Strong Target Attack on Hypergraph Neural Networks via Label Poisoning and Structure Modification

TL;DR

This paper introduces a new method to attack hypergraph neural networks by precisely misclassifying nodes into target classes through label poisoning and structure modification.

Contribution

The paper proposes STALS, a novel strong target attack framework for HGNNs that enables precise control over misclassification targets.

Findings

STALS selects the optimal target class using feature similarity and hypergraph structure adaptability.

The method outperforms existing baseline methods in terms of success classification rate on four mainstream datasets.

Gradient-guided hyperedge reconstruction maximizes the propagation of mislabeled information within budget constraints.

Abstract

Hypergraph Neural Networks (HGNNs) have become an important tool for processing complex structured data due to their ability to model higher-order associative relationships. However, the inherent adversarial vulnerabilities of HGNNs may raise serious security risks. The associated risks are far more pronounced in strong target attacks, which are highly targeted and demand the accurate misclassification of source-class nodes into predefined target classes. Current research on attacks against HGNNs mostly focuses on untargeted attacks or common target attacks, and lacks attacks that precisely control the attack class. Therefore, the research related to strong target attacks is still in an undeveloped state. To fill this research gap, this paper proposes a Strong Target Attack framework for HGNNs based on Label poisoning and Structure modification (STALS). The framework first uses feature similarity and hypergraph structure adaptability to select the optimal target class. Subsequently, the nodes are label-poisoned under the label change budget constraint. A gradient-guided greedy hyperedge reconstruction strategy is used to optimize the association relationship between poisoned nodes and hyperedges within the structure modification budget, maximize the propagation efficiency of mislabeled information, and achieve stable directed misclassification from source class nodes to target classes. We conducted extensive experiments on four mainstream datasets, and the experimental results show that STALS achieves excellent attack performance and significantly outperforms existing baseline methods in terms of success classification rate.

Figures