mlsanityData to 14 Oct 2026

Trojaning the Alignment: Stealthy Backdoor Attacks against Graph Foundation Models

arXiv 2608.20991 ↗First posted 21 Aug 2026cs.LGcited by 0

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Graph Foundation Models (GFMs) on text-attributed graphs (TAGs) align graph representations with language semantics to support transferable graph learning. Despite these advantages, the backdoor vulnerability of GFMs on TAGs remains insufficiently understood, especially under graph-language alignment, where graph and text representations are trained to constrain each other in a shared semantic space. Existing backdoor attacks mainly target either the graph side or the text side, treating the two modalities independently. This makes direct adaptation ineffective: graph-only triggers can be constrained by clean text semantics, while text-only triggers alter the language view but do not directly shift the graph representation being aligned and scored. TAGs also impose a stealth challenge because triggers are exposed as both node text and local graph structure, making incoherent trigger attributes or anomalous subgraphs easy to inspect or filter. In this paper, we propose STAG, a stealthy trojan attack framework designed for the graph-language alignment interface of GFMs on TAGs. STAG coordinates a graph-trigger generator with a text-side soft prompt so that trigger-attached graph representations and triggered text representations move toward the same target-class text region. To address TAG-specific stealthiness, STAG realizes trigger nodes as readable text through candidate retrieval and regularizes the trigger-attached subgraph so that its local structure remains close to the original subgraph. Extensive experiments on multiple TAG datasets and representative GFMs demonstrate the effectiveness and stealthiness of STAG. Our code is available at https://github.com/ventr1c/STAG.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 41 of its 49 references that are in the map. First posted on arXiv 21 Aug 2026.

Builds on

41 of 49 references.

Closest ancestors · 5

Same direction, newest first

  1. 2025Towards Effective, Stealthy, and Persistent Backdoor Attacks Targeting Graph Foundation Models22 Nov
  2. 2025Stealthy Dual-Trigger Backdoors: Attacking Prompt Tuning in LM-Empowered Graph Foundation Models16 Oct
  3. 2024Cross-Context Backdoor Attacks against Graph Prompt Learning28 May
  4. 2023BadCLIP: Dual-Embedding Guided Backdoor Attack on Multimodal Contrastive Learning20 Nov
  5. 2023PoisonPrompt: Backdoor Attack on Prompt-based Large Language Models19 Oct

Other references · 36

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,399
  2. 2020Language Models are Few-Shot Learnerscited by 32,419
  3. 2016Semi-Supervised Classification with Graph Convolutional Networkscited by 11,361
  4. 2019Sentence-BERT: Sentence Embeddings using Siamese BERT-Networkscited by 9,170
  5. 2021Prefix-Tuning: Optimizing Continuous Prompts for Generationcited by 3,915
  6. 2021The Power of Scale for Parameter-Efficient Prompt Tuningcited by 3,795
  7. 2021SimCSE: Simple Contrastive Learning of Sentence Embeddingscited by 2,173
  8. 2020Open Graph Benchmark: Datasets for Machine Learning on Graphscited by 2,163
  9. 2019Graph Transformer Networkscited by 523
  10. 2020Graph Neural Networks in Recommender Systems: A Surveycited by 494
  11. 2020ONION: A Simple and Effective Defense Against Textual Backdoor Attackscited by 263
  12. 2020Wiki-CS: A Wikipedia-Based Benchmark for Graph Neural Networkscited by 260
24 more
  1. 2023GraphGPT: Graph Instruction Tuning for Large Language Modelscited by 226
  2. 2020A Semi-supervised Graph Attentive Network for Financial Fraud Detectioncited by 151
  3. 2021Node Feature Extraction by Self-Supervised Multi-scale Neighborhood Predictioncited by 138
  4. 2020Backdoor Attacks to Graph Neural Networkscited by 128
  5. 2020Graph Backdoorcited by 112
  6. 2023GraphLLM: Boosting Graph Reasoning Ability of Large Language Modelcited by 107
  7. 2023Graph Foundation Models: Concepts, Opportunities and Challengescited by 103
  8. 2024GraphTranslator: Aligning Graph Model to Large Language Model for Open-ended Taskscited by 63
  9. 2023Augmenting Low-Resource Text Classification with Graph-Grounded Pre-training and Promptingcited by 62
  10. 2024LLMs as Zero-shot Graph Learners: Alignment of GNN Representations with LLM Token Embeddingscited by 61
  11. 2024GraphCLIP: Enhancing Transferability in Graph Foundation Models for Text-Attributed Graphscited by 58
  12. 2023Unnoticeable Backdoor Attacks on Graph Neural Networkscited by 45
  13. 2026Group-Evolving Agents: Open-Ended Self-Improvement via Experience Sharingcited by 36
  14. 2026Harness Updating Is Not Harness Benefit: Disentangling Evolution Capabilities in Self-Evolving LLM Agentscited by 34
  15. 2023Temporal and Heterogeneous Graph Neural Network for Financial Time Series Predictioncited by 30
  16. 2018Outlier Aware Network Embedding for Attributed Networkscited by 29
  17. 2024Rethinking Graph Backdoor Attacks: A Distribution-Preserving Perspectivecited by 22
  18. 2024Let's Ask GNN: Empowering Large Language Model for Graph In-Context Learningcited by 21
  19. 2024Bridging Local Details and Global Context in Text-Attributed Graphscited by 15
  20. 2026MemMA: Coordinating the Memory Cycle through Multi-Agent Reasoning and In-Situ Self-Evolutioncited by 12
  21. 2023A Multimodal Graph Neural Network Framework of Cancer Molecular Subtype Classificationcited by 10
  22. 2024LOGIN: A Large Language Model Consulted Graph Neural Network Training Frameworkcited by 8
  23. 2024Are You Using Reliable Graph Prompts? Trojan Prompt Attacks on Graph Neural Networkscited by 2
  24. 2026A Benchmark on LLM-Based Power Flow Computation: Do More Structured Prompts Help?cited by 1

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026Graph-Aware Stealthy Poison-Text Backdoors for Text-Attributed Graphs
  2. 2025BadGraph: A Backdoor Attack Against Latent Diffusion Model for Text-Guided Graph Generation
  3. 2026Can LLMs Fool Graph Learning? Exploring Universal Adversarial Attacks on Text-Attributed Graphs
  4. 2026BadSKP: Backdoor Attacks on Knowledge Graph-Enhanced LLMs with Soft Prompts
  5. 2024Krait: A Backdoor Attack Against Graph Prompt Tuning
  6. 2025Cross-Paradigm Graph Backdoor Attacks with Promptable Subgraph Triggers
  7. 2022Motif-Backdoor: Rethinking the Backdoor Attack on Graph Neural Networks via Motifs
  8. 2025Stealthy Yet Effective: Distribution-Preserving Backdoor Attacks on Graph Classification