Stealthy graph backdoor attack based on feature trigger
Abstract Recent studies have shown that Graph Neural Networks (GNNs) are vulnerable to backdoor attacks. Embedding malicious triggers (e.g., subgraphs or features) in the graph leads to erroneous outputs. Most graph backdoor attacks focus only on the effectiveness of the attack and ignore stealth, w...
Saved in:
| Main Authors: | , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Springer
2025-06-01
|
| Series: | Complex & Intelligent Systems |
| Subjects: | |
| Online Access: | https://doi.org/10.1007/s40747-025-01934-5 |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1849388667150270464 |
|---|---|
| author | Yang Chen Zhou Bin Haixing Zhao |
| author_facet | Yang Chen Zhou Bin Haixing Zhao |
| author_sort | Yang Chen |
| collection | DOAJ |
| description | Abstract Recent studies have shown that Graph Neural Networks (GNNs) are vulnerable to backdoor attacks. Embedding malicious triggers (e.g., subgraphs or features) in the graph leads to erroneous outputs. Most graph backdoor attacks focus only on the effectiveness of the attack and ignore stealth, which can easily be detected by defense models leading to attack failure. To solve this problem, we propose a novel graph Backdoor Attack based on Feature Trigger (BAFT). Specifically, BAFT contains two modules: (1). trigger generation and embedding, (2). graph structure reconstruction and optimization. To enhance the stealthiness of the trigger, we use statistical sampling of the target label node features and select the features with the number of occurrences as the trigger. We use the node feature encoding of poisoned graphs as an approximate solution to the Singular Value Decomposition (SVD) for graph reconstruction. This approach effectively removes useless or harmful edges, thereby enhancing the homogeneity of the nodes. Then, BAFT uses optimization constraints to ensure the invisibility of the attack. The effectiveness of our proposed model is demonstrated with extensive experimental results in a node classification task. In Polblogs, Cora and Citeseer, BAFT achieves the highest attack success rate of 83.19 $$\%$$ % , 88.95 $$\%$$ % and 87.11 $$\%$$ % , respectively. At the same time, BAFT does not affect the classification accuracy of GNNs at clean nodes. |
| format | Article |
| id | doaj-art-929a72105d66418382dffddc0cc6a566 |
| institution | Kabale University |
| issn | 2199-4536 2198-6053 |
| language | English |
| publishDate | 2025-06-01 |
| publisher | Springer |
| record_format | Article |
| series | Complex & Intelligent Systems |
| spelling | doaj-art-929a72105d66418382dffddc0cc6a5662025-08-20T03:42:11ZengSpringerComplex & Intelligent Systems2199-45362198-60532025-06-0111811510.1007/s40747-025-01934-5Stealthy graph backdoor attack based on feature triggerYang Chen0Zhou Bin1Haixing Zhao2School of Computer Science and Technology, Shandong Technology and Business UniversitySchool of Computer Science, Qinghai Normal UniversitySchool of Computer Science, Qinghai Normal UniversityAbstract Recent studies have shown that Graph Neural Networks (GNNs) are vulnerable to backdoor attacks. Embedding malicious triggers (e.g., subgraphs or features) in the graph leads to erroneous outputs. Most graph backdoor attacks focus only on the effectiveness of the attack and ignore stealth, which can easily be detected by defense models leading to attack failure. To solve this problem, we propose a novel graph Backdoor Attack based on Feature Trigger (BAFT). Specifically, BAFT contains two modules: (1). trigger generation and embedding, (2). graph structure reconstruction and optimization. To enhance the stealthiness of the trigger, we use statistical sampling of the target label node features and select the features with the number of occurrences as the trigger. We use the node feature encoding of poisoned graphs as an approximate solution to the Singular Value Decomposition (SVD) for graph reconstruction. This approach effectively removes useless or harmful edges, thereby enhancing the homogeneity of the nodes. Then, BAFT uses optimization constraints to ensure the invisibility of the attack. The effectiveness of our proposed model is demonstrated with extensive experimental results in a node classification task. In Polblogs, Cora and Citeseer, BAFT achieves the highest attack success rate of 83.19 $$\%$$ % , 88.95 $$\%$$ % and 87.11 $$\%$$ % , respectively. At the same time, BAFT does not affect the classification accuracy of GNNs at clean nodes.https://doi.org/10.1007/s40747-025-01934-5Graph neural networksBackdoor attackFeature triggerNode classification task |
| spellingShingle | Yang Chen Zhou Bin Haixing Zhao Stealthy graph backdoor attack based on feature trigger Complex & Intelligent Systems Graph neural networks Backdoor attack Feature trigger Node classification task |
| title | Stealthy graph backdoor attack based on feature trigger |
| title_full | Stealthy graph backdoor attack based on feature trigger |
| title_fullStr | Stealthy graph backdoor attack based on feature trigger |
| title_full_unstemmed | Stealthy graph backdoor attack based on feature trigger |
| title_short | Stealthy graph backdoor attack based on feature trigger |
| title_sort | stealthy graph backdoor attack based on feature trigger |
| topic | Graph neural networks Backdoor attack Feature trigger Node classification task |
| url | https://doi.org/10.1007/s40747-025-01934-5 |
| work_keys_str_mv | AT yangchen stealthygraphbackdoorattackbasedonfeaturetrigger AT zhoubin stealthygraphbackdoorattackbasedonfeaturetrigger AT haixingzhao stealthygraphbackdoorattackbasedonfeaturetrigger |