ML Security PapersHeteroHBA: A Generative Structure-Manipulating Backdoor Attack on Heterogeneous Graphs
Honglin Gao , Lan Zhao , Junhao Ren , Xiang Li , Gaoxi Xiao
Published on arXiv
2512.24665
Model Poisoning
OWASP ML Top 10 — ML10
Key Finding
HeteroHBA consistently achieves higher attack success than prior backdoor baselines on multiple real-world heterogeneous graphs and remains effective under the CSD heterogeneity-aware structural defense
HeteroHBA
Novel technique introduced
Heterogeneous graph neural networks (HGNNs) have achieved strong performance in many real-world applications, yet targeted backdoor poisoning on heterogeneous graphs remains less studied. We consider backdoor attacks for heterogeneous node classification, where an adversary injects a small set of trigger nodes and connections during training to force specific victim nodes to be misclassified into an attacker-chosen label at test time while preserving clean performance. We propose HeteroHBA, a generative backdoor framework that selects influential auxiliary neighbors for trigger attachment via saliency-based screening and synthesizes diverse trigger features and connection patterns to better match the local heterogeneous context. To improve stealthiness, we combine Adaptive Instance Normalization (AdaIN) with a Maximum Mean Discrepancy (MMD) loss to align the trigger feature distribution with benign statistics, thereby reducing detectability, and we optimize the attack with a bilevel objective that jointly promotes attack success and maintains clean accuracy. Experiments on multiple real-world heterogeneous graphs with representative HGNN architectures show that HeteroHBA consistently achieves higher attack success than prior backdoor baselines with comparable or smaller impact on clean accuracy; moreover, the attack remains effective under our heterogeneity-aware structural defense, CSD. These results highlight practical backdoor risks in heterogeneous graph learning and motivate the development of stronger defenses.
Key Contributions
- Saliency-based screening to select the most influential auxiliary neighbor nodes for trigger attachment in heterogeneous graphs
- AdaIN + MMD loss combination to align trigger feature distributions with benign statistics, improving stealthiness against detection
- Bilevel optimization objective that jointly maximizes attack success rate while preserving clean node classification accuracy
🛡️ Threat Analysis
HeteroHBA injects trigger nodes and connections during HGNN training so that specific victim nodes are misclassified into an attacker-chosen label at test time — a classic backdoor/trojan attack with hidden, trigger-activated targeted behavior.