# Motif-Backdoor: Rethinking the Backdoor Attack on Graph Neural Networks via Motifs

arXiv: https://arxiv.org/abs/2210.13710 · HTML: https://mlsanity.com/paper/2210.13710/

## Key facts

- Cited by 19 papers in the map (data through 14 Oct 2026).
- Builds on 25 of its 63 references that are in the map.
- First posted on arXiv 25 Oct 2022.

## Builds on (most cited first, 25 of 25)

- [Semi-Supervised Classification with Graph Convolutional Networks](https://mlsanity.com/paper/1609.02907/) (2016)
- [Graph Attention Networks](https://mlsanity.com/paper/1710.10903/) (2017)
- [Inductive Representation Learning on Large Graphs](https://mlsanity.com/paper/1706.02216/) (2017)
- [How Powerful are Graph Neural Networks?](https://mlsanity.com/paper/1810.00826/) (2018)
- [node2vec: Scalable Feature Learning for Networks](https://mlsanity.com/paper/1607.00653/) (2016)
- [DeepWalk: Online Learning of Social Representations](https://mlsanity.com/paper/1403.6652/) (2014)
- [Link Prediction Based on Graph Neural Networks](https://mlsanity.com/paper/1802.09691/) (2018)
- [Hierarchical Graph Representation Learning with Differentiable Pooling](https://mlsanity.com/paper/1806.08804/) (2018)
- [Self-Attention Graph Pooling](https://mlsanity.com/paper/1904.08082/) (2019)
- [Adversarial Attacks on Neural Networks for Graph Data](https://mlsanity.com/paper/1805.07984/) (2018)
- [Adversarial Attack on Graph Structured Data](https://mlsanity.com/paper/1806.02371/) (2018)
- [Backdoor Attacks to Graph Neural Networks](https://mlsanity.com/paper/2006.11165/) (2020)
- [Graph Backdoor](https://mlsanity.com/paper/2006.11890/) (2020)
- [Explainability-based Backdoor Attacks Against Graph Neural Networks](https://mlsanity.com/paper/2104.03674/) (2021)
- [NeuronFair: Interpretable White-Box Fairness Testing through Biased Neuron Identification](https://mlsanity.com/paper/2112.13214/) (2021)
- [Adversarial Attack on Large Scale Graph](https://mlsanity.com/paper/2009.03488/) (2020)
- [MotifExplainer: a Motif-based Graph Neural Network Explainer](https://mlsanity.com/paper/2202.00519/) (2022)
- [Time-aware Gradient Attack on Dynamic Network Link Prediction](https://mlsanity.com/paper/1911.10561/) (2019)
- [MODEL: Motif-based Deep Feature Learning for Link Prediction](https://mlsanity.com/paper/2008.03637/) (2020)
- [GraphAttacker: A General Multi-Task GraphAttack Framework](https://mlsanity.com/paper/2101.06855/) (2021)
- [Motif-based Convolutional Neural Network on Graphs](https://mlsanity.com/paper/1711.05697/) (2017)
- [motif2vec: Motif Aware Node Representation Learning for Heterogeneous Networks](https://mlsanity.com/paper/1908.08227/) (2019)
- [Belief Dynamics in Social Networks: A Fluid-Based Analysis](https://mlsanity.com/paper/1710.00530/) (2017)
- [Motif Enhanced Recommendation over Heterogeneous Information Network](https://mlsanity.com/paper/1908.09701/) (2019)
- [EGC2: Enhanced Graph Classification with Easy Graph Compression](https://mlsanity.com/paper/2107.07737/) (2021)

## Built on by (most cited first, 19 of 19)

- [Data and Model Poisoning Backdoor Attacks on Wireless Federated Learning, and the Defense Mechanisms: A Comprehensive Survey](https://mlsanity.com/paper/2312.08667/) (2023)
- [A clean-label graph backdoor attack method in node classification task](https://mlsanity.com/paper/2401.00163/) (2023)
- [A semantic backdoor attack against Graph Convolutional Networks](https://mlsanity.com/paper/2302.14353/) (2023)
- [Identifying Backdoored Graphs in Graph Neural Network Training: An Explanation-Based Approach with Novel Metrics](https://mlsanity.com/paper/2403.18136/) (2024)
- [Bkd-FedGNN: A Benchmark for Classification Backdoor Attacks on Federated Graph Neural Network](https://mlsanity.com/paper/2306.10351/) (2023)
- [Graph Neural Backdoor: Fundamentals, Methodologies, Applications, and Future Directions](https://mlsanity.com/paper/2406.10573/) (2024)
- [Robustness questions the interpretability of graph neural networks: what to do?](https://mlsanity.com/paper/2505.02566/) (2025)
- [Backdoor Attacks on Discrete Graph Diffusion Models](https://mlsanity.com/paper/2503.06340/) (2025)
- [Towards Effective, Stealthy, and Persistent Backdoor Attacks Targeting Graph Foundation Models](https://mlsanity.com/paper/2511.17982/) (2025)
- [Stealthy Yet Effective: Distribution-Preserving Backdoor Attacks on Graph Classification](https://mlsanity.com/paper/2509.26032/) (2025)
- [Effective backdoor attack on graph neural networks in link prediction tasks](https://mlsanity.com/paper/2401.02663/) (2024)
- [A Clean-graph Backdoor Attack against Graph Convolutional Networks with Poisoned Label Only](https://mlsanity.com/paper/2404.12704/) (2024)
- [Single-Node Trigger Backdoor Attacks in Graph-Based Recommendation Systems](https://mlsanity.com/paper/2506.08401/) (2025)
- [Defense-as-a-Service: Black-box Shielding against Backdoored Graph Models](https://mlsanity.com/paper/2410.04916/) (2024)
- [DMGNN: Detecting and Mitigating Backdoor Attacks in Graph Neural Networks](https://mlsanity.com/paper/2410.14105/) (2024)
- [Framework GNN-AID: Graph Neural Network Analysis Interpretation and Defense](https://mlsanity.com/paper/2505.03424/) (2025)
- [Heterogeneous Graph Backdoor Attack](https://mlsanity.com/paper/2506.00191/) (2025)
- [Universal Graph Backdoor Defense: A Feature-based Homophily Perspective](https://mlsanity.com/paper/2605.16815/) (2026)
- [Rethinking Molecular Graph Backdoors under Chemistry-aware Admission](https://mlsanity.com/paper/2606.23361/) (2026)

## Abstract (arXiv)

Graph neural network (GNN) with a powerful representation capability has been widely applied to various areas, such as biological gene prediction, social recommendation, etc. Recent works have exposed that GNN is vulnerable to the backdoor attack, i.e., models trained with maliciously crafted training samples are easily fooled by patched samples. Most of the proposed studies launch the backdoor attack using a trigger that either is the randomly generated subgraph (e.g., erdHos-r'enyi backdoor) for less computational burden, or the gradient-based generative subgraph (e.g., graph trojaning attack) to enable a more effective attack. However, the interpretation of how is the trigger structure and the effect of the backdoor attack related has been overlooked in the current literature. Motifs, recurrent and statistically significant sub-graphs in graphs, contain rich structure information. In this paper, we are rethinking the trigger from the perspective of motifs, and propose a motif-based backdoor attack, denoted as Motif-Backdoor. It contributes from three aspects. (i) Interpretation: it provides an in-depth explanation for backdoor effectiveness by the validity of the trigger structure from motifs, leading to some novel insights, e.g., using subgraphs that appear less frequently in the graph as the trigger can achieve better attack performance. (ii) Effectiveness: Motif-Backdoor reaches the state-of-the-art (SOTA) attack performance in both black-box and defensive scenarios. (iii) Efficiency: based on the graph motif distribution, Motif-Backdoor can quickly obtain an effective trigger structure without target model feedback or subgraph model generation. Extensive experimental results show that Motif-Backdoor realizes the SOTA performance on three popular models and four public datasets compared with five baselines.