Heterogeneous Graph Neural Networks (HGNNs) are increasingly recognized for their performance in areas like the web and e-commerce, where resilience against adversarial attacks is crucial. However, existing adversarial attack methods, which are primarily designed for homogeneous graphs, fall short when applied to HGNNs due to their limited ability to address the structural and semantic complexity of HGNNs. This paper introduces HGAttack, the first dedicated gray box evasion attack method for heterogeneous graphs. We design a novel surrogate model to closely resemble the behaviors of the target HGNN and utilize gradient-based methods for perturbation generation. Specifically, the proposed surrogate model effectively leverages heterogeneous information by extracting meta-path induced subgraphs and applying GNNs to learn node embeddings with distinct semantics from each subgraph. This approach improves the transferability of generated attacks on the target HGNN and significantly reduces memory costs. For perturbation generation, we introduce a semantics-aware mechanism that leverages subgraph gradient information to autonomously identify vulnerable edges across a wide range of relations within a constrained perturbation budget. We validate HGAttack's efficacy with comprehensive experiments on three datasets, providing empirical analyses of its generated perturbations. Outperforming baseline methods, HGAttack demonstrated significant efficacy in diminishing the performance of target HGNN models, affirming the effectiveness of our approach in evaluating the robustness of HGNNs against adversarial attacks.

翻译：异构图神经网络（HGNN）因其在网络与电子商务等领域的卓越性能而日益受到关注，其对对抗攻击的鲁棒性至关重要。然而，现有对抗攻击方法主要针对同构图设计，由于难以应对HGNN的结构与语义复杂性，在应用于HGNN时存在不足。本文提出HGAttack，这是首个专用于异构图灰盒逃逸攻击方法。我们设计了一种新颖的替代模型以紧密模拟目标HGNN的行为，并利用基于梯度的扰动生成方法。具体而言，该替代模型通过提取元路径诱导子图并应用图神经网络从每个子图学习具有不同语义的节点嵌入，从而有效利用异构信息。这一方法提升了生成攻击对目标HGNN的可迁移性，并显著降低了内存消耗。在扰动生成方面，我们引入了一种语义感知机制，利用子图梯度信息在受限扰动预算内自动识别跨多种关系的脆弱边。通过在三组数据集上的综合实验验证了HGAttack的有效性，并对其生成扰动进行了实证分析。优于基线方法，HGAttack在降低目标HGNN模型性能方面展现出显著效力，证实了该方法在评估HGNN对对抗攻击鲁棒性方面的有效性。