Adversarial Attacks and Robust Training for Hypergraph Neural Networks

Recent studies show that Hypergraph Neural Networks (HGNNs) are vulnerable to adversarial attacks, while adversarial learning in the context of hypergraphs remains substantially under-investigated. In particular, all existing attacks on HGNNs are white-box and customized for either structural or feature perturbation. But in reality, the attacker might not have access to the target model parameters. Motivated by this knowledge gap, we propose a generic meta-objective-based learning framework, MeLA, that leverages the hypergraph Laplacian to conduct gray-box, structural, and feature perturbations under explicit perturbation budgets. In contrast to the attack literature, there is no adversarial training mechanism for HGNNs to defend against such attacks. Hence, we propose a novel adversarial training mechanism for HGNNs to obtain a robust classifier. We further prove the convergence of our robust training. Extensive experiments across various HGNN models and datasets show that (a) our proposed attack is effective in poisoning and evasion settings, and (b) our adversarial training enhances defense against adversarial attacks.

Hypergraph neural networks learn from data where relationships involve groups of entities, not just pairs, for instance, users and items in recommendation systems or genes in biological networks. We study how small changes to such data can make these models fail, even when an attacker does not have access to the full model. We also propose a training method that makes the models more robust by exposing them to difficult examples during training. Our experiments show that current hypergraph models can be vulnerable, but that robustness can be improved. This work can help researchers and practitioners test hypergraph models more carefully before using them in important applications.