# Unnoticeable Backdoor Attacks on Graph Neural Networks

arXiv: https://arxiv.org/abs/2303.01263 · HTML: https://mlsanity.com/paper/2303.01263/

## Key facts

- Cited by 45 papers in the map (data through 14 Oct 2026).
- Builds on 38 of its 49 references that are in the map.
- First posted on arXiv 11 Feb 2023.

## Builds on (most cited first, 30 of 38)

- [Semi-Supervised Classification with Graph Convolutional Networks](https://mlsanity.com/paper/1609.02907/) (2016)
- [Graph Attention Networks](https://mlsanity.com/paper/1710.10903/) (2017)
- [Inductive Representation Learning on Large Graphs](https://mlsanity.com/paper/1706.02216/) (2017)
- [Model-Agnostic Meta-Learning for Fast Adaptation of Deep Networks](https://mlsanity.com/paper/1703.03400/) (2017)
- [How Powerful are Graph Neural Networks?](https://mlsanity.com/paper/1810.00826/) (2018)
- [Open Graph Benchmark: Datasets for Machine Learning on Graphs](https://mlsanity.com/paper/2005.00687/) (2020)
- [Understanding Black-box Predictions via Influence Functions](https://mlsanity.com/paper/1703.04730/) (2017)
- [Graph Convolutional Neural Networks for Web-Scale Recommender Systems](https://mlsanity.com/paper/1806.01973/) (2018)
- [Simple and Deep Graph Convolutional Networks](https://mlsanity.com/paper/2007.02133/) (2020)
- [GNNExplainer: Generating Explanations for Graph Neural Networks](https://mlsanity.com/paper/1903.03894/) (2019)
- [GraphSAINT: Graph Sampling Based Inductive Learning Method](https://mlsanity.com/paper/1907.04931/) (2019)
- [GCC: Graph Contrastive Coding for Graph Neural Network Pre-Training](https://mlsanity.com/paper/2006.09963/) (2020)
- [Adversarial Attacks on Neural Networks for Graph Data](https://mlsanity.com/paper/1805.07984/) (2018)
- [Adversarial Attack on Graph Structured Data](https://mlsanity.com/paper/1806.02371/) (2018)
- [Adversarial Attacks on Graph Neural Networks via Meta Learning](https://mlsanity.com/paper/1902.08412/) (2019)
- [Topology Attack and Defense for Graph Neural Networks: An Optimization Perspective](https://mlsanity.com/paper/1906.04214/) (2019)
- [GNNGuard: Defending Graph Neural Networks against Adversarial Attacks](https://mlsanity.com/paper/2006.08149/) (2020)
- [Say No to the Discrimination: Learning Fair Graph Neural Networks with Limited Sensitive Attribute Information](https://mlsanity.com/paper/2009.01454/) (2020)
- [A Semi-supervised Graph Attentive Network for Financial Fraud Detection](https://mlsanity.com/paper/2003.01171/) (2020)
- [Backdoor Attacks to Graph Neural Networks](https://mlsanity.com/paper/2006.11165/) (2020)
- [A Comprehensive Survey on Trustworthy Graph Neural Networks: Privacy, Robustness, Fairness, and Explainability](https://mlsanity.com/paper/2204.08570/) (2022)
- [Graph Backdoor](https://mlsanity.com/paper/2006.11890/) (2020)
- [Adversarial Attacks on Node Embeddings via Graph Poisoning](https://mlsanity.com/paper/1809.01093/) (2018)
- [How to Find Your Friendly Neighborhood: Graph Attention Design with Self-Supervision](https://mlsanity.com/paper/2204.04879/) (2022)
- [ProtGNN: Towards Self-Explaining Graph Neural Networks](https://mlsanity.com/paper/2112.00911/) (2021)
- [Molecular graph generation with Graph Neural Networks](https://mlsanity.com/paper/2012.07397/) (2020)
- [Towards Self-Explainable Graph Neural Network](https://mlsanity.com/paper/2108.12055/) (2021)
- [NRGNN: Learning a Label Noise-Resistant Graph Neural Network on Sparsely and Noisily Labeled Graphs](https://mlsanity.com/paper/2106.04714/) (2021)
- [A Restricted Black-box Adversarial Framework Towards Attacking Graph Embedding Models](https://mlsanity.com/paper/1908.01297/) (2019)
- [TDGIA:Effective Injection Attacks on Graph Neural Networks](https://mlsanity.com/paper/2106.06663/) (2021)

## Built on by (most cited first, 30 of 45)

- [Rethinking Graph Backdoor Attacks: A Distribution-Preserving Perspective](https://mlsanity.com/paper/2405.10757/) (2024)
- [A Unified Framework of Graph Information Bottleneck for Robustness and Membership Privacy](https://mlsanity.com/paper/2306.08604/) (2023)
- [Cross-Context Backdoor Attacks against Graph Prompt Learning](https://mlsanity.com/paper/2405.17984/) (2024)
- [ERASE: Error-Resilient Representation Learning on Graphs for Label Noise Tolerance](https://mlsanity.com/paper/2312.08852/) (2023)
- [A clean-label graph backdoor attack method in node classification task](https://mlsanity.com/paper/2401.00163/) (2023)
- [Spear and Shield: Adversarial Attacks and Defense Methods for Model-Based Link Prediction on Continuous-Time Dynamic Graphs](https://mlsanity.com/paper/2308.10779/) (2023)
- [Robustness Inspired Graph Backdoor Defense](https://mlsanity.com/paper/2406.09836/) (2024)
- [Identifying Backdoored Graphs in Graph Neural Network Training: An Explanation-Based Approach with Novel Metrics](https://mlsanity.com/paper/2403.18136/) (2024)
- [Certifiably Robust Graph Contrastive Learning](https://mlsanity.com/paper/2310.03312/) (2023)
- [Provable Robustness of (Graph) Neural Networks Against Data Poisoning and Backdoor Attacks](https://mlsanity.com/paper/2407.10867/) (2024)
- [Backdoor Graph Condensation](https://mlsanity.com/paper/2407.11025/) (2024)
- [Bkd-FedGNN: A Benchmark for Classification Backdoor Attacks on Federated Graph Neural Network](https://mlsanity.com/paper/2306.10351/) (2023)
- [Graph Neural Backdoor: Fundamentals, Methodologies, Applications, and Future Directions](https://mlsanity.com/paper/2406.10573/) (2024)
- [Single Node Injection Label Specificity Attack on Graph Neural Networks via Reinforcement Learning](https://mlsanity.com/paper/2305.02901/) (2023)
- [PreGIP: Watermarking the Pretraining of Graph Neural Networks for Deep Intellectual Property Protection](https://mlsanity.com/paper/2402.04435/) (2024)
- [Stealing Training Graphs from Graph Neural Networks](https://mlsanity.com/paper/2411.11197/) (2024)
- [TooBadRL: Trigger Optimization to Boost Effectiveness of Backdoor Attacks on Deep Reinforcement Learning](https://mlsanity.com/paper/2506.09562/) (2025)
- [Everything Perturbed All at Once: Enabling Differentiable Graph Attacks](https://mlsanity.com/paper/2308.15614/) (2023)
- [Krait: A Backdoor Attack Against Graph Prompt Tuning](https://mlsanity.com/paper/2407.13068/) (2024)
- [Are You Using Reliable Graph Prompts? Trojan Prompt Attacks on Graph Neural Networks](https://mlsanity.com/paper/2410.13974/) (2024)
- [Deterministic Certification of Graph Neural Networks against Graph Poisoning Attacks with Arbitrary Perturbations](https://mlsanity.com/paper/2503.18503/) (2025)
- [Stealthy Yet Effective: Distribution-Preserving Backdoor Attacks on Graph Classification](https://mlsanity.com/paper/2509.26032/) (2025)
- [Effective backdoor attack on graph neural networks in link prediction tasks](https://mlsanity.com/paper/2401.02663/) (2024)
- [A Clean-graph Backdoor Attack against Graph Convolutional Networks with Poisoned Label Only](https://mlsanity.com/paper/2404.12704/) (2024)
- [On the Robustness of Graph Reduction Against GNN Backdoor](https://mlsanity.com/paper/2407.02431/) (2024)
- [RIDA: A Robust Attack Framework on Incomplete Graphs](https://mlsanity.com/paper/2407.18170/) (2024)
- [Backdoor Attack on Vertical Federated Graph Neural Network Learning](https://mlsanity.com/paper/2410.11290/) (2024)
- [LiSA: Leveraging Link Recommender to Attack Graph Neural Networks via Subgraph Injection](https://mlsanity.com/paper/2502.09271/) (2025)
- [A Semantic and Clean-label Backdoor Attack against Graph Convolutional Networks](https://mlsanity.com/paper/2503.14922/) (2025)
- [Single-Node Trigger Backdoor Attacks in Graph-Based Recommendation Systems](https://mlsanity.com/paper/2506.08401/) (2025)

## Abstract (arXiv)

Graph Neural Networks (GNNs) have achieved promising results in various tasks such as node classification and graph classification. Recent studies find that GNNs are vulnerable to adversarial attacks. However, effective backdoor attacks on graphs are still an open problem. In particular, backdoor attack poisons the graph by attaching triggers and the target class label to a set of nodes in the training graph. The backdoored GNNs trained on the poisoned graph will then be misled to predict test nodes to target class once attached with triggers. Though there are some initial efforts in graph backdoor attacks, our empirical analysis shows that they may require a large attack budget for effective backdoor attacks and the injected triggers can be easily detected and pruned. Therefore, in this paper, we study a novel problem of unnoticeable graph backdoor attacks with limited attack budget. To fully utilize the attack budget, we propose to deliberately select the nodes to inject triggers and target class labels in the poisoning phase. An adaptive trigger generator is deployed to obtain effective triggers that are difficult to be noticed. Extensive experiments on real-world datasets against various defense strategies demonstrate the effectiveness of our proposed method in conducting effective unnoticeable backdoor attacks.