Research map / Adversarial robustness and security / Attacks on text and graphs
Hypergraph Attacks via Injecting Homogeneous Nodes into Elite Hyperedges
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes IE-Attack, a node-injection evasion attack on hypergraph neural networks that injects one KDE-generated homogeneous node into hyperedges selected via a node-spanning "cycle ratio" criterion.
Problem
Adversarial attacks on hypergraph neural networks have been limited to gradient-guided hypergraph modification, which ignores node spanning across hyperedges and the group identity of hyperedges, yielding weak and detectable attacks.
Approach
Identify elite hyperedges via a node "cycle ratio" computed from H·Hᵀ (node spanning), then inject a single node whose features are sampled from a KDE fit to the elite node and refined with a surrogate HGNN, so the injected node resembles the hyperedge group and evades detection.
Key results
- On Cora with Hyper-KNN, IE-Attack reaches 55.92% misclassification versus 52.09% for the best baseline G-NIA (clean 25.24%).
- On Citeseer with Hyper-KNN, IE-Attack reaches 72.00% misclassification versus 56.93% for G-NIA*.
- Under PCA and HBOS detectors, IE-Attack remains the strongest on all five datasets, e.g. 79.20% on Citeseer under PCA.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use IE-Attack instead of the strongest baseline | HGNN attacks · Cora, Citeseer, Pubmed, Chameleon, and Lastfm across Hyper-KNN, Hyper-HOR, and Hyper-L1 | misclassification rate (%) | Helped |
| Add elite hyperedge selection (R1) (ablation) | IE-Attack · Cora, Hyper-KNN | misclassification rate (%): 30.80 -> 59.60 | Helped |
| Add KDE feature sampling (R2) (ablation) | IE-Attack · Cora, Hyper-KNN | misclassification rate (%): 39.40 -> 59.60 | Helped |
| Add the node generator (R3) (ablation) | IE-Attack · Cora, Hyper-KNN | misclassification rate (%): 29.50 -> 59.60 | Helped |
| Use the Gaussian kernel instead of Tophat or Epanechnikov (ablation) | IE-Attack node feature generation · Chameleon, Hyper-KNN | misclassification rate (%): 46.20 vs. 45.20 | Hurt |
| Use the Gaussian kernel instead of Tophat or Epanechnikov (ablation) | IE-Attack node feature generation · Lastfm, Hyper-HOR | misclassification rate (%): 64.77 vs. 64.70 | Hurt |
Surprising findings
- GIA-R, DICE, FGA and IGA barely improve over the clean misclassification rate on hypergraphs, suggesting random or gradient-guided hyperedge selection is ineffective.
Limitations
- Evaluated only in evasion setting on one HGNN surrogate/victim family with white-box knowledge.
- Does not address black-box attacks or different HGNN variants (stated as future work).
- Hyperparameter choices (elite budget, kernel) are tuned per dataset and hypergraph model.
Experimental setup
Datasets: Cora Citeseer Pubmed Chameleon Lastfm
Benchmarks: Cora Citeseer Pubmed Chameleon Lastfm
Metrics: Misclassification rate
Baselines: GIA-Random DICE FGA IGA G-NIA G-NIA_CANA
Builds on: G-NIA G-NIA_CANA HyperAttack Hyper-KNN Hyper-L1
Closest papers by meaning
- HyperNear: Unnoticeable Node Injection Attacks on Hypergraph Neural Networks (ICML 2025 · similarity 0.90)
- HyperDefender: A Robust Framework for Hyperbolic GNNs (AAAI 2025 · similarity 0.86)
- Highly Imperceptible Black-Box Graph Injection Attacks with Reinforcement Learning (AAAI 2025 · similarity 0.85)
- Training-Free Message Passing for Learning on Hypergraphs (ICLR 2025 · similarity 0.84)
- K-hop Hypergraph Neural Network: A Comprehensive Aggregation Approach (AAAI 2025 · similarity 0.84)
- Hypergraph Neural Architecture Search (AAAI 2024 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.