Pith. sign in

REVIEW 3 major objections 5 minor 1 cited by

Heterogeneous Graph Backdoor Attack

T0 review · 3 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A single added edge per poisoned node, placed along a metapath to a chosen trigger node, is enough to backdoor heterogeneous graph neural networks at low budget with high success and near-clean accuracy, the paper claims.

desk verdict A novel trigger idea for heterogeneous GNNs, but the one-edge-per-node budget claim is underspecified and the headline numbers don't match the appendix; both need fixing before the results can be trusted. read the letter →

arxiv 2506.00191 v1 pith:PBNKYAZO submitted 2025-05-30 cs.CR cs.AIcs.LG

Jiawei Chen , Lusi Li , Daniel Takabi , Masha Sosonkina , Rui Ning This is my paper
classification cs.CRcs.AIcs.LG
keywords backdoorattackheterogeneousgraphneuralnetworkrelation-basedtriggermetapathnodeclassificationsuccessrateadversarialrobustness
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that the right way to backdoor a heterogeneous graph neural network is to replace subgraph triggers with a relation: one added edge that completes a metapath connection between a poisoned node and a preselected trigger node. On this design, HGBA reports high attack success rates at an attack budget of 1% of the training graph's nodes and edges, while keeping clean accuracy within a few points of the unpoisoned model. The paper also argues that prior attack-success-rate measurements for node classification are unreliable, because triggering many test nodes at once lets neighboring triggers interfere with each other, and it proposes measuring one trigger at a time. If the claims hold, backdoor attacks become cheaper, easier to activate, and more durable in real-world heterogeneous settings, and current defense methods do not stop them.

What carries the argument

The carrying object is the relation-based trigger: a metapath-defined relation (for example Paper-Author-Paper) that holds between the trigger node and each poisoned node once a single edge is added. Metapaths are formal sequences of node and edge types that heterogeneous graphs use to express composite semantics; by attaching the trigger to the model's own relational machinery, the backdoor signal is structural rather than feature-based. Two selection procedures tune the trigger: betweenness centrality picks the trigger node (low betweenness gives a clearer, more distinctive signal), and a proxy model chooses the backdoor metapath (highest classification accuracy for homogeneous GNN proxies, highest metapath attention weight for HAN), so the planted relation is one the model already weights heavily.

What would settle it

Run the paper's own poisoning procedure (Algorithm 1) on ACM, DBLP, and IMDB and count, for each poisoned node, the minimum number of edges that must actually be added to establish the backdoor metapath to the trigger node; then recompute the attack-success curve with true edge counts on the x-axis. If a substantial fraction of poisoned nodes require two or more edges, the advertised one-edge budget does not hold and the attack is more expensive than claimed.

Watch

Extended reading notes

Core claim

On the paper's own terms, the discovery is that a heterogeneous graph model's learned sensitivity to metapaths can be hijacked: the trigger is not a pattern of features or a subgraph but a composite relation of the same type the model already uses for classification. Poisoning selects one trigger node (the node with minimal betweenness centrality), selects the metapath that a proxy model finds most influential, and then for each poisoned node adds a single edge so that the poisoned node and the trigger node stand in that metapath relation, relabeling the node to the target class. At test time the backdoor is activated either by linking an attacker-owned node to an intermediate node already connected to the trigger node (Self-Node Attack) or by planting a replica of the trigger node next to any target node (Indiscriminate Attack). The paper reports average attack success rates between roughly 83% and 93% across ACM, DBLP, and IMDB against six HGNNs at a 1% budget, with clean metrics dropping only 1–3%, and it shows the same relation-based trigger transferring to homogeneous-graph node and graph classification.

Load-bearing premise

The entire low-budget claim rests on one added edge being enough to connect each poisoned node to the trigger node through the backdoor metapath, which requires that a suitable intermediate node already exists in the graph for every selected poisoned node.

Editorial extensions

If this is right

  • Graph backdoor attacks gain a low-budget mode for heterogeneous networks: at a 1% attack budget HGBA reports average ASR near or above 90% where subgraph-based baselines mostly stay below 60%.
  • Because the trigger is a relation rather than a feature pattern, node-feature perturbations that break subgraph triggers leave the backdoor largely intact.
  • Evaluators of node-level graph backdoors should score attack success one trigger at a time; simultaneous triggering of many test nodes produces interference that can inflate or deflate reported ASR.
  • Defenses that prune dissimilar edges or that use robust classifiers do not reliably neutralize the attack; HGBA's ASR stays high under Prune, Prune+LD, E-SAGE, GNNGuard, and RobustGCN, though some aggressive defenses destroy clean accuracy.
  • The same single-edge metapath trigger transfers to homogeneous graph classification and node classification, extending the threat beyond heterogeneous graphs.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The one-edge budget is only guaranteed if, for every poisoned node, some intermediate node already connected to the trigger node along the metapath exists; on sparser graphs the true cost is the number of edges actually needed to complete each metapath, so the reported budget curve is an upper bound on efficiency rather than a proof of it.
  • A possible detection signal follows from the attack's own logic: a poisoned graph should show an anomalous rise in low-betweenness nodes acting as metapath hubs, or in same-type node pairs joined by short metapaths despite dissimilar features; metapath-density statistics could be tested as a defense.
  • The one-at-a-time ASR protocol would likely lower the reported success rates of subgraph-based baselines as well, which could change how the baselines rank against one another in future comparisons.
  • If the relation-based trigger works by aligning with the model's existing relational attention, the same mechanism may generalize to any graph model with metapath- or relation-aware aggregation, including recommendation and transaction graphs, where a single added edge is hard to distinguish from ordinary user activity.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper investigates backdoor attacks against heterogeneous graph neural networks (HGNNs). It first reports that existing graph backdoor attacks, designed for homogeneous graphs, suffer from high injection budgets, unreliable activation under node-feature drift, and inaccurate ASR measurements when applied to heterogeneous graphs. It then proposes HGBA, a relation-based trigger attack that selects a low-betweenness trigger node and an influential metapath, adds edges from poisoned nodes to the trigger node along that metapath, and relabels poisoned nodes to the target class. Two activation strategies are proposed: Self-Node Attack and Indiscriminate Attack, the latter using a replica trigger node. The paper also proposes an improved ASR protocol that attaches triggers one test sample at a time. Experiments cover three heterogeneous datasets and six HGNNs, compare with five baseline attacks, and include ablations, robustness tests against feature perturbations, and evaluations against data-level and model-level defenses, as well as extensions to homogeneous-graph tasks.

Significance. If the main claims hold, HGBA would be the first backdoor attack designed specifically for HGNNs and would offer a qualitatively lower structural attack budget than subgraph-based triggers. The paper's strengths are its breadth of experiments (three heterogeneous and four homogeneous datasets, six models, multiple baselines, defenses, ablations) and a thoughtful correction to ASR evaluation for node classification, where simultaneous trigger attachment can create cross-node interference. The proposed attack is also plausible in its broad outline: correlating a metapath connection to a trigger node with the target label is a natural extension of graph backdoor ideas. However, the central efficiency claim rests on an underspecified edge-adding procedure, and the headline quantitative results in Table 2 are not reproducible from the per-model appendix tables. These issues must be resolved before the paper's main claims are established.

major comments (3)
  1. [Section 1 and Algorithm 1 (Appendix F)] The central claim that HGBA requires only one added edge per poisoned node is not established. Algorithm 1 (line 5) calls AddEdges(v_pi, v_t, P_b), but AddEdges is never specified, and the selection criterion in step 3 (poisoned nodes that do not initially connect to v_t via P_b) does not guarantee the existence of an intermediate node x that is already connected to v_t along the remaining segment of P_b. For metapaths of length at least two (e.g., PAP or APCPA), a single new edge can complete the backdoor metapath only if such an x exists and the edge type is valid. Without an explicit existence condition or a specification of how AddEdges selects x, the realized per-node budget may exceed one edge, which would invalidate the claimed low-budget advantage and the fair comparison at B_a=1% in Table 2. Please provide the AddEdges algorithm, state its preconditions, or report the actual realized edge count per poisoned node.
  2. [Section 5.2, Table 2 vs. Appendix G.1, Tables 15-17] The averaged results in Table 2 are not consistent with the per-model results in Appendix G.1. For example, averaging the ACM HGBA I ASR values from Table 15 gives 91.37%, not the reported 87.28%; for IMDB the per-model average is 67.19%, not the reported 83.36%. Several clean-metric averages also differ, e.g., DBLP clean Micro-F1 is 87.18% when averaged from Table 16 but 88.60% in Table 2. Since Table 2 is the principal RQ1 evidence for HGBA's superiority, this mismatch must be reconciled, and the exact averaging procedure (including which models and runs are included) must be described.
  3. [Section 4.1, Phase II] The paper's efficiency claims also require clarification for the Indiscriminate Attack. Although Section 1 states that activation requires only a single connection between the trigger node and the target node, the Indiscriminate Attack instead creates a replica trigger node v'_t for each target node, which adds a node and at least one edge (and, for metapaths of length at least two, likely multiple edges) to the test-time graph. The paper does not specify how many structural operations this activation actually costs, nor whether this test-time cost is included anywhere in the budget comparisons or in the improved ASR protocol. Please state the per-sample activation cost of both strategies and clarify how the reported ASR is computed for the replica-node strategy.
minor comments (5)
  1. [Section 3] The section heading reads "Research Tast 1" and should be "Research Task 1."
  2. [Abstract] The abstract contains the typo "strength of HBGA" and should say "HGBA."
  3. [Table 3] Table 3 is difficult to read because the row/column structure is not clear; please align the centrality metrics with the Max/Min columns and state the node identifiers in a consistent format.
  4. [Figure 8 caption] The caption refers to "2245, 4, 242" as the selected trigger nodes, but this is not explained in relation to Table 3; please clarify which dataset and centrality metric each number corresponds to.
  5. [Table 10] Table 10 lists an HGT architecture, but HGT is not among the six models evaluated in the experiments; either remove it or explain why it is included.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: HGBA is an empirical attack whose components are selected via clean-graph analysis and validated experimentally, with no fitted quantity renamed as a prediction.

full rationale

This paper does not contain a mathe­matical derivation whose output reduces to its inputs. The central claims are empirical: HGBA achieves high ASR with a single-edge trigger, is robust to feature perturbation, and resists defenses. Each of these is evaluated on held-out test nodes with standard metrics, and the attack components (trigger node via betweenness centrality, backdoor metapath via proxy-model accuracy or HAN attention) are selected on clean graph information before poisoning. This is a standard adaptive-attack design choice, not a fit to the measured ASR. There are no self-citations used as load-bearing evidence, and no uniqueness theorem or imported ansatz is invoked to forbid alternatives. The only notable gap is the unspecified AddEdges routine in Algorithm 1, which leaves open whether a single added edge can always complete the chosen metapath; that is a correctness and reproducibility concern, not circularity, because the claim is not derived from the routine's definition. The improved ASR protocol is a methodological decision, not a parameter fitted to the outcome. Accordingly, the appropriate circularity score is 0.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

The attack relies on domain assumptions about attacker capabilities and HGNN behavior, plus two ad hoc assumptions specific to the proposed method: the feasibility of single-edge connections and the transferability of proxy-based metapath selection. No free parameters are fitted to data, and no new physical entities are introduced.

assumptions (4)
  • domain assumption The attacker can add edges and relabel nodes in the training graph.
    Threat model described in Section 3.1 allows a malicious data provider to modify the dataset under budget constraints.
  • ad hoc to paper A single added edge can establish a backdoor metapath connection between any poisoned node and the trigger node.
    Central to the low budget claim; not guaranteed by the algorithm description in Section 4.1 and Algorithm 1, which relies on an intermediate node already connected to the trigger node.
  • ad hoc to paper The metapath with highest clean classification performance (proxy) is the most effective backdoor metapath for the victim model.
    Proxy model-based metapath selection in Section 4.1 assumes transferability from proxy to victim, which is not proven.
  • domain assumption HGNNs learn the spurious correlation between the metapath connection and the target label from a small number of poisoned nodes.
    The attack's effectiveness depends on the learnability of the trigger from only a few poisoned examples, which is supported only empirically in Section 5.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Heterogeneous Graph Backdoor Attack." pith.science (2026). https://pith.science/paper/PBNKYAZO

@misc{pith2026250600191,
  author       = {Pith},
  title        = {Pith review of: Heterogeneous Graph Backdoor Attack},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/PBNKYAZO}},
  note         = {Machine review of arXiv:2506.00191}
}
read the original abstract

Heterogeneous Graph Neural Networks (HGNNs) excel in modeling complex, multi-typed relationships across diverse domains, yet their vulnerability to backdoor attacks remains unexplored. To address this gap, we conduct the first investigation into the susceptibility of HGNNs to existing graph backdoor attacks, revealing three critical issues: (1) high attack budget required for effective backdoor injection, (2) inefficient and unreliable backdoor activation, and (3) inaccurate attack effectiveness evaluation. To tackle these issues, we propose the Heterogeneous Graph Backdoor Attack (HGBA), the first backdoor attack specifically designed for HGNNs, introducing a novel relation-based trigger mechanism that establishes specific connections between a strategically selected trigger node and poisoned nodes via the backdoor metapath. HGBA achieves efficient and stealthy backdoor injection with minimal structural modifications and supports easy backdoor activation through two flexible strategies: Self-Node Attack and Indiscriminate Attack. Additionally, we improve the ASR measurement protocol, enabling a more accurate assessment of attack effectiveness. Extensive experiments demonstrate that HGBA far surpasses multiple state-of-the-art graph backdoor attacks in black-box settings, efficiently attacking HGNNs with low attack budgets. Ablation studies show that the strength of HBGA benefits from our trigger node selection method and backdoor metapath selection strategy. In addition, HGBA shows superior robustness against node feature perturbations and multiple types of existing graph backdoor defense mechanisms. Finally, extension experiments demonstrate that the relation-based trigger mechanism can effectively extend to tasks in homogeneous graph scenarios, thereby posing severe threats to broader security-critical domains.

Figures

Figures reproduced from arXiv: 2506.00191 by the authors.

Figure 1
Figure 1. An illustrative example of a heterogeneous graph. [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. General Framework of Current Graph Backdoor [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Impact of Heterogeneity on Attack Budget in Graph [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (15 more)
Figure 4
Figure 4. Figure 4: Impact of Node Perturbations on Backdoor Activation for Existing Graph Backdoor Attacks on HGNNs. The represen [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: Impact of Trigger Density on Attack Success Rate [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: Overview of HGBA. (a) Backdoor Injection (Training): The attacker (1) selects a trigger node [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]
Figure 7
Figure 7. Figure 7: HGBA Performance under Varying Attack Budgets. [PITH_FULL_IMAGE:figures/full_fig_p010_7.png]
Figure 9
Figure 9. Figure 9: Impact of Backdoor Metapath Selection on HGBA [PITH_FULL_IMAGE:figures/full_fig_p011_9.png]
Figure 10
Figure 10. Figure 10: Effect of Node Feature Perturbations on HGBA’s [PITH_FULL_IMAGE:figures/full_fig_p012_10.png]
Figure 11
Figure 11. Figure 11: Impact of Node Perturbations on Backdoor Ac [PITH_FULL_IMAGE:figures/full_fig_p015_11.png]
Figure 12
Figure 12. Figure 12: Impact of Node Perturbations on Backdoor Ac [PITH_FULL_IMAGE:figures/full_fig_p016_12.png]
Figure 13
Figure 13. Figure 13: Impact of Node Perturbations on Backdoor Ac [PITH_FULL_IMAGE:figures/full_fig_p016_13.png]
Figure 14
Figure 14. Figure 14: Impact of Trigger Density on Attack Success Rate (ASR) of Graph Backdoor Attacks in Heterogeneous Graphs (ACM [PITH_FULL_IMAGE:figures/full_fig_p017_14.png]
Figure 15
Figure 15. Figure 15: Impact of Trigger Density on Attack Success Rate (ASR) of Graph Backdoor Attacks in Heterogeneous Graphs (DBLP [PITH_FULL_IMAGE:figures/full_fig_p017_15.png]
Figure 16
Figure 16. Figure 16: Impact of Trigger Density on Attack Success Rate (ASR) of Graph Backdoor Attacks in Heterogeneous Graphs (IMDB [PITH_FULL_IMAGE:figures/full_fig_p018_16.png]
Figure 17
Figure 17. Figure 17: The Average Performance of HGBA Attacking Six [PITH_FULL_IMAGE:figures/full_fig_p020_17.png]
Figure 18
Figure 18. Figure 18: Impact of Trigger Node Selection for HGBA [PITH_FULL_IMAGE:figures/full_fig_p020_18.png]
Figure 19
Figure 19. Figure 19: Attention values of metapaths in HAN, illustrating [PITH_FULL_IMAGE:figures/full_fig_p020_19.png]

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Architectural Backdoors in Deep Learning: A Survey of Vulnerabilities, Detection, and Defense

    cs.CR 2025-07 conditional novelty 4.0 of 10

    Architectural backdoors are a persistent class of neural-network backdoors that survive clean retraining, and current detection tools and benchmarks are not ready for them.

Reference graph

Works this paper leans on

57 extracted references · 32 canonical work pages · cited by 1 Pith paper

  1. [1]

    Djihad Arrar, Nadjet Kamel, and Abdelaziz Lakhfif. 2024. A comprehensive survey of link prediction methods.The journal of supercomputing80, 3 (2024), 3902–3942

    work page 2024

  2. [2]

    Alexandru T Balaban. 1985. Applications of graph theory in chemistry.Journal of chemical information and computer sciences25, 3 (1985), 334–343

    work page 1985

  3. [3]

    Jiarui Chen, Yain-Whar Si, Chon-Wai Un, and Shirley WI Siu. 2021. Chemical toxicity prediction based on semi-supervised learning and graph convolutional neural network.Journal of cheminformatics13 (2021), 1–16

    work page 2021

  4. [4]

    Mengru Chen, Chao Huang, Lianghao Xia, Wei Wei, Yong Xu, and Ronghua Luo. 2023. Heterogeneous graph contrastive learning for recommendation. In Proceedings of the sixteenth ACM international conference on web search and data mining. 544–552

    work page 2023

  5. [5]

    Enyan Dai, Minhua Lin, Xiang Zhang, and Suhang Wang. 2023. Unnoticeable backdoor attacks on graph neural networks. InProceedings of the ACM Web Conference 2023. 2263–2273

    2023

  6. [6]

    Yuanhao Ding, Yang Liu, Yugang Ji, Weigao Wen, Qing He, and Xiang Ao. 2025. SPEAR: A Structure-Preserving Manipulation Method for Graph Backdoor At- tacks. InTHE WEB CONFERENCE 2025

    work page 2025

  7. [7]

    Federico Errica, Marco Podda, Davide Bacciu, and Alessio Micheli. 2019. A fair comparison of graph neural networks for graph classification.arXiv preprint arXiv:1912.09893(2019)

    arXiv 2019

  8. [8]

    Shaohua Fan, Junxiong Zhu, Xiaotian Han, Chuan Shi, Linmei Hu, Biyu Ma, and Yongliang Li. 2019. Metapath-guided heterogeneous graph neural network for intent recommendation. InProceedings of the 25th ACM SIGKDD international conference on knowledge discovery & data mining. 2478–2486

    work page 2019

Show all 57 references
  1. [9]

    Xinyu Fu, Jiani Zhang, Ziqiao Meng, and Irwin King. 2020. Magnn: Metap- ath aggregated graph neural network for heterogeneous graph embedding. In Proceedings of the web conference 2020. 2331–2341

    2020

  2. [10]

    Chen Gao, Xiang Wang, Xiangnan He, and Yong Li. 2022. Graph neural net- works for recommender system. InProceedings of the fifteenth ACM international conference on web search and data mining. 1623–1625

    2022

  3. [11]

    Chen Gao, Yu Zheng, Nian Li, Yinfeng Li, Yingrong Qin, Jinghua Piao, Yuhan Quan, Jianxin Chang, Depeng Jin, Xiangnan He, et al. 2023. A survey of graph neural networks for recommender systems: Challenges, methods, and directions. ACM Transactions on Recommender Systems1, 1 (20...

    2023

  4. [12]

    Will Hamilton, Zhitao Ying, and Jure Leskovec. 2017. Inductive representation learning on large graphs.Advances in neural information processing systems30 (2017)

    2017

  5. [13]

    Shiwen He, Shaowen Xiong, Yeyu Ou, Jian Zhang, Jiaheng Wang, Yongming Huang, and Yaoxue Zhang. 2021. An overview on the application of graph neural networks in wireless networks.IEEE Open Journal of the Communications Society 2 (2021), 2547–2565

    2021

  6. [14]

    Ziniu Hu, Yuxiao Dong, Kuansan Wang, and Yizhou Sun. 2020. Heterogeneous graph transformer. InProceedings of the web conference 2020. 2704–2710

    2020

  7. [15]

    Dusanka Janezic, Ante Milicevic, Sonja Nikolic, and Nenad Trinajstic. 2015. Graph-theoretical matrices in chemistry. CRC Press

    2015

  8. [16]

    Jian Jiang, Rui Wang, and Guo-Wei Wei. 2021. GGL-Tox: geometric graph learning for toxicity prediction.Journal of chemical information and modeling61, 4 (2021), 1691–1700

    2021

  9. [17]

    Thomas N Kipf and Max Welling. 2016. Semi-supervised classification with graph convolutional networks.arXiv preprint arXiv:1609.02907(2016)

    2016 arXiv

  10. [18]

    Qingsong Lv, Ming Ding, Qiang Liu, Yuxiang Chen, Wenzheng Feng, Siming He, Chang Zhou, Jianguo Jiang, Yuxiao Dong, and Jie Tang. 2021. Are we really making much progress? revisiting, benchmarking and refining heterogeneous graph neural networks. InProceedings of the 27th ACM S...

    2021

  11. [19]

    Abdul Majeed and Ibtisam Rauf. 2020. Graph theory: A comprehensive sur- vey about graph theory applications in computer science and social networks. Inventions5, 1 (2020), 10

    2020

  12. [20]

    Bhavya Mehta, Kush Kothari, Reshmika Nambiar, and Seema C. Shrawne. 2023. Benchmarking Toxic Molecule Classification using Graph Neural Networks and Few Shot Learning.ArXivabs/2311.13490 (2023). https://api.semanticscholar. org/CorpusID:265352060

    2023 arXiv

  13. [21]

    Peng Mei and Yu Hong Zhao. 2024. Dynamic network link prediction with node representation learning from graph convolutional networks.Scientific Reports 14, 1 (2024), 538

    2024

  14. [22]

    Christopher Morris, Nils M Kriege, Franka Bause, Kristian Kersting, Petra Mutzel, and Marion Neumann. 2020. Tudataset: A collection of benchmark datasets for learning with graphs.arXiv preprint arXiv:2007.08663(2020)

    2020 arXiv

  15. [23]

    Seth A Myers, Aneesh Sharma, Pankaj Gupta, and Jimmy Lin. 2014. Informa- tion network or social network? The structure of the Twitter follow graph. In Proceedings of the 23rd international conference on world wide web. 493–498

    2014

  16. [24]

    Mark EJ Newman, Duncan J Watts, and Steven H Strogatz. 2002. Random graph models of social networks.Proceedings of the national academy of sciences99, suppl_1 (2002), 2566–2572

    2002

  17. [25]

    Amirreza Salamat, Xiao Luo, and Ali Jafari. 2021. HeteroGraphRec: A hetero- geneous graph-based neural networks for social recommendations.Knowledge- Based Systems217 (2021), 106817

    2021

  18. [26]

    Michael Schlichtkrull, Thomas N Kipf, Peter Bloem, Rianne Van Den Berg, Ivan Titov, and Max Welling. 2018. Modeling relational data with graph convolu- tional networks. InThe semantic web: 15th international conference, ESWC 2018, Heraklion, Crete, Greece, June 3–7, 2018, proc...

    2018

  19. [27]

    Md Shariar Sozol, Golam Mostafa Saki, and Md Mostafizur Rahman. 2024. Anom- aly Detection in Cybersecurity with Graph-Based Approaches.International Journal of Scientific Research in Engineering and Management (IJSREM)8, 8 (2024), 1–7

    2024

  20. [28]

    Lei Tang and Huan Liu. 2010. Graph mining applications to social network analysis.Managing and mining graph data(2010), 487–513

    2010

  21. [29]

    2018.Chemical graph theory

    Nenad Trinajstic. 2018.Chemical graph theory. CRC press

    2018

  22. [30]

    Petar Veličković, Guillem Cucurull, Arantxa Casanova, Adriana Romero, Pietro Lio, and Yoshua Bengio. 2017. Graph attention networks.arXiv preprint arXiv:1710.10903(2017)

    2017 arXiv

  23. [31]

    Jianian Wang, Sheng Zhang, Yanghua Xiao, and Rui Song. 2021. A review on graph neural network methods in financial applications.arXiv preprint arXiv:2111.15367 (2021)

    2021 arXiv

  24. [32]

    Shoujin Wang, Liang Hu, Yan Wang, Xiangnan He, Quan Z Sheng, Mehmet A Orgun, Longbing Cao, Francesco Ricci, and Philip S Yu. 2021. Graph learning based recommender systems: A review.arXiv preprint arXiv:2105.06339(2021)

    2021 arXiv

  25. [33]

    Xiao Wang, Houye Ji, Chuan Shi, Bai Wang, Yanfang Ye, Peng Cui, and Philip S Yu

  26. [34]

    Jun Wu, Jingrui He, and Jiejun Xu. 2019. Net: Degree-specific graph neural networks for node and graph classification. InProceedings of the 25th ACM SIGKDD international conference on knowledge discovery & data mining. 406–415

    2019

  27. [35]

    Shiwen Wu, Fei Sun, Wentao Zhang, Xu Xie, and Bin Cui. 2022. Graph neural networks in recommender systems: a survey.Comput. Surveys55, 5 (2022), 1–37

    2022

  28. [36]

    Zhaohan Xi, Ren Pang, Shouling Ji, and Ting Wang. 2021. Graph backdoor. In 30th USENIX security symposium (USENIX Security 21). 1523–1540

    2021

  29. [37]

    Shunxin Xiao, Shiping Wang, Yuanfei Dai, and Wenzhong Guo. 2022. Graph neural networks in node classification: survey and evaluation.Machine Vision and Applications33, 1 (2022), 4

    2022

  30. [38]

    Bo Yan, Cheng Yang, Chuan Shi, Yong Fang, Qi Li, Yanfang Ye, and Junping Du

  31. [39]

    Shuiqiao Yang, Bao Gia Doan, Paul Montague, Olivier De Vel, Tamas Abraham, Seyit Camtepe, Damith C Ranasinghe, and Salil S Kanhere. 2022. Transferable graph backdoor attack. InProceedings of the 25th international symposium on research in attacks, intrusions and defenses. 321–332

    2022

  32. [40]

    Zhilin Yang, William Cohen, and Ruslan Salakhudinov. 2016. Revisiting semi- supervised learning with graph embeddings. InInternational conference on ma- chine learning. PMLR, 40–48

    2016

  33. [41]

    Zihao Yao, Fanding Huang, Yannan Li, Wei Duan, Peng Qian, Nan Yang, and Willy Susilo. 2025. Mecon: A GNN-based graph classification framework for MEV activity detection.Expert Systems with Applications269 (2025), 126486

    2025

  34. [42]

    Dingqiang Yuan, Xiaohua Xu, Lei Yu, Tongchang Han, Rongchang Li, and Meng Han. 2024. E-SAGE: Explainability-Based Defense Against Backdoor Attacks on Graph Neural Networks. InInternational Conference on Wireless Artificial Conference acronym ’XX, June 03–05, 2018, Woodstock, N...

    2024

  35. [43]

    Hanqing Zeng, Hongkuan Zhou, Ajitesh Srivastava, Rajgopal Kannan, and Viktor Prasanna. 2019. Graphsaint: Graph sampling based inductive learning method. arXiv preprint arXiv:1907.04931(2019)

    2019 arXiv

  36. [44]

    Chuxu Zhang, Dongjin Song, Chao Huang, Ananthram Swami, and Nitesh V Chawla. 2019. Heterogeneous graph neural network. InProceedings of the 25th ACM SIGKDD international conference on knowledge discovery & data mining. 793–803

    2019

  37. [45]

    Hangfan Zhang, Jinghui Chen, Lu Lin, Jinyuan Jia, and Dinghao Wu. 2023. Graph contrastive backdoor attacks. InInternational Conference on Machine Learning. PMLR, 40888–40910

    2023

  38. [46]

    Muhan Zhang and Yixin Chen. 2018. Link prediction based on graph neural networks.Advances in neural information processing systems31 (2018)

    2018

  39. [47]

    Mengmei Zhang, Xiao Wang, Meiqi Zhu, Chuan Shi, Zhiqiang Zhang, and Jun Zhou. 2022. Robust heterogeneous graph neural networks against adversarial attacks. InProceedings of the AAAI conference on artificial intelligence, Vol. 36. 4363–4370

    2022

  40. [48]

    Xiang Zhang and Marinka Zitnik. 2020. Gnnguard: Defending graph neural networks against adversarial attacks.Advances in neural information processing systems33 (2020), 9263–9275

    2020

  41. [49]

    Xiao-Meng Zhang, Li Liang, Lin Liu, and Ming-Jing Tang. 2021. Graph neural networks and their current applications in bioinformatics.Frontiers in genetics 12 (2021), 690049

    2021

  42. [50]

    Zaixi Zhang, Jinyuan Jia, Binghui Wang, and Neil Zhenqiang Gong. 2021. Back- door attacks to graph neural networks. InProceedings of the 26th ACM Symposium on Access Control Models and Technologies. 15–26

    2021

  43. [51]

    Zhiwei Zhang, Minhua Lin, Enyan Dai, and Suhang Wang. 2024. Rethinking graph backdoor attacks: A distribution-preserving perspective. InProceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining. 4386–4397

    2024

  44. [52]

    Tianxiang Zhao, Xiang Zhang, and Suhang Wang. 2021. Graphsmote: Imbalanced node classification on graphs with graph neural networks. InProceedings of the 14th ACM international conference on web search and data mining. 833–841

    2021

  45. [53]

    Tianxiang Zhao, Xiang Zhang, and Suhang Wang. 2024. Disambiguated node clas- sification with graph neural networks. InProceedings of the ACM Web Conference

    2024

  46. [54]

    Dingyuan Zhu, Ziwei Zhang, Peng Cui, and Wenwu Zhu. 2019. Robust graph convolutional networks against adversarial attacks. InProceedings of the 25th ACM SIGKDD international conference on knowledge discovery & data mining. 1399–1407. A Details of Datasets A.1 Heterogeneous Gra...

    2019

  47. [57]

    De- tailed statistics for these datasets are summarized in Table 8 & Table 9

    as used in IO1 to explore the impact of the attack budget. De- tailed statistics for these datasets are summarized in Table 8 & Table 9. (i)Cora, PubMed, and CiterSeer [ 40] - These datasets are cita- tion networks in which nodes represent papers and edges indicate citation li...

    2018

  48. [2019]

    InThe world wide web conference

    Heterogeneous graph attention network. InThe world wide web conference. 2022–2032

    2022

  49. [2023]

    Graph mining for cybersecurity: A survey.ACM Transactions on Knowledge Discovery from Data18, 2 (2023), 1–52

    2023

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.