Metapath-free adversarial attacks against heterogeneous graph neural networks

Heterogeneous Graph Neural Networks (HeteGNNs) have exhibited remarkable performance by harnessing metapaths, abstract paths comprising node and link types, to capture intricate relationships. Recent studies have underscored the susceptibility of HeteGNNs to adversarial attacks involving minor perturbations such as edge modifications. However, existing attack methods, reliant on manually defined metapaths, may be impractical without domain-specific expertise. Even worse, depending on the metapath setting, the attack performance can vary significantly. In this paper, we find that such instability in attacks may be caused by the type imbalance issue within HeteGNNs, where edge types that exhibit similar performance when utilized individually are treated in a highly imbalanced manner when combined. Based on this finding, we introduce a novel black-box attack method HSA to eliminate the need for manually defined metapaths. Specifically, HSA first partitions the graph into single-edge-type subgraphs and queries their predictions to detail the type imbalance issue within the victim HeteGNN. Subsequently, HSA integrates data-driven prior knowledge by considering gradients and embedding similarities of node pairs to improve perturbation generation. This combined strategy enhances the perturbation generation process from both the target model and data perspectives. Experimental results validate the effectiveness of our approach can even comparable to gray-box attacks. • Our method, unlike the previous attack, does not require manual metapath setup. • Our approach is founded on our discovery called “Type Imbalance Issue”. • Experimental results validate the effectiveness of our approach.