified into an attacker-chosen label at test time while preserving clean performance. We propose HeteroHBA, a generative backdoor framework that selects influential auxiliary neighbors for trigger attachment via saliency-based screening and synthesizes diverse trigger features and connection patterns to better match the local heterogeneous context. To improve stealthiness, we combine Adaptive Instance Normalization (AdaIN) with a Maximum Mean Discrepancy (MMD) loss to align the trigger feature distribution with benign statistics, thereby reducing detectability, and we optimize the attack with a bilevel objective that jointly promotes attack success and maintains clean accuracy. Experiments on multiple real-world heterogeneous graphs with representative HGNN architectures show that HeteroHBA consistently achieves higher attack success than prior backdoor baselines with comparable or smaller impact on clean accuracy; moreover, the attack remains effective under our heterogeneity-aware structural defense, CSD. These results highlight practical backdoor risks in heterogeneous graph learning and motivate the development of stronger defenses.