Momentum Gradient-based Untargeted Attack on Hypergraph Neural Networks
Hypergraph Neural Networks (HGNNs) have been successfully applied in various
hypergraph-related tasks due to their excellent higher-order representation
capabilities. Recent works have shown that deep learning models are vulnerable
to adversarial attacks. Most studies on graph adversarial attacks have focused
on Graph Neural Networks (GNNs), and the study of adversarial attacks on HGNNs
remains largely unexplored. In this paper, we try to reduce this gap. We design
a new HGNNs attack model for the untargeted attack, namely MGHGA, which focuses
on modifying node features. We consider the process of HGNNs training and use a
surrogate model to implement the attack before hypergraph modeling.
Specifically, MGHGA consists of two parts: feature selection and feature
modification. We use a momentum gradient mechanism to choose the attack node
features in the feature selection module. In the feature modification module,
we use two feature generation approaches (direct modification and sign
gradient) to enable MGHGA to be employed on discrete and continuous datasets.
We conduct extensive experiments on five benchmark datasets to validate the
attack performance of MGHGA in the node and the visual object classification
tasks. The results show that MGHGA improves performance by an average of 2%
compared to the than the baselines.
Yang Chen, Stjepan Picek, Zhonglin Ye, Zhaoyang Wang, Haixing Zhao
# Momentum Gradient-based Untargeted Attack on Hypergraph Neural Networks

###### Abstract

Hypergraph Neural Networks (HGNNs) have been successfully applied in various hypergraph-related tasks due to their excellent higher-order representation capabilities. Recent works have shown that deep learning models are vulnerable to adversarial attacks. Most studies on graph adversarial attacks have focused on Graph Neural Networks (GNNs), and the study of adversarial attacks on HGNNs remains largely unexplored. In this paper, we try to reduce this gap. We design a new HGNNs attack model for the untargeted attack, namely MGHGA, which focuses on modifying node features. We consider the process of HGNNs training and use a surrogate model to implement the attack before hypergraph modeling. Specifically, MGHGA consists of two parts: feature selection and feature modification. We use a momentum gradient mechanism to choose the attack node features in the feature selection module. In the feature modification module, we use two feature generation approaches (direct modification and sign gradient) to enable MGHGA to be employed on discrete and continuous datasets. We conduct extensive experiments on five benchmark datasets to validate the attack performance of MGHGA in the node and the visual object classification tasks. The results show that MGHGA improves performance by an average of \(2\%\) compared to the than the baselines.

## 1 Introduction

Graph Neural Networks (GNNs) are widely used in tasks such as graph classification [11], node classification [23, 24], and link prediction [25, 26] due to their efficient learning ability and generalization capability. Graphs provide a useful way to represent pairwise connections between objects in real-world networks. However, they may not fully capture the complex higher-order relationships between objects [18]. When dealing with multimodal data, GNNs cannot efficiently learn all the information between objects, resulting in missing information and lower efficiency [14]. For example, in the scientist collaboration network, researchers are abstracted as nodes and edges represent the paper collaboration relationship. Here, the common graph cannot represent the situation where multiple researchers work together on a paper [13]. The hypergraph can clearly represent this complex relationship. Specifically, the hyperedge (an edge in a hypergraph is called a hyperedge) represents the collaboration of a paper, and a hyperedge connecting \(K\) nodes means that \(K\) researchers collaboratively work on a paper. Thus, the hypergraph has an advantage over the common graph in modeling complex relationships. Hypergraph Neural Networks (HGNNs) based on the hypergraph also outperform GNNs in many tasks [15, 16, 17], especially in the field of network security [13].

In recent years, many works have demonstrated the vulnerability of GNNs to adversarial attacks, resulting in degraded performance [25, 26]. HGNNs, as an extension of hypergraph deep learning on graph data, also show vulnerability to graph adversarial attacks [15]. Graph adversarial attacks aim to disrupt the performance of GNNs by adding small perturbations to the graph [3, 16]. Depending on the goal of the attack, the adversarial attacks can be classified as targeted and untargeted attacks [25, 16]. In the targeted attack, the attacker focuses on the classification of some test nodes. The attack is successful only if the target node is misclassified to the attacker-specified label [15]. In the untargeted attack, the attacker usually focuses on the classification of all test nodes, and the attack succeeds if the test nodes are misclassified [16]. Since the targeted attack usually attacks users with higher privileges, they are easily detected by defense models and are difficult to implement in real attacks [15]. Therefore, many works are based on the untargeted attack [16, 17].

Almost all of the current works on graph adversarial learning focus on GNNs and ignore the security of HGNNs [23, 24, 15], which makes HGNNs difficult to apply in practice. For example, adding some malicious noise to the pathology data can make it hard for doctors to understand the patient's condition and make wrong decisions in the task of detecting mental illness (e.g. Alzheimer's disease) [18].
There are some differences between HGNNs and GNNs when dealing the data. For example, GNNs can only process traditional graph data, while HGNNs can not only process traditional graph data but also complex and high-dimensional data. Due to the specificity of hypergraph data, we summarize two main challenges in HGNNs attacks from the perspective of hypergraph data:

(1) **Unstructuredness**. Unlike common graph datasets, there is no association between nodes in most hypergraph datasets, and the hypergraph structure (adjacency relations) can be obtained through various modeling methods [1].

(2) **Continuous Features**. Many common graph datasets are consist of discrete features. Hypergraph datasets can be applied in tasks such as graph visualization [14], image classification [15], etc. Many hypergraph datasets are continuous features, so many attacks on GNNs cannot be applied to HGNNs [1].

HGNNs differ from GNNs in the convolution operation. Specifically, graph convolution is defined based on edges between nodes, while hypergraph convolution is defined based on hyperedges between nodes [13, 14]. Hypergraph convolution is more complex than graph convolution, which leads to more difficult implementation of attacks in HGNNs. To the best of our knowledge, only HyperAttack [11] has made a preliminary exploration of adversarial attacks for HGNNs. HyperAttack uses the gradient to modify the hyperedges. However, the HyperAttack implementation assumes that the hypergraph dataset has been modeled to obtain the hypergraph structure (the original hypergraph dataset is unstructured). In other words, HyperAttack implements the attack in the hypergraph with fixed structure. Fig. 1 (a) shows the hypergraph structure \(H\) obtained using two distance-based HGNNs (HGNN-KNN, HGNN-\(\varepsilon\)[12]). We observe that the hypergraph structure \(H\) is obtained differently under different approaches. In addition, different settings of HGNNs' parameters generate different hypergraph structures in practice. Therefore, HyperAttack has attack destabilizability as it exhibits different performances in different structural hypergraphs generated under the same dataset. Intuitively, attacking hyperedges is not the best choice in HGNNs. This is because hypergraph datasets are unstructured and the same datasets generate the different hypergraph structures. The defender can learn from previous experience in adding or deleting many useless hyperedges to reduce the efficiency of the attack [1].

To address the above challenges, in this paper, we propose an attack that is more applicable to HGNNs, namely MGHGA. MGHGA sets up the utility wider untargeted attack. Fig. 1 (b) and (c) represent the training process of GNNs and HGNNs, respectively. We observe that modeling the dataset is a prerequisite for training HGNNs, whereas GNNs do not require this step. The previous attack algorithms directly modify the structure of the graph [10, 12], and HyperAttack is no exception. To address the challenge (1), we take a new perspective of attacking features before hypergraph modeling. MGHGA uses momentum gradients to guide the attacker to modify the features. To address challenge (2), we consider the scenarios of attacking discrete and continuous features separately. In discrete datasets, MGHGA directly inverts the feature values from 0 to 1 or 1 to 0. In continuous datasets, we update the features using a sign gradient strategy. Finally, the new hypergraph structure is obtained by modeling the perturbed hypergraph dataset and feeding it into the HGNNs to verify the validity of the MGHGA. The above process is shown in Fig. 1 (d). To highlight the innovations of our model, Table 1 shows the differences between HyperAttack and MGHGA.

Finally, we summarize the contributions of this paper as follows:

\(\bullet\) We propose the first untargeted adversarial attack MGHGA against HGNNs. MGHGA considers the training characteristics of HGNNs and implements the attack before hypergraph modeling.

\(\bullet\) We propose a momentum gradient method to guide the attacker in modifying the node's features, and our model can be applied to both discrete and continuous hypergraph datasets.

\(\bullet\) Extensive experiments on five datasets verified that MGHGA can effectively reduce the effectiveness of HGNNs and outperform other baseline methods in node and visual object classification tasks.

The rest of this work is organized as follows. In Section 2, we introduce some fundamentals of the HGNNs and untargeted attack. Section 3 introduces MGHGA in detail, including feature selection and feature modification. Section 4 presents the experimental dataset, parameters and experimental results. In Section 5, we first review the work related to hypergraph learning and graph adversarial attacks. Finally, we conclude our work in Section 6.

## 2 Preliminaries

For convenience, Table 2 gives the frequently used notations.

### Hypergraph Neural Network

Given a hypergraph dataset \(\mathcal{D}=(V,X)\), where \(V=\{v_{1},v_{2},...,v_{|V|}\}\) represents the set of nodes, \(X\in\mathbb{R}^{|V|\times d}\) denotes the node feature matrix and \(d\) denotes the dimensions of the feature. Constructing the hypergraph \(\mathcal{G}=(V,E,W)\), where \(E=\{e_{1},e_{2},...,e_{|E|}\}\) represents the set of hyperedges, and \(diag(W)=[w(e_{1}),w(e_{2}),...,w(e_{|E|})]\) is the diagonal matrix of the hyperedge weights, \(w(e)\) is the weight of the hyperedge. The correlation matrix \(H\in\{0,1\}^{|V|\times|E|}\) is used to represent the structure of the hypergraph, \(H(v,e)=1\) if the node \(v\) is inside the hyperedge \(e\), and \(H(v,e)=0\) otherwise, which can be expressed as follows:

\[H(v,e)=\left\{\begin{array}{l l}1,&if\quad v\in e.\\ 0,&if\quad v\notin e.\end{array}\right. \tag{1}\]

Due to the significant performance achieved by HGNNs widely used in classification [12]. In this paper, the downstream task of HGNNs is set as node classification. The hypergraph convolutional network learns node representations, transforms and propagates information to accomplish downstream tasks. A hypergraph convolutional layer can be represented as [16]

\[X^{(l+1)}=\sigma\left(D_{v}^{-1/2}HWD_{e}^{-1}H^{T}D_{v}^{-1/2}X^{(l)}\Theta^{( l)}\right). \tag{2}\]
where \(X^{(l)}\) denotes the node representation of the hypergraph at \(l\)-th layer. \(\sigma(\cdot)\) denotes the nonlinear activation function, \(W\) is the weight matrix of the hyperedges. \(D_{e}\) represents the diagonal matrix of the hyperedge degree (hyperedge degree is the number of nodes contained in the hyperedge), \(D_{v}\) is the diagonal matrix representing the node degree (node degree is the number of hyperedges containing the node), \(\Theta^{(l)}\) denotes the \(l\) layer training parameters.

We set the layer number of HGNNs to 2 as in most other works [10], whose definition can be expressed as

\[Z=f(H,X)=\mathrm{softmax}\left(\widehat{H}\operatorname{Re}LU\left(\widehat{ H}X\Theta^{(1)}\right)\Theta^{(2)}\right). \tag{3}\]

\[\text{where }\widehat{H}=D_{v}^{-1/2}HWD_{e}^{-1}H^{T}D_{v}^{-1/2}.\ \Theta^{(1)}\text{ and }\Theta^{(2)}\text{ are denoted as the training parameters of the first and second layers, respectively. In the training phase our goal is to continuously optimize \(\Theta=(\Theta^{(1)},\Theta^{(2)})\) to obtain the optimal classifier \(f_{\Theta^{*}}(H,X)\):

\[\min_{\Theta}L_{model}=-\sum_{u\in V_{L}}Y_{u}\ln{(Z_{u,:})}. \tag{4}\]

where \(Z_{u,:}\) denotes the set of predicted labeling probabilities for node \(u\), \(Y_{u}\) denotes the true label of node \(u\), \(V_{L}\) denotes the training set of node, and the predicted label of node \(u\) is denoted as

\[L_{pre}=\arg\max(Z_{u,:}). \tag{5}\]

\begin{table}
\begin{tabular}{c|c|c|c} \hline \hline Model & Target of attack & Phase of attack & Downstream task \\ \hline HyperAttack & Targeted attack & After hypergraph modeling & Node classification \\ MGHGA & Untargeted attack & Before hypergraph modeling & Node and Visual object classification \\ \hline \hline \end{tabular}
\end{table}
Table 1: Comparison of HyperAttack and MGHGA.

Figure 1: (a) shows two hypergraph modeling approaches. (b) and (c) represent the GNNs and HGNNs training processes, respectively. (d) shows the process of MGHGA.
### Untargeted Attack

The aim of untargeted is to reduce the global classification performance of HGNNs. Given a budget \(\Delta\) which represents the number of times the attacker modifies the feature entities. The untargeted attack can be expressed as

\[\arg\max_{X^{\prime}}\sum_{v\in V_{T}}\mathbb{I}\left(Y_{v}\neq C_{v} \right), \tag{6}\] \[\text{s.t.}\ C=\arg\max f_{\Theta^{*}}\left(H,X^{\prime}\right), \Theta^{*}=\arg\min L_{\text{model}}\ \left(H,X^{\prime}\right),\|\]

Where \(C\) is the set of node prediction labels, \(V_{T}\) denotes the test set of nodes. \(\mathbb{I}(x)\) is the indicator function. If x is true, \(\mathbb{I}(x)\) returns 1, otherwise \(\mathbb{I}(x)\) returns 0.

The main rationale for Eq. 6 is that in a model with high training error is likely to generalize poorly on the test set as well.

### Threat Model

Depending on whether the attack occurs before or after the training of HGNNs, it can be categorized into the evasion attack and poisoning attack Sharma _et al._ (2023); Shafahi _et al._ (2018). Evasion attack is performed on the trained HGNNs, and the attacker cannot modify the parameters or structure of the HGNNs Zhang _et al._ (2022). Poisoning attack is performed before the HGNNs are trained, and the attacker can insert perturbations in the training data in interfere with the training process of the HGNNs Jiang _et al._ (2022). Evasion and poisoning attacks occur during the testing and training of HGNNs Wang _et al._ (2020); Sharma _et al._ (2023), respectively. In an evasion attack, the attacker's goal is to modify the links or features of the test nodes causing the nodes to misclassify Fan _et al._ (2021). In the real attack, the attacker cannot access all the test data. For example, in an e-commerce recommendation system, graph deep learning models are used to predict the recommendation of a target item based on the sales records of existing goods. The attacker cannot modify the information of the competitor's goods, and the evasion attack is not applicable to this situation. However, the poisoning attack can solve this situation. For example, the attacker uses the surrogate model to train the goods dataset. The feedback from the surrogate model guides the attacker to modify the goods dataset. Eventually, the dataset with malicious perturbations is obtained Nguyen Thanh _et al._ (2023). When the graph deep models are run on the perturbed datasets, which learns the representation with malicious information, which decreases the recommendation rate of the target goods.

We focus on achieving HGNNs attack under poisoning attack, and the core idea is to use the surrogate model to attack to get the perturbed dataset before the HGNNs are trained. We study the robustness of HGNNs, so the surrogate model is set to HGNNs.

In addition, MGHGA is a white-box attack, which requires constant feedback information (e.g., gradient or node prediction labels) from surrogate HGNNs.

## 3 Momentum Gradient Hypergraph Attack

In this section, we detail the MGHGA components. The MGHGA pipeline is shown in Fig. 2. MGHGA addresses two challenges in hypergraph attacks. First, many hypergraph datasets do not have correlation relationships between nodes. Attacking the hypergraph structure does not guarantee the stability of the attack, due to the different hypergraph structures generated for the same hypergraph dataset under different modeling approaches. To solve this problem, we use the surrogate model to attack the nodes' features before the hypergraph modeling, as shown in Fig. 2 (c). Second, hypergraph datasets can be classified as discrete and continuous based on feature attributes. In order to improve the MGHGA, we design two methods to update the features.

### Feature Selection

We use the gradient of the feature matrix in the surrogate model to select features, denoted as

\[F_{i,j}=\frac{\partial L_{model}}{\partial X_{i,j}}. \tag{7}\]

Where, \(F\in\mathbb{R}^{|V|\times d}\) is the gradient matrix of features. A larger gradient of a feature indicates that this feature has a greater impact on the optimization of HGNNs, and thus modifying the feature can often have a large impact on HGNNs. However, previous studies have shown that using a greedy approach to directly modify the feature with the largest gradient makes the attack susceptible to falling into the optimized local optimum and easily overfitting to the attack model, which can diminish the generalizability of the generated adversarial samples Zugner _et al._ (2018); Liu _et al._ (2022).

To address the above problem, we propose a momentum gradient hypergraph attack. The momentum method is a technique to accelerate the gradient descent algorithm by accumulating velocity vectors along the gradient direction of the

\begin{table}
\begin{tabular}{c c} \hline Notation & Description \\ \hline \(\mathcal{D}\) & Clean hypergraph dataset \\ \(\mathcal{D}^{\prime}\) & Poisoned hypergraph dataset \\ \(\mathcal{G}\) & Hypergraph \\ \(V\) & Set of nodes of the clean hypergraph \\ \(X\) & Feature matrix of the hypergraph graph \\ \(X^{\prime}\) & Feature matrix of the perturbed hypergraph \\ \(E\) & Set of hyperedges of the clean hypergraph \\ \(W\) & Hyperedge weight matrix \\ \(H\) & Correlation matrix of the clean graph \\ \(D_{e}\) & Hyperedge degree \\ \(D_{v}\) & Node degree \\ \(Y\) & True label \\ \(C\) & Prediction label \\ \(F\) & Feature gradient matrix \\ \(\Delta\) & Attack budget \\ \(u\) & Momentum decay \\ \(\eta\) & Constraint factor \\ \(L_{model}(\cdot)\) & HGNNs loss \\ \hline \end{tabular}
\end{table}
Table 2: Notations frequently used in this paper and their corresponding descriptions.
loss function during the iteration [3]. Accumulating previous gradients helps the model avoid falling into local optimum. We apply the momentum method to generate malicious features. The momentum gradient matrix of the features is first computed.

\[\left\{\begin{array}{c}F^{0}=0.\\ F^{t}=\mu F^{t-1}+\frac{\partial L_{model}}{\partial X^{t}}.\end{array}\right. \tag{8}\]

where \(u\) represents the momentum decay factor and \(X^{(t)}\) denotes the perturbation feature matrix after \(t\) iterations.

MGHGA select the feature of the maximum absolute value of the momentum gradient matrix.

\[m_{i,j}^{t}=\arg\max|F^{t}|. \tag{9}\]

where \(m_{i,j}^{t}\) represents the absolute maximum value of gradient at \(t\) iterations, \(i\) and \(j\) represent the node and feature indexs, respectively.

### Feature Modification

At each iteration, we modify only one feature and stop the attack when the number of modifications reaches the budget \(\Delta\). Here, we consider discrete and continuous feature modifications, respectively.

**Discrete Feature.** In discrete features, where the feature values are only 1 or 0, we use a direct inversion mechanism to modify the features. At \(t\) iterations, feature deletion or addition can be expressed as

\[X_{i,j}^{t}=1-X_{i,j}^{t},\quad s.t.\quad||X^{t}-X||\leq\Delta. \tag{10}\]

**Continuous Feature.** For the image attack with continuous features, the researchers use the gradient sign mechanism to generate perturbations, and the results indicate that the mechanism can achieve high efficiency attack in continuous data [1]. Inspired by this, we use a gradient sign mechanism to update the continuous features. Our approach involves introducing perturbations along the opposite direction of the normal sample gradient to maximize the target model's training loss error, thereby lowering its classification confidence and increasing the probability of inter-class confusion, ultimately leading to misclassification. Specifically, the update feature matrix can be expressed as

\[X_{i,j}^{t}=X_{i,j}^{t}+\eta sign(F_{i,j}^{t}),\quad s.t.\quad||X^{t}-X||\leq\Delta. \tag{11}\]

where \(\eta\) is the constraint factor and \(sign(x)\) is denoted as the gradient symbol. \(sign(x)=1\) when \(x>0\), otherwise \(sign(x)=0\). At the end of the iteration, the anomalous features are filtered in order to avoid that the newly generated features are not within the original features.

\[\left\{\begin{array}{l}X_{i,j}^{\prime}=\arg\min X,\text{ s.t. }X_{ij}^{\prime}<\arg\min X.\\ X_{i,j}^{\prime}=\arg\max X,\text{ s.t. }X_{ij}^{\prime}>\arg\max X.\end{array}\right. \tag{12}\]

where \(X\) and \(X^{\prime}\) denote the original and perturbed hypergraph feature sets, respectively. \(argmin(X)\) and \(argmax(X)\) denote the minimum and maximum values of the original hypergraph feature set, respectively.

We reset the features that are beyond the lower and upper of the original features, which ensures the imperceptibility of the perturbations and prevents them from being detected by some simple defense mechanisms (e.g., outlier detection models). Note that filtering anomalous features in MGHGA does not consume budget.

Figure 2: The pipeline of MGHGA. The goal of MGHGA is to generate perturbed datasets with malicious information. Where the red color represents the features of the nodes under attack.
Since multiple modifications of the same feature cause a waste of budget, we attack at most once for both continuous and discrete features.

### Algorithm

The pseudo-code of MGHGA is given in Algorithm 1.

```
0: Hypergraph dataset \(\mathcal{D}=(V,X)\), momentum decay factor \(u\), constraint factor \(\varepsilon\), budget \(\Delta\)
0: Perturbation hypergraph dataset \(\mathcal{D}^{\prime}=(V,X^{\prime})\)
1:Initialization: Modeling hypergraph \(\mathcal{G}=(V,E,W)\), number of attack iterations \(T\), HGNN surrogate model \(f_{\Theta^{\prime}}(H,X)\), perturbation gradient matrix \(F^{0}\)
2:while\(t<T\) or \(||X^{t}-X||\leq\Delta\)do
3: Calculate the gradient of \(i\) iterations through Eq. 7
4: Calculate the \(i\) iteration momentum gradient through Eq. 8
5: Select the \(i\) iteration features through Eq. 9
6:if\(X\) is the discrete feature then
7: Update gradient matrix through Eq. 10
8:else\(\triangleright\)\(X\) is the continuous feature
9: Update gradient matrix through Eq. 11
10:endif
11:\(t=t+1\)
12:endwhile
13:if\(X\) is the continuous feature then
14: Filter features through Eq. 12
15:endif
```

**Algorithm 1** MGHGA

**Complexity Analysis.** MGHGA uses HGNN as a pre-training model, and HGNN includes forward and backward propagation in training with a complexity of \(\mathcal{O}(t||H||\cdot||X||)\), where \(t\) denotes the number of HGNN training. Then MGHGA calculates the gradient of the feature matrix, the complexity is \(\mathcal{O}(d|V|)\). Updating and filtering features are basic operations with low complexity and are ignored here. The complexity of modifying features is \(\mathcal{O}(Td|V|)\), where \(T\) denotes the number of attack iterations. In summary the overall complexity of MGHGA is \(\mathcal{O}(t||H||\cdot||X||+Td|V|)\).

## 4 Experiments

### Datasets

Recent works have shown that HGNNs exhibit excellent performance on node classification and visual object classification tasks [11, 14], which are the most common practical applications of HGNNs. Therefore, our work focuses on these two tasks. To illustrate the performance of MGHGA, experiments are carried out on five datasets. We performed node classification tasks on Cora, Cora-ML and Citeseer [14] datasets. The visual object classification task is performed on two multi-feature and continuous datasets including National Taiwan University 3D model (NTU) [2] and Princeton ModelNet40 (ModelNet40) [21]. The dataset information is summarized in Table 3. Hypergraphs are obtained by modeling hypergraph datasets. However, NTU and ModelNet40 are without adjacencies, and their adjacencies are obtained using the hypergraph construction methods. In order to ensure the consistency of the adjacency relations of each dataset, we do not use the original adjacency of the Cora, Cora-ML and Citeseer datasets but instead utilize commonly used construction methods to generate hypergraph structures in the experiments.

### Baselines

**Since MGHGA is the first work on the untargeted adversarial attack in HGNNs, there are fewer comparative models to refer.** HyperAttack, which is most relevant to our work, is set up as a targeted attack and cannot be used as a comparison model. Due to the specificity of the hypergraph structure, it is difficult to directly migrate the GNNs adversarial attack models to HGNNs. Here, we use the following model as comparison models.

**Random Attack (Random)**: The conclusion of the work on common graph attacks shows that the Random Attack can degrade the performance of GNNs [13]. In this paper, we attack the features randomly. Specifically, the features are randomly changed from 0 to 1 and from 1 to 0 in the discrete dataset. In the continuous dataset, the features are randomly modified. It should be noted that the modified features are within the range of the original features.

**Node Degree Attack (NDA)**: Previous works have shown that attacking nodes with maximum node degree degrades the performance of the GNNs [20]. Extending to HGNNs, NDA is a method to attack nodes with maximum node degree. Note that features are modified in the same way as Random.

**Fast Gradient Attack (FGA)**: Fast Gradient Attack is a common gradient attack in the common graph [2]. We extend it to hypergraphs. In each attack, we choose the feature with the largest absolute value of the gradient to attack.

**Fast Gradient Attack-Node Degree (FGA-D)**: We add a constraint for the FGA that attacks the node with the larger degree, which obtains the FGA-D. Note that the FGA and FGA-D modify the discrete features similarly to MGHGA.

**MGHGA-D**: MGHGA-D is an extended model of MGHGA, and MGHGA-D is obtained from MGHGA with the same constraint as FGA-D.

Note that FGA-D and MGHGA-D are attacks with constraints, i.e., they attack nodes with larger node degrees.

### Parameter setting and metrics

**Parameters**. In our experiments, the hypergraph is generated using two distance-based generation methods, i.e., HGNN-KNN and HGNN-\(\varepsilon\), where \(K\) and \(\varepsilon\) are set to 10 and 0.5, respectively. The correlation matrix \(H\) is set to a binary matrix. HGNNs are set to two layers, the feature dimension of the hidden layer is set to 64 and dropout is applied to avoid overfitting. In the training process, the training count is set to 300 and the learning rate of the Adam optimizer is 0.001. The ratio of the training set to the test set is 0.2 and 0.8, respectively. In the discrete dataset, the constraint factor \(\eta\) is set to \(X_{avg}\). The constraint factor \(\eta\) is set to \(X_{avg}=\frac{sum(X)}{|V|d}\) in the continuous dataset. The budget \(\Delta=\lambda|V|\), where \(\lambda\) is the
budget factor is set to 0.05 by default. The decay factor \(\mu\) is 0.8. FGA-D and MGHGA-D attack nodes with top \(1\%\) node degree by default. The victim model and the target model are the same by default, where the victim model is the model used by the user and the victim model is the pre-trained model used by the surrogate model. The experiments are conducted on a computer with an Intel(R) Xeon(R) Gold 5118 processor and 2* NVIDIA GeForce GTX 1070Ti GPU.

**Metrics**. For a comprehensive evaluation of MGHGA, we use the classification success rate to measure the attack effectiveness. The classification success rate indicates the classification accuracy of HGNN in the test set, and a lower rate indicates a better attack.

### Experimental Results

**MGHGA Attack Performance**

Table 4 summarizes the classification accuracies of the five types of datasets under the attacks. The performance of HGNN-KNN and HGNN-\(\varepsilon\) decreases under all attacks, which indicates that attacking node features can effectively degrade the performance of HGNNs. Specifically, we observe that MGHGA achieves the best performance under all the datasets. For example, using HGNN-KNN as the victim model, the classification accuracies of the discrete dataset Cora are 58.65\(\%\), 58.47\(\%\), 57.63\(\%\) and 55.33\(\%\) for Random, NDA, FGA and MGHGA, respectively. The lower classification accuracy indicates that the attack causes more damage to HGNNs. Therefore, MGHGA achieves the best efficiency in comparing the advanced attacks. The results are the same in other datasets, especially in NTU and ModelNet40 continuous datasets, which shows that our proposed method is applicable not only to discrete datasets but also to continuous datasets.

MGHGA improves the performance by \(3\%\) on average compared to Random. In particular, MGHGA improves the performance by 5\(\%\) in Citeseer, which shows that MGHGA can add some critically important perturbations with the same budget. FGA shows significant performance on some new tasks due to its strong generalization ability. In the comparison models, the results of FGA can be viewed as the current optimum. With a small budget, our proposed model improves the attack performance by 2\(\%\) on average, which is a satisfactory result for us. HGNNs are better able to utilize global as well as longer range contextual information when aggregating neighboring features, resulting in improved robustness of HGNNs over GNNs. Attacking HGNNs is more difficult than attacking GNNs. MGHGA, as a preliminary exploration of targetless attacks on HGNNs, shows outstanding performance compared to all other models, which indicates that our proposed attack is capable of achieving an optimal attack.

In addition, we investigate the effect of adding attack constraints (attacking the node with the largest node degree) on the attacks. Comparing MGHGA-D and MGHGA found that the performance of MGHGA-D attacking the node with the largest node degree, although it can reduce the performance of GNNs, the attack performance is not as good as that of MGHGA without constraints. For example, in Citeseer, the performance of MGHGA over MGHGA-D is improved by 2.08\(\%\) and 2.67\(\%\) in HGNN-KNN and HGNN-\(\varepsilon\) respectively. The same rule is exhibited in FGA-D and FGA. Intuitively, the unrestricted attack can maximize the efficiency of the attack.

**Running Time**

Table 5 shows the runtimes for several attacks. Specifically, Random has a low runtime in each dataset, but its performance is the worst of all the attacks and therefore would not be considered for application in the real attack. Comparing FGA and MGHGA shows that MGHGA runtime can be similar to FGA, but enables more efficient attacks. For example, in Citeseer, the running times of FGA and MGHGA are 4.10 and 4.15 minutes, respectively. Their classification accuracies are 62.44\(\%\) and 58.05\(\%\) (obtained from Table 4) when the victim model is HGNN-KNN, respectively. Our results show that our model achieves efficient attack while also achieving runtimes similar to comparison models. In most cases, we find that the runtime of the attack is positively correlated with the size of the nodes, and the runtime is longer when the node size is larger. For example, the number of nodes in descending order are ModelNet40, Citeseer, Cora_ML, Cora and NTU, and the runtimes in descending order are: ModelNet40, Citeseer, Cora_ML, NTU and Cora. An exception exists where NTU\(>\) Cora. Intuitively, NTU is two-featured data, and HGNNs spend longer time processing two-featured data than single-featured data.
As shown in Fig. 3, we observe that MGHGA achieves satisfactory results with different budgets in all datasets. In Fig. 3 (j), the classification accuracies of FGA and MGHGA are {87.64\(\%\), 85.82\(\%\), 85.29\(\%\)} and {86.62\(\%\), 84.19\(\%\), 84.14\(\%\)} when the budget factor \(\lambda\) are {0.01, 0.05, 0.1}, respectively.

Furthermore, we investigated the effect of the budget on two constrained attacks (FGA-D and MGHGA-D). Fig. 3 shows that the increase in budget negatively affects the constrained attacks. As an example, the classification accuracies of FGA-D and MGHGA-D are {88.36\(\%\), 87.54\(\%\), 87.88\(\%\)} and {88.12\(\%\), 86.97\(\%\), 87.40\(\%\)} in Fig. 3 (e), when the budget factor \(\lambda\) are {\(0.01,0.05,0.1\)}. We analyze that the larger nodes (FGA-D and MGHGA-D attack the node with the larger node degree each time) have a limited impact on the attack performance. FGA-D and MGHGA-D attack features do not positively impact the attack when the budget is too large. Therefore, the performance of the restricted attack increases and then decreases with the budget increases, which is particularly evident in the Cora and ModelNet40 datasets.

**Attack performance in HGNNs parameters \(K\) and \(\varepsilon\)**

Fig. 4 shows the performance of our proposed model for different parameter \(K\). We find that the performance of MGHGA is independent of the victim model HGNN-KNN parameter \(K\), i.e., MGHGA still reduces the accuracy of HGNN-KNN regardless of \(K\). For example, in NTU, MGHGA-D and MGHGA reduce the accuracy of {2.08\(\%\), 3.84\(\%\), 1.51\(\%\)}, and {3.90\(\%\), 4.27\(\%\), 3.81\(\%\)}, respectively, when \(K\) are {5, 10, 15}.

We investigate the effect of parameter \(\varepsilon\) on our model, and the results are shown in Fig. 5. In each dataset, MGHGA is able to achieve reduced HGNN-\(\varepsilon\) classification accuracy. Specifically, the average performance of MGHGA-D and MGHGA in Citeseer is 3.03\(\%\) and 4.43\(\%\) under all \(\varepsilon\), respectively.

The above results indicate that our model is not affected

\begin{table}
\begin{tabular}{c|c|c c c c c c c} \hline \hline Datasets & Model & Clean & Random & NDA & FGA-D & FGA & MGHGA-D & MGHGA \\ \hline \multirow{2}{*}{Cora} & HGNN-KNN & 59.31\(\pm\)0.3 & 58.65\(\pm\)0.9 & 58.47\(\pm\)0.5 & 58.24\(\pm\)0.8 & 57.63\(\pm\)1.1 & 58.13\(\pm\)0.9 & **55.33\(\pm\)1.8** \\  & HGNN-\(\varepsilon\) & 57.19\(\pm\)0.2 & 56.97\(\pm\)1.1 & 56.73\(\pm\)0.6 & 56.46\(\pm\)0.7 & 55.10\(\pm\)1.0 & 54.94\(\pm\)0.9 & **53.51\(\pm\)1.5** \\ \hline \multirow{2}{*}{Cora\_ML} & HGNN-KNN & 69.33\(\pm\)0.2 & 68.89\(\pm\)0.8 & 68.34\(\pm\)0.6 & 68.11\(\pm\)0.5 & 67.76\(\pm\)1.0 & 67.90\(\pm\)0.7 & **66.12\(\pm\)1.2** \\  & HGNN-\(\varepsilon\) & 69.13\(\pm\)0.3 & 68.77\(\pm\)0.8 & 68.19\(\pm\)0.4 & 68.04\(\pm\)0.8 & 67.42\(\pm\)0.8 & 67.64\(\pm\)0.9 & **65.76\(\pm\)1.3** \\ \hline \multirow{2}{*}{Citeseer} & HGNN-KNN & 64.63\(\pm\)0.2 & 63.34\(\pm\)0.4 & 63.03\(\pm\)0.6 & 62.90\(\pm\)0.6 & 62.44\(\pm\)1.6 & 60.13\(\pm\)0.7 & **58.05\(\pm\)0.9** \\  & HGNN-\(\varepsilon\) & 62.12\(\pm\)0.1 & 61.41\(\pm\)0.5 & 60.90\(\pm\)0.4 & 60.21\(\pm\)0.4 & 59.13\(\pm\)1.3 & 59.34\(\pm\)0.7 & **57.67\(\pm\)1.5** \\ \hline \multirow{2}{*}{NTU} & HGNN-KNN & 75.06\(\pm\)0.2 & 73.99\(\pm\)0.4 & 73.23\(\pm\)0.5 & 72.92\(\pm\)0.6 & 72.11\(\pm\)1.0 & 72.17\(\pm\)0.5 & **71.22\(\pm\)1.2** \\  & HGNN-\(\varepsilon\) & 73.73\(\pm\)0.2 & 73.06\(\pm\)0.7 & 72.61\(\pm\)0.6 & 72.13\(\pm\)0.5 & 70.30\(\pm\)0.8 & 70.49\(\pm\)0.7 & **69.18\(\pm\)1.4** \\ \hline \multirow{2}{*}{ModelNet40} & HGNN-KNN & 89.91\(\pm\)0.2 & 88.15\(\pm\)0.4 & 87.93\(\pm\)0.5 & 87.54\(\pm\)0.7 & 86.67\(\pm\)0.8 & 86.97\(\pm\)0.6 & **85.64\(\pm\)0.9** \\  & HGNN-\(\varepsilon\) & 88.12\(\pm\)0.3 & 87.49\(\pm\)0.4 & 87.02\(\pm\)0.4 & 86.46\(\pm\)0.5 & 85.82\(\pm\)0.9 & 86.07\(\pm\)0.6 & **84.19\(\pm\)1.3** \\ \hline \hline \end{tabular}
\end{table}
Table 4: Comparison of classification accuracy (\(\%\)) of several attack models. The lower the classification success rate, the better the model performance. In each case, the best results are bolded. The results are the average of 10 runs.

\begin{table}
\begin{tabular}{c|c|c c c c c} \hline \hline Datasets & Model & Random & NDA & FGA-D & FGA & MGHGA-D & MGHGA \\ \hline \multirow{2}{*}{Cora} & HGNN-KNN & 0.25 & 0.37 & 2.35 & 2.33 & 2.35 & 2.34 \\  & HGNN-\(\varepsilon\) & 0.25 & 0.37 & 2.35 & 2.33 & 2.35 & 2.34 \\ \hline \multirow{2}{*}{Cora\_ML} & HGNN-KNN & 0.25 & 0.35 & 3.33 & 3.31 & 3.34 & 3.33 \\  & HGNN-\(\varepsilon\) & 0.25 & 0.36 & 3.34 & 3.31 & 3.35 & 3.33 \\ \hline \multirow{2}{*}{Citeseer} & HGNN-KNN & 0.27 & 0.40 & 4.15 & 4.10 & 4.19 & 4.15 \\  & HGNN-\(\varepsilon\) & 0.27 & 0.39 & 4.16 & 4.11 & 4.19 & 4.16 \\ \hline \multirow{2}{*}{NTU} & HGNN-KNN & 0.25 & 0.44 & 2.56 & 2.50 & 2.56 & 2.55 \\  & HGNN-\(\varepsilon\) & 0.25 & 0.44 & 2.56 & 2.49 & 2.56 & 2.55 \\ \hline \multirow{2}{*}{ModelNet40} & HGNN-KNN & 1.23 & 2.54 & 10.64 & 11.13 & 10.67 & 11.21 \\  & HGNN-\(\varepsilon\) & 1.26 & 2.58 & 10.66 & 11.16 & 10.71 & 11.18 \\ \hline \hline \end{tabular}
\end{table}
Table 5: Running time of various attacks in minutes.
Figure 4: The model performance in different parameters \(K\).

Figure 3: The attack performance under different budget factors \(\lambda\).
by the victim model parameters. Previous work has shown that the parameters \(K\) and \(\varepsilon\) do not affect the performance of HGNNs on classification tasks, i.e., HGNNs have good stability [14]. We think that the parameters \(K\) and \(\varepsilon\) do not affect our model due to the stability of HGNNs.

**Attack performance in different decay factors**

The decay factor \(\mu\) is an important parameter of our model. Fig. 6 shows the effect of the decay factor \(\mu\) on our model. Note that the MGHGA degrades to FGA when \(\mu\)= 0. We observe that the model performance first increases and reaches a plateau or decreases as \(\mu\) increases. For example, in Fig. 6 (d), the accuracy of MGHGA are {72.11\(\%\), 71.21\(\%\), 71.23\(\%\) } when \(\mu\) are {0, 1, 1.4}, respectively. In addition, our model performs best when \(\mu\) = 1 for discrete and continuous data sets in most cases. Intuitively, when \(\mu\) is small, the momentum gradient mainly depends on the gradient of the HGNNs at the \(t\) moment, and the performance of MGHGA is similar to that of the normal gradient attack FGA. As \(\mu\) increases, the gradient of the MGHGA depends on the gradients of the previous moments and the current moment, and this way of combining the gradients starts to improve the performance of the MGHGA. However, as \(\mu\) continues to increase, the momentum gradient relies heavily on the gradient of the previous moments and ignores the feedback from the gradient of the latest moment, and MGHGA performance degrades. The above results indicate that using the momentum gradient model can improve the attack performance.

**Transferability of MGHGA**

In this section, we verify the transferability of our model. The heat map 7 illustrates the performance of MGHGA in various surrogate and victim models. It is observed that the combination of surrogate and victim models does not affect the MGHGA performance. Specifically, in Citeseer, the performance of IMGIA improved by 0.16\(\%\) when the surrogate model and victim models are HGNN-KNN and HGNN-\(\varepsilon\), respectively. We think that MGHGA completes the attack before the victim HGNNs are trained and do not need to access the training parameters of the victim model, so the choice of surrogate and victim models does not affect the performance of MGHGA. In addition, there are differences in the way the hypergraphs of HGNN-KNN and HGNN-\(\varepsilon\) are modeled making their accuracies in the classification task different, and the MGHGA performance differs under different combinations of HGNNs.

## 5 Related Work

### Hypergraph Learning

The flexibility and capability of hypergraph learning to model complex higher-order data correlations have garnered increasing attention in recent years [11, 12]. Hypergraph learning usually consists of two parts: constructing hypergraphs and designing hypergraph learning methods. (1) **Constructing hypergraphs**. There are four types of methods for constructing hypergraphs: distance-based, representation-based, attribute-based, and network-based. Specifically, Huang et al. [11] proposed a nearest neighbor construction method whose main aim is to find adjacent vertices in the feature space and construct a hyperedge to connect them. Wang et al. [13] proposed a representation-based hyperedge construction mechanism that exploits the correlation between feature vectors to establish nodes connections. The literature [11] proposed a generation method applicable to attribute hypergraphs, which uses attribute information to construct hypergraphs. Fang et al. [14] used user friendship and mobility information to construct hypergraphs in the location social networks. (2) **Hypergraph learning methods**. Hypergraph learning can be divided into spectral analysis methods, neural network methods, and other methods according to their implementations. Feng et al. [14] first proposed the hypergraph neural network, which extends the spectral approach of graph convolutional neural networks to the hypergraph and designs hypergraph convolution operations. Yadati et al. [15] proposed the HyperGCN, which solves the problem of processing semi-supervised classification on the hypergraph. Huang et al. [11] proposed MultiHGNN, which learns multimodal hypergraph data and uses hypergraph modeling for each modality to accomplish downstream tasks. Jiang et al. [11] proposed a dynamic hypergraph neural network, which consists of two modules: dynamic hypergraph construction and convolution. Tran [2] proposed a directed hypergraph neural network based on the directed hypergraph Laplacian operator for the semi-supervised learning of the directed hypergraph.

### Graph Adversarial Attack

Graph attack algorithms can be classified into different types, mainly attack type, target, knowledge and capability. (1) Attacks can be classified into three categories based on their type: **the topology attack, the feature attack and the hybrid attack**[1, 12, 13]. In the topology attack, the attacker focuses on modifying the graph topology, which is a common attack method, e.g., FGA [1], Mettack [25], RL-S2V [1] and HyperAttack [15]. The node feature modification is another common attack method, where the attacker focuses on modifying the features of the nodes, e.g., GANI [14]. In Nettack [25] and IG-Attack [15], attackers use the graph topology and node feature attacks to degrade GNNs' accuracy. (2) Based on the target of the attack, we can classify the attacks into the following two categories: **targeted and untargeted attacks**[1, 12, 13]. Dai et al. [1] proposed a targeted universal attack against GNNs, where the attacker's goal is to misclassify some of the test nodes into the attacker-specified labels. Fang et al. [14] injected fake nodes with malicious information into the graph which made the GNN perform very poorly on the test nodes. (3) According to the knowledge classification of the attacker can be divided into three categories: **the white box attack, the gray box attack and the black box attack**[1, 12]. In white box attack, the attacker knows all the knowledge about the GNNs model and datasets [25]. In a gray-box attack, the attacker only
Figure 5: The model performance in different parameters \(\varepsilon\).

Figure 6: The model performance in different decay factor \(\mu\).

Figure 7: The translatability of MGHGA. Where the x-axis represents the victim model and the y-axis represents the surrogate model.
has some knowledge, e.g., knowing the parameters of GNNs but not the prediction results of nodes [22]. In black-box attacks, the attacker does not know the model architecture, parameters and training data, and can only obtain a small amount of model feedback [15]. Liu et al. [16] proposed a multi-level propagation surrogate white box attack where the attacker knows the model parameters and dataset information. The attack improved the success rate of the attack by querying the node information and using batch normalization to enhance the dissimilarity of node representations. Hussain et al. [17] proposed a gray-box attack where the attacker can access the labels of nodes and disrupt the fairness of node classification by injecting adversarial links. Ju et al. [18] proposed a black-box attack method using a reinforcement learning framework, the attacker is not using a surrogate model to query model parameters or training labels. (4) Attacks can be classified into three categories based on the capabilities of the attacker: the **single node attack, the some node attack, and the all node attack**[10, 11, 12]. Chen et al. [10] proposed a single node structure attack model proving that the single node attack can effectively reduce the accuracy of GNNs. Zang et al. [19] proposed a universal attack with modified edges in which the attacker reduces the effectiveness of GNNs by modifying a particular node or subgraph structure.

## 6 Conclusion

Our work shows that HGNNs are vulnerable to attacks in untargeted attack. In this paper, we present the first untargeted attack on HGNNs, named MGHGA. Considering the training differences between HGNN and GNNs, MGHGA uses surrogate models to modify node features before hypergraph modeling. Specifically, MGHGA uses the momentum gradient mechanism to select the features of the attack nodes. MGHGA uses different methods to update discrete and continuous features in the feature generation module. Extensive experimental results show that MGHGA can achieve advanced attack levels in node and visual object classification tasks.

In this paper, we only discuss the vulnerability of HGNNs. However, MGHGA has drawbacks. For example, MGHGA is set up as a white-box attack that accesses the HGNNs training parameters during the process of the attack. In some extreme cases, the attacker can only access some or none of the parameters, which leads to MGHGA failure. In our future work, we will consider two main aspects: (1) Consider the robustness of HGNNs in more scenarios, such as gray-box and black-box attacks. (2) According to the conclusion of this paper, we will consider how to improve the robustness of HGNNs under untargeted attacks.

There is a paucity of current research on the robustness of HGNNs. We hope that MGHGA is the first step in opening up exciting research avenues for studying HGNNs attacks and defenses.

## References

* [1]D. Chen, X. Tian, Y. Shen, and M. Ouyoung (2003) On visual similarity based 3d model retrieval. In Computer graphics forum, Vol. 22, pp. 223-232. Cited by: SS1.
* [2]J. Chen, Y. Wu, X. Xu, Y. Chen, H. Zheng, and Q. Xuan (2018) Fast gradient attack on network embedding. arXiv preprint arXiv:1809.02797. Cited by: SS1.
* [3]J. Chen, Y. Chen, H. Zheng, S. Shen, S. Yu, D. Zhang, and Q. Xuan (2020) Mga: momentum gradient attack on network. IEEE Transactions on Computational Social Systems8 (1), pp. 99-109. Cited by: SS1.
* [4]Y. Chen, H. Zheng, S. Shen, S. Yu, D. Zhang, and Q. Xuan (2020) Mga: momentum gradient attack on network. IEEE Transactions on Computational Social Systems8 (1), pp. 99-109. Cited by: SS1.
* [5]Y. Chen, H. Zheng, X. Chen, Z. Ye, H. Zhao, L. Meng, Z. Wang, and Y. Yang (2022) A practical adversarial attack on graph neural networks by attacking single node structure. In 2022 IEEE 24th Int Conf on High Performance Computing, pp. 143-152. Cited by: SS1.
* [6]F. Cui, W. Dai, Y. Zhu, X. Kan, A. A. Chen Gu, J. Lukemire, L. Zhan, L. He, Y. Guo, and C. Yang (2023-06) Braingb: a benchmark for brain network analysis with graph neural networks. IEEE TRANSACTIONS ON MEDICAL IMAGING42 (2), pp. 493-506. Cited by: SS1.
* [7]H. Dai, H. Li, T. Tian, X. Huang, L. Wang, J. Zhu, and L. Song (2018) Adversarial attack on graph structured data. In International conference on machine learning, pp. 1115-1124. Cited by: SS1.
* [8]J. Dai, W. Zhu, and X. Luo (2022) A targeted universal attack on graph convolutional network by using fake nodes. Neural Processing Letters54 (4), pp. 3321-3337. Cited by: SS1.
* [9]H. Dong and Y. Yang (2018) Training Generative Adversarial Networks with Binary Neurons by End-to-end Backpropagation. arXiv e-prints. Cited by: SS1.
* [10]H. Fan, B. Wang, P. Zhou, A. Li, Z. Xu, C. Fu, H. Li, and Y. Chen (2021) Reinforcement learning-based black-box evasion attacks to link prediction in dynamic graphs. In 2021 IEEE 23rd Int Conf on High Performance Computing & Communications, pp. 933-940. Cited by: SS1.
* [11]Q. Fang, J. Sang, C. Xu, and Y. Rui (2014) Topic-sensitive influencer mining in interest-based social media networks via hypergraph learning. IEEE Transactions on Multimedia16 (3), pp. 796-812. Cited by: SS1.
* [12]J. Fang, H. Wen, J. Wu, Q. Xuan, Z. Zheng, and C. K. Tse (2022) Gani: global attacks on graph neural networks via imperceptible node injections. arXiv preprint arXiv:2210.12598. Cited by: SS1.
* [13]Y. Feng, H. You, Z. Zhang, R. Ji, and Y. Gao (2021) Hypergraph neural networks. Cited by: SS1.
* [14]H. Fan, B. Wang, P. Zhou, A. Li, Z. Xu, C. Fu, H. Li, and Y. Chen (2021) Reinforcement learning-based black-box evasion attacks to link prediction in dynamic graphs. In 2021 IEEE 23rd Int Conf on High Performance Computing & Communications, pp. 933-940. Cited by: SS1.
* [15]H. Fan, B. Wang, P. Zhou, A. Li, Z. Xu, C. Fu, H. Li, and Y. Chen (2021) Reinforcement learning-based black-box evasion attacks to link prediction in dynamic graphs. In 2021 IEEE 23rd Int Conf on High Performance Computing & Communications, pp. 933-940. Cited by: SS1.
* [16]J. Fan, H. Wen, J. Wu, Q. Xuan, Z. Zheng, and C. K. Tse (2022) Gani: global attacks on graph neural networks via imperceptible node injections. arXiv preprint arXiv:2210.12598. Cited by: SS1.
* [17]Y. Feng, H. You, Z. Zhang, R. Ji, and Y. Gao (2021) Hypergraph neural networks. Cited by: SS1.
* [18]Y. Feng, H. Wu, Z. Zhang, and C. K. Tse (2021) Gani: global attacks on graph neural networks via imperceptible node injections. arXiv preprint arXiv:2101.12598. Cited by: SS1.
* [19]Y. Feng, H. Wu, Z. Zhang, R. Ji, and Y. Gao (2021) Hypergraph neural networks. Cited by: SS1.

[MISSING_PAGE_POST]
In _Proceedings of the AAAI conference on artificial intelligence_, volume 33, pages 3558-3565, 2019.
* [Fischer _et al._2021] Maximilian T. Fischer, Devanshu Arya, Dirk Streeb, Daniel Seebacher, Daniel A. Keim, and Marcel Worring. Visual analytics for temporal hypergraph model exploration. _IEEE Transactions on Visualization and Computer Graphics_, 27(2):550-560, FEB 2021.
* [Gao _et al._2022] Yue Gao, Zizhao Zhang, Haojie Lin, Xibin Zhao, Shaoyi Du, and Changqing Zou. Hypergraph learning: Methods and practices. _IEEE Transactions on Pattern Analysis and Machine Intelligence_, 44(5):2548-2566, 2022.
* [Gao _et al._2023] Yue Gao, Yifan Feng, Shuyi Ji, and Rongrong Ji. Hgnn+: General hypergraph neural networks. _IEEE Transactions on Pattern Analysis and Machine Intelligence_, 45(3):3181-3199, 2023.
* [Goodfellow _et al._2014] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. _arXiv preprint arXiv:1412.6572_, 2014.
* [Han _et al._2009] Yi Han, Bin Zhou, Jian Pei, and Yan Jia. Understanding importance of collaborations in co-authorship networks: A supportiveness analysis approach. In _Proceedings of the SIAM International Conference on Data Mining_, pages 1111-1122, 04 2009.
* [Heydari and Livi2022] Sajjad Heydari and Lorenzo Livi. Message passing neural networks for hypergraphs. In _AR-TIFICAL NEURAL NETWORKS AND MACHINE LEARNING_, volume 13530, pages 583-592, 2022.
* [Hu _et al._2023] Chao Hu, Ruishi Yu, Binqi Zeng, Yu Zhan, Ying Fu, Quan Zhang, Rongkai Liu, and Heyuan Shi. Hyperattack: Multi-gradient-guided white-box adversarial structure attack of hypergraph neural networks, 2023.
* [Huang _et al._2009] Yuchi Huang, Qingshan Liu, and Dimitris Metaxas. Video object segmentation by hypergraph cut. In _2009 IEEE conference on computer vision and pattern recognition_, pages 1738-1745. IEEE, 2009.
* [Huang _et al._2015] Sheng Huang, Mohamed Elhoseiny, Ahmed Elgammal, and Dan Yang. Learning hypergraph-regularized attribute predictors. In _Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition_, pages 409-417, 2015.
* [Huang _et al._2021] Jing Huang, Xiaolin Huang, and Jie Yang. Residual enhanced multi-hypergraph neural network. In _2021 IEEE international conference on image processing_, pages 3657-3661. IEEE, 2021.
* [Huang _et al._2023] Jin Huang, Tian Lu, Xuebin Zhou, Bo Cheng, Zhibin Hu, Weihao Yu, and Jing Xiao. Hyperdne: Enhanced hypergraph neural network for dynamic network embedding. _NEUROCOMPUTING_, 527:155-166, MAR 28 2023.
* [Hussain _et al._2022] Hussain Hussain, Meng Cao, Sandipan Sikdar, Denis Helic, Elisabeth Lex, Markus Strohmaier, and Roman Kern. Adversarial inter-group link injection degrades the fairness of graph neural networks. _arXiv preprint arXiv:2209.05957_, 2022.
* [Ji _et al._2023] Junzhong Ji, Hao Jia, Yating Ren, and Minglong Lei. Supervised contrastive learning with structure inference for graph classification. _IEEE Transactions on Network Science and Engineering_, 10(3):1684-1695, MAYS-JUN 2023.
* [Jiang _et al._2019] Jianwen Jiang, Yuxuan Wei, Yifan Feng, Jingxuan Cao, and Yue Gao. Dynamic hypergraph neural networks. In _2019 International Joint Conferences on Artificial Intelligence_, pages 2635-2641, 2019.
* [Jiang _et al._2022] Chao Jiang, Yi He, Richard Chapman, and Hongyi Wu. Camouflaged poisoning attack on graph neural networks. In _Proceedings of the 2022 International Conference on Multimedia Retrieval_, page 451-461, New York, NY, USA, 2022.
* [Jin _et al._2020] Wei Jin, Yao Ma, Xiaorui Liu, Xianfeng Tang, Suhang Wang, and Jiliang Tang. _Graph Structure Learning for Robust Graph Neural Networks_. 2020.
* [Jingjing _et al._2022] Lin Jingjing, Ye Zhonglin, Zhao Haixing, and Fang Lusheng. Deephgnn: A novel deep hypergraph neural network. _Chinese Journal of Electronics_, 31(5):958-968, SEP 2022.
* [Ju _et al._2022] Mingxuan Ju, Yujie Fan, Chuxu Zhang, and Yanfang Ye. Let graph be the go board: Gradient-free node injection attack for graph neural networks via reinforcement learning. _arXiv preprint arXiv:2211.10782_, 2022.
* [Kipf and Welling2016] Thomas N Kipf and Max Welling. Semi-supervised classification with graph convolutional networks. _arXiv preprint arXiv:1609.02907_, 2016.
* [Kong _et al._2023] Wei Kong, Yufang Xu, Shuaiqun Wang, Kai Wei, Gen Wen, Yaling Yu, and Yuemin Zhu. A novel longitudinal phenotype-genotype association study based on deep feature extraction and hypergraph models for alzheimer's disease. _BIOMOLECULES_, 13(5), APR 23 2023.
* [Lin _et al._2022] Lu Lin, Ethan Blaser, and Hongning Wang. Graph structural attack by perturbing spectral distance. In _The 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining_, pages 989-998, 2022.
* [Liu _et al._2022a] Ao Liu, Beibei Li, Tao Li, Pan Zhou, and Rui Wang. An-gcn: An anonymous graph convolutional network against edge-perturbing attacks. _IEEE Transactions on Neural Networks and Learning Systems_, pages 1-15, 2022.
* [Liu _et al._2022b] Zihan Liu, Yun Luo, Lirong Wu, Zicheng Liu, and Stan Z. Li. Towards reasonable budget allocation in untargeted graph structure attacks via gradient debias. In _Advances in Neural Information Processing Systems_, 2022.
* [Liu _et al._2022c] Zihan Liu, Ge Wang, Yun Luo, and Stan Z. Li. What Does the Gradient Tell When Attacking the Graph Structure. _arXiv e-prints_, August 2022.
* [Ma _et al._2022] Zhongtian Ma, Zhiguo Jiang, and Haopeng Zhang. Hyperspectral image classification using feature fusion hypergraph convolution neural network. _IEEE TRANSACTIONS ON GEOSCIENCE AND REMOTE SENSING_, 60, 2022.
* [Min _et al._2023] Xin Min, Wei Li, Panpan Ye, Tianlong Ji, and Weidong Xie. Multi-channel hypergraph topic neural network for clinical treatment pattern mining. _Information Processing & Management_, 60(4), JUL 2023.
* [Nguyen Thanh _et al._2023] Toan Nguyen Thanh, Nguyen Duc Khang Quach, Thanh Tam Nguyen, Thanh Trung Huynh, Viet Hung Vu, Phi Le Nguyen, Jun Jo, and Quoc Viet Hung Nguyen. Poisoning gnn-based recommender systems with generative surrogate-based attacks. _ACM TRANSACTIONS ON INFORMATION SYSTEMS_, 41(3), feb 2023.
* [Raman _et al._2017] M. R. Gauthama Raman, Nivethitha Somu, Kannan Kirthivasan, and V. S. Shankar Sriram. A hypergraph and arithmetic residue-based probabilistic neural network for classification in intrusion detection systems. _NEURAL NETWORKS_, 92(SI):89-97, AUG 2017.
* [Saxena _et al._2023] Rahul Saxena, Spandan Pankaj Patil, Atul Kumar Verma, Mahipal Jadeja, Pranshu Vyas, Vikrant Bhateja, and Jerry Chun-Wei Lin. An efficient bet-gcn approach for link prediction. _International Journal of Interactive Multimedia and Artificial Intelligence_, 8(1):38-52, MAR 2023.
* [Sen _et al._2008] Prithviraj Sen, Galileo Namata, Mustafa Bilgic, Lise Getoor, Brian Galligher, and Tina Eliassi-Rad. Collective classification in network data. _AI magazine_, 29(3):93-93, 2008.
* [Shafahi _et al._2018] Ali Shafahi, W Ronny Huang, Mahyar Najibi, Octavian Suciu, Christoph Studer, Tudor Dumitras, and Tom Goldstein. Poison frogs! targeted clean-label poisoning attacks on neural networks. _Advances in neural information processing systems_, 31, 2018.
* [Sharma _et al._2023] Ansh Kumar Sharma, Rahul Kukreja, Mayank Kharbanda, and Tanmoy Chakraborty. Node injection for class-specific network poisoning. _arXiv preprint arXiv:2301.12277_, 2023.
* [Sun _et al._2020] Yiwei Sun, Suhang Wang, Xianfeng Tang, Tsung-Yu Hsieh, and Vasant Honavar. Adversarial attacks on graph neural networks via node injections: A hierarchical reinforcement learning approach. In _Proceedings of The Web Conference 2020_, WWW '20, page 673-683, 2020.
* [Tao _et al._2022] Shuchang Tao, Qi Cao, Huawei Shen, Yunfan Wu, Liang Hou, and Xueqi Cheng. Adversarial camouflage for node injection attack on graphs. _arXiv e-prints_, 2022.
* [Tran and Tran2020] Loc Hoang Tran and Linh Hoang Tran. Directed hypergraph neural network. _arXiv preprint arXiv:2008.03626_, 2020.
* [Wang _et al._2015] Meng Wang, Xueliang Liu, and Xindong Wu. Visual classification by l1 hypergraph modeling. _IEEE Transactions on Knowledge and Data Engineering_, 27(9):2564-2574, 2015.
* [Wang _et al._2020a] Binghui Wang, Tianxiang Zhou, Minhua Lin, Pan Zhou, Ang Li, Meng Pang, Cai Fu, Hai Li, and Yiran Chen. Evasion attacks to graph neural networks via influence function. _arXiv preprint arXiv:2009.00203_, 2020.
* [Wang _et al._2020b] Jihong Wang, Minnan Luo, Fnu Suya, Jundong Li, Zijiang Yang, and Qinghua Zheng. Scalable attack on graph data by injecting vicious nodes. _Data Mining and Knowledge Discovery_, 34(5):1363-1389, SEP 2020.
* [Wang _et al._2022a] Xiaoyun Wang, Minhao Cheng, Joe Eaton, Cho-Jui Hsieh, and S Felix Wu. Fake node attacks on graph convolutional networks. _Journal of Computational and Cognitive Engineering_, 1(4):165-173, 2022.
* [Wang _et al._2022b] Yongwei Wang, Yong Liu, and Zhiqi Shen. Revisiting item promotion in gnn-based collaborative filtering: A masked targeted topological attack perspective, 2022.
* [Wu _et al._2015] Zhirong Wu, Shuran Song, Aditya Khosla, Fisher Yu, Linguang Zhang, Xiaoou Tang, and Jianxiong Xiao. 3d shapenets: A deep representation for volumetric shapes. In _Proceedings of the IEEE conference on computer vision and pattern recognition_, pages 1912-1920, 2015.
* [Wu _et al._2019] Huijun Wu, Chen Wang, Yuriy Tyshetskiy, Andrew Docherty, Kai Lu, and Liming Zhu. Adversarial examples on graph data: Deep insights into attack and defense. _arXiv preprint arXiv:1903.01610_, 2019.
* [Wu _et al._2023] Hanrui Wu, Yuguang Yan, and Michael Kwok-Po Ng. Hypergraph collaborative network on vertices and hyperedges. _IEEE Transactions on Pattern Analysis and Machine Intelligence_, 45(3):3245-3258, MAR 1 2023.
* [Yadati _et al._2019] Naganand Yadati, Madhav Nimishakavi, Prateek Yadav, Vikram Nitin, Anand Louis, and Partha Talukdar. Hypergcn: A new method for training graph convolutional networks on hypergraphs. _Advances in neural information processing systems_, 32, 2019.
* [Yang _et al._2022] Shuiqiao Yang, Bao Gia Doan, Paul Montague, and Olivier DeVel. Transferable graph backdoor attack. In _Proceedings of the 25th International Symposium on Research in Attacks, Intrusions and Defenses_, pages 321-332, 2022.
* [Yang _et al._2023] Kai Yang, Yuan Liu, Zijuan Zhao, Xingxing Zhou, and Peijin Ding. Graph attention network via node similarity for link prediction. _The European Physical Journal B_, 96(3), MAR 2023.
* [Yu _et al._2023] Ruowang Yu, Yu Xin, Yihong Dong, and Jiangbo Qian. A time sequence coding based node-structure feature model oriented to node classification. _Expert Systems with Applications_, 223, AUG 1 2023.
* [Zang _et al._2023] Xiao Zang, Jie Chen, and Bo Yuan. Guap: Graph universal attack through adversarial patching. _arXiv preprint arXiv:2301.01731_, 2023.
* [Zhang _et al._2022] He Zhang, Xingliang Yuan, Chuan Zhou, and Shirui Pan. Projective ranking-based gnn evasion attacks. _IEEE Transactions on Knowledge and Data Engineering_, 2022.
* [Zhu _et al._2019] Dingyuan Zhu, Ziwei Zhang, Peng Cui, and Wenwu Zhu. Robust graph convolutional networks against adversarial attacks. In _Proceedings of the 25th ACM