mlsanityData to 14 Oct 2026

Trapping Attacker in Dilemma: Examining Internal Correlations and External Influences of Trigger for Defending GNN Backdoors

arXiv 2605.08278 ↗First posted 8 May 2026cs.LG cs.AI cs.CRcited by 0

Not on the map. Why?

Abstract (arXiv)

GNNs have become a standard tool for learning on relational data, yet they remain highly vulnerable to backdoor attacks. Prior defenses often depend on inspecting specific subgraph patterns or node features, and thus can be circumvented by adaptive attackers. We propose PRAETORIAN, a new defense that targets intrinsic requirements of effective GNN backdoors rather than surface-level cues. Our key observation is that flipping a victim node's prediction requires substantial influence on the victim: attackers tend to either inject many trigger nodes or rely on a small set of highly influential ones. Building on this observation, PRAETORIAN (i) analyzes internal correlations within potential trigger subgraphs to detect abnormally large injected structures, and (ii) quantifies external node influence to identify triggers with disproportionate impact. Across our evaluations, PRAETORIAN reduces the average attack success rate (ASR) to 0.55% with only a 0.62% drop in clean accuracy (CA), whereas state-of-the-art defenses still yield an average ASR of >20% and a CA drop of >3% under the same conditions. Moreover, PRAETORIAN remains effective against a range of adaptive attacks, forcing adversaries to either inject many trigger nodes to achieve high ASR (>80%), which incurs a >10% CA drop, or preserve CA at the cost of limiting ASR to 18.1%. Overall, PRAETORIAN constrains attackers to an unfavorable trade-off between efficacy and detectability.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 36 of its 58 references that are in the map. First posted on arXiv 8 May 2026.

Builds on

36 of 58 references.

References · 36

  1. 2016Semi-Supervised Classification with Graph Convolutional Networkscited by 11,361
  2. 2017Graph Attention Networkscited by 8,923
  3. 2017Inductive Representation Learning on Large Graphscited by 6,320
  4. 2018How Powerful are Graph Neural Networks?cited by 4,393
  5. 2020Open Graph Benchmark: Datasets for Machine Learning on Graphscited by 2,163
  6. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
  7. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,055
  8. 2018Link Prediction Based on Graph Neural Networkscited by 832
  9. 2019Graph Neural Networks for Social Recommendationcited by 714
  10. 2019GraphSAINT: Graph Sampling Based Inductive Learning Methodcited by 618
  11. 2022GraphMAE: Self-Supervised Masked Graph Autoencoderscited by 448
  12. 2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 263
24 more
  1. 2020GNNGuard: Defending Graph Neural Networks against Adversarial Attackscited by 195
  2. 2020Blind Backdoors in Deep Learning Modelscited by 182
  3. 2021Is Homophily a Necessity for Graph Neural Networks?cited by 182
  4. 2018Adversarial Attack and Defense on Graph Data: A Surveycited by 167
  5. 2020Backdoor Attacks to Graph Neural Networkscited by 128
  6. 2020Graph Backdoorcited by 112
  7. 2019Molecular geometry prediction using a deep generative graph neural networkcited by 91
  8. 2021NRGNN: Learning a Label Noise-Resistant Graph Neural Network on Sparsely and Noisily Labeled Graphscited by 73
  9. 2021Graph-Based Deep Learning for Medical Diagnosis and Analysis: Past, Present and Futurecited by 67
  10. 2023How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defensescited by 66
  11. 2020Certified Robustness of Graph Neural Networks against Adversarial Structural Perturbationcited by 57
  12. 2023Unnoticeable Backdoor Attacks on Graph Neural Networkscited by 45
  13. 2020A Survey of Adversarial Learning on Graphscited by 42
  14. 2021Explainability-based Backdoor Attacks Against Graph Neural Networkscited by 42
  15. 2018Robust Graph Learning from Noisy Datacited by 34
  16. 2019Learning Graph Neural Networks with Noisy Labelscited by 30
  17. 2022Robust Training of Graph Neural Networks via Noise Governancecited by 29
  18. 2024Rethinking Graph Backdoor Attacks: A Distribution-Preserving Perspectivecited by 22
  19. 2024Distributed Backdoor Attacks on Federated Graph Learning and Certified Defensescited by 15
  20. 2022Spectral Adversarial Training for Robust Graph Neural Networkcited by 12
  21. 2022Link-Backdoor: Backdoor Attack on Link Prediction via Node Injectioncited by 10
  22. 2023WaveAttack: Asymmetric Frequency Obfuscation-based Backdoor Attacks Against Deep Neural Networkscited by 8
  23. 2024Robustness Inspired Graph Backdoor Defensecited by 7
  24. 2021Dyn-Backdoor: Backdoor Attack on Dynamic Link Predictioncited by 4

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2023Rethinking the Trigger-injecting Position in Graph Backdoor Attack
  2. 2026Universal Graph Backdoor Defense: A Feature-based Homophily Perspective
  3. 2024"No Matter What You Do": Purifying GNN Models via Backdoor Unlearning
  4. 2024Attack by Yourself: Effective and Unnoticeable Multi-Category Graph Backdoor Attacks with Subgraph Triggers Pool
  5. 2022Defending Against Backdoor Attack on Graph Nerual Network by Explainability
  6. 2025Boosting Graph Robustness Against Backdoor Attacks: An Over-Similarity Perspective
  7. 2024MADE: Graph Backdoor Defense with Masked Unlearning
  8. 2025Towards Effective, Stealthy, and Persistent Backdoor Attacks Targeting Graph Foundation Models