HyperNear: Unnoticeable Node Injection Attacks on Hypergraph Neural Networks
Authors: Tingyi Cai
Yunliang Jiang
Ming Li
Lu Bai
Changqin Huang
Yi Wang
Venue: ICML 2025 poster (2025)
Keywords: hypergraph neural network
homophily
attack
Primary area: deep_learning->graph_neural_networks

Abstract: With the growing adoption of Hypergraph Neural Networks (HNNs) to model higher-order relationships in complex data, concerns about their security and robustness have become increasingly important. However, current security research often overlooks the unique structural characteristics of hypergraph models when developing adversarial attack and defense strategies. To address this gap, we demonstrate that hypergraphs are particularly vulnerable to node injection attacks, which align closely with real-world applications. Through empirical analysis, we develop a relatively unnoticeable attack approach by monitoring changes in homophily and leveraging this self-regulating property to enhance stealth. Building on these insights, we introduce HyperNear, i.e., $\underline{N}$ode inj$\underline{E}$ction $\underline{A}$ttacks on hype$\underline{R}$graph neural networks, the first node injection attack framework specifically tailored for HNNs. HyperNear integrates homophily-preserving strategies to optimize both stealth and attack effectiveness. Extensive experiments show that HyperNear achieves excellent performance and generalization, marking the first comprehensive study of injection attacks on hypergraphs. Our code is available at https://github.com/ca1man-2022/HyperNear.

HyperNear: Unnoticeable Node Injection Attacks on Hypergraph Neural Networks
Tingyi Cai 123 Yunliang Jiang 1234 Ming Li 5
Lu Bai
Changgin Huang
Yi Wang'
Abstract
1. Introduction
Hypergraphs have emerged as a powerful framework for modeling higher-order relationships in complex systems, of- fering richer representations compared to traditional graphs. Their ability to capture intricate structures has enabled suc- cessful applications in domains like social networks and biological systems (Feng et al., 2024; Gao et al., 2024; Antelmi et al., 2023). However, the growing reliance on hypergraph-bast models has raised concerns about their robustness and security (Hu al., 2023; Chen et al., 2023).
With the growing adoption of Hypergraph Neu- ral Networks (HNNs) to model higher-order re- lationships in complex data, concerns about their security and robustness have become increasingly important. However, current security research of- ten overlooks the unique structural characteristics of hypergraph models when developing adver- sarial attack and defense strategies. To address this gap, we demonstrate that hypergraphs are particularly vulnerable to node injection attacks, which align closely with real-world applications. Through empirical analysis, we develop a rela- tively unnoticeable attack approach by monitor- ing changes in homophily and leveraging this self- regulating property to enhance stealth. Building on these insights, we introduce HyperNear, i.e., Node injEction Attacks on hypeRgraph neural networks, the first node injection attack frame- work specifically tailored for HNNs. HyperNear integrates homophily- preeeervigg strategies to opti- mize both stealth and attack effectiveness. Exten- sive experiments show that HyperNear achieves excellent performance and generalization, mark- ing the first comprehensive study of injection attacks on hypergraphs. Our code is available at https:://// / / gi tiutuuu.... com/ ca calmana222222222 HyperNear.
Adversarial attacks, particularly those targeting Hypergraph Neural Networks (HNNs), pose serious risks to their reliabil- ity. potentially impacting sensitive areas such as healthcare and finance. While much research focuses on adversarial challenges in pairwise graphs (Zhang & Zitnik, 2020; Huang et al., 2017), the unique vulnerabilities of hypergraphs re- main underexplored, highlighting the need for more resilient HNNs.
Among the various types of adversarial attacks, we focus on node injection attacks (Tao et al., 2021; Zou et al., 2021; Chen et al., 2022: Zhang et al., 2024). These attacks are stealthy and practical, as they avoid altering existing nodes or hyperedges. Figure (a) illustrates how injected nodes influence the network by embedding themselves within the hypergraph structure. However, we find that naive injection strategies often lead to significant topological changes, re- ducing both the effectiveness and stealthiness of the attack. Particularly, hypergraphs amplify minor perturbations due to their unique structure, making stealthiness a key challenge.
The most threatening adversarial strategies are those that achieve disruption while remaining imperceptible. To il- lustrate, consider social network as shown in Figure 1(b), where a malicious actor aims to infiltrate without raising sus- picion. The attacker strategically mimics the connections and attributes of legitimate users, effectively blending in through homophily (Bi et al., 2024; Wang al., 2024; Luan et al., 2022), where similar nodes are more likely connect. This principle of homophily provides useful blueprint for adversarial unnoticeability, as it encourages alignment with the existing network structure. By aligning perturbations with homophily principles, we aim to design a framework
'Zhejiang Key Laboratory of Intelligent Education Technol- ogy and Application, Zhejiang Normal University, Jinhua, China Mozia--ez Belt and Road Joint Laboratory Smart Agriculture, Zhejiang Normal University, Jinhua, China 'School of Computer Science and Technology, Zhejiang Normal Univer- sity. Jinhua, China "School of Information Engineering, Huzhou University, Huzhou, China 'Zhejiang Institute of Optoelectron- ies, Jinhua, China Beijing Normal University, Beijing, China. Correspondence to: Yunliang Jiang @nj..e22
zjnu.en>>.
Proceedings of the nnnd International Conference Machine Learning, Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).

---

HyperNeear: Unnoticeable Node Injection Attacks on Hypergraph Neural Networks
we propose new approach termed HyperNear, which provides stealth-enhanced hypergraph injection at- tack strategy by utilizing the homophily metric constraint.
V2
U
V.
V6
Our HyperNear shows superior attack performance and stealth through extensive experiments. Moreover, it demonstrates good transferability across different backbone hypergraph networks.
44
(a) Malicious impacts propagate along topology.
Homo.
2. Preliminaries and Problem Definition
Alarm
2.1. HNNs
8
Normal User
Given a hypergraph = (V,E, W), which consists of set of nodes V and set of hyperedges E. For each node we denote its class by yv, and the structure of a hypergraph is usually represented by an incidence matrix H E IR [ Each entry H(v, e) denotes whether a node e is in the hy- peredge e or not, i.e.,
Malicious User
Hete.
Alarm
Malicious User with Camouflage
(b) Social networks subject to injection attacks: Homophily
(Homo.) vs. Heterophily (Hete.) cases.
H(u,e) = { if Ee
(I)
Figure Schematic of hypergraph injection attacks.
if
Then, define the degree of a node v E V and the average degree of hyperedge E & as follows:
that achieves both effectiveness and unnoticeability.
In this paper, we introduce HyperNear, the first node in- jection attack framework tailored for HNNs. We begin with theoretical analysis uncover HNNs vulnerabilities to injection attacks, highlighting the significant structural disruptions they cause. To ensure stealth, conduct em- pirical analysis revealing that naive attacks often drastically alter homophily, key metric of node similarity, reducing their effectiveness. Based on these findings, we design Hy- perNear, incorporating homophily constraints to achieve imperceptible perturbations. Extensive experiments on five real-world datasets demonstrate HyperNear's effectiveness, generalization, and stealth, outperforming baseline methods.
d, -H(r,e), de 1 E de DEV
(2)
DEC
For clarity, Table in the Appendix A summarizes the symbols and definitions used in this paper.
2.2. Homophily
Homophily in hypergraphs refers to the tendency of nodes with similar characteristics to form higher-order connections within hyperedge (Li al., 2025). We define homophily for hypergraphs based on the similarity of node labels within each hyperedge. Specifically, the homophily rate for hyper- edges is calculated as follows:
To summarize, our paper makes the following contributions:
From the perspective of problem definition, we make the first attempt to study the research on injection attacks on hypergraphs extend the existing research hypergraph applications consider security and to advance the practical applications of hypergraph systems.
E8|
Ku, u) {(u, E em A (Ya =yhH
H
Ca
1121
We call this the node label-based homophily rate, where em is the m-th hyperedge and C22 is the combination number, representing the number of possible ways to choose two nodes from Um nodes.
From the perspective of theoretical insights, ad- dress the specific challenges posed by adversarial at- tacks on hypergraphs by providing a theoretical analy- sis that demonstrates the susceptibility of hypergraph models to our proposed attack strategies. This analysis further informs and guides the design of our algorithm for adversarial attacks on hypergraphs.
2.3. Problem Definition
We focus node injection attacks, stealthy adversarial approach that introduces new nodes into the hypergraph without altering the original structure. These attacks are subtle but can severely distort model predictions. In real- world applications, they enable adversarial manipulation of
From the perspective of algorithmic development,
2

---

HyperNear: Unnoticeable Node Injection Attacks on Hypergraph Neural Networks
the hypergraph minimal cost, posing serious threat. We define and formalize the objectives of hypergraph injection attacks.
hypergraph structures in mind, tend to significantly disrupt homophily, metric that reflects the similarity between connected nodes. This sensitivity motivates using homophily to quantify subtle structural changes and refine attack strategies.
Definition 2.1. (Hypergraph Injection Attack) Given a hypergraph G = (V,E, W) with an incidence matrix H E R x|el and a node feature matrix X E RD a hypergraph injection attack introduces a set of new nodes Y and new hyperedges E into the hypergraph, while leaving the edges and features of the original nodes V unchanged. Formally, the attack constructs a modified hypergraph G' with the following incidence matrix:
3.1. Topological Vulnerability of Hypergraphs
We express the general hypergraph convolution process (Chien al., 2022) as an aggregation process node et
h = =(hh! [((h (k-1) I E eji ej E R,))), (6)
H
I. H
H
(4)
where R. = UnjeE (ez v E e5} is the set of all hyper- edges containing node e, and ej = 1, ..., (8]) denotes the j-th hyperedge. The functions Φb()) and ʃ(-) are vector- valued functions that update the node features based on the information from neighboring nodes.
I
where I E TR. ViXlēl represents the connections between original nodes and new hyperedges, Ig |IM rep- resents the connections between new nodes and original hyperedges, and Å E TR. [V represents the connections between new nodes and new hyperedges.
In adversarial settings, we focus on the hypergraph injection attack discussed in Sec. 2.3, which allows attackers to target specific regions of the hypergraph with limited access to the full network. To model the impact of such attacks on the hypergraph structure, we consider perturbations through node injections, leading to changes in both topology and feature representations.
Definition 2.2. (Optimization Objective for Hypergraph In- jection Attacks) The goal of the hypergraph injection attack is to introduce minimal perturbations to the hypergruph G in the form of additional incidence matrices H' and node feature matrices X', while minimizing the impact on model performance. Formally, the optimization problem is defined as:
Theorem 3.1 (Propagation of Perturbation in HNNs). Given a hypergraph with node u and its feature vector h up- dated by the aggregation function & as defined in Eq. (6), a perturbation AR, in the topology results in a feature change Ahe that satisfies:
max C (fo-(H'' (H),))) s.t. 8 = min (fo ()) H.X
(5)
(8))
where fo(.) is the model parameterized by 0, C(-) is the loss function (such as cross entropy). The objective is to maximize the model's loss the adversarial hypergraph g' while ensuring that the original model's 's parameters 6" are optimized to minimize the loss on the unperturbed hy- pergraph.
O0 Σ
4h (k)
Af 0f
O((Af)))
Nonlinear higher- order effects significant under large pertubattonns
Sensitiviity of E-hop features
(7)
where Aft = ft- fe represents the change in the t-hop aggregation function. This propagation effect highlights the sensitivity of hypergraph- models to structural perturbations.
3. Impact of Attacks on Topology and Homophily of Hypergraphs
In this section, we investigate the impact of adversarial attacks on HNNs, presenting two key findings.
(k) is updated by Proof. Using Eq. (6). the feature vector h
Finding 1: Hypergraph topological vulnerability. We demonstrate that hypergraphs are highly vulnerable to adversarial attacks, where even small perturbations may produce amplified effects due to the intricate in- terdependencies within hyperedges. This amplification poses unique challenges for developing attacks that are both effective and unnoticeable, as minor structural changes can propagate unpredictably.
aggregating features from neighbors across t-hop distances. When a perturbation AR, alters the hypergraph structure, it modifies the aggregation function fi(-) to f(()). A first- order Taylor expansion of & yields:
(((k)) (A) + Σ de
A + (((Af))))
(8)
of
where Afr represents the perturbation. Subtracting h (k) from (()) gives the desired result.
Finding 2: Naive attacks disrupt homophily. We observe that naive attacks, which are not designed with
3

---

HyperNear: Unnoticeable Node Injection Attacks on Hypergraph Neural Networks
Corollary 3.2 (Amplification Effect of Aggregation). For weighted aggregation method, the perturbation D can be expressed as:
Table I. Homophily ratio changes in the hypergraph neural work (UniSAGE) after adversarial attack.
A
Σ
DATASETS
CORA-CA
DBLP-CA
CITESEER
CORA
PUBMED
{uEe)le;ER.)
BEFORE
0.6129
0.6381
0.7104
0.7079
0.77
AFTER
0,5416
0.5508
0.5859.
0.5915
0.5888 L
Weight-Induced perturbation
(9)
Σ
(w (w
(uEeglesER.)
vulnerabilities, demonstrating that simple perturbations can cause noticeable changes in hypergraph structure.
Feature-induced perturbation
where Awy and Ahu (h-1) represent the changes in the hy- peredge weights and the node features. respectively. This result indicates that changes in hyperedge weights Awl, or node features Ahs (k-1) can amplify the overall perturbation. In particular, when certain hyperedges have larger weights or exhibit more significant feature changes, they dispropor- tionately influence the overall perturbation, causing a more substantial impact on the node feature updates.
These results align with expectations (Zhu et al., 2022; Chen et al., 2022), as homophily, which reflects the similarity of nodes within the same hyperedge, plays a key role in HNNs' predictive accuracy. Our observation shows that naive at- tacks disrupt homophily patterns, suggesting its potential as metric for assessing attack stealth. Minimizing homophily changes enables more covert attacks that effectively dis- rupt hypergraph structures, while also providing a basis for monitoring and refining attack designs.
Remarks. Figure 10 illustrates the sensitivity of node to t-hop neighbors and the nonlinear higher-order effects in HNNs. More detail is shown in the Appendix B.
While attackers typically lack complete node labels, con- sistent with real-world attack scenarios, we propose the concept of node feature homophily (Wang et al., 2025), which quantifies node similarity based on the aggregation of features from connected nodes.
Through this analysis, it becomes evident that hy hypergraph topology is particularly vulnerable to small, targeted pertur- bations. single perturbation can propagate through the structure, affecting multiple nodes simultaneously and high- lighting the fragility of hypergraphs. However, introducing new nodes and hyperedges often leads noticeable changes in the overall topology, making it easier for defenders to detect potential breaches. The key question is how can we design more subtle and unnoticeable attacks that exploit these topological vulnerabilities in hypergraphs?
Definition 3.4. (Feature- Homophily in Hypergraphs)
The homophily of a hypernode can be defined the sim- ilarity between the features of hypernode and the aggre- gated features of its neighboring nodes:
FHH = sim X.):
H.=IVa--a H H₂ H,=) Σ
1
(10)
Vi Vd ((Xitiee)
EER. Vde
3.2. Significant Shifts in Homophily Caused by Naive Attacks
where de = Eice di is the average degree of hyperedge and sim(-) is a similarity metric, such cosine similarity. The R. denotes the set of all hyperedges containing node v. In this paper, homophily ratio is measured using the FHH.
Building on the vulnerability analysis from Sec. 3.1, we focus on the impact of adversarial attacks on homophily, a key structural property of hypergraphs. Specifically, our em- pirical studies show significant reduction in the homophily ratio after attack.
Proposition 3.3. Naive adversarial attacks cause sig- nificant reduction in the homophily ratio of hypergraphs, which negatively impacts the network's 's ability to preserve structural relationships between nodes. This reduction in homophily leads to a decrease in the predictive accuracy of Hypergraph Neural Networks (HNNs).
Discussion. Our analysis shows that adversarial attacks severely disrupt hypergraph structures, with a significant reduction in homophily observed in our experiments. This
highlights that successful attacks not only destabilize the structure but also leave detectable traces in homophily pat- terns. Since homophily is critical for HNNs performance, we propose using it as a metric to design stealthier attacks. Minimizing disruptions to homophily can make interven- tions less noticeable while still effectively degrading net- work performance.
Observation 1. The experimental results presented in Ta- ble show a significant decrease in the homophily ratio after adversarial attacks. This reduction occurs even when the attacks are not specifically designed to target structural

---

Hepe:Near: Unnoticeable Node Injection Attacks on Hypergraph Neural Networks
Original Features
Pi
Perturbation
V5
D2
V
17
:
17
V.
V6
05
[P]
batk
Feature Generation
Hyperedge Selection
Injection
Structural Update
Vietim HNNs
Classification Results
Classification Results After Attack
vs
Malicious Node
@
HNNSs
Misclassified Node
V/2
Homophily- Prreervvi--
Hyperedge Split
Figure 2. Systematic framework of HyperNear and corresponding evaluations. The process includes: (1) Feature generation create adversarial node features, (2) Hyperedge selection to determine the target hyperedges for injection, (3) Injection of adversarial nodes into the hypergraph, and (4) Structural update to refine hyperedge connections, ensuring the attack remains effective and unnoticeable.
4. Methodology
injected nodes. Although random, this selection process has two key advantages: it avoids bias in the attack design, mak- ing detection harder, and it ensures flexibility in variety of hypergraph topologies.
In this section, we present HyperNear, i.e., Node injEction Attacks on hypeRgraph neural networks, the first node in- jection attack framework tailored for HNNs. The overall process of HyperNear is illustrated Figure 2. We begin by introducing the design idea of the general framework for hypergraph injection attack, followed by the integration of adversarial objectives to enhance the effectiveness of the attacks.
Injection. Subsequently, we adopt a fully connected injec- tion strategy as the initialized injection state, i.e., all injected nodes are connected to nodes in the selected hyperedge. This approach extends the influence of the injecting node and maximizes its potential to disrupt the network's predic- tive capabilities. This approach amplifies the influence of the injected node, maximizing its potential for disrupting the network's prediction capabilities.
4.1. The HyperNear Framework
The framework comprises four core steps: feature genera- tion, hyperedge selection, injection, and structural update. This structured approach addresses the unique challenges of hypergraph manipulation and provides a foundation for future adversarial attack research on hypergraphs.
Structural Update. To increase the adversarial impact, we split the injected hyperedge that is fully connected based on the gradient information obtained during backpropaga- tion. Updates guided based the principle of enlarg- ing the classification loss, adjusting the connections within the hyperedge to ensure that perturbations caused by the injected nodes maximize the damage to the model perfor- mance. This process can be represented as
Feature Generation. The first step in our attack is gener- ating features for the injected nodes. To make them indis- tinguishable from original nodes, we adopt a perturbation- based approach. Specifically, the feature vector of the in- jected node is created by adding controlled perturbations to the existing node features. This ensures that the injected nodes share characteristics with the original graph (Bai et al., 2022), while allowing for the necessary deviations to achieve adversarial effects. Formally, for each injected node, we denote its feature vector as Xinj, generated from an original node feature Xpri as:
Sinj = arg max Les (J((HHHHHtttte) v),
(12)
where Siny represents the splitting strategy applied to the injected hyperedge, and H Hupdate denotes the hypergraph structure after a random split of the injected hyperedge. The goal is find split that maximizes the classfication loss L. thereby increasing the adversarial influence of the attack. Our analysis shows that hypergraphs susceptible to both feature-based attacks and structural attacks, which together can degrade the performance of hypergraph-bar models drastically. Our attack strategy achieves dual per- turbations of features and structure, thereby enhancing the effectiveness of the attack.
Xinj Xori + TJ
(11)
where 17 is a small perturbation to the feature space.
Hyperedge Selection. In our framework, we use ran- domized selection strategy to choose the hyperedges of the
5

---

HyperNear: Unnoticeable Node Injection Attacks on Hypergraph Neural Networks
4.2. Homophity-Pressere Adversarial Objective
DBLP (Rossi & Ahmed, 2015), Pubmed, Citeseer and Cora (Sen et al., 2008). We use the same preprocessed hyper- graphs as those provided in the official implementations of HyperGCN (Yadati et al., 2019) and UniGNN (Huang & Yang, 2021); ensuring that attack effects can be compared. More detail is in Appendix A.4.
Maintaining homophily is critical for designing unnotice- able attacks. Our empirical findings reveal that adversarial attacks significantly disrupt hypergraph homophily, which measures the similarity between a node's features and its neighbors. Disrupting homophily compromises structural coherence, making attacks more detectable.
Baselines, Since ours is the first work to perform a global adversarial attack on HNNs in a black-box setting, we com- pare with methods adapted from graph theories. It is briefly described as follows:
To address this, we propose homophily preservvng adver- sarial objective with the following constraints:
LFHH Hofter - FF Hoefre
(13)
Random Attack (Random): We believe that the method of randomized attacks can effectively illustrate the im- portance of understanding hypergraph structures. To ensure a fair comparison, we utilize random injection attack as a benchmark for randomization, maintaining a certain level of concealment. This involves randomly generating node features and then selecting nodes for one-to-one injection.
where FH Hee and H are the homophily ratios before and after the attack, and T controls the allowable change.
This objective is integrated into the overall adversarial loss as:
max -
Latk
Letss XLFHH,
(14)
Node Degree Attack (NDA) (Zhang et al., 2024): Node degree is a significant metric for evaluating graph struc- ture, and previous studies have demonstrated that at- tacking nodes with lower degrees can impair graph performance. Therefore, we extend the concept to hypergraphs by proposing a NDA method, which tar- gets nodes with the smallest degrees and modifies their features.
where X balances attack effectiveness and homophily preser- vation, and B is the allowed perturbation budget. Further details, including the derivation of homophily perturbations, can be found in Appendix A.
In summary, our approach introduces the first adversarial attack on hypergraphs with homophily constraints, achiev- ing effective yet unnoticeable attacks. Algorithm 1 details the implementation. Our method aligns with three attack types: poisoning, global, and black-box. Poisoning attacks alter training data, global attacks degrade performance with minimal cost, and black-box setups simulate real-world con- ditions with limited information. Addressing node injection in these contexts crucial for enhancing HNNs robustness.
Fast Gradient Attack (FGA) (Chen et al., 2018): Gradi- ent attacks are also classic attack strategy. We extend this approach to hypergraphs by targeting the features of hypernodes with the highest absolute gradient val- ues in the hypergraph proxy model during each attack iteration.
5. Experiments
Experimental Details. Our experiments adopt a strict black- box setup, restricting any model querying and granting ac- cess only to the incidence and feature matrices of the input data, All methods are evaluated under identical budget con- straints. The victim and target models are assumed identical, with the victim model being the pre-trained agent used in the attacks. More detail is provided in the Appendix A.2.
In this section, we present experiments to evaluate the effec- tiveness of the proposed HyperNear, addressing the follow- ing research questions:
RQI: How effective is HyperNear compared to state-of-the- art attack methods?
RQ2: How transferable is HyperNear across different hy- pergraph architectures?
5.2. Performance Comparison (RQ1)
To answer RQI, we compare HyperNear with three base- lines on four victim HNNs in a black-box setting, as shown in Table 2. HyperNear demonstrates superior attack effec- tiveness in most cases, significantly reducing the classifi- cation accuracy of the victim models across five datasets. This indicates that HyperNear effectively exploits the vul- nerabilities of HNNs in generating adversarial perturba- tions. The poor performance of the Random attack validates our intuition that injection attacks, while stealthier, require
RQ3: How stealthy is HyperNear?
RQ4: How do hyperparameters affect HyperNear's 's perfor- mance?
5.1. Experimental Setups
We evaluate our models on five real-world hyper- graph datasets for hypernode classfication tasks, including
Datasets.
6

---

HyperNeea: Unnoticeable Node Injection Attacks on Hypergraph Neural Networks
Table Comparison of classification accuracy (%) of several attack models. The classification performance of the hypergraph network used as measure of the effectivvness of the global attack, the lower the better. with the best results highlighted in bold and shaded in gray, and sub-optimal results shaded blue. Red represents the invalid result of random injection attack.
VICTIM MODEL
METHODS
CORA-CA
DBLP-CA
CITESEER
CORA
PUBMED
CLEAN
74.13 + 1.23
89.01 = 0.11
61.72 1.84
67.44 + 2.09
74.31 + 1.61
RANDOM
73.86 + 1.20
89.00 0.11
61.23 1.64
67.38 2.19
74.49 + 1.55
UNISAGE
NDA
71.70 + 1.07
=.15
59.55 1.73
64.96 + 2.03
72.50 + 1.28
FGA
71.58 1.95
88.57 = 0.22
2.02 58.69
63.57
71.57 = 3.12
HYPERNEAR (OURS)
60.24 = 2.10
80.12 = 4.29
4.80 47.47
49.35 + 7.41
55.31 + 8.13
CLEAN
74.45 1.12
89.14 + 0.11
61.85 1.87
67.69 + 2.09
74.87 + 1.50
RANDOM
74.16 1.25
89.13 = 0.14
61.15 1.61
67.49 2.226
75.07 1.42
UNIGIN
NDA
71.98 + 1.09
84.92 = 0.13
59.70 1.79
64.98
72.65 1.41
FGA
71.79 + 1.58
88.58 = 0.24
57.35 2.23
63.48
72.17
HYPERNEAR (OURS)
65.86 1.47
80.16 = 4.26
47.47 4.80
19.35
55.31 + 8.12
CLEAN
75.74 0.88
88.83 = 0.16
64.29 1.16
70.53 1 1.22
75.53 1: 1.00
RANDOM
76.36 + 1.27
88.82 = 0.16
64.47 = 1.12
70.77 1 1.09
75.41 + 1.07
UNIGCN
NDA
73.59 11599100 0.74
84.60 = 0.13
62.09
1.44
68.27 + 0.98
73.12 + 0.89
FGA
75.16 + 0.93
88.80 + 0.19
63.28 1.40
69.60 + 1.11
74.81 + 1.15
HYPERNEAR (OURS)
67.55 0.67
85.45 = 0.48
0.75 56.47
56.69 + 1.76
68.13 0.87
CLEAN
76.29 1.22
88.85 = 0.11
64.95 1.40
70.51 1.49
75.92
0.84
RANDOM
76.42 + 1.10
$8.83 = 0.11
64.62 = 0.93
71.43 + 1.60
75.70 + 1.17
UNIGAT
NDA
73.61 1.31
84.74 = 0.14
62.23
0.94
68.16 1.50
73.42
0.87
FGA
74.97 1 1.35
88.69 1 0.19
63.40
1.34
69.53 1 1.38
74.87 T 1.06
HYPERNEAR (OURS)
67.50 2.30
0.16 84.36
0.59 56.52
1.92 57.13
68.38
1.18
thoughtful design for hypergraph models. Randomly in- jected nodes sometimes even improved model performance, as highlighted in red in Table 2. Although NDA and FGA more reasonable alternatives, they are designed for tradi- tional graphs and fail to fully leverage hypergraph-specific properties. In contrast, HyperNear, tailored for hypergraphs, disrupts the model's learning process more effectively. No- tably, HyperNear achieves consistent performance across different datasets and victim models, highlighting its effec- tiveness and generalization capability.
Bdfiie Mtack
Detie Aback
30
Homophily
Homophily
Cora-CA
(b) Cora
Figure 3. Changes the homophily ratio. Left: UniGCN is trained on the Cora- CA- dataset. Right: UniSAGE is trained on the Cora dataset.
5.3. Transferability Analysis (RQ2)
In addition to the four models demonstrated in Table 2, also evaluate the transferability of HyperNear in four other classical HNN models, including HyperGCN (Yadati et al., 2019), HGNN (Feng et al., 2019). ED-HNN (Wang et al., 2023), and UniGCNII (Huang & Yang. 2021). Trans- ferability critical to understanding whether HyperNear can effectively compromise different hypergraph models in black-box settings, demonstrating its generality across various backbones. The average classification results over 10 runs, both before and after the attack, are presented in Table 3, demonstrating that HyperNear maintains consis- tent aggressiveness across all tested architectures. Such high transferability is advantageous for real-world scenarios
where attackers may have detailed knowledge of the target model architecture.
5.4. Visualization (RQ3)
To answer RQ3, we analyze the homophily ratio and data distribution following the attack. As shown in Figure 3, the homophily ratio remains largely unchanged, indicating that HyperNear introduces perturbations in a manner that preserves the overall structural properties of the hypergraph. Despite this, effectively degrades the predictive perfor- mance of the target model.

---

HyperNear: Unnoticeable Node Injection Attacks on Hypergraph Neural Networks
Table 3. Performance comparison of HyperNear different HNNs.
CORA
DBLP-CA
PUBMED
VICTIM MODEL
BEFORE
AFTER
BEFORE
AFTER
BEFORE
AFTER
HYPERGCN
73.25 + 2.77
49.56 + 5.91
87.80 + 0.41
76.04 + 3.02
78.84 + 2.59
64.06 + 5.71 +
HGNN
79.01 0.97
52.19
1.58
91.01
73.62 0.39
83.23 + 0.35
67.18
ED-HNN
81.21 + 1.00
62.11 + 1.88
91.93 0.20
83.27
88.32 + 0.42
78.42 0.47
UNIGCNII
77.52 1.12
69.44 = 1.38
90.30 + 0.24
86.25 = 0.34
86.08 + 0.48
81.42 0.57
ginal
Original
njocted Nedos
90
Injected
20
0
-20
-25
-0
-20
-30
Originl Modes
Original Nodes
-00
Injected Nodes
-10
-5
-20
(a) Pubmed
(b) Cora
(a) After attack acc.: 63.67%.
(b) After attack acc.: 53.89%.
Figure 4. T-SNE visualization of data distribution after attack. The victim model UniGAT.
Figure 6. Data distribution after HyperNear when a 1%. Left: UniGAT is trained on the Pubmed dataset. Right: UniGAT is trained on the Cora dataset.
18:22
B1:C4
12:12
11:01
A3.35
1832
4S:11
51.01
AC.31
wherein the injected nodes are crafted to align with exist- ing structural patterns within the hypergraph. This design enables the attack to evade detection while preserving key topological properties. While the empirical analyses above strongly suggest that HyperNear achieves improved unno- ticeability, we acknowledge that a formal theoretical charac- terization of detectability under hypergraph-sporn metrics remains an open challenge. Addressing this would further solidify the unnoticeability claim.
MART
MANT
91-11
54.22
0
(a) Cora
(b) Cora-CA
Figure 5. Hcatmap of classification accuracy after HyperNear in
In addition, we note that most existing adversarial defenses for graphs may not transfer directly to hypergraph settings, owing to fundamental differences in representation and con- nectivity. As such, designing specialized defense mecha- nisms tailored for hypergraph neural networks is an impor- tant and promising direction for future research.
the (X, ar) parameter space.
We further visualize the data distribution after the attack using I-SNE (Hinton & Van Der Maaten, 2008) in Figure 4, which demonstrating that HyperNear does not drastically alter the overall embedding distribution in most cases. This effect is especially evident in Cora-CA (Figure 4(a)), where the distribution remains largely indistinguishable from the original, owing to its more structured hypergraph construc- tion.
5.5. Hyperparameter Study (RQ4)
We analyze the impact of key parameters in HyperNeea, fo- cusing on the homophily preservation parameter and the injection rate a, which controls the number injected hy- pernodes. To evaluate the sensitivity of HyperNear's effec- tiveness, we measure test accuracy across a parameter grid, Specifically, we vary À over (-0.1, 0.1, 0.2, ... 0.6) and a over (0.01, 0.03. ... 0.09, 0.15, 0.25). Figure 5 presents heatmaps for UniSAGE (the victim model). showing per- formance sensitivity across this parameter space. These results demonstrate that appropriate tuning of and a en- ables HyperNear balance attack effectiveness and stealth.
These analyses collectively demonstrate that HyperNear achieves relatively unnoticeable adversarial behavior across multiple datasets, with its detectability varying depending on the underlying hypergraph structure.
The unnoticeability of HyperNear fundamen- tally stems from its homophily-awe aware perturbation strategy,
Remarks.
8

---

HyperNear: Unnoticeable Node Injection Attacks on Hypergraph Neural Networks
To further illustrate HyperNear's impact, we visualize the node embedding distribution post-attack. Figure 6 (setup consistent with Figure 4) highlights that reducing the in- jection rate (a 1%) enhances the unnoticeability of the attack while maintaining a significant degradation in model performance.
References
Antelmi, A., Cordasco, G., Polato, M., Scarano, V., Spag- nuolo, C., and Yang, D. A survey on hypergraph repre- sentation learning. ACM Computing Surveys, 16(1); 2023.
Arya, D., Gupta, D. K., Rudinac, S., and Worring, M. Hy- perSAGE: Generalizing inductive representation learning hypergraphs. arXiv preprint arXiv:2010.04558. 2020.
6. Related Works
Adversarial attacks on graph data (Zügner et al., 2020; Gosch et al., 2023) are mainly categorized into modifica- tion (Zügnnrr et al., 2018; Zügner& & Günnemann, 2019) and injection attacks (Zou et al., 2021; Fang et al., 2024). While much of the research focuses on traditional graphs (Wu et al.,, 2019), the security of hypergraphs, which capture higher- order relationships, has been less explored. HNNs (Kim et al., 2024; Gao et al., 2020) are powerful tools for complex data (La Gatta et al., 2022; Shao et al., 2020; Yang et al., 2019), but their vulnerability to adversarial attacks remains understudied. Previous work (Hu et al., 2023; Chen et al., 2023) addresses related threats, but no black-box attack (Xu et al., 2022; Wen al., 2024) framework specifically targets HNNs, gap this paper fills. For more details these works, please refer to the Appendix C.
Bai, L., Cui, L., Jiao, Y., Rossi, L.,, and Hancock, E. R. Learning backtrackless aligned-spatial graph convolu- tional networks for graph classification. IEEE Transac- tions on Pattern Analysis and Machine Intelligence. 44 (2)783-798, 2022.
Bai, S., Zhang, F., and Torr, P. H. Hypergraph convolu- tion and hypergraph attention. Pattern Recognition, 110: 107637, 2021.
Bi, W. Du, L., Fu, Q., Wang, Y., Han, S., and Zhang, D. Make heterophilic graphs better fit GNN: A graph rewiring approach. IEEE Transactions on Knowledge and Data Engineering, 36(12):8744-87555 2024.
Chen, J., Wu, Y., Xu, X., Chen, Y., Zheng, H., and Xuan, Q. Fast gradient attack on network embedding. arXiv preprint arXiv:/8099 100. 009902 2018.
7. Conclusion
In this work, we explore black-box adversarial attacks on hypergraph-based models, revealing their structural vulner- abilities. We introduce HyperNear, the first node injection attack framework for HNNs, leveraging homophily con- straints for stealth. Experiments demonstrate its high attack efficacy, transferability, and unnoticeability. Our analysis of unnoticeability metrics deepens the understanding of hyper- graph structure and model robustness, paving the way for future work on strengthening hypergraph-base based models.
Chen, Y., Yang, H., Zhang, Y., KAILI, M., Liu, T., Han, B., and Cheng, J. Understanding and improving graph injection attack by promoting unnoticeability. In ICLR, 2022.
Chen, Y., Picek, S., Ye, Z., Wang. Z., and Zhao, H. Mo- mentum gradient-based untargeted attack on hypergraph neural networks. arXiv preprint arXiv:2310. 15656, 2023.
Chien, E.,, Pan, C.,, Peng, J., and Milenkovic, O. You Are AllSet: A multiset function framework for hypergraph neural networks. In ICLR, 2022.
Acknowledgements
This work is supported by National Key Research and De- velopment Program of China (2024YFE02) 14000), the Na- tional Natural Science Foundation of China (Grant Nos. U22A20102, 62337001, 62172370, T2122020). and the Jinhua Science and Technology Plan (No. 2023-3-003a).
Dai, H., Li, H., Tian, T., Huang, X., Wang, L.,, Zhu, J., and Song, L. Adversarial attack on graph structured data. In ICML. pp. 1115-1124, 2018.
Fang, J., Wen, H., Wu, J., Xuan, Q., Zheng, Z., and Tse. C. K. GANI: Global attacks on graph neural networks via imperceptible node injections. IEEE Transactions on Computational Social Systems, 1 1(4))3374-53877 2024.
Impact Statement
This paper presents work whose goal is to advance the field of Machine Learning. There are many potential societal consequences of our work, none which we feel must be specifically highlighted here.
Feng, Y., You, H., Zhang, Z., Ji. R., and Gao, Y. Hypergraph neural networks. In AAAI, pp. 3558-35655 2019.
Feng. Y., Han, J., Ying, S., and Gao, Y. Hypergraph isomor- phism computation. IEEE Transactions on Pattern Anal- ysis and Machine Intelligence, 46(5):3880-3888 2024.

---

HyperNear: Unnoticeable Node Injection Attacks on Hypergraph Neural Networks
Gao, Y., Zhang, Z., Lin, H., Zhao, X., Du, S., and Zou, C. Hypergraph learning: Methods and practices. IEEE Transactions on Pattern Analysis and Machine Intelli- gence, 44(5):2548-22) 25668, 2020.
Li, M., Gu, Y., Wang, Y., Fang, Y., Bai, L.,, Zhuang, X., and Lio, P. When hypergraph meets heterophily: New benchmark datasets and baseline. In AAAI, pp. 18377- 18384, 2025.
Gao, Y., Feng, Y., Ji, S., and Ji, R. HGNN+ General hy- pergraph neural networks. IEEE Transactions on Pattern Analysis and Machine Intelligence, 45(3):3181-3199 2022.
Luan, S., Hua, C., Lu, Q. Zhu, J., Zhao, M., Zhang, S., Chang, X.-W., and Precup, D. Revisiting heterophily for graph neural networks. In NeurlPS, pp. 1362-1375, 2022.
Gao, Y., Ji. S., Han, X., and Dai, Q. Hypergraph computa- tion. Engineering, 2024.
Rossi, R. and Ahmed, N. The network data repository with interactive graph analytics and visualization. In AAAI, pp. 4292-4293 2015.
Gosch, L., Sturm, D., Geisler, S., and Günnemann, S. Re- visiting robustness in graph machine learning. In ICLR, 2023.
Sen, P., Namata, G., Bilgic, M., Getoor, L., Galligher, B., and Eliassi-Rad, T. Collective classification in network data. Al Magazine, 29(3):93 2008.
Hinton, G. and Van Der Maaten, L. Visualizing data using t-SNE journal of machine learning research. Journal of Machine Learning Research, 9:2579- 2605, 2008
Shao, W., Peng, Y., Zu, C.,, Wang, M., Zhang, D., Initiative, A. D. N., et al. Hypergraph based multi-task feature selection for multimodal classification of Alzheimer's disease. Computerized Medical Imaging and Graphics, 80: 80:101663, 2020.
Hu, C., Yu, R., Zeng, B., Zhan, Y., Fu, Y., Zhang, Q.. Liu, R., and Shi, H. HyperAttack: Multi- graadeet-guidee white-box adversarial structure attack of hypergraph neu- ral networks. arXiv preprint (tti::2302..2000) 2023.
Sun, L., Dou, Y., Yang, C., Zhang, K., Wang, J., Philip, Y., He, L.., and Li, B. Adversarial attack and defense on graph data: A survey. IEEE Transactions on Knowledge and Data Engineering, 35(8):7693-7711 2022.
Huang, C., Wang, Y., Jiang, Y., Li, M., Huang, X., Wang, S., Pan, S., and Zhou, C. Flow2GNN: Flexible two-way flow message passing for enhancing gnns beyond homophily. IEEE Transactions on Cybernetics, 54(1 (4(11))6607-6618 2024.
Sun, Y. Wang. S., Tang. X., Hsieh, T.-Y., and Honavar, V. Adversarial attacks on graph neural networks via node injections: A hierarchical reinforcement learning approach. In WWW, pp. 673-683, 202.0.......
Huang, J. and Yang, J. UniGNN: A unified framework for graph and hypergraph neural networks. In IJCAI, pp. 2563 6663, 2021.
Tao, S., Cao, Q., Shen, H., Huang, J., Wu, Y., and Cheng, X. Single node injection attack against graph neural networks. In CIKM, pp. 1794-11881888 1803, 2021.
Huang, S., Papernot, N., Goodfellow, I., Duan, Y., and Abbeel, P. Adversarial attacks on neural network policies. In ICLR, 2017.
Wang. K., Zhang, G., Zhang, X., Fang, J., Wu, X., Li, G., Pan, S., Huang, W., and Liang, Y. The heterophilic snowflake hypothesis: Training and empowering GNNs for heterophilic graphs. In KDD, pp. 3164-3175, 2024.
Ju, M., Fan, Y., Zhang, C., and Ye, Y. Let graph be the go board: Gradient-free node injection attack for graph neural networks via reinforcement learning. In AAAI, pp. 4390, 2023.
Wang, P., Yang, S., Liu, Y., Wang, Z.,, and Li, P. Equivariant hypergraph diffusion neural operators. In ICLR, 2023.
4383 4383-4390,
Kim, S., Lee. S. Y., Gao, Y., Antelmi, A., Polato, M., and Shin, K. A survey on hypergraph neural networks: An in-depth and step-by-step guide. In SIGKDD, pp. 6534 6544, 2024.
Wang, Y., Huang, C., Li, M., Cai, T., Zheng, Z., and Huang, X. All roads lead to Rome: Exploring edge distribution shifts for heterophilic graph learning. In IJCAI, 2025.
Wei, T. You, Y., Chen, T. Shen, Y., He, J., and Wang, Z. Augmentations in hypergraph contrastive learning: Fabricated and generative. In NeurlPS, pp. 1902-1922, 2022.
La Gatta, V., Moscato, V., Pennone, M., Postiglione, M., and Sperlí, G. Music recommendation via hypergraph embedding, IEEE Transactions on Neural Networks and Learning Systems, (4(10))7887-7899 2022.
Wen, L., Liang, J., Yao, K., and Wang, Z. Black-box adver- sarial attack on graph neural networks with node voting mechanism. IEEE Transactions on Knowledge and Data Engineering, 36( (66(10)55055503 2024.
Li, D., Xu, Z., Li, S., and Sun, X. Link prediction in social networks based on hypergraph. In WWW, pp. 41-42, 2013.
10

---

HyperNeea:: Unnoticeable Node Injection Attacks on Hypergraph Neural Networks
Wu, H., Wang, C., Tyshetskiy, Y., Docherty, A., Lu, K., and Zhu, L. Adversarial examples for graph data: Deep insights into attack and defense. In IJCAI, pp. 4816-4823, 2019.
Zou, X., Zheng, Q., Dong, Y., Guan, X., Kharlamov, E., Lu, J., and Tang. J. TDGIA: Effective injection attacks graph neural networks. In KDD, pp. 2461-2471, 2011.
Zügner, D. and Günnemann, Adversarial attacks on graph neural networks via meta learning. In ICLR, 2019.
Wu, H., Yan, Y., and Ng, M. K.-P. Hypergraph collabora- tive network on vertices and hyperedges. IEEE Transac- tions Pattern Analysis and Machine Intelligence, 45 (3):3245-3258, 2022.
Zügner, D., Akbarnejad. A., and Günnnemann, S. Adversarial attacks on neural networks for graph data. In KDD, pp. 2847-2856, 2018
Xiao, L., Wang, J., Kassani, P. H., Zhang, Y., Bai, Y., Stephen, J. M., Wilson, T. W., Calhoun, V. D., and Wang, Y.-P. Multi-hypergraph learning-based brain functional connectivity analysis in fMRI data. IEEE Transactions on Medical Imaging, 3965)1746-1775, 2019.
Zügner, D., Borchert, O., Akbarnejad, A., and Günnemann, S. Adversarial attacks on graph neural networks: Pertur- bations and their patterns. ACM Transactions on Knowl- edge Discovery from Data, 14(5):1-31, 2020.
Xu, J., Sun, Y., Jiang, X., Wang, Y., Wang, C., Lu, J., and Yang, Y. Blindfolded attackers still threatening: Strict black-box adversarial attacks on graphs. In AAAI, pp. 4299-4307,
Yadati, N., Nimishakavi, M., Yadav, P., Nitin, V., Louis, A., and Talukdar, P. HyperGCN: A new method for training graph convolutional networks on hypergraphs. In NeurIPS, pp. 1511-1522, 2019.
Yang. D., Qu, B., Yang, J., and Cudre- P. Revis- iting user mobility and social relationships in LbSNs: A hypergraph embedding approach. In WWW, pp. 2147- 2157, 2019.
Yu, J., Yin, H., Li, J., Wang, Q., Hung, Q. V., and Zhang, X. Self-supervised multi-channel hypergraph convolu- tional network for social recommendation. In WWW, pp. 413-424, 2021.
Zhang, X. and Zitmik, M. GNNGuard: Defending graph neural networks against adversarial attacks. In NeurIPS, 2020.
volume 33, pp.
Zhang, X., Bao, P.. and Pan, S. Maximizing malicious influence in node injection attack. In WSDM, pp. 958- 966, 2024.
Zheng, X.,
Zhu, W., Tang, C., and Wang, M. Gene selection for microarray data classification via adaptive hypergraph embedded dictionary learning. Gene, 706:188 188-288000 2019.
Zheng, X., Wang, Y., Liu, Y., Li, M., Zhang, M., Jin, D., Yu, S., and Pan, S. Graph neural networks for graphs with heterophily: A survey, arXiv preprint 270002220.007082. 2022.
Zhu, J. Jin, J., Loveland, D., Schaub, M. T., and Koutra, D. How does heterophily impact the robustness of graph neural networks? Theoretical connections and practical implications. In KDD, pp. 2637-2647, 2022.

---

HyperNear: Unnoticeable Node Injection Attacks on Hypergraph Neural Networks
A. Supplementary Materials
A.1. Further Discussion
Hypergraphs are commonly used to model complex relationships between entities, often relying on homophily, the tendency for similar nodes to cluster together, as key structural property that enhances predictive accuracy. In domains like social networks, recommender systems, and biological networks, this property forms crucial foundation for tasks such as community detection and classification.
It is well understood that higher homophily generally helps GNNs achieve better performance downstream tasks, as neighbors positively influence the representation of the central node during aggregation (Zheng et al., 2022; Zhu et al., 2022; Luan et al., 2022; Huang et al., 2024). Reducing homophily between nodes disrupts the neighborhood aggregation process of graph-based model, resulting in performance degradation. However, this disruption can also be leveraged as an indicator of a potential attack. Therefore, by colftoonstrainig the actions of attacker with respect to homophily, the attack can achieve greater stealth and evade detection more effectively. Also, the effect of other attack methods on the homophiliy ratio as shown in Figure 7.
Although this paper utilizes homophily as a restrictive metric for designing attack strategies, the complex structure of hypergraphs presents opportunities for deeper exploration. Investigating more sophisticated metries for attack stealth will help uncover the fundamental principles needed to protect the stability of hypergraph models.
Honodhll
Node IndeR
Figure 7. Impact of other attack methods homophily ratio. The left visuals show NDA attacks on the DBLP-CA dataset and Cora dataset, while the right two represent FGA attacks on the Pubmed dataset and Citeseer, respectively.
Relationship Between Changes in FHH and Changes in Hypernode Feature. Suppose that the hypergraph is perturbed by injecting nodes, and that the perturbation affects the set of neighbors R2, of node w. This perturbation causes a change in the node feature aggregation function, denoted as f-). By Taylor expansion, we know that the feature change Ab. of supernode is denoted as:
a
do Afi + O (Af)))
Ah(
Σ
(15)
Of
According to the definition of Eq. 10, FHH measures the similarity between the features of node v and its neighboring feature aggregates. Then the change of FHH after perturbation can be approximated as:
AFHH. ss sim(H,, x - sim(H,, X.).
(16)
Similarly, using the Taylor expansion, the result is obtained:
a de af.
AFHH Σ Aft+ +i++0 ((Af))).
(17)
This suggests that changes in FHH are directly caused by changes in the characteristics of node and its neighbors, which can be captured by the perturbation function Af. and the partial derivatives of the corresponding aggregation function ā..
de
We believe that promoting shift from heterophily to homophily is key to developing an unnoticeable attack. Our empirical findings indicate a significant reduction in the homophily ratio of hypergraphs following adversarial attacks. Homophily, which measures the similarity between a node's 's features and those of its neighboring nodes, is essential for preserving the structural integrity of hypergraphs. When homophily disrupted, the structural coherence of the hypergraph is compromised,
12

---

HyperNeea: Unnoticeable Node Injection Attacks on Hypergraph Neural Networks
making the attack more noticeable and less effective. Therefore, maintaining homophily is crucial for ensuring that the attack remains unnoticeable and achieves its desired impact. In hypergraphs, where nodes connected by hyperedges that capture complex high-order relationships, even small changes in homophily can lead significant topological shifts due to the collaborative nature of the hypergraph structure. As shown in (q.() small perturbations may cause nonlinear changes, especially in higher-order structures where the effects may be amplified as the perturbations propagate through multiple nodes.
By integrating homophily constraint into the overall loss function, we ensure that our adversarial perturbations are optimized for both attack effectiveness and unnoticeable. The full adversarial objective expressed as:
max batk Leds XLFHH:
(18)
|| - 1S
where Cois the classification loss and À a hyperparameter controlling trade-off between classification performance and homophily preservation, and l|g' 9ll s ensures that the adversarial modifications stay within the allowed perturbation budget B.
A.2. Experimental Setups
In our study, we follow the strict black-bor box setup, which prohibits any querying of the model and only allows access to the incidence and feature matrices of the input data. The default hyperparameter settings in method are follows, the parameter random seed is 4202, the choice of hyperedge & is 10%, the ratio of the injected nodes is 5%, the effect of controlling the loss of homophily À and T is 0.1. The comparison method is subjected to the same budgetary constraints. By default, the victim model and the target model are the same, where the victim model is the model used by the user and the victim model is the pre-trained model used by the agent model, which is the model attacked in our experiments. All experiments are conducted on a device with AMD EPYC 7543 32-core processor and a NVIDIA RTX A6000 GPU with 48 GB of RAM.
A.3. Experimental Results
We provide visualization results on other datasets, as shown Figure and Figure 9.
Before Attack
Before Attack
Before Attack After Attack
After Attack
4.0
After Attack
3.5
3.0
Density
2.5
bensity
2.0
0.0
0.2
0.6
1.0
0.2
0.6
1.0
0.0
0.4
0.6
0.8
Homaphily
Homophily
Homaphily
Figure 8, Changes in the homophily ratio. From left to right, Cora-CA datasct, Citeseer dataset, Pubmed dataset.
We also evaluated the portability of HyperNear to other HNN models in two additional datasets complement the experimental results in the main text, as shown in Table 4.
A.4. Datasets
We evaluate models on five real-world hypergraph datasets for hypernode classfication tasks, including DBLP (Rossi & Ahmed, 2015), Pubmed, Citeseer and Cora (Sen et al., 2008). These are standard academic web datasets, where each node represents a document. For the DBLP and Cora datasets, co-authorship hypergraph is constructed, with all documents co-authored by the same author forming a single hyperedge. In the case of PubMed, Citeseer, and Cora, a co-citation hypergraph is created, where each hyperedge links all documents cited by the same author. The statistics of datasets are provided in Table 5.
13

---

Hep:rNear: Unnoticcable Node Injection Attacks on Hypergraph Neural Networks
Original Nodes
Original Nodes
Original Nodes
Injected Nodes
Injected Nodes
Injected Nodes
-20
-20
-40
-40
-40
-20
-43
-20
40
-40
-20
40
Figure 9. T-SNE visualization of data distribution after HyperNear attack. From left to right, Citeseer dataset, Cora dataset, Cora-CA dataset.
Table Performance comparison HyperNear on different HNNs.
CORA-CA
CITESEER
VICTIM MODEL.
BEFORE
AFTER
BEFORE
AFTER
HYPERGCN
75.26 + 2.78
57.36 + 7.42
70.76 0.92
56.68 + 1.77 4
HGNN
82.10 + 0.86
53.29
0.95
72.71 + 1.27
46.14
1.53
ED-HNN
84.08 + 1.75
62.38 1.18
55.19 + 1.55
UNIGCNII
81.79 + 1.29
70.28 + 1.42
73.26 + 1.16
68.50 + 1.37
Table 5. Statistics of hypergraph datasets. The homophily ratio H. is computed from Eq,(3) by labels.
DATASETS
# NODES ([V))
HyperedGES (EE)
# CLASSES
AVG.HYPEREDGE SIZE
LABEL RATE
LABLE-BASED HOMO. (H)
CORA-CA
2,708
1,072
4.2+4.1
0.052
0.7797
DBLP-CA
43,413
22,535
4.7+6.1
0.040
0.8656
CITESEER
3,312
1,079
3.2+2.0
0.052
0.6814
CORA
2,708
1.579
7
3.011.1
0.052
0.7462
PUBMED
19,717
7,963
3
4.3
0.008
0.7765
A.5. Notation Table
Table 6 summarizes the notations and definitions throughout this paper for clarity.
Table 6. Notation Table.
NOTATION
DESCRIPTION
NOTATION
DESCRIPTION
G
HYPERGRAPE
VECTOR VERTEX FEATURES
V
SET OF VERTEXS
LABEL
W
DIAGONAL MATRIX OF HYPEREDGE WEIGHTS
H
BABEL-BASED HOMOPHILY RATIO
MATRIX VERTEX FEATURES INCIDENCE
L
MATRIX BETWEEN THE ORIGINAL VERTEX AND THE NEW HYPEREDGE
I.
HYPEREDGE
H'
INCIDENCE MATRIX AFTER ATTACK
MATRIX BETWEEN THE NEW VERTEX AND THE NEW HYPEREDGE HYPEREDGES THE AVERAGE DECREE OF HYPEREDGE
HYPEREDGE
R.
VERTEX
VERTEX
d.
A.6. Algorithm
The implementation our algorithm is summarized in Algorithm 1.
14

---

HyperNear: Unnoticeable Node Injection Attacks on Hypergraph Neural Networks
Algorithm 1 HyperNear: Node InjEction Attack HypeRgraph
1: Input: Node feature matrix X R Vixd Hypergraph incidence matrix H R Injection ratio a, Selected
hyperedges k., Perturbation standard deviation 7), Random seed Budget B, Hyperparameter À
2: Output: Modified node feature matrix X', Modified hypergraph incidence matrix H!
3: Set random seed 8
4: V'njocteed f- a X [V] (Number of injected nodes)
5: new - Generate features for injected nodes using X with perturbation ?
6: Esclected Select hyperedges from H randomly
7: for = 1 to k do
8: Inject nodes from Xnew into hyperedge [sclecee[[]]
9: Compute Lats for the modified hypergraph
10: Compute HF based on feature homophily preservation
11:
if |lg' 9 S B then
12:
Calculate Lark f- Lets - ACFHH
else
14: Revert the injection
15: end if
16:
end for
17:
while adversarial objective not met do
18: Hupdate < Perform random split on the injected hyperedge in H
19: Compute L.ts for Hupdate
20:
Compute LFHH for the updated features
Sinj arg maxg Lote (Huudatt))) ). y) {Find the optimal splitting strategy)
22:
if adversarial loss increases ||g' G B then
23:
Reject the split
24: else
25:
Accept the new hyperedge split Sinj
26:
end if
end while
28:
return X', H'
B. Analyzing Hypergraph Topological Vulnerabilities
In this appendix, we present a detailed derivation of the theoretical framework that models the topological vulnerability of hypergraphs under adversarial perturbations, specifically focusing on hypergraph injection attacks. These attacks target hypergraphs by perturbing the node features and structure, causing significant changes in the model's s performance. The impact of these perturbations is formally captured Theorem 3.1. We begin by revisiting the general process of hypergraph convolution, before introducing the perturbations and analyzing their impact on the node feature vectors.
B.1. Hypergraph Convolution Process
We start by defining the general hypergraph convolution process, which aggregates information from neighboring nodes in a hypergraph. The feature vector for node at the k-th layer, h is computed as function of the feature vector from the previous layer, h((-1), (k-1) and the aggregated features of the neighboring nodes:
h ((() ((hhht")
([((( u R.))),
(19)
where R,, = (e, v E represents the set of hyperedges that contain node v, and ej (for 1,2, 1,,,..., ..E....,)))... denotes the j-th hyperedge. The functions o6-) and f(.) are vector-valued functions that update the node features based on the information from neighboring nodes.
This equation captures the process of updating the feature vector for node v by aggregating the feature vectors of its neighbors across all hyperedges that contain v.
15

---

HyperNeea: Unnoticeable Node Injection Attacks on Hypergraph Neural Networks
B.2. Adversarial Injection Attack Hypergraphs
In the context of adversarial attacks, introduce the concept of a hypergraph injection attack. This attack targets specific areas of the hypergraph by injecting new nodes, perturbing the structure and feature vectors of the hypergraph without needing full access to the graph. The goal is to simulate the effect of small, targeted changes to the hypergraph that lead to significant changes in the model's output.
To model the effect of adversarial perturbations, we introduce a modified version of the aggregation function where the neighborhood sets are altered by injected nodes. Specifically, we define R2 as the set of t-hop neighbors of node v, and the corresponding aggregation function is denoted as fe(-). The feature update process can then be rewritten as:
h (K) =Φ (Jo((n)) (), IuE E R,))),
(20)
f2(th ejjey fu(th
(( EuEejee E E R3)))
In this formulation, the feature vector h is updated by aggregating the features from the node's t-hop neighbors across different layers of the hypergraph.
B.3. Perturbation of the Hypergraph
Next, we introduce perturbations into the hypergraph. We assume that after the injection attack, the t-hop neighborhood of node v changes from R. to R2 and the corresponding aggregation function fe(-) changes to f(()). The change in the feature vector h (k) due these perturbations can be approximated using first-order Taylor expansion:
dΦ
de (ff - fi)
do
k((k)
-h
+
(5o
fo) +
+
Sh - fa) +0)+0((A)))) ((A))*+(A)))) (ASI) 0fn
- + +((A)))
f
0f
(21)
do
=h
(fi fi) + 0 ((A1)))))
where Aft = fi fo represents the perturbation in the aggregation function for the t-hop neighbors.
The change in the
feature vector Ah (k) is then:
0
Ah h
Af
o((Af)
(22)
āfe
t=
Change t-hop aggregated features
Higher-order effects (nonlinear)
Sensitivity of á to t-hop features
This equation quantifies how the perturbations in the hypergraph propagate through the network and alter the feature vectors of the nodes.
B.4. Weighted Aggregation and Perturbation Effects
For the case where the aggregation function uses a weighted average, the function fa(-) can be written as:
fe((h (k-1) I ej, E R₂))
Σ
h (k-1)
(23)
{uÉey (.ERR)
where w is the weight associated with the hyperedge between node v and its t-hop neighbors. Under perturbations, the change the aggregation function is given by:
Af.
Σ
(Auth!/--) w(, (ttAh((()))
(24)
(uEey (RE)
This expression demonstrates that the changes in both the structure (i.c., the weights) and the feature vectors the neighbors amplify the perturbation effect.
16

---

HyperNeea: Unnoticcable Node Injection Attacks on Hypergraph Neural Networks
Feature Change Magnitude
2.5
----
Linear Sensitivity (Deeay)
Nonlinear Higher-Order Effects (Growth)
Overall Propagation Effect
1.5
1.0
0.0
2
t-hop Levels (Distance from Node V)
Figure 10. Illustration of perturbation propagation in HNNs. In Theorem 3.1, the first term models the primary contribution through linear propagation, which dominates for small perturbations, In contrast, the higher-order terms reflect nonlinear effects that, while smaller in magnitude, can become significant under large perturbations or high variability in hyperedge weights.
B.5. Optimization Objective for Perturbations
key aspect of adversarial perturbations minimize the magnitude of the change in the feature vector Ah; while ensuring that the perturbations in the aggregation function exceed certain threshold. This be formulated as the following optimization problem:
(k)
min 9
(h(k)
s.t.
Σ
(25)
where || Ah! represents the magnitude of the change in the feature vector, and Afr is the perturbation size in the aggregation function for the t-hop neighbors. The constraint ensures that the perturbation exceeds predefined threshold which is necessary to produce significant changes in the output.
B.6. Perturbation Propagation in HNNS
Figure 10 illustrates the sensitivity brought about by /-hop neighbors of node versus the change in uncertainty brought about by nonlinear higher-order effects on HNNs. These theorem and corollary offer theoretical perspective on how perturbations in hypergraph topology propagate through the network. While the results illustrate the potential for small manipulations in hyperedges or node features to influence model behavior, the exact extent this effect depends on specific model designs and datasets. As observed in Sec. 5.3, experimental results confirm that our injection attack framework, HyperNear, effectively exploits these vulnerabilities across multiple HNN models, demonstrating strong disruptive capabilities under diverse scenarios.
Note: Optimization Objective for Adversarial Attacks
To design effective injection attacks, the following optimization problem formalizes the trade-off:
min Ah (k)
Ah(A) ||
s.t.
Af
(26)
T=
where || Ah represents the magnitude of the change in the feature vector, and Aft is measure of the size of the perturbation in the aggregation function ft).), which we want to be at least a predefined threshold for significant change.
(k)
Objective: Identify minimal perturbations that lead to significant changes in the output.
17

---

HyperNear: Unnoticeable Node Injection Attacks on Hypergraph Neural Networks
C. Related Works
Adversarial Attack on Graph Data. Existing attack methods (Dai et al., 2018; Zügner et al., 2020; Sun et al., 2022: Gosch et al., 2023) on graph data can be categorized into two types: graph modification attacks (Chen al., 2018; Zügner al., 2018; Zügner & Günnemann, 2019) and graph injection attacks (Sun et al., 2020; Zou al., 2021; Ju al., 2023; Zhang et al., 2024; Fang et al., 2024). Modification attacks achieve the desired attack effect by altering the graph structure, while injection attacks aim to disrupt the model's performance by injecting new nodes. Both types of attacks can significantly decrease the model's 's accuracy, however, injection attacks generally require less access privilege from the attacker. Thus, this paper focuses primarily on designing an injection attack framework.
Most prior work has only addressed simple graph structures (Wu et al., 2019), with edges representing direct connections between node pairs. In contrast, hypergraphs, which model higher-order relationships, have seen limited exploration in the context of adversarial attacks. This gap particularly critical given the increasing adoption of HNNS in real-world applications, as the absence of robust understanding about potential vulnerabilities could expose these models to significant security risks.
Hypergraph Neural Networks. HNNs have been developed as an advanced extension of GNNs, specifically designed to capture high-order relationships that beyond the pairwise interactions typical of traditional graph structures (Gao et al., 2020; Antelmi et al., 2023; Kim et al., 2024). Hypergraphs use hyperedges to simultaneously connect multiple nodes, enabling HNNs to model the more intricate and varied relationships found in real-world data. This feature makes HNNS particularly effective in domains such as social networks (Li et al., 2013; Yang et al., 2019), bioinformatics (Zheng et al.. 2019; Shao al., 2020; Xiao et al., 2019), and recommendation systems (Yu et al., 2021; La Gatta et al., 2022), where interactions often involve groups of nodes rather than individual pairs.
Various models have been proposed: HGNN (Feng et al., 2019; Gao et al., 2022), HyperConv (Bai et al., 2021), and HyperGCN (Yadati et al., 2019) process hypergraphs by converting them into traditional graphs through the hypergraph Laplacian operator. HyperMSG (Arya et al., 2020) leverages hypergraph structures by aggregating messages in a two-stage process. UniGNN (Huang & Yang, 2021) proposes a unified framework for both graph and hypergraph neural networks. HyperGCL (Wei et al., 2022) enhances the generalization ability of hypergraphs through contrastive learning, while ED- HNN (Wang et al., 2023) models high-order relationships using hypergraph diffusion operator. HCoN (Wu al., 2022) introduces hypergraph reconstruction error train classifier. These approaches enhance the ability of HNNs to handle large-scale data with complex multi-node relationships, enabling the development of hypergraph applications. Despite these advances, the security and robustness of HNNs remain underexplored.
Remarks. While some initial efforts (Hu et al., 2023; Chen et al., 2023) have explored related threats, these studies mainly focus on probing different data modeling approaches rather than designing attacks specifically for hypergraph models, which are central to many applications. Consequently, research addressing the unique structural characteristics of hypergraphs in adversarial scenarios remains scarce.
Our work directly tackles this gap by focusing the structural vulnerabilities of HNNs under adversarial manipulation, with emphasis on black-box attack settings. Black-box attacks (Xu al., 2022; Wen et al., 2024), where adversaries generate adversarial samples without any knowledge of the target model's internal parameters or architecture, pose realistic and severe threats in practical scenarios. To the best of our knowledge, this is the first work to conduct adversarial attacks on hypergraphs in a blackbbox setting.
18


Reviews:
[{"review_id": "eO5xSEoXZQ", "reviewer": "Reviewer_LMBD", "summary": "The authors proposed a node injection attack algorithm for hypergraph neural networks in black-box setting.", "questions": "", "limitations": "", "rating": 1, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We sincerely appreciate your detailed feedback and address your concerns below.\n\nClaims1: Our claim of unnoticeability is **relative**, meaning that our attack is designed to be less detectable compared to naive perturbations. **The degree of unnoticeability also varies across datasets due to differences in hypergraph structures [1]**. For instance, Cora has a noisier and less structured hypergraph compared to Cora-CA, as their hyperedge constructions differ. Thus it produces less impact in Fig.4(b) (Cora-CA) than in Fig.4(a) (Cora).\n\nClaims2: Yes. Please refer to our response to Reviewer FH69’s Q2.\n\nClaims3: In addition to four surrogate models in transferability (HyperGCN, HGNN, ED-HNN, UniGCNII), Table 2 includes UniSAGE, UniGIN, UniGCN, and UniGAT, **covering diverse hypergraph neural networks** for comprehensive evaluation.\n\nMethods1&Exp: Our study focuses on homophily because both structural and feature perturbations directly affect it, making it a better indicator of unnoticeability than degree or feature distributions, which are outside our scope. As noted in line 201, we measure homophily FHH, defining the x-axis in Figure 4. Revealing homophily’s sensitivity is a key contribution, as it captures both structural and feature-based perturbation effects.\n\nMethods2: Random: Node features are randomly sampled from a Gaussian distribution fitted to existing node features. NDA: We select nodes with the smallest degrees and perturb their features by adding Gaussian noise proportional to feature variance. Full details are available in our public code.\n\nTheoretical1&Theoretical2: Section 3.1 analyzes hypergraph topology's vulnerability, not its comparison to standard graphs. Hyperedges amplify perturbations differently from graphs, where message passing is pairwise. While both graphs and hypergraphs allow perturbation propagation through the structure, **their structural mechanisms differ fundamentally**. Corollary 3.2 shows hyperedge weight and feature changes impact all incident nodes simultaneously.\n\nSupplementary: Thank you for noting this issue. The incomplete code was due to an outdated version of the repository used at the time of submission. We have **now updated it with the correct, runnable code**.\n\nOther: We will redraw Figure 2 to improve clarity, ensuring legends do not obscure numbers.\n\nQ1: The practicality of such attacks lies in the non-i.i.d. nature of hypergraph data, where structural dependencies significantly impact representation learning. Unlike graphs, hypergraphs propagate information across multiple entities, influencing representation learning (e.g., HGNN+ [2]).\n\nQ2: Lines 916-927 (Appendix B) define our adversarial objective. Algorithm 1 (Line 17) terminates when further perturbations **no longer improve attack effectiveness** or when **accuracy drops below a threshold**, preventing over-perturbation and also to conserve resources.\n\nQ3: We believe that, in some cases, random injections may unintentionally act as data enhancement, leading to performance improvements rather than degradation. This aligns with findings in contrastive learning for hypergraphs (e.g., HyperGCL [3]), where certain hyperedge augmentation can enhance model generalizability and robustness. This further justifies the need for dedicated adversarial attack studies on hypergraphs.\n\nQ4: Theorem 3.1's perturbation $ΔR_v$​ refers to **structural modifications via node injection**, altering neighborhood relationships and feature propagation.\n\nQ5: ''t-hop features\" are neighborhood features aggregated through t-hop hyperedges. Line 110 defines $f(\\cdot)$ as the aggregation function, with $f_t$ representing t-hop features. We will clarify that $n$ is the maximum hop count. As noted in Line 161, both $f(\\cdot)$ and $\\phi$ are differentiable hypergraph convolution aggregation functions. Theorem 3.1 holds if aggregation follows Eq. (6).\n\nQ6: Line 198 already provides the definition: the average degree of hyperedge $e$ is given by $d_e=\\frac{1}{|e|}\\sum_{i \\in e}d_i$, ensuring balanced normalization in homophily calculations.\n\nQ7: Naive adversarial attacks lack strategic design and inject random or heuristic perturbations without considering hypergraph structure. Our optimized hypergraph-specific attacks balance effectiveness and stealth.\n\nWe sincerely appreciate your thorough review and constructive feedback, which have greatly contributed to improving the clarity of our work. If you have any further questions or concerns, we would be glad to provide additional clarification or discussion. Thank you once again for your time and valuable input.\n\n[1] Wang et al., From Graphs to Hypergraphs: Hypergraph Projection and its Remediation. In ICLR, 2024.\n\n[2] Gao et al., HGNN+: General Hypergraph Neural Networks. In TPAMI, 2023.\n\n[3] Wei et al., Augmentations in Hypergraph Contrastive Learning: Fabricated and Generative. In NeurIPS, 2022.", "claims_and_evidence": "Problematic claims:\n1. Un-noticability: I do not understand why the authors claim unnoticability where Figure 4(a) clearly distinguishes that \"After attack\" distribution is bimodal while \"before attack\" distr. is unimodal. Similarly, Figure 5(b) shows that one can identify the injected nodes in the periphery region. \n2. Black-box claim. In the Feature Generation step of the algorithm, since the attacker uses the original node feature x_{ori} to construct the node feature of the injected node x_{inj}, could such an attack still be considered a black box? \n3. Transferability: I am confused about the setting of the transferability experiment as it is not discussed properly. Have you considered any surrogate models other than HyperGCN, HGNN, ED-HNN and UniGCNII to generate perturbed Hypergraph $H'$?", "methods_and_evaluation_criteria": "1. I understand the reason to analyse Homophily distribution to justify un-noticability, but a more straightforward and practical way is to look at simpler statistics such as degree and dimension distribution.\n\n2. However, the baseline models are inadequately discussed in section 5.1. The authors should consider explaining Random, NDA and FGA more precisely in detail. For instance, it is not clear how \"randomly generating node features\" work. Or what kind of modification of features are considered for the smallest deg node in NDA?", "theoretical_claims": "One of the key theoretical claims of the paper shows that the topology of a hypergraph is vulnerable to adversarial attack (sec 3.1). Apart from under-explained notations (articulated in ``Other comments’’), the most problematic part is that it is not clear how hypergraphs amplify minor perturbations in comparison to graphs. A more convincing argument is lacking here.\n\nI did not find anything specific to hypergraph structure being shown as contributing to the Amplification effect. Similar arguments can be made for graphs with GNNs aggregation. For instance, lines 184-186 say, “A single perturbation can propagate through the structure, affecting multiple nodes simultaneously and highlighting the fragility of hypergraphs.”; the same thing can be said for a graph node that is connected to multiple other nodes.", "experimental_designs_or_analyses": "The x-axis in Figure 4 => Does it indicate FHH, or node-label based homophily rate? I understand the reason to analyse Homophily distribution to justify un-noticeability, but a more reasonable way is to look at simpler statistics such as degree and dimension distribution.", "relation_to_broader_scientific_literature": "The broader direction of the paper is promising.", "essential_references_not_discussed": "None, to the best of my knowledge.", "other_strengths_and_weaknesses": "The work is promising but needs more time to be publication-ready.", "other_comments_or_suggestions": "Figure 2 is not good enough. Legends are obfuscating the numbers.", "questions_for_authors": "1. Lines 25-27: “These attacks are\nstealthy and practical, as they avoid altering existing nodes\nor hyperedges. “ - why such attacks are practical in a hypergraph context? \n2. Line 17 in Algorithm 1 says, “while adversarial objective not met do .. “. What are the conditions for the objectives to meet? \n3. Table 2, Why some random injection attacks are invalid? \n4. Theorem 3.1, What is the nature of the perturbation $\\Delta \\mathcal{R}_v$?\n5. Equation 7, What do you mean by ``t-hop features’’? $f_1, f_2,...,f_n$ was never properly defined before? What are the choices and properties of $f()$ and $\\phi$? Do you consider them differentiable? Please properly articulate the conditions under which the theorem holds. \n6. Defn 3.4, What is the definition of average degree of hyperedge $e$? Please be clear and concise.\n7. Proposition 3.3, “Naive adversarial attacks cause a significant\nreduction in the homophily ratio of hypergraphs,..” - What constitutes a naive adversarial attack?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "4T7ndIbd5A", "reviewer": "Reviewer_FH69", "summary": "This paper proposes a black-box node injection attack on Hypergraph Neural Networks (HNNs), named HyperNear. Unlike previous gradient-based white-box attacks on HNNs, this method does not require access to model parameters or gradients. Instead, it strategically injects malicious nodes and optimizes their connections to maintain high homophily, making the attack less detectable. The paper formulates the attack as an optimization problem, balancing attack effectiveness and stealthiness. Experimental results demonstrate that HyperNear significantly degrades classification performance while maintaining structural similarity to the original hypergraph, suggesting its robustness in real-world scenarios.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Claims&W2&W3: Thank you for your valuable feedback and for recognizing the effectiveness of our attack methodology.\n\nOur claim of stealthiness is based on the observation that homophily-aware attacks introduce perturbations aligned with existing structural patterns, making them less detectable than naive attacks. While **Figure 4 & 5 provide empirical evidence**, we acknowledge the need for stronger theoretical justification. Regarding adversarial defenses, existing graph-based methods may not directly apply to hypergraphs due to structural differences. Evaluating robustness against hypergraph-specific defenses is an important direction for future work.\n\nTo the best of our knowledge, no prior work has established attack methods for hypergraphs. Our study serves as an exploratory step, proposing the first black-box attack framework for hypergraph neural networks, which is a fundamental prerequisite for systematic defense research. Given the absence of standardized adversarial defenses in hypergraph learning, we deliberately **prioritize vulnerability analysis over premature defense development**, aligning with security research paradigms in graph learning [4], where attack understanding precedes defense formulation. We believe **this work lays a crucial foundation for future robustness studies in hypergraph learning**.\n\nTheoretical: Thank you for recognizing our mathematical formulation of the attack optimization process, which balances effectiveness and stealthiness. While we do not provide formal convergence guarantees, this is due to the complexity of hypergraph structures, where high-order dependencies and discrete perturbations make theoretical analysis non-trivial. Nevertheless, **our empirical results consistently demonstrate stable and effective attack performance across multiple datasets**. Future work could explore theoretical analyses, such as proving convergence under specific constraints or employing continuous relaxations of the attack space.\n\nW1: While we agree that black-box attacks are a key contribution, our work is not merely about transferring existing attacks to a black-box setting. Instead, we position this as an exploratory study into the fundamental vulnerabilities of hypergraph neural networks under adversarial attacks, an area that has received little attention.\n\nNotably, every reviewer recognized our work as a promising and significant direction, **highlighting the importance of understanding adversarial threats in hypergraphs**. Our study emphasizes the challenges posed by the higher-order dependence of hypergraphs and the need for homophily-aware perturbations. We further elaborate on these challenges in Q1, where we discuss the difficulty of designing attacks that remain stealthy while coordinating complex hypergraph structures.\n\nW2: Thank you for the suggestion. We will enhance Figure 1(b) by improving color contrast, making the distinction between homophilous and heterophilous hyperedges more visually intuitive. For concerns regarding formal proofs, please refer to our response to Claims&W2&W3.\n\nQ1: Compared to black-box attacks on GNNs, perturbations in **standard graphs only affect pairwise connections, while in hypergraphs, a single hyperedge impacts multiple nodes**. This requires coordinated modifications to remain stealthy, making attack design significantly harder.\nCompared to white-box attacks on HNNs, **our black-box setting lacks access to model parameters or gradients**, requiring surrogate models and heuristic strategies.\n\nMoreover, hypergraph attacks require greater stealth, as their intricate interdependencies render naive perturbations more easily detectable. Additionally, while hypergraphs have attracted growing interest for their strong representational capabilities, the study of homophily in hypergraphs has only recently begun to receive attention [5]. The structural complexity of hypergraphs makes the homophily problem particularly challenging and still largely underexplored.\n\nQ2: We follow the strict black-box setting in [6], where attacker can access node features but has no knowledge of model parameters or gradients. Therefore, using original feature for feature generation is consistent with this definition. In addition, the use of raw features belongs to the reasonable a priori knowledge of the attacker (e.g., publicly available user features are observable by the attacker in social networks) and **does not conflict with the black-box setting**.\n\nThank you again for recognizing this work and for your constructive comments.\n\n[4] Zügner et al., Adversarial Attacks on Neural Networks for Graph Data. In KDD, 2018.\n\n[5] Li et al., When Hypergraph Meets Heterophily: New Benchmark Datasets and Baseline. In AAAI, 2025.\n\n[6] Xu et al., Blindfolded Attackers Still Threatening: Strict Black-Box Adversarial Attacks on Graphs. In AAAI, 2022.", "claims_and_evidence": "The paper claims that HyperNear effectively degrades HNN classification performance while remaining stealthy due to homophily-aware node injection. While the empirical results support the performance degradation claim, the assertion that homophily-based attacks are harder to detect lacks rigorous mathematical or experimental justification. Additionally, the paper does not discuss whether existing adversarial defense mechanisms can counteract this attack, leaving its robustness against defenses unclear.", "methods_and_evaluation_criteria": "The proposed method aligns with the problem setting, leveraging node injection to attack HNNs under a black-box assumption. The evaluation uses standard benchmark datasets, which are appropriate for assessing classification performance.", "theoretical_claims": "The paper provides a mathematical formulation for the attack optimization process, defining the objective function that balances attack effectiveness and stealthiness, though it lacks formal guarantees on its convergence and optimality.", "experimental_designs_or_analyses": "The experimental design follows standard practices, evaluating the attack on benchmark datasets with classification accuracy as the primary metric. The results demonstrate a clear performance drop, supporting the attack's effectiveness.", "relation_to_broader_scientific_literature": "The paper extends prior work on adversarial attacks against HNNs by shifting from gradient-based white-box methods to a black-box node injection attack, aligning with broader research on adversarial robustness in graph-based learning. It builds on the concept that homophily influences attack effectiveness, which has been explored in GNN adversarial studies but is less studied in hypergraph settings.", "essential_references_not_discussed": "None", "other_strengths_and_weaknesses": "Strengths:\nS1. Novel black-box attack formulation for HNNs.\n\nS2. Optimization framework balances attack effectiveness and stealthiness.\n\nS3. Empirical evaluation on multiple benchmark datasets.\n\nWeakness\n\nW1: As described in the Related Works section, previous studies have already proposed gradient-based adversarial attack methods for HNNs. Therefore, the key focus of this work should be on transferring the attack to a black-box setting. I believe the novelty and motivation should emphasize black-box attacks rather than HNNs themselves.\n\nW2: In Figure 1(b), I do not clearly see the distinction between Homo. and Hete.. Although I eventually realized that the authors might be trying to illustrate that injection attacks targeting Homo. structures are harder to detect, this conclusion requires strict mathematical or experimental support.\n\nW3: The paper does not seem to discuss whether existing adversarial defense methods can detect or mitigate this attack.", "other_comments_or_suggestions": "None", "questions_for_authors": "Q1: Compared to black-box attacks on GNNs and white-box attacks on HNNs, what are the key challenges of this paper’s attack on HNNs?\n\nQ2: Can the attacker obtain complete information about the hypergraph? If they have full access to the graph structure and node attributes, would this still be considered a black-box attack?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "W7xHdbze6i", "reviewer": "Reviewer_tPAy", "summary": "This work introduces HyperNear, a homophily-preserving node injection attack for hypergraph neural networks (HNNs). It provides a theoretical analysis of hypergraph vulnerability and demonstrates that homophily can be leveraged to enhance attack stealth. Extensive experiments show that HyperNear is highly effective and unnoticeable, making it the first black-box attack framework for HNNs, with important implications for hypergraph security.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We sincerely appreciate your detailed review and for recognizing the novelty and contributions of our work, including the introduction of HyperNear, its theoretical grounding, and its strong empirical results. Below, we address your comments point by point.\n\nWeakness1: Figure 4 illustrates the difference in the distribution of homophily ratio before and after the attack. We will refine Figure 4 by enhancing its clarity, improving the legend contrast, and adding explanatory annotations to highlight how classification results support our stealthiness claims. Thank you for your valuable suggestions.\n\nWeakness2: We clarify that Figure 1(a) is designed to illustrate **how the impact of injected malicious nodes propagates through the hypergraph topology**, rather than demonstrating homophily-guided injection. Meanwhile, we acknowledge that Figure 1(b) could better highlight homophily's role in stealthiness. To improve clarity, we will enhance the figure and captions to better convey these distinctions.\n\nWeakness3: Thank you for the suggestion. The five datasets we use are widely adopted benchmarks in hypergraph learning, making them appropriate for evaluating HyperNear. However, we agree that exploring additional datasets could further reveal the impact of hypergraph structure on attack robustness. We consider this an important direction for future work.\n\nOther 1: We will increase the font size in Table 1 to improve readability.\n\nQuestion 1: Our paper already provides a theoretical analysis of how hypergraph topology influences homophily and how local perturbations can cascade through the structure. Specifically, Theorem 3.1 formalizes how perturbations affect node relationships, **with the first term capturing linear propagation effects, while higher-order terms reflect nonlinear amplification**, which can become significant under large perturbations or varying hyperedge weights.\n\nAdditionally, **Figure 11** illustrates how perturbations propagate in HNNs, visually demonstrating this cascading effect. The primary term dominates for small perturbations, ensuring controlled degradation, while higher-order dependencies introduce more complex, nontrivial effects under larger structural changes.\n\nQuestion 2: In hypergraphs, **homophily quantifies the similarity of connected nodes in feature space**, making it a natural and intuitive measure of structural changes. Since **hypergraph neural networks heavily rely on homophily for information propagation**, perturbing homophily can significantly degrade model performance, which aligns with our attack objectives.\n\nAs discussed in our paper, **exploring alternative structural change metrics in hypergraphs is an important future research direction**. While homophily provides a strong foundation, other potential measures could offer complementary insights into structural vulnerabilities.\n\nOnce again, we sincerely appreciate your thoughtful feedback and your recognition of the novelty and significance of this work. Your comments have helped us refine our presentation and identify valuable directions for future research.", "claims_and_evidence": "The claims are well-supported by the presented evidence. The authors demonstrate that hypergraphs are vulnerable to node injection attacks through empirical analysis and propose a novel attack framework, HyperNear. The results show strong performance and generalization, validating their claims.", "methods_and_evaluation_criteria": "The proposed methods are appropriate for the problem. The authors introduce a tailored attack framework for HNNs and evaluate it using extensive experiments in a black-box setting. The approach is sound and demonstrates effectiveness.", "theoretical_claims": "Yes. I have checked carefully the proofs and details. Theorem 3.1 and Corollary 3.2 are well-grounded.", "experimental_designs_or_analyses": "The experimental design is well-structured, and the theoretical analysis is clearly presented and sound. I have carefully reviewed the relevant details and found them to be appropriate and convincing.", "relation_to_broader_scientific_literature": "The paper introduces a valuable contribution to adversarial attacks on hypergraphs. The study of vulnerabilities in graph neural networks is an active area of research. This paper extends this line of inquiry to hypergraphs, offering novel insights that are relevant to both theoretical and applied researchers.", "essential_references_not_discussed": "The paper provides a comprehensive overview of relevant works on HNNs and adversarial attacks on graph data. No critical gaps in the literature review were identified based on the provided context.", "other_strengths_and_weaknesses": "Strengths\nNovelty: The introduction of HyperNear as a node injection attack specifically designed for HNNs is a strong contribution.\nClear Motivation: The introduction effectively explains the research motivation. It contrasts traditional injection strategies with the paper’s core issue—achieving effective and stealthy attacks in hypergraphs. This sets a clear direction for the research.\nClear Mathematical Formulations: The paper rigorously defines its attack methodology and impact analysis.\nStrong Empirical Results: The experiments show that HyperNear is effective across multiple datasets and models.\nWeaknesses\n1.The diagram in Figure 4 is somewhat unclear. It would be helpful to provide more context or explanation in the caption to clarify what the classification results represent and how they support the paper’s claims about the attack's effectiveness. Additionally, improving the visual clarity (e.g., clearer legends, or annotated highlights) could make the figure more informative.\n2.Figures 1(a) and 1(b) could better illustrate how injected nodes integrate into the network through homophily, beyond just connections and attributes. This would highlight the role of homophily in stealthiness more clearly.\n3.The authors have conducted experiments on five datasets (Cora-CA, DBLP-CA, Citeseer, Cora, and Pubmed), which effectively demonstrate the potential of HyperNear. To further strengthen their findings, it might be beneficial to explore a more diverse range of datasets. This would help ensure that the method remains effective across different scenarios.", "other_comments_or_suggestions": "1.The font size in Table 1 could be increased to improve readability.", "questions_for_authors": "1.The paper states that hypergraphs' intricate dependencies can amplify the effects of small perturbations. Could you provide a more explicit quantitative measure or theoretical derivation to demonstrate this amplification effect?\n2.I'm curious why the theoretical analysis in the paper focuses primarily on homophily. Is this the only or the best measure to evaluate the impact of hypergraph attacks?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Ag5LvqcuOe", "reviewer": "Reviewer_wtog", "summary": "This paper focuses on the vulnerability of hypergraph neural networks (HNNs) to node injection attacks. The authors introduce HyperNear, a novel node injection attack method specifically designed for HNNs, which exploits the homophily property to improve stealthiness. Through extensive experiments, the study demonstrates the effectiveness of HyperNear in black-box scenarios, representing a significant advancement in the field of adversarial attacks on hypergraphs. The findings underscore critical implications for the security and robustness of hypergraph-based models, offering valuable insights for future research in this area.", "questions": "", "limitations": "", "rating": 5, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We sincerely appreciate your **comprehensive and positive evaluation** of our work, particularly your recognition of our **theoretical contributions, experimental rigor, and positioning within the broader adversarial attack literature on hypergraphs**. Your feedback reinforces the significance of our study and motivates future research in this area. Next I address your concerns point by point.\n\nWeakness 1: In our paper, we have already evaluated the homophily shift for the ''Random'' baseline to illustrate stealthiness. Additionally, Figure 8 **provides a comprehensive analysis of how other attack methods (NDA, FGA) affect homophily across different datasets (DBLP-CA, Cora, Pubmed, Citeseer)**. This effectively demonstrates the stealthiness variations among different attack strategies. Your suggestion is valuable, and we will consider adding a table with homophily change metrics for other methods in the revised manuscript.\n\nWeakness 2: To improve the clarity of performance comparisons, we have added a summary row to the table that presents the average performance drop for each attack method relative to the ''Clean'' baseline. This allows for a more intuitive comparison of the overall impact of HyperNear against other methods.\n\n| Victim Model       | Clean | Random | NDA  | FGA  | HyperNEAR | Clean | Random | NDA  | FGA  | HyperNEAR | Clean | Random | NDA  | FGA  | HyperNEAR | Clean | Random | NDA  | FGA  | HyperNEAR |\n|--------------------|-------|--------|------|------|-----------|-------|--------|------|------|-----------|-------|--------|------|------|-----------|-------|--------|------|------|-----------|\n| Methods      |       |        |      |      |           |       |        |      |      |           |       |        |      |      |           |       |        |      |      |           |\n| UniSAGE          | Clean | Random | NDA  | FGA  | HyperNEAR | Clean | Random | NDA  | FGA  | HyperNEAR | Clean | Random | NDA  | FGA  | HyperNEAR | Clean | Random | NDA  | FGA  | HyperNEAR |\n| Avg. Drop ↓ | -     | 0.13   | 2.59 | 2.53 | 14.82     | -     | 0.2    | 2.75 | 2.93 | 13.97     | -     | -0.18  | 2.65 | 0.65 | 8.13      | -     | -0.48  | 2.67 | 1.01 | 8.53      |\n\n\nSuggestion 1: Thank you for the suggestion to improve cross-referencing between the main text and the supplementary material. We will scrutinize our manuscript againto **ensure that the reader is clearly directed to the relevant supplemental chapters** that provide more detail. \n\nSuggestion 2: Yes. We will ensure consistent font styles across all figures for a more polished presentation.  \n\nSuggestion 3: We will increase the font size in the experimental figures to improve readability.  \n\nThank you again for recognizing this work and for your constructive comments.", "claims_and_evidence": "Yes, the claims made in the submission are supported by clear arguments and convincing results with detailed discussion.", "methods_and_evaluation_criteria": "Yes.", "theoretical_claims": "The paper provides a theoretical analysis on the impact of attacks on hypergraph topology and homophily, identifying two key findings: (1) Hypergraphs are highly sensitive to adversarial attacks due to their intricate interdependencies; (2) Naive attacks significantly disrupt homophily, which can be leveraged to design more subtle and effective attacks.", "experimental_designs_or_analyses": "The experiments are sound and substantiate the claims made in the theoretical analysis. The empirical results effectively showcase the impact of node injection attacks on the topology and homophily of hypergraphs.", "relation_to_broader_scientific_literature": "This paper fills a gap in research on adversarial attacks against HNNs. The authors effectively position their work within the broader literature by highlighting the unique challenges posed by higher-order dependencies in hypergraphs, which have been largely overlooked in prior research on adversarial attacks. The discussion of Finding 1 and Finding 2 provides a solid theoretical foundation that connects well with existing studies on graph-based adversarial attacks.", "essential_references_not_discussed": "The paper has covered the relevant related works necessary to understand its key contributions.", "other_strengths_and_weaknesses": "Strengths:\n1. The paper provides a compelling motivation for investigating node injection attacks on hypergraphs, emphasizing the unique challenges introduced by higher-order dependencies. This is an interesting and important piece of work.\n2. The paper is exceptionally well-organized, making it easy to follow. The motivation, methodology, theoretical analysis, and experiments are all presented in a coherent and logical manner.\n3. The experimental design is comprehensive, and the open-source code facilitates further research in the field.\n\nWeaknesses:\n1. The comparison methods lack evaluation of stealthiness.\n2. Where applicable, include summary rows or average performance rows to make it easier to compare the overall effectiveness of HyperNear against baselines.", "other_comments_or_suggestions": "1. Ensure that the main text references key sections of the supplementary material to guide readers through the additional content.\n2. Ensure consistent font styles across all figures. \n3. Increase the font size of the figures in the Experiments section.", "questions_for_authors": "See the weaknesses and the above comments.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: This paper studies the vulnerability of hypergraph neural networks (HNNs) to node injection attacks and proposes HyperNear, a node injection attack method specifically designed for HNNs, which exploits the homophily property to improve stealthiness. Four reviewers reviewed this paper but with diverse scores. After rebuttal and discussion, three reviewers are positive, and one reviewer is still negative. The reviewer who increased the score from negative to positive still has concerns about the theoretical or empirical explanation supporting why unnoticeability is particularly crucial for hypergraph attacks. Based on the above facts, the AC would treat this paper as a borderline paper. Considering this paper is claimed to be the first one to explore the adversarial attacks on hypergraph neural networks (HNNs), the AC leans acceptance. The reviewers' comments and the rebuttal are suggested to be taken into account in the final version if this paper is accepted.
Decision: Accept (poster)