# Dyn-Backdoor: Backdoor Attack on Dynamic Link Prediction

arXiv: https://arxiv.org/abs/2110.03875 · HTML: https://mlsanity.com/paper/2110.03875/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- Builds on 20 of its 55 references that are in the map.
- First posted on arXiv 8 Oct 2021.

## Builds on (most cited first, 20 of 20)

- [node2vec: Scalable Feature Learning for Networks](https://mlsanity.com/paper/1607.00653/) (2016)
- [DeepWalk: Online Learning of Social Representations](https://mlsanity.com/paper/1403.6652/) (2014)
- [EvolveGCN: Evolving Graph Convolutional Networks for Dynamic Graphs](https://mlsanity.com/paper/1902.10191/) (2019)
- [Backdoor Attacks to Graph Neural Networks](https://mlsanity.com/paper/2006.11165/) (2020)
- [Graph Backdoor](https://mlsanity.com/paper/2006.11890/) (2020)
- [DynGEM: Deep Embedding Method for Dynamic Graphs](https://mlsanity.com/paper/1805.11273/) (2018)
- [dyngraph2vec: Capturing Network Dynamics using Dynamic Graph Representation Learning](https://mlsanity.com/paper/1809.02657/) (2018)
- [GC-LSTM: Graph Convolution Embedded LSTM for Dynamic Link Prediction](https://mlsanity.com/paper/1812.04206/) (2018)
- [Explainability-based Backdoor Attacks Against Graph Neural Networks](https://mlsanity.com/paper/2104.03674/) (2021)
- [GCN-GAN: A Non-linear Temporal Link Prediction Model for Weighted Dynamic Networks](https://mlsanity.com/paper/1901.09165/) (2019)
- [Attributed Network Embedding for Learning in a Dynamic Environment](https://mlsanity.com/paper/1706.01860/) (2017)
- [E-LSTM-D: A Deep Learning Framework for Dynamic Network Link Prediction](https://mlsanity.com/paper/1902.08329/) (2019)
- [TIMERS: Error-Bounded SVD Restart on Dynamic Networks](https://mlsanity.com/paper/1711.09541/) (2017)
- [Indirect Adversarial Attacks via Poisoning Neighbors for Graph Convolutional Networks](https://mlsanity.com/paper/2002.08012/) (2020)
- [K-Core based Temporal Graph Convolutional Network for Dynamic Graphs](https://mlsanity.com/paper/2003.09902/) (2020)
- [Time-aware Gradient Attack on Dynamic Network Link Prediction](https://mlsanity.com/paper/1911.10561/) (2019)
- [Reinforcement Learning-based Black-Box Evasion Attacks to Link Prediction in Dynamic Graphs](https://mlsanity.com/paper/2009.00163/) (2020)
- [Optimizing Pinning Control of Complex Dynamical Networks Based on Spectral Properties of Grounded Laplacian Matrices](https://mlsanity.com/paper/1804.10818/) (2018)
- [Belief Dynamics in Social Networks: A Fluid-Based Analysis](https://mlsanity.com/paper/1710.00530/) (2017)
- [On the Complexity of Minimum-Cost Networked Estimation of Self-Damped Dynamical Systems](https://mlsanity.com/paper/1911.11381/) (2019)

## Built on by (most cited first, 4 of 4)

- [Dynamic Graph Unlearning: A General and Efficient Post-Processing Method via Gradient Transformation](https://mlsanity.com/paper/2405.14407/) (2024)
- [GENIE: Watermarking Graph Neural Networks for Link Prediction](https://mlsanity.com/paper/2406.04805/) (2024)
- [Effective backdoor attack on graph neural networks in link prediction tasks](https://mlsanity.com/paper/2401.02663/) (2024)
- [Trapping Attacker in Dilemma: Examining Internal Correlations and External Influences of Trigger for Defending GNN Backdoors](https://mlsanity.com/paper/2605.08278/) (2026)

## Abstract (arXiv)

Dynamic link prediction (DLP) makes graph prediction based on historical information. Since most DLP methods are highly dependent on the training data to achieve satisfying prediction performance, the quality of the training data is crucial. Backdoor attacks induce the DLP methods to make wrong prediction by the malicious training data, i.e., generating a subgraph sequence as the trigger and embedding it to the training data. However, the vulnerability of DLP toward backdoor attacks has not been studied yet. To address the issue, we propose a novel backdoor attack framework on DLP, denoted as Dyn-Backdoor. Specifically, Dyn-Backdoor generates diverse initial-triggers by a generative adversarial network (GAN). Then partial links of the initial-triggers are selected to form a trigger set, according to the gradient information of the attack discriminator in the GAN, so as to reduce the size of triggers and improve the concealment of the attack. Experimental results show that Dyn-Backdoor launches successful backdoor attacks on the state-of-the-art DLP models with success rate more than 90%. Additionally, we conduct a possible defense against Dyn-Backdoor to testify its resistance in defensive settings, highlighting the needs of defenses for backdoor attacks on DLP.