Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Adaptive Backdoor Attacks with Reasonable Constraints on Graph Neural Networks

Xuewen Dong, Jiachen Li, Shujun Li, Zhichao You, Qiang Qu, Yaroslav Kholodov, Yulong Shen

TL;DR

ABARC addresses backdoor vulnerabilities in graph neural networks by introducing adaptive triggers with reasonable constraints for graph-level and node-level tasks. It combines a topology-free subgraph trigger and feature-based modification with an adaptive edge-pruning mechanism to sustain a high attack success rate while maintaining evasiveness. Across multiple datasets and models, ABARC achieves ASR above $0.94$ with CAD typically below a few percent, and remains effective under defenses like RS and NC. This work highlights security risks in GNNs and points to future directions in constraint-aware defenses and broader graph settings.

Abstract

Recent studies show that graph neural networks (GNNs) are vulnerable to backdoor attacks. Existing backdoor attacks against GNNs use fixed-pattern triggers and lack reasonable trigger constraints, overlooking individual graph characteristics and rendering insufficient evasiveness. To tackle the above issues, we propose ABARC, the first Adaptive Backdoor Attack with Reasonable Constraints, applying to both graph-level and node-level tasks in GNNs. For graph-level tasks, we propose a subgraph backdoor attack independent of the graph's topology. It dynamically selects trigger nodes for each target graph and modifies node features with constraints based on graph similarity, feature range, and feature type. For node-level tasks, our attack begins with an analysis of node features, followed by selecting and modifying trigger features, which are then constrained by node similarity, feature range, and feature type. Furthermore, an adaptive edge-pruning mechanism is designed to reduce the impact of neighbors on target nodes, ensuring a high attack success rate (ASR). Experimental results show that even with reasonable constraints for attack evasiveness, our attack achieves a high ASR while incurring a marginal clean accuracy drop (CAD). When combined with the state-of-the-art defense randomized smoothing (RS) method, our attack maintains an ASR over 94%, surpassing existing attacks by more than 7%.

Adaptive Backdoor Attacks with Reasonable Constraints on Graph Neural Networks

TL;DR

ABARC addresses backdoor vulnerabilities in graph neural networks by introducing adaptive triggers with reasonable constraints for graph-level and node-level tasks. It combines a topology-free subgraph trigger and feature-based modification with an adaptive edge-pruning mechanism to sustain a high attack success rate while maintaining evasiveness. Across multiple datasets and models, ABARC achieves ASR above with CAD typically below a few percent, and remains effective under defenses like RS and NC. This work highlights security risks in GNNs and points to future directions in constraint-aware defenses and broader graph settings.

Abstract

Recent studies show that graph neural networks (GNNs) are vulnerable to backdoor attacks. Existing backdoor attacks against GNNs use fixed-pattern triggers and lack reasonable trigger constraints, overlooking individual graph characteristics and rendering insufficient evasiveness. To tackle the above issues, we propose ABARC, the first Adaptive Backdoor Attack with Reasonable Constraints, applying to both graph-level and node-level tasks in GNNs. For graph-level tasks, we propose a subgraph backdoor attack independent of the graph's topology. It dynamically selects trigger nodes for each target graph and modifies node features with constraints based on graph similarity, feature range, and feature type. For node-level tasks, our attack begins with an analysis of node features, followed by selecting and modifying trigger features, which are then constrained by node similarity, feature range, and feature type. Furthermore, an adaptive edge-pruning mechanism is designed to reduce the impact of neighbors on target nodes, ensuring a high attack success rate (ASR). Experimental results show that even with reasonable constraints for attack evasiveness, our attack achieves a high ASR while incurring a marginal clean accuracy drop (CAD). When combined with the state-of-the-art defense randomized smoothing (RS) method, our attack maintains an ASR over 94%, surpassing existing attacks by more than 7%.

Paper Structure

This paper contains 32 sections, 25 equations, 14 figures, 4 tables, 2 algorithms.

Table of Contents

  1. Introduction
  2. Related Work
  3. Advanced GNNs and Graph Learning
  4. Backdoor attacks against GNNs
  5. Preliminary
  6. Graph Neural Networks
  7. Backdoor Attacks
  8. Threat Model
  9. Adaptive Graph-level Backdoor Attack
  10. Attack Analysis
  11. Attack Overview
  12. Proportional Random Node Selection
  13. Feature-based Trigger
  14. Constraints
  15. An Illustrative Example
  16. ...and 17 more sections

Figures (14)

  • Figure 1: The process of the backdoor attacks on GNNs.
  • Figure 2: The framework of our adaptive graph-level trigger generation method.
  • Figure 3: An example of our subgraph trigger generation.
  • Figure 4: The framework of our adaptive node-level trigger generation method.
  • Figure 5: An example of our node trigger generation.
  • ...and 9 more figures