DMGNN: Detecting and Mitigating Backdoor Attacks in Graph Neural Networks

TL;DR

DMGNN is proposed against OOD and ID graph backdoor attacks that can powerfully eliminate stealthiness to guarantee defense effectiveness and improve the model performance and presents a reverse sampling pruning method to screen and discard the triggers directly on the data level.

Abstract

Recent studies have revealed that GNNs are highly susceptible to multiple adversarial attacks. Among these, graph backdoor attacks pose one of the most prominent threats, where attackers cause models to misclassify by learning the backdoored features with injected triggers and modified target labels during the training phase. Based on the features of the triggers, these attacks can be categorized into out-of-distribution (OOD) and in-distribution (ID) graph backdoor attacks, triggers with notable differences from the clean sample feature distributions constitute OOD backdoor attacks, whereas the triggers in ID backdoor attacks are nearly identical to the clean sample feature distributions. Existing methods can successfully defend against OOD backdoor attacks by comparing the feature distribution of triggers and clean samples but fail to mitigate stealthy ID backdoor attacks. Due to the lack of proper supervision signals, the main task accuracy is negatively affected in defending against ID backdoor attacks. To bridge this gap, we propose DMGNN against OOD and ID graph backdoor attacks that can powerfully eliminate stealthiness to guarantee defense effectiveness and improve the model performance. Specifically, DMGNN can easily identify the hidden ID and OOD triggers via predicting label transitions based on counterfactual explanation. To further filter the diversity of generated explainable graphs and erase the influence of the trigger features, we present a reverse sampling pruning method to screen and discard the triggers directly on the data level. Extensive experimental evaluations on open graph datasets demonstrate that DMGNN far outperforms the state-of-the-art (SOTA) defense methods, reducing the attack success rate to 5% with almost negligible degradation in model performance (within 3.5%).

Figures (8)

• Figure 1: Feature distribution in OOD and ID backdoor attacks.
• Figure 2: The overview of DMGNN. In Stage 1, identify the hidden ID or OOD triggers by diffusion and denoising processes. Stage 2, further eliminate triggers via reverse sampling pruning in the data level.
• Figure 3: Impacts of the different proportions of backdoored samples against three attacks on the Cora dataset.
• Figure 4: Ablation analysis against DPGBA attack on four real-world datasets.
• Figure 5: Impacts of the different proportions of backdoored samples against three attacks on the Cora dataset.