# Structural Adversarial Attacks on Relational Deep Learning under Integrity Constraints Source: [Structural Adversarial Attacks on Relational Deep Learning under Integrity Constraints]() Collection index: [llms.txt]() Data updated: 2026-07-10T05:00:01.278Z Authors: Alan Gany, Bogdan Cautis, Silviu Maniu Published: 2026-07-08T07:23:09.000Z ## Abstract Relational Deep Learning (RDL) has become a standard methodology for machine learning on relational databases: the database is encoded as a heterogeneous temporal graph in which tuples become nodes and primary-key to foreign-key (PK-FK) dependencies become typed edges, over which a graph neural network is trained for downstream prediction. We study the adversarial robustness of this pipeline. We consider a white-box attacker who knows how the graph is built and the model is trained, reasons about perturbations on the graph, but can only act on the upstream database, by rewiring foreign-key references while preserving the integrity constraints of the schema (foreign-key validity, the degree-one FK constraint, and functional dependencies). This restricts the attacker to a constrained, combinatorial set of admissible edits under a global perturbation budget, which is intractable to explore exhaustively and made non-additive by GNN message passing. We investigate seven attack heuristics - two random sampling baselines and five gradient-guided variants that exploit differentiable edge masks - and evaluate them on the RelBench rel-f1 benchmark. Gradient-based attacks consistently outperform random baselines on regression tasks, whereas gains on classification are smaller, which we attribute to low label-flip rates and greater local stability of classification outputs. ## Recorded benchmark results A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. - [Driver-Top3 Classification on rel-f1 (Attacked)](): driver-top3 classification; rel-f1; Attacked Accuracy: 77.63. - [Driver-DNF Classification on rel-f1](): driver-dnf classification; rel-f1; Attacked Accuracy: 0.7737. - [Attacked Driver Position Regression on rel-f1](): driver-position regression; rel-f1; Attacked MAE: 3.1527. - [Qualifying Position Regression on rel-f1](): qualifying-position regression; rel-f1; Attacked MAE: 0.9949. ## Original sources and implementation [Original paper]() [PDF]()