mlsanityData to 7 Oct 2026

Neighboring Backdoor Attacks on Graph Convolutional Network

arXiv 2201.06202 ↗First posted 17 Jan 2022cs.AIcited by 7

Not on the map. Why?

Abstract (arXiv)

Backdoor attacks have been widely studied to hide the misclassification rules in the normal models, which are only activated when the model is aware of the specific inputs (i.e., the trigger). However, despite their success in the conventional Euclidean space, there are few studies of backdoor attacks on graph structured data. In this paper, we propose a new type of backdoor which is specific to graph data, called neighboring backdoor. Considering the discreteness of graph data, how to effectively design the triggers while retaining the model accuracy on the original task is the major challenge. To address such a challenge, we set the trigger as a single node, and the backdoor is activated when the trigger node is connected to the target node. To preserve the model accuracy, the model parameters are not allowed to be modified. Thus, when the trigger node is not connected, the model performs normally. Under these settings, in this work, we focus on generating the features of the trigger node. Two types of backdoors are proposed: (1) Linear Graph Convolution Backdoor which finds an approximation solution for the feature generation (can be viewed as an integer programming problem) by looking at the linear part of GCNs. (2) Variants of existing graph attacks. We extend current gradient-based attack methods to our backdoor attack scenario. Extensive experiments on two social networks and two citation networks datasets demonstrate that all proposed backdoors can achieve an almost 100% attack success rate while having no impact on predictive accuracy.

Key facts. Cited by 7 papers in the map (data through 7 Oct 2026). Builds on 31 of its 46 references that are in the map. First posted on arXiv 17 Jan 2022.

Builds on

31 of 46 references.

References · 31

  1. 2016Semi-Supervised Classification with Graph Convolutional Networkscited by 11,282
  2. 2017Graph Attention Networkscited by 8,854
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  5. 2017Inductive Representation Learning on Large Graphscited by 6,284
  6. 2020LightGCN: Simplifying and Powering Graph Convolution Network for Recommendationcited by 1,134
  7. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  8. 2019Neural Graph Collaborative Filteringcited by 660
  9. 2018Spectral Signatures in Backdoor Attackscited by 457
  10. 2020Backdoor Learning: A Surveycited by 412
  11. 2018Adversarial Attacks on Neural Networks for Graph Datacited by 395
  12. 2020Weight Poisoning Attacks on Pre-trained Modelscited by 318
19 more
  1. 2018Adversarial Attack on Graph Structured Datacited by 300
  2. 2019Adversarial Attacks on Graph Neural Networks via Meta Learningcited by 261
  3. 2019A backdoor attack against LSTM-based text classification systemscited by 214
  4. 2019Topology Attack and Defense for Graph Neural Networks: An Optimization Perspectivecited by 196
  5. 2020Rumor Detection on Social Media with Bi-Directional Graph Convolutional Networkscited by 152
  6. 2020Backdoor Attacks to Graph Neural Networkscited by 126
  7. 2019TBT: Targeted Neural Network Attack with Bit Trojancited by 112
  8. 2020Graph Backdoorcited by 112
  9. 2020An Embarrassingly Simple Approach for Trojan Attack in Deep Neural Networkscited by 92
  10. 2019A Restricted Black-box Adversarial Framework Towards Attacking Graph Embedding Modelscited by 68
  11. 2018Backdooring Convolutional Neural Networks via Targeted Weight Perturbationscited by 66
  12. 2019Certifiable Robustness to Graph Perturbationscited by 62
  13. 2019Certifiable Robustness and Robust Training for Graph Convolutional Networkscited by 59
  14. 2020Scalable Attack on Graph Data by Injecting Vicious Nodescited by 50
  15. 2021Single Node Injection Attack against Graph Neural Networkscited by 45
  16. 2019TrojDRL: Trojan Attacks on Deep Reinforcement Learning Agentscited by 29
  17. 2018Attack Graph Convolutional Networks by Adding Fake Nodescited by 26
  18. 2020Adversarial Attack on Community Detection by Hiding Individualscited by 20
  19. 2020Indirect Adversarial Attacks via Poisoning Neighbors for Graph Convolutional Networkscited by 16

Built on by

Cited by year

Citing papers per year: 2022: 2; 2023: 3; 2024: 2.

7 papers.

  1. 2022Recent Advances in Reliable Deep Graph Learning: Inherent Noise, Distribution Shift, and Adversarial Attackcited by 10
  2. 2023A clean-label graph backdoor attack method in node classification taskcited by 10
  3. 2023A semantic backdoor attack against Graph Convolutional Networkscited by 8
  4. 2022Be Careful with Rotation: A Uniform Backdoor Pattern for 3D Shapecited by 4
  5. 2023Single Node Injection Label Specificity Attack on Graph Neural Networks via Reinforcement Learningcited by 3
  6. 2024Effective backdoor attack on graph neural networks in link prediction taskscited by 1
  7. 2024"No Matter What You Do": Purifying GNN Models via Backdoor Unlearningcited by 0