HeTa: Relation-wise Heterogeneous Graph Foundation Attack Model

Pengfei Jiao; Xiao Wang; Yuling Wang; Zihui Chen

REVIEW 4 major objections 5 minor 1 cited by

HeTa: Relation-wise Heterogeneous Graph Foundation Attack Model

T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read HeTa claims that heterogeneous graph neural networks share a common ordering over relation subgraphs, so one serialized node-injection attack built from a lightweight surrogate can transfer across target models and adapt to new graphs…

desk verdict A novel relation-wise HGNN attack with genuine transfer results, but the paper never shows that the relation-importance ordering it relies on is actually what makes the attack transfer. read the letter →

arxiv 2506.07428 v1 pith:4LSMMUDJ submitted 2025-06-09 cs.AI cs.LG

Yuling Wang , Zihui Chen , Pengfei Jiao , Xiao Wang This is my paper

classification cs.AIcs.LG

keywords heterogeneousgraphneuralnetworksadversarialattacknodeinjectionrelationsubgraphtransferablefoundationmodelevasionimportance

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that adversarial attacks on heterogeneous graph neural networks can be made generalizable rather than retrained per target. Its key empirical claim is that different HGNNs rank the importance of their relation subgraphs in the same order, so a relation subgraph is a shared attack unit across models. HeTa learns that ordering with a lightweight surrogate, then injects fake nodes relation by relation, starting with the highest-weighted relation, and the resulting perturbed graph degrades several unseen target HGNNs. If the claim is right, robustness evaluation for HGNNs can use one transferred perturbation, and adapting to a new graph requires only retraining the surrogate while reusing the fake-node generators.

What carries the argument

The load-bearing mechanism is the learned relation-weight vector $\mu=(\mu_1,\dots,\mu_{|R|})$ produced by a lightweight foundation surrogate whose message passing is an ensemble over relation subgraphs: $H^l = \sigma\left(\sum_{r=1}^{|R|} \mu_r \hat A_r H^{l-1}\right)$, with $\sum_r \mu_r = 1$. The surrogate first aligns heterogeneous node features into one space, and the optimized $\mu$ is taken to be the importance distribution of shared relation-aware attack units. The attack then selects the relation with the largest current weight, generates a fake node of one of that relation's endpoint types, and chooses the fake node's edges by the top-$K$ entries of the gradient of the attack loss with respect to that relation's adjacency matrix; the attacked relation's weight is divided by a penalty $\beta$ so the next step moves to a different relation. A proven property of the mechanism is that the attack gradient grows as the target node's degree decreases, which is why low-degree nodes are the most exposed.

What would settle it

Take a new heterogeneous graph with at least three relations, separately remove each relation subgraph from the clean graph, and record the Macro-F1 drop for several HGNN families; if the resulting importance ranking is not roughly consistent across models or does not match the order of $\mu$ learned by HeTa's surrogate, the shared-attack-unit premise is falsified.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central discovery is that vulnerability in heterogeneous graphs is relation-wise and transferable: despite large differences in architecture and parameter space, HAN, HGT, RGCN, and SimpleHGN all lose more accuracy when the same relation subgraph is removed, which the paper demonstrates on ACM with the ordering $R_1 > R_2 > R_3$. HeTa converts this into an attack by training a lightweight surrogate whose learned relation-weight vector $\mu$ gives the order in which relation subgraphs should be disrupted, and by carrying out node injection serially over those units. The perturbed graph is then a fixed input that can be fed to any trained target HGNN, and for a new heterogeneous graph the surrogate is retrained while the injected-node generators are frozen and reused. The paper reports that this transferred attack outperforms the compared baselines on all three datasets, with the largest Macro-F1 drops reaching tens of percentage points at 5% injection.

Load-bearing premise

The claim collapses if different HGNNs do not actually agree on which relation subgraphs are most important, because then the surrogate's relation weights would not identify attack targets that transfer.

Editorial extensions

If this is right

On the three datasets tested, the transferred perturbations outperform the compared baselines for every target backbone at every reported injection rate.
Relation weights learned once can be reused to choose attack units for multiple target models, so robustness testing does not need gradients or parameter access to each HGNN.
For a new heterogeneous graph, only the lightweight surrogate needs retraining; the frozen fake-node generators transfer, and in the ACM-to-IMDB experiment the transferred attack is close to training directly on IMDB for some backbones.
The surrogate trains effectively on limited data: using 25% of the training data reaches attack performance comparable to the full dataset.
Low-degree nodes are systematically more vulnerable to injected edges, so a simplified version of HeTa that simply connects fake nodes to low-degree neighbors is already competitive.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Left implicit in the paper: if the shared relation-importance ordering is a stable property of heterogeneous graphs rather than a quirk of these benchmarks, the same vector $\mu$ could double as a robustness diagnostic, telling a defender which relation subgraph deserves structural hardening first.
The paper's use of 'foundation' denotes a transferable attack primitive, not a generative or task-general model; a natural test the paper does not run is whether the same frozen fake-node generators still transfer when the new graph has relation or node types absent from the training graph.
The serialized relation-by-relation strategy suggests a link to explainability: attacking the highest-weight relation first is equivalent to removing the semantically most load-bearing part of the graph, so $\mu$ could be compared against human- or domain-derived relation importance as a sanity check.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Quick take: this is a real and novel attack framework for HGNNs. The idea of treating relations as shared attack units, learned by a lightweight surrogate, is well-designed, and the transfer results across HAN, HGT, RGCN, and SimpleHGN look solid. Figure 1, showing that different HGNNs rank relations similarly when relations are removed, is a nice empirical observation that the paper builds on.

Where the paper earns credit: the surrogate is genuinely lightweight, the serialized relation-by-relation attack is a new combination, and the reported F1 drops are large and consistent. The cross-graph adaptation experiment (Figure 4) shows the fake node generator carries something transferable.

The main soft spot is the gap between the evidence for the relation-importance premise and the attack mechanism. The mu weights are validated by relation removal experiments, but HeTa attacks by node injection into a relation. The paper never shows that injecting fake nodes into the highest-mu relation is more damaging than injecting into a lower-mu relation. Without that per-relation injection ablation, the central claim—that the shared relation weights are what make the attack transfer—is not established. The 'Simple' baseline in Table 3 makes this more pressing: it still uses mu to select relations but picks low-degree neighbors instead of gradient-chosen edges, and it nearly matches or beats HeTa on DBLP and IMDB. That suggests low-degree targeting may be doing most of the work, and the sophisticated edge selector adds less than it appears. This is addressable, but the paper as written doesn't close the loop.

Other issues, in decreasing importance: the most relevant transferable HG baselines (HGAttack, Shang et al.) are cited but never run; the comparison is against weaker baselines. No standard deviations are reported despite five runs, and no code is released. Equations 11 and 12 are underspecified—x_neighbor and the top-K gradient selection need more detail. And the 'foundation attack' framing is a stretch; the surrogate is retrained for each new graph, so it's a generalizable attack with fine-tuning, not a foundation model in any strong sense.

None of this is fatal. The empirical transfer is impressive and the relation-importance observation is interesting in its own right. The paper deserves a serious referee. The revision should add the per-relation injection ablation, run the missing transferable baselines, report error bars, and release code. If the per-relation experiment confirms that mu-ordering is causal, this is a solid paper.

Referee Report

4 major / 5 minor

Summary. This paper proposes HeTa, a relation-wise heterogeneous graph attack model. HeTa trains a lightweight surrogate HGNN with shared relation weights μ on a clean graph, then performs a serialized node-injection attack: at each step it selects the relation with the largest μ, generates fake nodes with optimized features and gradient-guided fake edges, and penalizes the attacked relation's weight. The perturbed graph is evaluated on four frozen target HGNNs (HAN, HGT, RGCN, SimpleHGN) under an evasion setting, and the fake-node generator is transferred across graphs. Experiments on DBLP, ACM, and IMDB report large Macro/Micro F1 drops relative to baseline attacks, plus cross-graph adaptation results.

Significance. The paper makes a distinctive empirical observation—that multiple HGNNs share a common relative importance ordering over relation subgraphs—and builds an attack around that insight. The lightweight surrogate has O(2d^2+K|R|) parameters, and the attack achieves large performance drops at 1–5% injection rates. If the mechanism is as claimed, this could be a useful transferable robustness-evaluation tool. The paper also ships detailed hyperparameters and baseline URLs. However, the significance is not fully established because the two most related transferable HG attack baselines cited in the paper are not evaluated, and the evidence that the learned relation weights are the causal driver of the injection attack is indirect.

major comments (4)

[§5.1 (Baselines), §1 (Introduction)] The evaluation omits the two transferable heterogeneous-graph attack methods that the paper itself cites as related work: Shang et al. (2023) and Zhao et al. (2024). Section 5.1 compares only RoHe-attack, FGA, and G2A2C; consequently the claim in Section 5.2 that HeTa achieves state-of-the-art performance against transferable attacks is not supported by the experiments. The authors should add these baselines (or justify their exclusion) to substantiate the central transferability claim.
[§4.2 (Relation-wise Attack), §5.3 (Figure 5a), §D.2 (Table 3)] The relation weights μ are validated by relation-removal experiments (Figure 5a), but the attack under evaluation is node injection. No experiment shows that attacking the relation with the highest μ under node injection is more damaging than attacking a different relation; the only ablation (Figure 6) replaces the edge selector, not the μ-ordering. Moreover, Table 3 shows that the 'Simple' baseline, which uses low-degree neighbor selection guided by μ, matches or outperforms HeTa on DBLP for three of four target models (e.g., DBLP/HGT Macro F1 0.6802 vs 0.7349). This raises the possibility that low-degree targeting (Remark 4.1) rather than the serialized relation-wise gradient attack drives the transfer results. The authors should add a per-relation injection experiment that varies the relation order independently of μ, and an ablation that randomizes the relation order, to establish the claimed mechanism.
[§B.3 (Implementation Details), Tables 1 and 3] The paper reports five-run averages but no standard deviations or significance tests. Since some differences between HeTa and Simple are tiny (e.g., IMDB/HAN Macro F1 0.2465 vs 0.2437), the reader cannot assess whether observed improvements are statistically meaningful. Reporting standard deviations and, where feasible, paired tests across seeds would materially strengthen the performance claims.
[Eq. (11) and Appendix A] Eq. (11) uses x_neighbor as the 'feature aggregation of v_in's neighbors' but neither the equation nor Appendix A defines the aggregation mechanism (e.g., which neighbors, whether the aggregation is relation-specific, and how it is computed during the m-th step). Similarly, Eq. (12) says the gradient ∂Lcw/∂A'^{m-1}_r is 'precomputed in forward propagation,' which is unclear since gradients are normally obtained by backward propagation. These gaps hinder reproducibility of the fake-node generator and edge selector.

minor comments (5)

[Abstract] There is a missing space after the colon in 'ask:Can we design' in the abstract.
[§3.2, Eq. (2)] The objective in Eq. (2) is written as a maximization of L(f_theta*(G')), but the attack loss in Eq. (7) is minimized; please clarify the sign convention or align the notation.
[Figure 8] The y-axis of Figure 8 is labeled 'Macro F1' but the caption describes label distributions (counts of predicted classes). This label appears to be a typo; the axis should reflect counts.
[§B.3] The hyperparameter list for the surrogate model repeats the sentence about the scaling factor α; please remove the duplication.
[§4.3 / Title] The term 'foundation model' is used for a surrogate trained from scratch on a single graph, with only the fake-node generator transferred. This is a much weaker sense than the usual foundation-model pretraining; consider qualifying the terminology to avoid overclaiming.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: HeTa's surrogate fit, relation selection, and transfer evaluation are distinct and independently tested.

full rationale

HeTa's derivation chain is self-contained and does not reduce to its own inputs. The surrogate model is trained with cross-entropy on the clean graph (Eq. 4-5), yielding relation weights mu. These weights select attack relations via Eq. (6), and fake edges are chosen by gradients of the attack loss (Eq. 12) against the frozen surrogate. The resulting perturbed graph is evaluated on four target HGNNs (HAN, HGT, RGCN, SimpleHGN) that were not used to fit mu, so the transfer claim is an independent empirical test rather than a fitted prediction. The cross-graph experiment (Section 5.3) freezes the fake node generator trained on ACM and retrains only the surrogate on IMDB, again leaving target models out of the fitting loop. Figure 1, which motivates relation subgraphs as attack units, is an empirical observation about target-model behavior, not an input to the surrogate's training objective. The only self-citation, [Wang et al., 2022] for ensemble multi-relational message passing, is non-load-bearing because Eq. (4) fully specifies the mechanism in the paper. The skeptical concern that relation-removal validation (Figure 5a) does not establish that mu-ordering drives node-injection transfer is an empirical-evidence gap, not a circularity: the paper does not define mu in terms of the target models or rename a fitted parameter as a prediction. No equation in the paper is shown to be equivalent to its own input by construction.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The ledger shows HeTa rests on one strong empirical premise (shared relation importance), a standard surrogate assumption, a threat-model assumption, and two ad hoc approximations (linearized gradient edge selection and low-degree vulnerability). The relation weights and a set of per-dataset hyperparameters are free; no code artifacts are supplied.

free parameters (5)

Relation weights mu_r = learned, not reported numerically
Learned by the surrogate through cross-entropy training (Eq. 4); the serialized attack selects the relation with the largest current weight (Eq. 6). These weights are the core mechanism for choosing attack units.
Per-dataset surrogate hyperparameters = alpha [0.1,0.3,0.3], hidden dim [128,64,256], layers [3,2,2], temperature [0.4,0.5,0.8], lr [1e-2,1e-4,1e-3]
Chosen separately for DBLP, ACM, IMDB in Appendix B.3; reported scores depend on these choices.
Injection degree K = [5,5,4] for DBLP, ACM, IMDB
Limits each fake node's degree and is part of the attack budget; Appendix B.3 reports different K per dataset.
Penalty beta = 1.8
Reweights previously attacked relations (Eq. 6 update); tuned in the hyperparameter study, peaking at 1.8.
Fake node generator hyperparameters = hidden dim [64,128,128], lr [1,1e-3,1e-2] for DBLP, ACM, IMDB
The MLP generator in Eq. (11) has per-dataset architecture and learning rate.

assumptions (5)

domain assumption Different HGNNs share a common importance pattern over relation subgraphs.
Used to justify treating relation weights learned on a surrogate as universally valid attack units (Section 1, Figure 1, Section 4.1). Only shown for four HGNNs on one dataset, ACM.
domain assumption A lightweight surrogate trained with cross-entropy on the clean graph faithfully approximates the vulnerability landscape of unseen target HGNNs.
Standard black-box transfer assumption; not proven, and target models differ architecturally (Section 4.1, Eq. 2).
domain assumption Node injection with fake nodes and edges is a valid threat model for evaluating HGNN robustness.
Attacker modifies test graph only, black-box; assumed realistic for security evaluation (Section 3.2).
ad hoc to paper Gradient of the linearized CW loss with respect to the adjacency indicates which edges maximize attack damage.
The surrogate is linearized in Appendix A, and top-K absolute gradients select edges (Eq. 12). This approximation is not validated against exact discrete optimization.
ad hoc to paper Low-degree target nodes are more vulnerable, and this guides neighbor selection.
Remark 4.1 and Appendix A provide a proof, but the proof drops a term involving the injected edge vector e_r and treats the lambda dependence heuristically; the claim is not rigorously derived.

how reviews work

0 comments

Cite this review

Pith. "Pith review of HeTa: Relation-wise Heterogeneous Graph Foundation Attack Model." pith.science (2026). https://pith.science/paper/4LSMMUDJ

@misc{pith2026250607428,
  author       = {Pith},
  title        = {Pith review of: HeTa: Relation-wise Heterogeneous Graph Foundation Attack Model},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/4LSMMUDJ}},
  note         = {Machine review of arXiv:2506.07428}
}

read the original abstract

Heterogeneous Graph Neural Networks (HGNNs) are vulnerable, highlighting the need for tailored attacks to assess their robustness and ensure security. However, existing HGNN attacks often require complex retraining of parameters to generate specific perturbations for new scenarios. Recently, foundation models have opened new horizons for the generalization of graph neural networks by capturing shared semantics across various graph distributions. This leads us to ask:Can we design a foundation attack model for HGNNs that enables generalizable perturbations across different HGNNs, and quickly adapts to new heterogeneous graphs (HGs)? Empirical findings reveal that, despite significant differences in model design and parameter space, different HGNNs surprisingly share common vulnerability patterns from a relation-aware perspective. Therefore, we explore how to design foundation HGNN attack criteria by mining shared attack units. In this paper, we propose a novel relation-wise heterogeneous graph foundation attack model, HeTa. We introduce a foundation surrogate model to align heterogeneity and identify the importance of shared relation-aware attack units. Building on this, we implement a serialized relation-by-relation attack based on the identified relational weights. In this way, the perturbation can be transferred to various target HGNNs and easily fine-tuned for new HGs. Extensive experiments exhibit powerful attack performances and generalizability of our method.

Figures

Figures reproduced from arXiv: 2506.07428 by the authors.

**Figure 2.** An overview of the framework for our proposed HeTa model. [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗

**Figure 3.** Analysis of the hyper-parameter K and β on ACM dataset with an injection rate of 0.01 [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗

Figures from the paper (6 more)

**Figure 5.** Figure 5: Results on the ACM dataset at 1% injection. (a) Dropping [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]

**Figure 6.** Figure 6: Ablation study with an injection rate of 0.01. [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]

**Figure 7.** Figure 7: Analysis of the hyper-parameter K and β on DBLP, IMDB dataset with an injection rate of 0.01. Dataset IMDB DBLP ACM Target Model Attack Methods Macro F1 Micro F1 Macro F1 Micro F1 Macro F1 Micro F1 HAN RoHe-attack 0.4583 0.4955 0.7636 0.7771 0.7266 0.7247 HeTa 0.2465 0…

**Figure 8.** Figure 8: Label distribution across four target models under varying [PITH_FULL_IMAGE:figures/full_fig_p011_8.png]

**Figure 9.** Figure 9: Supplementary material for Figure 4. ‘IMDB’ means attack train on IMDB dataset. ‘transACM’ means parameters obtained from [PITH_FULL_IMAGE:figures/full_fig_p012_9.png]

**Figure 10.** Figure 10: Node degree distribution under different injection rates. [PITH_FULL_IMAGE:figures/full_fig_p013_10.png]

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

Attacking Graph Foundation Models Through Their Shared Representation
cs.AI 2026-07 conditional novelty 6.0 of 10

A shared representation layer in graph foundation models is a distinct attack surface: input edits break three of six models and one spectral tokenizer is uniquely fragile.

Reference graph

Works this paper leans on

30 extracted references · 24 canonical work pages · cited by 1 Pith paper

[1]

Towards evaluating the robustness of neural networks

[Carlini and Wagner, 2017] Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In2017 ieee symposium on security and privacy (sp), pages 39–57. Ieee,

work page 2017
[2]

2 4 6 8 10 K 1.0 1.2 1.4 1.6 1.8 2.0 0.50 0.60 0.70 0.80 0.90 Macro F1 (a) HAN 2 4 6 8 10 K 1.0 1.2 1.4 1.6 1.8 2.0 0.78 0.80 0.82 0.84 0.86 0.88 Macro F1 (b) HGT 2 4 6 8 10 K 1.0 1.2 1.4 1.6 1.8 2.0 0.50 0.60 0.70 0.80 0.90 Macro F1 (c) SimpleHGN 2 4 6 8 10 K 1.0 1.2 1.4 1.6 1.8 2.0 0.50 0.60 0.70 0.80 Macro F1 (d) RGCN 2 4 6 8 10 K 1.0 1.2 1.4 1.6 1.8 2...

work page arXiv 1973
[3]

This is likely related to the degree distribution [Zhanget al., 2024; Zouet al., 2021 ], as DBLP has a high proportion of nodes with low degrees

By comparingSimplewith HeTa and the RoHe-attack,Simpleachieves ranking among the top two in overall performance and the DBLP dataset are more vulnerable under the simplified version of the attack. This is likely related to the degree distribution [Zhanget al., 2024; Zouet al., 2021 ], as DBLP has a high proportion of nodes with low degrees. Effective Dest...

work page 2024
[7]

Let graph be the go board: gradient-free node injection attack for graph neural networks via reinforce- ment learning

[Juet al., 2023 ] Mingxuan Ju, Yujie Fan, Chuxu Zhang, and Yanfang Ye. Let graph be the go board: gradient-free node injection attack for graph neural networks via reinforce- ment learning. InProceedings of the AAAI Conference on Artificial Intelligence, volume 37, pages 4383–4390,

work page 2023
[9]

Are we really mak- ing much progress? revisiting, benchmarking and refining heterogeneous graph neural networks

[Lvet al., 2021 ] Qingsong Lv, Ming Ding, Qiang Liu, Yuxi- ang Chen, Wenzheng Feng, Siming He, Chang Zhou, Jian- guo Jiang, Yuxiao Dong, and Jie Tang. Are we really mak- ing much progress? revisiting, benchmarking and refining heterogeneous graph neural networks. InProceedings of the 27th ACM SIGKDD conference on knowledge discov- ery & data mining, pages...

work page 2021
[11]

Is chatgpt a general-purpose natural language processing task solver?,

[Qinet al., 2023 ] Chengwei Qin, Aston Zhang, Zhuosheng Zhang, Jiaao Chen, Michihiro Yasunaga, and Diyi Yang. Is chatgpt a general-purpose natural language processing task solver?,

work page 2023
[12]

Kg-rag: Bridging the gap between knowledge and creativity.arXiv preprint arXiv:2405.12035,

[Sanmartin, 2024] Diego Sanmartin. Kg-rag: Bridging the gap between knowledge and creativity.arXiv preprint arXiv:2405.12035,

arXiv 2024
[13]

Modeling relational data with graph con- volutional networks

[Schlichtkrullet al., 2018 ] Michael Schlichtkrull, Thomas N Kipf, Peter Bloem, Rianne Van Den Berg, Ivan Titov, and Max Welling. Modeling relational data with graph con- volutional networks. InThe semantic web: 15th interna- tional conference, ESWC 2018, Heraklion, Crete, Greece, June 3–7, 2018, proceedings 15, pages 593–607. Springer,

work page 2018

Show all 30 references

[14]

Transferable structure- based adversarial attack of heterogeneous graph neural network

[Shanget al., 2023 ] Yu Shang, Yudong Zhang, Jiansheng Chen, Depeng Jin, and Yong Li. Transferable structure- based adversarial attack of heterogeneous graph neural network. InProceedings of the 32nd ACM International Conference on Information and Knowledge Management, pages 2...

2023
[15]

Adversarial attack and defense on graph data: A survey

[Sunet al., 2022 ] Lichao Sun, Yingtong Dou, Carl Yang, Kai Zhang, Ji Wang, S Yu Philip, Lifang He, and Bo Li. Adversarial attack and defense on graph data: A survey. IEEE Transactions on Knowledge and Data Engineering, 35(8):7693–7711,

2022
[17]

Hetero- geneous graph attention network

[Wanget al., 2019 ] Xiao Wang, Houye Ji, Chuan Shi, Bai Wang, Yanfang Ye, Peng Cui, and Philip S Yu. Hetero- geneous graph attention network. InThe world wide web conference, pages 2022–2032,

2019
[19]

Ensemble multi-relational graph neural networks.arXiv preprint arXiv:2205.12076,

[Wanget al., 2022 ] Yuling Wang, Hao Xu, Yanhua Yu, Mengdi Zhang, Zhenhao Li, Yuji Yang, and Wei Wu. Ensemble multi-relational graph neural networks.arXiv preprint arXiv:2205.12076,

2022 arXiv
[20]

Unsupervised heterogeneous graph rewriting attack via node clustering

[Wanget al., 2024 ] Haosen Wang, Can Xu, Chenglong Shi, Pengfei Zheng, Shiming Zhang, Minhao Cheng, and Hongyang Chen. Unsupervised heterogeneous graph rewriting attack via node clustering. InProceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining,...

2024
[21]

Anygraph: Graph foundation model in the wild,

[Xia and Huang, 2024] Lianghao Xia and Chao Huang. Anygraph: Graph foundation model in the wild,

2024
[22]

Simple and efficient heterogeneous graph neural network

[Yanget al., 2023 ] Xiaocheng Yang, Mingyu Yan, Shirui Pan, Xiaochun Ye, and Dongrui Fan. Simple and efficient heterogeneous graph neural network. InProceedings of the AAAI conference on artificial intelligence, volume 37, pages 10816–10824,

2023
[23]

Multi- plex heterogeneous graph convolutional network

[Yuet al., 2022 ] Pengyang Yu, Chaofan Fu, Yanwei Yu, Chao Huang, Zhongying Zhao, and Junyu Dong. Multi- plex heterogeneous graph convolutional network. InPro- ceedings of the 28th ACM SIGKDD Conference on Knowl- edge Discovery and Data Mining, pages 2377–2387,

2022
[24]

Robust heterogeneous graph neural networks against adversarial attacks

[Zhanget al., 2022 ] Mengmei Zhang, Xiao Wang, Meiqi Zhu, Chuan Shi, Zhiqiang Zhang, and Jun Zhou. Robust heterogeneous graph neural networks against adversarial attacks. InProceedings of the AAAI Conference on Artifi- cial Intelligence, volume 36, pages 4363–4370,

2022
[25]

Maximizing malicious influence in node injection attack

[Zhanget al., 2024 ] Xiao Zhang, Peng Bao, and Shirui Pan. Maximizing malicious influence in node injection attack. InProceedings of the 17th ACM International Conference on Web Search and Data Mining, pages 958–966,

2024
[26]

Hgattack: Transferable heterogeneous graph adversarial attack.arXiv preprint arXiv:2401.09945,

[Zhaoet al., 2024 ] He Zhao, Zhiwei Zeng, Yongwei Wang, Deheng Ye, and Chunyan Miao. Hgattack: Transferable heterogeneous graph adversarial attack.arXiv preprint arXiv:2401.09945,

2024 arXiv
[27]

Tdgia: Effective injection attacks on graph neural networks

[Zouet al., 2021 ] Xu Zou, Qinkai Zheng, Yuxiao Dong, Xinyu Guan, Evgeny Kharlamov, Jialiang Lu, and Jie Tang. Tdgia: Effective injection attacks on graph neural networks. InProceedings of the 27th ACM SIGKDD Con- ference on Knowledge Discovery & Data Mining, pages 2461–2471,

2021
[28]

Input: Clean graphG, the attack unitsA={A r, r∈ R}and relation weightµ={µ 1, µ2...µ|R|}from surrogate model

Algorithm 1The Attack Process in HeTa. Input: Clean graphG, the attack unitsA={A r, r∈ R}and relation weightµ={µ 1, µ2...µ|R|}from surrogate model. Parameter: Budget on injected rateρand the degree of each injected nodeK. The threshold for the total number of in- jected nodesM...

2020
[2014]

Heterogeneous graph transformer

[Huet al., 2020 ] Ziniu Hu, Yuxiao Dong, Kuansan Wang, and Yizhou Sun. Heterogeneous graph transformer. In Proceedings of the web conference 2020, pages 2704– 2710,

2020
[2017]

Fast gradient attack on network embedding.arXiv preprint arXiv:1809.02797,

[Chenet al., 2018 ] Jinyin Chen, Yangyang Wu, Xuanheng Xu, Yixian Chen, Haibin Zheng, and Qi Xuan. Fast gradient attack on network embedding.arXiv preprint arXiv:1809.02797,

2018 arXiv
[2018]

Mecch: metapath context convolution-based heterogeneous graph neural networks.Neural Networks, 170:266–275,

[Fu and King, 2024] Xinyu Fu and Irwin King. Mecch: metapath context convolution-based heterogeneous graph neural networks.Neural Networks, 170:266–275,

2024
[2019]

Scalable attack on graph data by injecting vicious nodes.Data Min- ing and Knowledge Discovery, 34:1363–1389,

[Wanget al., 2020 ] Jihong Wang, Minnan Luo, Fnu Suya, Jundong Li, Zijiang Yang, and Qinghua Zheng. Scalable attack on graph data by injecting vicious nodes.Data Min- ing and Knowledge Discovery, 34:1363–1389,

2020
[2020]

Kullback–leibler diver- gence metric learning.IEEE transactions on cybernetics, 52(4):2047–2058,

[Jiet al., 2020 ] Shuyi Ji, Zizhao Zhang, Shihui Ying, Liejun Wang, Xibin Zhao, and Yue Gao. Kullback–leibler diver- gence metric learning.IEEE transactions on cybernetics, 52(4):2047–2058,

2020
[2021]

Single-cell biolog- ical network inference using a heterogeneous graph trans- former.Nature Communications, 14(1):964,

[Maet al., 2023 ] Anjun Ma, Xiaoying Wang, Jingxian Li, Cankun Wang, Tong Xiao, Yuntao Liu, Hao Cheng, Juexin Wang, Yang Li, Yuzhou Chang, et al. Single-cell biolog- ical network inference using a heterogeneous graph trans- former.Nature Communications, 14(1):964,

2023
[2022]

Higpt: Heterogeneous graph language model.arXiv preprint arXiv:2402.16024,

[Tanget al., 2024 ] Jiabin Tang, Yuhao Yang, Wei Wei, Lei Shi, Long Xia, Dawei Yin, and Chao Huang. Higpt: Heterogeneous graph language model.arXiv preprint arXiv:2402.16024,

2024 arXiv
[2023]

Sora: A review on background, technology, limita- tions, and opportunities of large vision models,

[Liuet al., 2024 ] Yixin Liu, Kai Zhang, Yuan Li, Zhiling Yan, Chujie Gao, Ruoxi Chen, Zhengqing Yuan, Yue Huang, Hanchi Sun, Jianfeng Gao, Lifang He, and Lichao Sun. Sora: A review on background, technology, limita- tions, and opportunities of large vision models,

2024
[2024]

Explaining and harnessing adversarial examples.arXiv preprint arXiv:1412.6572,

[Goodfellowet al., 2014 ] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples.arXiv preprint arXiv:1412.6572,

2014 arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.

[1] [1]

Towards evaluating the robustness of neural networks

[Carlini and Wagner, 2017] Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In2017 ieee symposium on security and privacy (sp), pages 39–57. Ieee,

work page 2017

[2] [2]

2 4 6 8 10 K 1.0 1.2 1.4 1.6 1.8 2.0 0.50 0.60 0.70 0.80 0.90 Macro F1 (a) HAN 2 4 6 8 10 K 1.0 1.2 1.4 1.6 1.8 2.0 0.78 0.80 0.82 0.84 0.86 0.88 Macro F1 (b) HGT 2 4 6 8 10 K 1.0 1.2 1.4 1.6 1.8 2.0 0.50 0.60 0.70 0.80 0.90 Macro F1 (c) SimpleHGN 2 4 6 8 10 K 1.0 1.2 1.4 1.6 1.8 2.0 0.50 0.60 0.70 0.80 Macro F1 (d) RGCN 2 4 6 8 10 K 1.0 1.2 1.4 1.6 1.8 2...

work page arXiv 1973

[3] [3]

This is likely related to the degree distribution [Zhanget al., 2024; Zouet al., 2021 ], as DBLP has a high proportion of nodes with low degrees

By comparingSimplewith HeTa and the RoHe-attack,Simpleachieves ranking among the top two in overall performance and the DBLP dataset are more vulnerable under the simplified version of the attack. This is likely related to the degree distribution [Zhanget al., 2024; Zouet al., 2021 ], as DBLP has a high proportion of nodes with low degrees. Effective Dest...

work page 2024

[4] [7]

Let graph be the go board: gradient-free node injection attack for graph neural networks via reinforce- ment learning

[Juet al., 2023 ] Mingxuan Ju, Yujie Fan, Chuxu Zhang, and Yanfang Ye. Let graph be the go board: gradient-free node injection attack for graph neural networks via reinforce- ment learning. InProceedings of the AAAI Conference on Artificial Intelligence, volume 37, pages 4383–4390,

work page 2023

[5] [9]

Are we really mak- ing much progress? revisiting, benchmarking and refining heterogeneous graph neural networks

[Lvet al., 2021 ] Qingsong Lv, Ming Ding, Qiang Liu, Yuxi- ang Chen, Wenzheng Feng, Siming He, Chang Zhou, Jian- guo Jiang, Yuxiao Dong, and Jie Tang. Are we really mak- ing much progress? revisiting, benchmarking and refining heterogeneous graph neural networks. InProceedings of the 27th ACM SIGKDD conference on knowledge discov- ery & data mining, pages...

work page 2021

[6] [11]

Is chatgpt a general-purpose natural language processing task solver?,

[Qinet al., 2023 ] Chengwei Qin, Aston Zhang, Zhuosheng Zhang, Jiaao Chen, Michihiro Yasunaga, and Diyi Yang. Is chatgpt a general-purpose natural language processing task solver?,

work page 2023

[7] [12]

Kg-rag: Bridging the gap between knowledge and creativity.arXiv preprint arXiv:2405.12035,

[Sanmartin, 2024] Diego Sanmartin. Kg-rag: Bridging the gap between knowledge and creativity.arXiv preprint arXiv:2405.12035,

arXiv 2024

[8] [13]

Modeling relational data with graph con- volutional networks

[Schlichtkrullet al., 2018 ] Michael Schlichtkrull, Thomas N Kipf, Peter Bloem, Rianne Van Den Berg, Ivan Titov, and Max Welling. Modeling relational data with graph con- volutional networks. InThe semantic web: 15th interna- tional conference, ESWC 2018, Heraklion, Crete, Greece, June 3–7, 2018, proceedings 15, pages 593–607. Springer,

work page 2018