mlsanityData to 14 Oct 2026

Rethinking Graph Backdoor Attacks: A Distribution-Preserving Perspective

arXiv 2405.10757 ↗First posted 17 May 2024cs.LG cs.CRcited by 22

Not on the map. Why?

Abstract (arXiv)

Graph Neural Networks (GNNs) have shown remarkable performance in various tasks. However, recent works reveal that GNNs are vulnerable to backdoor attacks. Generally, backdoor attack poisons the graph by attaching backdoor triggers and the target class label to a set of nodes in the training graph. A GNN trained on the poisoned graph will then be misled to predict test nodes attached with trigger to the target class. Despite their effectiveness, our empirical analysis shows that triggers generated by existing methods tend to be out-of-distribution (OOD), which significantly differ from the clean data. Hence, these injected triggers can be easily detected and pruned with widely used outlier detection methods in real-world applications. Therefore, in this paper, we study a novel problem of unnoticeable graph backdoor attacks with in-distribution (ID) triggers. To generate ID triggers, we introduce an OOD detector in conjunction with an adversarial learning strategy to generate the attributes of the triggers within distribution. To ensure a high attack success rate with ID triggers, we introduce novel modules designed to enhance trigger memorization by the victim model trained on poisoned graph. Extensive experiments on real-world datasets demonstrate the effectiveness of the proposed method in generating in distribution triggers that can by-pass various defense strategies while maintaining a high attack success rate.

Key facts. Cited by 22 papers in the map (data through 14 Oct 2026). Builds on 32 of its 57 references that are in the map. First posted on arXiv 17 May 2024.

Builds on

32 of 57 references.

References · 32

  1. 2016Semi-Supervised Classification with Graph Convolutional Networkscited by 11,361
  2. 2017Graph Attention Networkscited by 8,923
  3. 2017Inductive Representation Learning on Large Graphscited by 6,320
  4. 2022Generative Adversarial Networkscited by 5,627
  5. 2018How Powerful are Graph Neural Networks?cited by 4,393
  6. 2020Open Graph Benchmark: Datasets for Machine Learning on Graphscited by 2,163
  7. 2016Variational Graph Auto-Encoderscited by 1,382
  8. 2020Graph Contrastive Learning with Augmentationscited by 1,208
  9. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,055
  10. 2016Revisiting Semi-Supervised Learning with Graph Embeddingscited by 976
  11. 2018Link Prediction Based on Graph Neural Networkscited by 832
  12. 2019Graph Neural Networks for Social Recommendationcited by 714
20 more
  1. 2020Deep Graph Contrastive Representation Learningcited by 539
  2. 2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 353
  3. 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 349
  4. 2020Weight Poisoning Attacks on Pre-trained Modelscited by 341
  5. 2020Say No to the Discrimination: Learning Fair Graph Neural Networks with Limited Sensitive Attribute Informationcited by 168
  6. 2021GraphSMOTE: Imbalanced Node Classification on Graphs with Graph Neural Networkscited by 147
  7. 2020Backdoor Attacks to Graph Neural Networkscited by 128
  8. 2020Graph Backdoorcited by 112
  9. 2020An Embarrassingly Simple Approach for Trojan Attack in Deep Neural Networkscited by 97
  10. 2019Molecular geometry prediction using a deep generative graph neural networkcited by 91
  11. 2020AnomalyDAE: Dual autoencoder for anomaly detection on attributed networkscited by 82
  12. 2022BOND: Benchmarking Unsupervised Outlier Node Detection on Static Attributed Graphscited by 80
  13. 2022Towards Robust Graph Neural Networks for Noisy Graphs with Sparse Labelscited by 63
  14. 2021Federated Social Recommendation with Graph Neural Networkcited by 56
  15. 2020Graph Neural Networks: Taxonomy, Advances and Trendscited by 48
  16. 2023Unnoticeable Backdoor Attacks on Graph Neural Networkscited by 45
  17. 2018Outlier Aware Network Embedding for Attributed Networkscited by 29
  18. 2017Deep Learning for Unsupervised Insider Threat Detection in Structured Cybersecurity Data Streamscited by 19
  19. 2022HP-GMN: Graph Memory Networks for Heterophilous Graphscited by 13
  20. 2024Overcoming Pitfalls in Graph Contrastive Learning Evaluation: Toward Comprehensive Benchmarkscited by 3

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2024: 4; 2025: 10; 2026: 8.

22 papers.

Sort:

By area:

  1. 2024Robustness Inspired Graph Backdoor Defensecited by 7
  2. 2024Stealing Training Graphs from Graph Neural Networkscited by 3
  3. 2025Towards Effective, Stealthy, and Persistent Backdoor Attacks Targeting Graph Foundation Modelscited by 3
  4. 2024Are You Using Reliable Graph Prompts? Trojan Prompt Attacks on Graph Neural Networkscited by 2
  5. 2025Stealthy Yet Effective: Distribution-Preserving Backdoor Attacks on Graph Classificationcited by 2
  6. 2025Single-Node Trigger Backdoor Attacks in Graph-Based Recommendation Systemscited by 1
  7. 2025Stealthy Dual-Trigger Backdoors: Attacking Prompt Tuning in LM-Empowered Graph Foundation Modelscited by 1
  8. 2024DMGNN: Detecting and Mitigating Backdoor Attacks in Graph Neural Networkscited by 0
  9. 2025Boosting Graph Robustness Against Backdoor Attacks: An Over-Similarity Perspectivecited by 0
  10. 2025HeteroBA: A Structure-Manipulating Backdoor Attack on Heterogeneous Graphscited by 0
  11. 2025Heterogeneous Graph Backdoor Attackcited by 0
  12. 2025Backdoor or Manipulation? Graph Mixture of Experts Can Defend Against Various Graph Adversarial Attackscited by 0
10 more
  1. 2025Cross-Paradigm Graph Backdoor Attacks with Promptable Subgraph Triggerscited by 0
  2. 2025HeteroHBA: A Generative Structure-Manipulating Backdoor Attack on Heterogeneous Graphscited by 0
  3. 2026BadSNN: Backdoor Attacks on Spiking Neural Networks via Adversarial Spiking Neuroncited by 0
  4. 2026Poisoning the Inner Prediction Logic of Graph Neural Networks for Clean-Label Backdoor Attackscited by 0
  5. 2026Graph-Aware Stealthy Poison-Text Backdoors for Text-Attributed Graphscited by 0
  6. 2026Trapping Attacker in Dilemma: Examining Internal Correlations and External Influences of Trigger for Defending GNN Backdoorscited by 0
  7. 2026Universal Graph Backdoor Defense: A Feature-based Homophily Perspectivecited by 0
  8. 2026Rethinking Molecular Graph Backdoors under Chemistry-aware Admissioncited by 0
  9. 2026FedLSG: LLM-Enhanced Semantic Calibration for Federated Graph Backdoor Defensecited by 0
  10. 2026Trojaning the Alignment: Stealthy Backdoor Attacks against Graph Foundation Modelscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2023Rethinking the Trigger-injecting Position in Graph Backdoor Attack
  2. 2021Explainability-based Backdoor Attacks Against Graph Neural Networks
  3. 2024Effective backdoor attack on graph neural networks in link prediction tasks
  4. 2024Identifying Backdoored Graphs in Graph Neural Network Training: An Explanation-Based Approach with Novel Metrics
  5. 2026BadImplant: Injection-based Multi-Targeted Graph Backdoor Attack
  6. 2024MADE: Graph Backdoor Defense with Masked Unlearning
  7. 2022Defending Against Backdoor Attack on Graph Nerual Network by Explainability
  8. 2024A Clean-graph Backdoor Attack against Graph Convolutional Networks with Poisoned Label Only