ML Security PapersTransferable Hypergraph Attack via Injecting Nodes into Pivotal Hyperedges
Meixia He 1, Peican Zhu 1, Le Cheng 1,1, Yangming Guo 1, Manman Yuan 2, Keke Tang 3
Published on arXiv
2511.10698
Input Manipulation Attack
OWASP ML Top 10 — ML01
Key Finding
TH-Attack outperforms state-of-the-art hypergraph injection attack baselines (IE-Attack, H3NI) in both attack effectiveness and transferability across multiple HGNN architectures on six real-world datasets.
TH-Attack
Novel technique introduced
Recent studies have demonstrated that hypergraph neural networks (HGNNs) are susceptible to adversarial attacks. However, existing methods rely on the specific information mechanisms of target HGNNs, overlooking the common vulnerability caused by the significant differences in hyperedge pivotality along aggregation paths in most HGNNs, thereby limiting the transferability and effectiveness of attacks. In this paper, we present a novel framework, i.e., Transferable Hypergraph Attack via Injecting Nodes into Pivotal Hyperedges (TH-Attack), to address these limitations. Specifically, we design a hyperedge recognizer via pivotality assessment to obtain pivotal hyperedges within the aggregation paths of HGNNs. Furthermore, we introduce a feature inverter based on pivotal hyperedges, which generates malicious nodes by maximizing the semantic divergence between the generated features and the pivotal hyperedges features. Lastly, by injecting these malicious nodes into the pivotal hyperedges, TH-Attack improves the transferability and effectiveness of attacks. Extensive experiments are conducted on six authentic datasets to validate the effectiveness of TH-Attack and the corresponding superiority to state-of-the-art methods.
Key Contributions
- First formalization of the common vulnerability caused by significant differences in hyperedge pivotality along aggregation paths in HGNNs
- Hyperedge recognizer via pivotality assessment to identify the most structurally critical hyperedges in information aggregation paths
- Feature inverter that generates maximally semantically divergent malicious nodes for injection into pivotal hyperedges, achieving superior transferability over state-of-the-art methods
🛡️ Threat Analysis
TH-Attack crafts malicious nodes (adversarial inputs) and injects them into pivotal hyperedges at inference time to cause misclassification across multiple HGNN architectures — a classic evasion/input manipulation attack. The transferability across architectures is analogous to black-box transferability of adversarial examples.