Stealthy Dual-Trigger Backdoors: Attacking Prompt Tuning in LM-Empowered Graph Foundation Models

TL;DR

This work analyzes security vulnerabilities in language model-empowered graph foundation models during the prompt-tuning phase, where prompts are externally sourced and can be weaponized. It introduces DTGBA, a novel dual-trigger backdoor framework that combines text-level perturbations generated by large language models with struct-level graph triggers, augmented by a text pool to maintain realism. Through bi-level optimization and extensive experiments on GraphCLIP across multiple datasets, DTGBA achieves high attack effectiveness while preserving clean accuracy, and demonstrates persistence against defenses and transferability to other GFMs. The results reveal significant privacy and security risks in open-source LM-GFM ecosystems, underscoring the need for robust supervision and defense mechanisms for prompt-tuning pipelines and text-attributed graph applications.

Abstract

The emergence of graph foundation models (GFMs), particularly those incorporating language models (LMs), has revolutionized graph learning and demonstrated remarkable performance on text-attributed graphs (TAGs). However, compared to traditional GNNs, these LM-empowered GFMs introduce unique security vulnerabilities during the unsecured prompt tuning phase that remain understudied in current research. Through empirical investigation, we reveal a significant performance degradation in traditional graph backdoor attacks when operating in attribute-inaccessible constrained TAG systems without explicit trigger node attribute optimization. To address this, we propose a novel dual-trigger backdoor attack framework that operates at both text-level and struct-level, enabling effective attacks without explicit optimization of trigger node text attributes through the strategic utilization of a pre-established text pool. Extensive experimental evaluations demonstrate that our attack maintains superior clean accuracy while achieving outstanding attack success rates, including scenarios with highly concealed single-trigger nodes. Our work highlights critical backdoor risks in web-deployed LM-empowered GFMs and contributes to the development of more robust supervision mechanisms for open-source platforms in the era of foundation models.

Figures (5)

• Figure 1: Attack Scenario (a) and DTGBA Framework (b).
• Figure 2: Shot Number Sensitive Results.
• Figure 3: Results (ASR+CA %) of the ablation study with $|\mathcal{N}^\Delta|=3$ in (a) and (b), and $|\mathcal{N}^\Delta|=1$ in (c) and (d), conducted on Cora ((a) and (c)) and CiteSeer ((b) and (d)).
• Figure 4: Relationship between LM ASR and CA/ASR on Cora (a) and CiteSeer (b). The size of the circle represents the variance.
• Figure 5: Baseline Attacks Result(CA% and ASR%) on GraphCLIP on Cora(a) and Citeseer(b) under 5-shot. w attr represents trigger generator is able to optimize the attribute of trigger nodes, while w/o attr represents not changing the attribute of trigger nodes but with structure-alone triggers. The black dashed line represents the accuracy of the model without attack.