[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-84178-en":3,"doc-seo-84178-105":29,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":13,"seo_description":14,"update_tm":27,"read_time":28},84178,1374391974468,"Eden","https://ap-avatar.wpscdn.com/davatar_29158cc5080c5b710cf443261637dec0",8,"Research & Report","Structural Adversarial Attacks on Relational Deep Learning under Integrity Constraints","Relational Deep Learning (RDL) encodes relational databases as heterogeneous temporal graphs, linking tuples via PK–FK dependencies and training graph neural networks for downstream prediction. This work studies white-box adversarial robustness when the attacker can only edit the upstream database by rewiring foreign-key references while preserving schema integrity constraints. The resulting search space is constrained, combinatorial, and non-additive due to GNN message passing. Seven heuristics are evaluated on RelBench rel-f1, with gradient-guided attacks consistently beating random baselines for regression, while classification improvements remain limited.","Structural Adversarial Attacks on Relational Deep Learning under  \nIntegrity Constraints  \nAlan Gany  \nUniv. Grenoble Alpes, CNRS, Grenoble INP, LIG Grenoble, France  \n[alan.gany@univ-grenoble-alpes.fr](alan.gany@univ-grenoble-alpes.fr)  \nBogdan Cautis Singapore Institute of Technology  \nSingapore [bogdan.cautis@singaporetech.edu.sg](bogdan.cautis@singaporetech.edu.sg)  \nSilviu Maniu  \nUniv. Grenoble Alpes, CNRS, Grenoble INP, LIG Grenoble, France  \n[silviu.maniu@univ-grenoble-alpes.fr](silviu.maniu@univ-grenoble-alpes.fr)  \narXiv :2607 .07089v 1 [ cs .LG] 8 Jul 2026  \nABSTRACT  \nRelational Deep Learning (RDL) has become a standard methodology for machine learning on relational databases: the database is encoded as a heterogeneous temporal graph in which tuples become nodes and primary-key to foreign-key (PK–FK) dependencies become typed edges, over which a graph neural network is trained for downstream prediction. We study the adversarial robustness of this pipeline. We consider a white-box attacker who knows how the graph is built and the model is trained, reasons about perturbations on the graph, but can only act on the upstream database – by rewiring foreign-key references while preserving the integrity constraints of the schema (foreign-key validity, the degree-one FK constraint, and functional dependencies) . This restricts the attacker to a constrained, combinatorial set of admissible edits under a global perturbation budget, which is intractable to explore exhaustively and made non-additive by GNN message passing. We investigate seven attack heuristics – two random sampling baselines and five gradient-guided variants that exploit differentiable edge masks – and evaluate them on the RelBench rel-f1 benchmark. Gradient-based attacks consistently outperform random baselines on regression tasks, whereas gains on classification are smaller, which we attribute to low label-flip rates and greater local stability of classification outputs.  \nVLDB Workshop Reference Format:  \nAlan Gany, Bogdan Cautis, and Silviu Maniu. Structural Adversarial Attacks on Relational Deep Learning under Integrity Constraints. VLDB 2026 Workshop: Applied AI for Database Systems and Applications (AIDB) .  \nVLDB Workshop Artifact Availability:  \nThe source code, data, and/or other artifacts have been made available at [https://github.com/alanganyDB/Structural-Adversarial-Attacks-on-Relational](https://github.com/alanganyDB/Structural-Adversarial-Attacks-on-Relational)Deep-Learning-under-Integrity-Constraints.git.  \n1 INTRODUCTION  \nDeep neural networks achieve strong predictive performance across many domains, yet they remain fragile: small, carefully crafted perturbations of their inputs can drastically alter their predictions, exposing these systems to malicious manipulation. Adversarial attacks, and in particular gradient-based ones, have been demonstrated on a wide range of data structures, including images, tabular data, graphs, and knowledge graphs. Attacks on dense inputs such as images are comparatively easy to formulate, whereas attacks on  \nThis work is licensed under the Creative Commons BY-NC-ND 4.0 International License. Visit [https://creativecommons.org/licenses/by-nc-nd/4.0/ to view a copy of](https://creativecommons.org/licenses/by-nc-nd/4.0/ to view a copy of)[ ](https://creativecommons.org/licenses/by-nc-nd/4.0/ to view a copy of)this license.  \nsparse, discrete structures are substantially harder because of their combinatorial nature; gradient-based methods nonetheless remain effective in these settings.  \nRelational databases store large volumes of structured, highvalue information, which makes them attractive targets. They have, however, remained largely outside the scope of adversarial machine learning, simply because few learning methods operated directly on relational data. Relational Deep Learning (RDL) changes this picture [10, 11, 20] . RDL encodes a multi-table database as a heterogeneous temporal graph in which each tuple","cbCaijXep43Y8PZZ","https://ap.wps.com/l/cbCaijXep43Y8PZZ","pdf",610039,1,10,"English","en",105,"# Abstract\n# Introduction\n# Threat Model and Attack Setting\n# Attack Directions: Feature vs Structural\n# Integrity-Constrained Structural Perturbations\n# Attack Heuristics and Evaluation","[{\"question\":\"What is the pipeline studied in this document?\",\"answer\":\"The document studies Relational Deep Learning (RDL), which encodes a relational database as a heterogeneous temporal graph (tuples as nodes and PK–FK dependencies as typed edges) and trains a graph neural network for prediction.\"},{\"question\":\"What operations can the attacker perform under the described threat model?\",\"answer\":\"The attacker is white-box and knows the graph construction and model training, but can only edit the upstream database. Perturbations are expressed as rewiring foreign-key references while preserving schema integrity constraints such as foreign-key validity and functional dependencies.\"},{\"question\":\"How do gradient-guided attacks compare with random baselines on RelBench?\",\"answer\":\"Gradient-based attacks outperform random sampling baselines on regression tasks. Gains for classification are smaller, attributed to low label-flip rates and greater local stability of classification outputs.\"}]",1784193670,25,{"code":4,"msg":30,"data":31},"ok",{"site_id":24,"language":23,"slug":32,"title":13,"keywords":33,"description":14,"schema_data":34,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":27},"structural-adversarial-attacks-on-relational-deep-learning-under-integrity-constraints","",{"@graph":35,"@context":85},[36,53,68],{"@type":37,"itemListElement":38},"BreadcrumbList",[39,43,47,50],{"item":40,"name":41,"@type":42,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":44,"name":45,"@type":42,"position":46},"https://docshare.wps.com/document/","Document",2,{"item":48,"name":12,"@type":42,"position":49},"https://docshare.wps.com/document/research-report/",3,{"item":51,"name":13,"@type":42,"position":52},"https://docshare.wps.com/document/structural-adversarial-attacks-on-relational-deep-learning-under-integrity-constraints/84178/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":23,"description":14,"dateModified":61,"datePublished":62,"encodingFormat":60,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":40,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-17","2026-07-16",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"What is the pipeline studied in this document?","Question",{"text":75,"@type":76},"The document studies Relational Deep Learning (RDL), which encodes a relational database as a heterogeneous temporal graph (tuples as nodes and PK–FK dependencies as typed edges) and trains a graph neural network for prediction.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"What operations can the attacker perform under the described threat model?",{"text":80,"@type":76},"The attacker is white-box and knows the graph construction and model training, but can only edit the upstream database. Perturbations are expressed as rewiring foreign-key references while preserving schema integrity constraints such as foreign-key validity and functional dependencies.",{"name":82,"@type":73,"acceptedAnswer":83},"How do gradient-guided attacks compare with random baselines on RelBench?",{"text":84,"@type":76},"Gradient-based attacks outperform random sampling baselines on regression tasks. Gains for classification are smaller, attributed to low label-flip rates and greater local stability of classification outputs.","https://schema.org",{"og:url":51,"og:type":87,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":89,"canonical":51},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,123,128,131,134],{"id":20,"doc_module":4,"doc_module_name":45,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":46,"doc_module":4,"doc_module_name":45,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":45,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":45,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":45,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":45,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":45,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":124,"doc_module":4,"doc_module_name":45,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":45,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":21,"doc_module":4,"doc_module_name":45,"category_name":132,"show_sort_weight":21,"slug":133},"Lifestyle","lifestyle",{"id":135,"doc_module":4,"doc_module_name":45,"category_name":136,"show_sort_weight":106,"slug":137},19,"General","general"]