Research map / Adversarial robustness and security / Attacks on text and graphs

HyperNear: Unnoticeable Node Injection Attacks on Hypergraph Neural Networks

ICML 2025 · Adversarial robustness and security › Attacks on text and graphs · approach: Graph neural network robustness

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes HyperNear, a black-box node injection attack on hypergraph neural networks that uses a feature-based homophily constraint to keep injected nodes stealthy while degrading node classification accuracy.

Problem

Hypergraph neural networks are vulnerable to adversarial attacks, but security research has largely ignored hypergraph-specific structure; naive node injection attacks noticeably disrupt hypergraph homophily and are easy to detect.

Approach

Injects new nodes with perturbed features into randomly selected hyperedges, then refines hyperedge connections by adversarial gradient-based splitting, while penalizing changes in feature-based hypergraph homophily so the attack stays unnoticeable.

Key results

• On UniSAGE, HyperNear reduces Cora-CA accuracy from 74.13% to 60.24%, and on PubMed from 74.31% to 55.31%, outperforming Random, NDA and FGA baselines.
• Transfer to HyperGCN, HGNN, ED-HNN and UniGCNII: e.g., Cora accuracy for HGNN drops from 79.01% to 52.19%.
• Feature-based homophily ratio remains largely unchanged after HyperNear attack in visualization (Fig. 3), while naive attacks reduce it (e.g., Cora-CA 0.6129 to 0.5416).

Measured effects reported in the paper

Surprising findings

• Randomly injected nodes sometimes slightly improved victim model accuracy.

Limitations

• Unnoticeability is supported only by empirical analysis; no formal characterization of detectability under hypergraph metrics.
• Existing graph defenses may not transfer to hypergraphs and no defense is evaluated.
• Hyperparameter sensitivity to lambda and injection rate alpha requires tuning.

Experimental setup

Datasets: Cora Cora-CA CiteSeer DBLP-CA PubMed

Benchmarks: Cora Cora-CA CiteSeer DBLP-CA PubMed

Metrics: classification accuracy homophily ratio

Baselines: Random injection Node Degree Attack Fast Gradient Attack

Builds on: Fast Gradient Attack UniGNN HyperGCN ED-HNN

Closest papers by meaning

• Hypergraph Attacks via Injecting Homogeneous Nodes into Elite Hyperedges (AAAI 2025 · similarity 0.90)
• HyperDefender: A Robust Framework for Hyperbolic GNNs (AAAI 2025 · similarity 0.87)
• Highly Imperceptible Black-Box Graph Injection Attacks with Reinforcement Learning (AAAI 2025 · similarity 0.87)
• Training-Free Message Passing for Learning on Hypergraphs (ICLR 2025 · similarity 0.87)
• Attack by Yourself: Effective and Unnoticeable Multi-Category Graph Backdoor Attacks with Subgraph Triggers Pool (NeurIPS 2025 · similarity 0.87)
• Trapping Attacker in Dilemma: Examining Internal Correlations and External Influences of Trigger for Defending GNN Backdoors (NeurIPS 2026 · similarity 0.86)