Transferable Black-Box Injection Attack against Heterogeneous Graph Neural Networks

Recent studies have shown that Heterogeneous Graph Neural Networks (HetGNNs) are vulnerable to adversarial attacks. Existing methods rely on the gradient information of source models or surrogate models to generate perturbations, which limits the attack of transferability and effectiveness in real-world attack scenarios, while consuming time costs. In this paper, we propose a novel framework, i.e., Transferable Black-Box Injection Attack against Heterogeneous Graph Neural Networks (TBI-Attack), to address these challenges. Specifically, we introduce a voting-based key nodes recognizer based on different meta-paths to identify key nodes in relational subgraphs. Subsequently, we present a semantic-confused feature generator that leverages self-supervised learning to integrate neighborhood information from different relational subgraphs, generating malicious nodes with conflicting semantic features. Furthermore, malicious nodes are injected into various relational subgraphs, disrupting their specific semantic functionality and systematically impairing the message-passing process of HetGNNs. Extensive experiments are conducted on four authentic datasets to validate the effectiveness and transferability of TBI-Attack and the corresponding superiority to state-of-the-art methods.