mlsanityData to 7 Oct 2026

Graph Neural Backdoor: Fundamentals, Methodologies, Applications, and Future Directions

arXiv 2406.10573 ↗First posted 15 Jun 2024cs.LG cs.AI cs.CRcited by 4

Not on the map. Why?

Abstract (arXiv)

Graph Neural Networks (GNNs) have significantly advanced various downstream graph-relevant tasks, encompassing recommender systems, molecular structure prediction, social media analysis, etc. Despite the boosts of GNN, recent research has empirically demonstrated its potential vulnerability to backdoor attacks, wherein adversaries employ triggers to poison input samples, inducing GNN to adversary-premeditated malicious outputs. This is typically due to the controlled training process, or the deployment of untrusted models, such as delegating model training to third-party service, leveraging external training sets, and employing pre-trained models from online sources. Although there's an ongoing increase in research on GNN backdoors, comprehensive investigation into this field is lacking. To bridge this gap, we propose the first survey dedicated to GNN backdoors. We begin by outlining the fundamental definition of GNN, followed by the detailed summarization and categorization of current GNN backdoor attacks and defenses based on their technical characteristics and application scenarios. Subsequently, the analysis of the applicability and use cases of GNN backdoors is undertaken. Finally, the exploration of potential research directions of GNN backdoors is presented. This survey aims to explore the principles of graph backdoors, provide insights to defenders, and promote future security research.

Key facts. Cited by 4 papers in the map (data through 7 Oct 2026). Builds on 61 of its 110 references that are in the map. First posted on arXiv 15 Jun 2024.

Builds on

61 of 110 references.

References · 61

  1. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 950
  2. 2023Graph of Thoughts: Solving Elaborate Problems with Large Language Modelscited by 873
  3. 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 341
  4. 2017Few-Shot Learning with Graph Neural Networkscited by 324
  5. 2023Exploring the Potential of Large Language Models (LLMs) in Learning on Graphscited by 271
  6. 2018Adversarial Attack and Defense on Graph Data: A Surveycited by 166
  7. 2017The Space of Transferable Adversarial Examplescited by 156
  8. 2021Rethinking the Backdoor Attacks' Triggers: A Frequency Perspectivecited by 155
  9. 2023MotionGPT: Finetuned LLMs Are General-Purpose Motion Generatorscited by 145
  10. 2020Entangled Watermarks as a Defense against Model Extractioncited by 144
  11. 2021Graph Learning: A Surveycited by 140
  12. 2023Spatio-Temporal Graph Neural Networks for Predictive Learning in Urban Computing: A Surveycited by 140
38 more
  1. 2022Data Augmentation for Deep Graph Learning: A Surveycited by 132
  2. 2020Backdoor Attacks to Graph Neural Networkscited by 126
  3. 2021Generative Causal Explanations for Graph Neural Networkscited by 124
  4. 2019Edge-labeling Graph Neural Network for Few-shot Learningcited by 114
  5. 2018Large-Scale Learnable Graph Convolutional Networkscited by 113
  6. 2020Graph Backdoorcited by 112
  7. 2020Molecular graph generation with Graph Neural Networkscited by 79
  8. 2020Rethinking the Trigger of Backdoor Attackcited by 76
  9. 2019Graph Representation Learning: A Surveycited by 75
  10. 2021Black-box Detection of Backdoor Attacks with Limited Information and Datacited by 71
  11. 2019Graph Transfer Learning via Adversarial Domain Adaptation with Graph Convolutioncited by 67
  12. 2023Graph Neural Prompting with Large Language Modelscited by 64
  13. 2021Dynamic Graph Neural Networks for Sequential Recommendationcited by 57
  14. 2021Handcrafted Backdoors in Deep Neural Networkscited by 57
  15. 2022Black-box Dataset Ownership Verification via Backdoor Watermarkingcited by 57
  16. 2021AEVA: Black-box Backdoor Detection Using Adversarial Extreme Value Analysiscited by 52
  17. 2021Non-Transferable Learning: A New Approach for Model Ownership Verification and Applicability Authorizationcited by 50
  18. 2021Poison Ink: Robust and Invisible Backdoor Attackcited by 50
  19. 2020Towards Probabilistic Verification of Machine Unlearningcited by 46
  20. 2023Unnoticeable Backdoor Attacks on Graph Neural Networkscited by 45
  21. 2021DeepPayload: Black-box Backdoor Attack on Deep Learning Models through Neural Payload Injectioncited by 42
  22. 2021Explainability-based Backdoor Attacks Against Graph Neural Networkscited by 42
  23. 2023Backdoor Attacks Against Deep Image Compression via Adaptive Frequency Triggercited by 40
  24. 2023The Parrot Dilemma: Human-Labeled vs. LLM-augmented Data in Classification Taskscited by 35
  25. 2020WAFFLE: Watermarking in Federated Learningcited by 34
  26. 2020Lifelong Graph Learningcited by 31
  27. 2020Open-sourced Dataset Protection via Backdoor Watermarkingcited by 30
  28. 2022BadHash: Invisible Backdoor Attacks against Deep Hashing with Clean Labelcited by 28
  29. 2022Untargeted Backdoor Attack against Object Detectioncited by 28
  30. 2021Watermarking Graph Neural Networks based on Backdoor Attackscited by 25
  31. 2021Robust Backdoor Attacks against Deep Neural Networks in Real Physical Worldcited by 20
  32. 2017Towards Practical Verification of Machine Learning: The Case of Computer Vision Systemscited by 19
  33. 2022Transferable Graph Backdoor Attackcited by 19
  34. 2022Motif-Backdoor: Rethinking the Backdoor Attack on Graph Neural Networks via Motifscited by 19
  35. 2016Intrinsic Geometric Information Transfer Learning on Multiple Graph-Structured Datasetscited by 18
  36. 2023Deep Intellectual Property Protection: A Surveycited by 16
  37. 2022More is Better (Mostly): On the Backdoor Attacks in Federated Graph Neural Networkscited by 15
  38. 2022Watermarking in Secure Federated Learning: A Verification Framework Based on Client-Side Backdooringcited by 14

50 most cited of 61 All 61 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 3; 2026: 1.

4 papers.

  1. 2025Stealthy Dual-Trigger Backdoors: Attacking Prompt Tuning in LM-Empowered Graph Foundation Modelscited by 1
  2. 2025Geometry-Aware Backdoor Attacks: Leveraging Curvature in Hyperbolic Embeddingscited by 0
  3. 2025Cross-Paradigm Graph Backdoor Attacks with Promptable Subgraph Triggerscited by 0
  4. 2026Hide and Find: A Distributed Adversarial Attack on Federated Graph Learningcited by 0