Research map / Graph learning / Graph self-supervised learning

Stealthy Yet Effective: Distribution-Preserving Backdoor Attacks on Graph Classification

NeurIPS 2025 · Graph learning › Graph self-supervised learning · approach: Graph domain adaptation · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes DPSBA, a clean-label graph classification backdoor attack that learns in-distribution triggers via adversarial training against anomaly discriminators, reducing detectability while keeping high attack success.

Problem

Graph-level backdoor attacks are easily detected by anomaly detectors because rare subgraph triggers cause structural deviation and label flipping causes semantic deviation; existing clean-label attacks lose attack success.

Approach

Learn trigger topology and features with a generator trained adversarially against structure and feature discriminators, selecting hard target-class samples for clean-label poisoning so triggers stay in-distribution while a surrogate classifier enforces misclassification.

Key results

• On AIDS with GCN surrogate, DPSBA reaches 94.76% ASR with 2.38% CAD and 72.65% AUC, versus 93.21% ASR and 99.34% AUC for GTA.
• On ENZYMES with GIN, DPSBA reports 99.33% ASR and AUC 41.20%, compared with GTA's 96.00% ASR.
• On PROTEINS_full with GCN, DPSBA reaches 73.93% ASR and 60.11% AUC, while Motif reaches 70.91% ASR and 79.16% AUC.

Measured effects reported in the paper

Surprising findings

• Transfer attacks with a GCN surrogate often achieve higher ASR on GIN or SAGPool than on GCN itself.
• Clean-label settings reduce AUC across all baselines but cause a notable ASR drop, showing a stealth-effectiveness trade-off.

Limitations

• Clean-label constraint may limit attack potency when target-class samples are scarce or classes are imbalanced.
• Requires partial access to training data, so it does not apply to fully black-box or test-time attacks.
• Only evaluated on TUDataset graph classification benchmarks with GCN, GIN, and SAGPool.

Experimental setup

Datasets: PROTEINS_full AIDS FRANKENSTEIN ENZYMES

Benchmarks: PROTEINS_full AIDS FRANKENSTEIN ENZYMES

Metrics: ASR CAD AUC

Baselines: ER-B LIA GTA Motif Motif-S

Builds on: GTA Motif-based backdoor SIGNET GCN GIN

Closest papers by meaning

• Clean-Label Graph Backdoor Attack in the Node Classification Task (AAAI 2025 · similarity 0.92)
• Robustness Inspired Graph Backdoor Defense (ICLR 2025 · similarity 0.90)
• Attack by Yourself: Effective and Unnoticeable Multi-Category Graph Backdoor Attacks with Subgraph Triggers Pool (NeurIPS 2025 · similarity 0.90)
• Self-Discriminative Modeling for Anomalous Graph Detection (ICML 2025 · similarity 0.86)
• Trapping Attacker in Dilemma: Examining Internal Correlations and External Influences of Trigger for Defending GNN Backdoors (NeurIPS 2026 · similarity 0.86)
• HyperNear: Unnoticeable Node Injection Attacks on Hypergraph Neural Networks (ICML 2025 · similarity 0.86)