Pith. sign in

REVIEW 5 major objections 6 minor 38 references

HeteroBA: A Structure-Manipulating Backdoor Attack on Heterogeneous Graphs

T0 review · 5 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read HeteroBA shows that a backdoor attack on heterogeneous graph node classification can reach near-perfect success with minimal clean accuracy loss.

desk verdict A first-of-its-kind backdoor attack for heterogeneous GNNs, but the label-flipping confound and weak ablation make the core claim about structure manipulation unproven. read the letter →

arxiv 2505.21140 v1 pith:L2QLKHLJ submitted 2025-05-27 cs.LG cs.AI

Honglin Gao , Xiang Li , Lan Zhao , Gaoxi Xiao This is my paper
classification cs.LGcs.AI
keywords HeterogeneousGraphBackdoorAttackNeuralNetworksNodeClassificationTriggerInjectionRobustness
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

HeteroBA is the first backdoor attack framework designed specifically for node classification on heterogeneous graphs. The paper claims that an attacker who can insert a few trigger nodes and flip the training labels of targeted nodes can make a victim heterogeneous graph neural network misclassify those targets into a chosen class, while the model's accuracy on clean data barely changes. On the ACM, DBLP, and IMDB datasets, with HAN, HGT, and SimpleHGN as victims, the reported attack success rate reaches 1.0000 in several settings and clean accuracy drop stays near zero, beating the adapted homogeneous-graph baselines UGBA and CGBA. The paper also introduces a quantitative stealthiness score for node-injection attacks, measuring how close injected nodes are to clean nodes in feature distribution and degree.

What carries the argument

The central object is the poisoned heterogeneous graph $\tilde{G}=(\tilde{V},\tilde{E},\tilde{X})$ obtained by adding trigger nodes $V_{t_{tr}}^{(new)}$ with features sampled from the estimated distribution of existing nodes of the same type, and edges that connect each trigger to a target primary-type node and to the top-$d_{t_b}$ auxiliary-type nodes in each auxiliary type. The two selection strategies define what 'top' means: the attention-based strategy ranks auxiliary nodes by the summed product of first-layer and second-layer attention coefficients $\alpha(v_{aux}^{(2)}, v_{t_{tr}}^{(1)})\cdot\alpha(v_{t_{tr}}^{(1)}, v_{y_t})$, while the clustering-based strategy ranks them by average cosine similarity to all other auxiliary nodes in the embedding space. These two-hop connections are what carry adversarial information from the trigger toward the target node's representation, and they are what the paper's ablation isolates by comparing against random connections.

What would settle it

Train a victim HGNN on a poisoned graph whose trigger nodes are connected to randomly chosen auxiliary nodes (the paper's HeteroBA-R ablation), and measure whether the attack success rate falls substantially below the attention- and clustering-based variants; an independent replication with more seeds and larger graphs would confirm that the selection mechanism, not the trigger injection itself, drives the reported ASR.

Watch

Extended reading notes

Core claim

On the paper's own terms, the discovery is that the relational structure of heterogeneous graphs is what makes backdoor attacks both effective and hard to spot. The attack constructs a poisoned graph by adding trigger nodes of an existing type, sampling each feature dimension of those nodes from a kernel density estimate (continuous) or a Bernoulli model (binary) of the trigger-type nodes already linked to non-target class nodes, so the new nodes look statistically ordinary. Each trigger node is then connected to a poisoned target node and to the top-ranked auxiliary-type nodes selected by either an attention-score product or an average cosine-similarity rank from a surrogate model. The paper argues that these auxiliary connections are the load-bearing part: they give the trigger a two-hop pathway to high-influence nodes, so that a victim model trained on the poisoned graph learns to route target nodes' representations to the designated class when the trigger pattern is present.

Load-bearing premise

The attack collapses if the adversary cannot add nodes of an existing type to the graph or cannot change the training labels of the targeted nodes, since both operations are built into the method.

Editorial extensions

If this is right

  • If HeteroBA holds, any deployed HGNN that trains on partially adversary-controlled data—for example a fraud-detection or recommendation model—can be steered to misclassify chosen entities without degrading overall accuracy.
  • Standard accuracy-based monitoring will not reveal the poisoning, because the clean accuracy drop is near zero; defenders must look at structural and distributional anomalies in the graph, such as the injected node's degree and feature distribution.
  • The proposed stealthiness score gives defenders a concrete, computable signal: a low score flags candidate injected nodes whose features or degrees deviate from the clean population, which can seed detection and pruning defenses.
  • The two edge-selection strategies both beat random connections, so the actionable finding is that connectivity to high-influence or high-centrality auxiliary nodes is the core mechanism, not the particular attention or clustering formula.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A likely extension is that the same trigger-injection mechanism transfers to link prediction or recommendation tasks, where the trigger could be connected to the user or item nodes being targeted, because the representation-steering effect is task-agnostic.
  • A sharp test of the attack's claimed stealth would be to run a simple detector that flags nodes whose neighbors' labels are concentrated on one class; if such nodes are easily found in the poisoned graph, the stealthiness score may not capture what a real defender would notice.
  • The observed sharp rise of ASR with poison rate looks like a percolation transition; if that threshold behavior is real, defenders could compute a budget line below which poisoning is not worthwhile, giving a practical bound for training-set auditing.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper proposes HeteroBA, a backdoor attack framework for heterogeneous graph node classification. The method injects trigger nodes of a chosen type, generates their features by sampling from KDE or Bernoulli estimates of existing nodes of that type, and connects them to targeted primary-type nodes plus auxiliary nodes selected by either an attention-based or a clustering-based ranking. The authors evaluate on ACM, DBLP, and IMDB with HAN, HGT, and SimpleHGN as victim models, reporting ASR and CAD against adapted versions of UGBA and CGBA. They also propose a stealthiness score, run an ablation with random edge selection (HeteroBA-R), and study the effect of poison rate. The central claim is that the structure-manipulating strategies achieve high attack success rates with minimal clean accuracy drop and outperform homogeneous-graph baselines.

Significance. If the claims were fully supported, this would be the first dedicated backdoor attack framework for heterogeneous graph node classification, opening a new area and motivating heterogeneous-graph-specific defenses. The paper has clear strengths: it formulates a concrete attack pipeline, provides a generative procedure for trigger-node features, and evaluates across three datasets and three HGNN architectures, reporting many high ASR values with near-zero CAD. The authors also state that the code is open-sourced. However, the central comparative and ablative claims are not currently supported: the CGBA baseline is confounded with label flipping, the ablation results contradict the paper's own summary in several settings, and the proposed stealthiness score is not validated against any detection method. These issues require substantial additional experiments and a careful rewriting of the conclusions.

major comments (5)
  1. [Section 5.2.3, Table 3] The claim that HeteroBA-R 'consistently exhibits a significant drop in ASR' is contradicted by the paper's own numbers. In Table 3, DBLP/HGT class 0 shows HeteroBA-R at 0.9950 while HeteroBA-C and HeteroBA-A are 0.9343 and 0.9130, respectively. In Table 5, ACM/HAN with the 'field' trigger class 0 shows HeteroBA-R at 0.9021 versus 0.3167 (C) and 0.7612 (A). The ablation therefore does not support the conclusion that attention/clustering edge selection is responsible for the attack's effectiveness; in several settings the random strategy performs better. The authors need to report the per-setting comparison and discuss when and why random edge selection can match or beat the proposed strategies before drawing the stated conclusion.
  2. [Section 5.1.3, Table 3, Section 1] The comparison with CGBA is confounded by label flipping. The introduction states that HeteroBA operates 'after modifying the labels of the targeted nodes', while CGBA is by construction a clean-label attack and is adapted in Section 5.1.3 without any label modification. Thus the ASR differences in Table 3 (e.g., IMDB/HAN class 1: 0.9984 vs 0.4523) vary two factors simultaneously: the structural trigger design and the label-supervision scheme. The authors must add (i) a clean-label variant of HeteroBA that does not flip labels, and (ii) a simple dirty-label baseline that flips labels and attaches each target node to one randomly chosen trigger node. Without these, the advantage over CGBA cannot be attributed to the proposed structural strategies. Note also that the Section 5.2.1 claim that HeteroBA 'consistently' outperforms CGBA is false as stated: DBLP/HAN class 0 gives CGBA 0.8993 vs HeteroBA-C 0.7849 and HeteroBA-A 0.7783.
  3. [Section 3.2, Eq. (1), Algorithm 1] The formal threat model does not include label modification, yet Section 1 and the experimental setup rely on flipping the labels of the targeted primary-type nodes. This ambiguity matters because it changes the attack from clean-label to dirty-label and affects the practical threat model. The paper should define the allowed modifications F(G) explicitly to include or exclude label changes, state the attack's data-poisoning requirements, and discuss the feasibility of inserting nodes of arbitrary trigger type (e.g., 'field' nodes in ACM or 'director' nodes in IMDB) in realistic deployment scenarios.
  4. [Section 5.1.4, Section 5.2.2] The proposed Stealthiness Score is introduced and used as the sole evidence for the stealthiness claim, but it is never validated. The score measures only the average Wasserstein feature distance and degree difference between injected and clean nodes; there is no experiment showing that this score correlates with evasion of a backdoor detector, a pruning defense, or human inspection. A higher score on this self-defined metric does not establish that the attack is less detectable. The authors should either validate the metric against existing defenses or soften the stealthiness claim.
  5. [Section 5.1.3] The UGBA adaptation is handicapping. UGBA is run on a homogeneous conversion of the graph, and the inserted nodes and edges are assigned random types when converting back. Since edge types are the defining structure in heterogeneous graphs, randomly assigned types can break the semantics that UGBA optimized for, making the baseline artificially weak. A fair comparison requires either a type-preserving adaptation of UGBA or a clear argument for why random type assignment is a faithful transfer. As it stands, the reported ASR advantage over UGBA may be partly an artifact of the adaptation.
minor comments (6)
  1. [Appendix B] The training hyperparameters table is missing; the text refers to 'Table??'.
  2. [Front matter] The CCS Concepts block contains placeholder text 'Do Not Use This Code' and the ACM reference-format footer ('Received 20 February 2007...') remains in the submitted version.
  3. [References] References [22] and [23] are the same paper (Graph backdoor, USENIX 2021), and references [32] and [33] are also duplicates; these should be consolidated.
  4. [Section 5.2.1] The claim that HeteroBA 'consistently' outperforms UGBA and CGBA is not supported by Tables 3 and 5, which contain multiple exceptions beyond the DBLP/HAN case noted in the major comments; the claim should be qualified or replaced with a summary statistic.
  5. [Table 3 caption] The HeteroBA-R column is not defined in the table caption; it is only introduced in Section 5.2.3, which makes the table difficult to read.
  6. [Section 5.2.4, Fig. 3] The text refers to 'the left figure' and 'the right figure' of Fig. 3, but the caption does not explicitly identify which panel corresponds to HeteroBA-A and which to HeteroBA-C; please label the panels directly in the figure or caption.

Circularity Check

1 steps flagged · score 2.0 of 10

No circularity in the central ASR/CAD evaluation; one minor self-referential element in the proposed stealthiness score.

  1. self definitional [Section 5.1.4 (Eqs. 13-17); Section 4.1 (Eqs. 2-5); Section 4.2 and Algorithm 1 (lines 5, 12)]
    "Feature similarity measures how closely the injected nodes' feature distribution matches that of clean nodes... Sim_feat = 1/(1+WD). Structural similarity evaluates the degree consistency between injected and clean nodes... Δd = |d_trg − d_clean|... Sim_struct = 1/(1+Δd)."

    The feature generator samples trigger features from the KDE/Bernoulli distribution of existing trigger-type nodes (Eqs. 2-5), and the edge generator sets each trigger's connection count to d_tb, the average degree of existing trigger-type nodes (Algorithm 1 lines 5 and 12). The stealthiness score rewards precisely feature Wasserstein distance near zero and degree difference near zero. Therefore HeteroBA's high Table 4 score is largely a restatement of the generator's design objective, not an independent detection test. The central attack-effectiveness claim is unaffected because ASR is measured on held-out poisoned test nodes and CAD on clean test nodes.

full rationale

The paper's derivation chain for attack success is self-contained: trigger features are sampled from a clean-data KDE/Bernoulli model (Eqs. 2-5), trigger edges are chosen by attention or clustering on a clean surrogate model (Eqs. 6-10), and ASR/CAD are measured on held-out poisoned and clean test nodes (Eqs. 11-12). None of these steps fits a parameter to the reported ASR, so the main result is not circular. The only self-referential element is the newly proposed Stealthiness Score (Eqs. 13-17), which measures the same feature and degree statistics that the generator was built to match; this makes the Table 4 advantage partly tautological but does not bear on the attack success results. The paper cites its own prior work [6, 29] for background vulnerability claims and a phase-transition analogy only; these citations are not load-bearing for the new attack. A separate threat-model concern, that the comparison with clean-label CGBA confounds label flipping with structural choice, is a correctness or fairness issue rather than circularity.

Assumptions & free parameters 3 free parameters · 4 assumptions · 1 invented entities

The central method relies on a threat model that permits node insertion and label flipping, on a surrogate model's attention and embeddings being transferable, and on several hand-chosen hyperparameters (stealthiness weights, KDE bandwidth). These are not derived from first principles and are not independently validated.

free parameters (3)
  • Stealthiness weights w1, w2 = 0.5 each (default)
    In Eq. (17), these weights combine feature and structural similarity into the stealthiness score. The paper gives no justification or sensitivity analysis for this choice.
  • KDE bandwidth h = Not specified
    In Eq. (2), the bandwidth of the kernel density estimator is a hyperparameter that controls the smoothness of the sampled trigger features. The paper does not state its value or selection procedure.
  • Poison rate = 5% of primary-type nodes
    Section 5.1.2 sets the poisoned training and test sets to 5% of V_tp. This is an experimental choice; Fig. 3 varies it, but the main results use only one value.
assumptions (4)
  • domain assumption The attacker can add nodes of the trigger type and flip labels of targeted primary-type nodes during training.
    Section 3.2 defines the poisoned graph as including new trigger nodes and modified labels. No justification is given for why real systems would permit this capability.
  • domain assumption KDE on the empirical feature distribution of V'_ttr yields realistic trigger features.
    Eq. (2) assumes the trigger-type nodes linked to non-target class nodes form a representative sample; if this subset is small or biased, sampled features may be unrealistic.
  • domain assumption SimpleHGN's attention weights and embeddings identify auxiliary nodes that will influence the victim model after retraining.
    Section 4.2 uses a surrogate model trained on clean data to score node influence. The transferability of these scores to HAN, HGT, and SimpleHGN victims is not demonstrated.
  • ad hoc to paper Attention and clustering scores rank nodes that improve backdoor propagation when connected to triggers.
    The influence score in Eq. (6) and average similarity in Eq. (10) are heuristics chosen by the authors without proof or systematic validation that they are optimal for attack success.
invented entities (1)
  • Trigger nodes
    purpose: Inserted into the graph to carry the backdoor trigger pattern and propagate adversarial influence to target nodes.
    Trigger nodes are the attack's mechanism, not an independently observable entity. Their existence and properties are entirely defined by the paper's method.

how reviews work

0 comments
Cite this review

Pith. "Pith review of HeteroBA: A Structure-Manipulating Backdoor Attack on Heterogeneous Graphs." pith.science (2026). https://pith.science/paper/L2QLKHLJ

@misc{pith2026250521140,
  author       = {Pith},
  title        = {Pith review of: HeteroBA: A Structure-Manipulating Backdoor Attack on Heterogeneous Graphs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/L2QLKHLJ}},
  note         = {Machine review of arXiv:2505.21140}
}
read the original abstract

Heterogeneous graph neural networks (HGNNs) have recently drawn increasing attention for modeling complex multi-relational data in domains such as recommendation, finance, and social networks. While existing research has been largely focused on enhancing HGNNs' predictive performance, their robustness and security, especially under backdoor attacks, remain underexplored. In this paper, we propose a novel Heterogeneous Backdoor Attack (HeteroBA) framework for node classification tasks on heterogeneous graphs. HeteroBA inserts carefully crafted trigger nodes with realistic features and targeted structural connections, leveraging attention-based and clustering-based strategies to select influential auxiliary nodes for effective trigger propagation, thereby causing the model to misclassify specific nodes into a target label while maintaining accuracy on clean data. Experimental results on three datasets and various HGNN architectures demonstrate that HeteroBA achieves high attack success rates with minimal impact on the clean accuracy. Our method sheds light on potential vulnerabilities in HGNNs and calls for more robust defenses against backdoor threats in multi-relational graph scenarios.

Figures

Figures reproduced from arXiv: 2505.21140 by the authors.

Figure 1
Figure 1. Overall Backdoor Attack Process on a Heteroge [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Attention distribution and Embedding Clustering [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗
Figure 3
Figure 3. Comparison of attack success rates for HeteroBA-A [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

38 extracted references · 34 canonical work pages

  1. [1]

    Yang Chen, Zhonglin Ye, Haixing Zhao, and Ying Wang. 2023. Feature-Based Graph Backdoor Attack in the Node Classification Task.International Journal of Intelligent Systems2023, 1 (2023), 5418398

    work page 2023

  2. [2]

    Pengzhou Cheng, Zongru Wu, Wei Du, Haodong Zhao, Wei Lu, and Gongshen Liu. 2023. Backdoor attacks and countermeasures in natural language processing models: A comprehensive security review.arXiv preprint arXiv:2309.06055(2023)

    arXiv 2023

  3. [3]

    Enyan Dai, Minhua Lin, Xiang Zhang, and Suhang Wang. 2023. Unnoticeable backdoor attacks on graph neural networks. InProceedings of the ACM Web Conference 2023. ACM, New York, NY, 2263–2273

    work page 2023

  4. [4]

    Saman Forouzandeh, Mehrdad Rostami, Kamal Berahmand, and Razieh Sheikh- pour. 2024. Health-aware food recommendation system with dual attention in heterogeneous graphs.Computers in Biology and Medicine169 (2024), 107882

    work page 2024

  5. [5]

    Xinyu Fu, Jiani Zhang, Ziqiao Meng, and Irwin King. 2020. MAGNN: Metap- ath aggregated graph neural network for heterogeneous graph embedding. In Proceedings of the Web Conference 2020. ACM, New York, NY, 2331–2341

    work page 2020

  6. [6]

    Honglin Gao and Gaoxi Xiao. 2024. Top k enhanced reinforcement learning at- tacks on heterogeneous graph node classification.arXiv preprint arXiv:2408.01964 (2024)

    work page arXiv 2024

  7. [7]

    Jun Hu, Bryan Hooi, and Bingsheng He. 2024. Efficient heterogeneous graph learning via random projection.IEEE Transactions on Knowledge and Data Engi- neering(2024)

    work page 2024

  8. [8]

    Ziniu Hu, Yuxiao Dong, Kuansan Wang, and Yizhou Sun. 2020. Heterogeneous graph transformer. InProceedings of the Web Conference 2020. ACM, New York, NY, 2704–2710

    work page 2020

Show all 38 references
  1. [9]

    Yiming Li. 2023. Poisoning-based backdoor attacks in computer vision. In Proceedings of the AAAI Conference on Artificial Intelligence. Vol. 37. AAAI Press, Menlo Park, CA, 16121–16122

    2023

  2. [10]

    Wenfei Liang, Yanan Zhao, Rui She, Yiming Li, and Wee Peng Tay. 2024. Fed- SheafHN: Personalized Federated Learning on Graph-structured Data.arXiv preprint arXiv:2405.16056(2024)

    2024 arXiv

  3. [11]

    Yunfei Liu, Xingjun Ma, James Bailey, and Feng Lu. 2020. Reflection backdoor: A natural backdoor attack on deep neural networks. InComputer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part X 16. Springer, 182–199

    2020

  4. [12]

    Yujia Liu, Kang Zeng, Haiyang Wang, Xin Song, and Bin Zhou. 2021. Content matters: A GNN-based model combined with text semantics for social network cascade prediction. InPacific-Asia Conference on Knowledge Discovery and Data Mining. Springer, 728–740

    2021

  5. [13]

    Qingsong Lv, Ming Ding, Qiang Liu, Yuxiang Chen, Wenzheng Feng, Siming He, Chang Zhou, Jianguo Jiang, Yuxiao Dong, and Jie Tang. 2021. Are we really making much progress? Revisiting, benchmarking and refining heterogeneous graph neural networks. InProceedings of the 27th ACM S...

    2021

  6. [14]

    Giulia Muzio, Leslie O’Bray, and Karsten Borgwardt. 2021. Biological network analysis with deep learning.Briefings in Bioinformatics22, 2 (2021), 1515–1530

    2021

  7. [15]

    Trung-Kien Nguyen, Zemin Liu, and Yuan Fang. 2023. Link prediction on latent heterogeneous graphs. InProceedings of the ACM Web Conference 2023. ACM, New York, NY, 263–273

    2023

  8. [16]

    Amirreza Salamat, Xiao Luo, and Ali Jafari. 2021. HeteroGraphRec: A hetero- geneous graph-based neural networks for social recommendations.Knowledge- Based Systems217 (2021), 106817

    2021

  9. [17]

    Xuan Sheng, Zhaoyang Han, Piji Li, and Xiangmao Chang. 2022. A survey on backdoor attack and defense in natural language processing. In2022 IEEE 22nd International Conference on Software Quality, Reliability and Security (QRS). IEEE, 809–820

    2022

  10. [18]

    George R Terrell and David W Scott. 1992. Variable kernel density estimation. The Annals of Statistics(1992), 1236–1265

    1992

  11. [19]

    Jianfei Wang, Cuiqing Jiang, Lina Zhou, and Zhao Wang. 2024. Representing and discovering heterogeneous interactions for financial risk assessment of SMEs. Expert Systems with Applications247 (2024), 123330

    2024

  12. [20]

    Xiao Wang, Houye Ji, Chuan Shi, Bai Wang, Yanfang Ye, Peng Cui, and Philip S Yu. 2019. Heterogeneous graph attention network. InThe World Wide Web Conference. ACM, New York, NY, 2022–2032

    2019

  13. [21]

    Bin Wu, Kuo-Ming Chao, and Yinsheng Li. 2024. Heterogeneous graph neural networks for fraud detection and explanation in supply chain finance.Information Systems121 (2024), 102335

    2024

  14. [23]

    Zhaohan Xi, Ren Pang, Shouling Ji, and Ting Wang. 2021. Graph backdoor. In 30th USENIX Security Symposium (USENIX Security 21). 1523–1540

    2021

  15. [24]

    Sheng Xiang, Dawei Cheng, Chencheng Shang, Ying Zhang, and Yuqi Liang

  16. [25]

    Xiaogang Xing, Ming Xu, Yujing Bai, and Dongdong Yang. 2024. A clean-label graph backdoor attack method in node classification task.Knowledge-Based Systems304 (2024), 112433

    2024

  17. [26]

    Siyong Xu, Cheng Yang, Chuan Shi, Yuan Fang, Yuxin Guo, Tianchi Yang, Luhao Zhang, and Maodi Hu. 2021. Topic-aware heterogeneous graph neural network for link prediction. InProceedings of the 30th ACM international conference on information & knowledge management. ACM, New Yor...

    2021

  18. [27]

    Bo Yan, Yang Cao, Haoyu Wang, Wenchuan Yang, Junping Du, and Chuan Shi

  19. [28]

    Zi Ye, Yogan Jaya Kumar, Goh Ong Sing, Fengyan Song, and Junsong Wang. 2022. A comprehensive survey of graph neural networks for knowledge graphs.IEEE Access10 (2022), 75729–75741

    2022

  20. [29]

    Yi Yu, Gaoxi Xiao, Jie Zhou, Yubo Wang, Zhen Wang, Jürgen Kurths, and Hans Joachim Schellnhuber. 2016. System crash as dynamics of complex networks. Proceedings of the National Academy of Sciences113, 42 (2016), 11726–11731

    2016

  21. [30]

    Xi Zeng, Fang-Yuan Lei, Chang-Dong Wang, and Qing-Yun Dai. 2024. Multi-view Heterogeneous Graph Neural Networks for Node Classification.Data Science and Engineering9, 3 (2024), 294–308

    2024

  22. [31]

    Chuxu Zhang, Dongjin Song, Chao Huang, Ananthram Swami, and Nitesh V Chawla. 2019. Heterogeneous graph neural network. InProceedings of the 25th ACM SIGKDD international conference on knowledge discovery & data mining. ACM, New York, NY, 793–803

    2019

  23. [33]

    Mengmei Zhang, Xiao Wang, Meiqi Zhu, Chuan Shi, Zhiqiang Zhang, and Jun Zhou. 2022. Robust heterogeneous graph neural networks against adversarial attacks. InProceedings of the AAAI Conference on Artificial Intelligence. Vol. 36. AAAI Press, Menlo Park, CA, 4363–4370

    2022

  24. [34]

    Zaixi Zhang, Jinyuan Jia, Binghui Wang, and Neil Zhenqiang Gong. 2021. Back- door attacks to graph neural networks. InProceedings of the 26th ACM Symposium on Access Control Models and Technologies. ACM, New York, NY, 15–26

    2021

  25. [35]

    He Zhao, Zhiwei Zeng, Yongwei Wang, Deheng Ye, and Chunyan Miao. 2024. HGAttack: Transferable Heterogeneous Graph Adversarial Attack.arXiv preprint arXiv:2401.09945(2024)

    2024 arXiv

  26. [36]

    Yanan Zhao, Xingchao Jian, Feng Ji, Wee Peng Tay, and Antonio Ortega. 2024. Generalized Graph Signal Reconstruction via the Uncertainty Principle.arXiv preprint arXiv:2409.04229(2024)

    2024 arXiv

  27. [37]

    Shichao Zhu, Chuan Zhou, Shirui Pan, Xingquan Zhu, and Bin Wang. 2019. Relation structure-aware heterogeneous graph neural network. In2019 IEEE International Conference on Data Mining (ICDM). IEEE, 1534–1539

    2019

  28. [38]

    Zhihua Zhu, Xinxin Fan, Xiaokai Chu, and Jingping Bi. 2020. HGCN: A heteroge- neous graph convolutional network-based deep learning model toward collective classification. InProceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining. ACM, ...

    2020

  29. [2022]

    InProceedings of the 31st ACM international conference on information & knowledge management

    Temporal and heterogeneous graph neural network for financial time series prediction. InProceedings of the 31st ACM international conference on information & knowledge management. ACM, New York, NY, 3584–3593

  30. [2024]

    InProceedings of the ACM on Web Conference 2024

    Federated heterogeneous graph neural network for privacy-preserving recommendation. InProceedings of the ACM on Web Conference 2024. ACM, New York, NY, 3919–3929

    2024

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.