mlsanityData to 14 Oct 2026

Backdoor Attacks to Graph Neural Networks

arXiv 2006.11165 ↗First posted 19 Jun 2020cs.CR cs.LGcited by 128

Not on the map. Why?

Cited by 23 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

In this work, we propose the first backdoor attack to graph neural networks (GNN). Specifically, we propose a subgraph based backdoor attack to GNN for graph classification. In our backdoor attack, a GNN classifier predicts an attacker-chosen target label for a testing graph once a predefined subgraph is injected to the testing graph. Our empirical results on three real-world graph datasets show that our backdoor attacks are effective with a small impact on a GNN's prediction accuracy for clean testing graphs. Moreover, we generalize a randomized smoothing based certified defense to defend against our backdoor attacks. Our empirical results show that the defense is effective in some cases but ineffective in other cases, highlighting the needs of new defenses for our backdoor attacks.

Key facts. Cited by 128 papers in the map (data through 14 Oct 2026). First posted on arXiv 19 Jun 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 25; 2022: 22; 2023: 22; 2024: 30; 2025: 21; 2026: 8.

128 papers.

Sort:

By area:

  1. 2024PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Modelscited by 267
  2. 2021A Comprehensive Survey on Graph Anomaly Detection with Deep Learningcited by 230
  3. 2021Graph Unlearningcited by 138
  4. 2021BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learningcited by 123
  5. 2022A Comprehensive Survey on Trustworthy Graph Neural Networks: Privacy, Robustness, Fairness, and Explainabilitycited by 118
  6. 2021ProtGNN: Towards Self-Explaining Graph Neural Networkscited by 96
  7. 2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoningcited by 94
  8. 2021Hidden Backdoors in Human-Centric Language Modelscited by 90
  9. 2022Trustworthy Graph Neural Networks: Aspects, Methods and Trendscited by 89
  10. 2021Node-Level Membership Inference Attacks Against Graph Neural Networkscited by 84
  11. 2021Membership Inference Attack on Graph Neural Networkscited by 81
  12. 2023A Comprehensive Survey on Deep Graph Representation Learningcited by 72
38 more
  1. 2022Black-box Dataset Ownership Verification via Backdoor Watermarkingcited by 65
  2. 2022Rickrolling the Artist: Injecting Backdoors into Text Encoders for Text-to-Image Synthesiscited by 59
  3. 2024A Survey of Graph Neural Networks in Real world: Imbalance, Noise, Privacy and OOD Challengescited by 54
  4. 2021Model Stealing Attacks Against Inductive Graph Neural Networkscited by 50
  5. 2023Unnoticeable Backdoor Attacks on Graph Neural Networkscited by 45
  6. 2021Explainability-based Backdoor Attacks Against Graph Neural Networkscited by 42
  7. 2022Rethinking the Reverse-engineering of Trojan Triggerscited by 39
  8. 2023Backdoor Defense via Deconfounded Representation Learningcited by 38
  9. 2021Towards Practical Deployment-Stage Backdoor Attack on Deep Neural Networkscited by 34
  10. 2021A Hard Label Black-box Adversarial Attack Against Graph Neural Networkscited by 26
  11. 2021Watermarking Graph Neural Networks based on Backdoor Attackscited by 25
  12. 2024Rethinking Graph Backdoor Attacks: A Distribution-Preserving Perspectivecited by 22
  13. 2023Backdoor Attacks Against Dataset Distillationcited by 21
  14. 2022Reinforcement learning on graphs: A surveycited by 20
  15. 2022A Survey of Trustworthy Graph Learning: Reliability, Explainability, and Privacy Protectioncited by 20
  16. 2022Transferable Graph Backdoor Attackcited by 19
  17. 2022Motif-Backdoor: Rethinking the Backdoor Attack on Graph Neural Networks via Motifscited by 19
  18. 2023Data and Model Poisoning Backdoor Attacks on Wireless Federated Learning, and the Defense Mechanisms: A Comprehensive Surveycited by 18
  19. 2022A Survey of Neural Trojan Attacks and Defenses in Deep Learningcited by 17
  20. 2025Goal-oriented Backdoor Attack against Vision-Language-Action Models via Physical Objectscited by 17
  21. 2021Teacher Model Fingerprinting Attacks Against Transfer Learningcited by 16
  22. 2022Private Graph Extraction via Feature Explanationscited by 16
  23. 2022More is Better (Mostly): On the Backdoor Attacks in Federated Graph Neural Networkscited by 15
  24. 2022Projective Ranking-based GNN Evasion Attackscited by 14
  25. 2024Cross-Context Backdoor Attacks against Graph Prompt Learningcited by 14
  26. 2022Recent Advances in Reliable Deep Graph Learning: Inherent Noise, Distribution Shift, and Adversarial Attackcited by 10
  27. 2022Link-Backdoor: Backdoor Attack on Link Prediction via Node Injectioncited by 10
  28. 2023An Equivariant Generative Framework for Molecular Graph-Structure Co-Designcited by 10
  29. 2023A clean-label graph backdoor attack method in node classification taskcited by 10
  30. 2021Check Your Other Door! Creating Backdoor Attacks in the Frequency Domaincited by 9
  31. 2021Safe Distillation Boxcited by 9
  32. 2022Bandits for Structure Perturbation-based Black-box Attacks to Graph Neural Networks with Theoretical Guaranteescited by 9
  33. 2022Defending Against Backdoor Attack on Graph Nerual Network by Explainabilitycited by 9
  34. 2023From Trojan Horses to Castle Walls: Unveiling Bilateral Data Poisoning Effects in Diffusion Modelscited by 9
  35. 2021GraphAttacker: A General Multi-Task GraphAttack Frameworkcited by 8
  36. 2023A semantic backdoor attack against Graph Convolutional Networkscited by 8
  37. 2023GraphGuard: Detecting and Counteracting Training Data Misuse in Graph Neural Networkscited by 8
  38. 2024GDeR: Safeguarding Efficiency, Balancing, and Robustness via Prototypical Graph Pruningcited by 8

50 most cited of 128 All 128 (JSON)