Attack by Yourself: Effective and Unnoticeable Multi-Category Graph Backdoor Attacks with Subgraph Triggers Pool
Jiangtong Li, Dungy Liu, Dawei Cheng, Changchun Jiang
TL;DR
This work tackles the challenge of multi-category backdoor attacks on graph neural networks for node classification by introducing EUMC, a framework that leverages a Multi-Category Subgraph Triggers Pool (MC-STP) derived from the attacked graph. It uses Attachment Probability Shift (APS) to select influential subgraphs and a 'select then attach' strategy to preserve unnoticeability while enabling category-aware misclassification through a bi-level optimization with a surrogate GCN. The method demonstrates strong attack success across six real-world datasets and multiple defenses, outperforming prior single-category trigger approaches and showing robustness across GNN architectures. The findings highlight a scalable, category-aware poisoning strategy that preserves graph statistics while achieving targeted, multifaceted backdoor effects with practical implications for GNN security research.
Abstract
\textbf{G}raph \textbf{N}eural \textbf{N}etworks~(GNNs) have achieved significant success in various real-world applications, including social networks, finance systems, and traffic management. Recent researches highlight their vulnerability to backdoor attacks in node classification, where GNNs trained on a poisoned graph misclassify a test node only when specific triggers are attached. These studies typically focus on single attack categories and use adaptive trigger generators to create node-specific triggers. However, adaptive trigger generators typically have a simple structure, limited parameters, and lack category-aware graph knowledge, which makes them struggle to handle backdoor attacks across multiple categories as the number of target categories increases. We address this gap by proposing a novel approach for \textbf{E}ffective and \textbf{U}nnoticeable \textbf{M}ulti-\textbf{C}ategory~(EUMC) graph backdoor attacks, leveraging subgraph from the attacked graph as category-aware triggers to precisely control the target category. To ensure the effectiveness of our method, we construct a \textbf{M}ulti-\textbf{C}ategory \textbf{S}ubgraph \textbf{T}riggers \textbf{P}ool~(MC-STP) using the subgraphs of the attacked graph as triggers. We then exploit the attachment probability shifts of each subgraph trigger as category-aware priors for target category determination. Moreover, we develop a ``select then attach'' strategy that connects suitable category-aware trigger to attacked nodes for unnoticeability. Extensive experiments across different real-world datasets confirm the efficacy of our method in conducting multi-category graph backdoor attacks on various GNN models and defense strategies.