Research map / Graph learning / GNN architectures
Attack by Yourself: Effective and Unnoticeable Multi-Category Graph Backdoor Attacks with Subgraph Triggers Pool
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes EUMC, a multi-category graph backdoor attack on node classification that builds a pool of attacked-graph subgraphs as category-aware triggers, selects influential ones via attachment probability shifts, and attaches them with a "select then attach" similarity strategy.
Problem
Existing graph backdoor attacks for node classification use adaptive trigger generators that target a single category and degrade as the number of target categories grows, so multi-category targeted backdoor attacks remain ineffective and detectable.
Approach
Instead of generating triggers, sample subgraphs from the attacked graph itself, score each by attachment probability shift on a surrogate GCN to assign target categories, build a multi-category subgraph trigger pool, and attach triggers chosen by feature similarity to keep them unnoticeable, optimized via bi-level optimization.
Key results
- On Flickr (no defense, averaged over GCN/GAT/GraphSAGE), EUMC reaches 90.4% ASR versus 93.1% for GTA and 24.6% for UGBA, with clean accuracy comparable to baselines.
- On OGB-arxiv with no defense, EUMC achieves 83.8% ASR vs. 68.8% for DPGBA, and remains around 84% under Prune and Prune+LD defenses.
- Under the Prune defense on Bitcoin, EUMC achieves 88.3% ASR while UGBA reaches 73.3% and DPGBA 33.3% (averaged results).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use EUMC instead of the strongest reported baseline | Multi-category graph backdoor attacks · Cora, None | ASR (%): 87.7 -> 97.4 | Helped |
| Use EUMC instead of the strongest reported baseline | Multi-category graph backdoor attacks · Pubmed, None | ASR (%): 91.5 -> 96.4 | Helped |
| Use EUMC instead of the strongest reported baseline | Multi-category graph backdoor attacks · Bitcoin, None | ASR (%): 80.1 -> 90.6 | Helped |
| Use EUMC instead of the strongest reported baseline | Multi-category graph backdoor attacks · Facebook, None | ASR (%): 86.6 -> 91.7 | Helped |
| Use EUMC instead of GTA | Multi-category graph backdoor attacks · Flickr, None | ASR (%): 93.1 -> 90.4 | Hurt |
| Use EUMC instead of the strongest reported baseline | Multi-category graph backdoor attacks · OGB-arxiv, None | ASR (%): 68.8 -> 83.8 | Helped |
| Add clean-graph subgraph structure rather than randomizing it (ablation) | EUMC · Flickr, None | ASR (%): 82.0 ± 17.3 -> 89.4 ± 9.7 | Helped |
| Add clean-graph subgraph features rather than randomizing them (ablation) | EUMC · Flickr, None | ASR (%): 61.5 ± 37.3 -> 89.4 ± 9.7 | Helped |
| Use attachment probability shifts to initialize target categories (ablation) | EUMC · Flickr, None | ASR (%): 67.4 ± 34.9 -> 89.4 ± 9.7 | Helped |
| Select triggers by node similarity rather than randomly (ablation) | EUMC · Flickr, None | ASR (%): 69.8 ± 35.6 -> 89.4 ± 9.7 | Helped |
| Attach a similarity-selected subset rather than all trigger nodes (ablation) | EUMC · Flickr, None | ASR (%): 79.7 ± 14.1 -> 89.4 ± 9.7 | Helped |
| Attach a similarity-selected set rather than only the most similar node (ablation) | EUMC · Flickr, None | ASR (%): 75.3 ± 25.2 -> 89.4 ± 9.7 | Helped |
Surprising findings
- Under Prune on Flickr, GTA's ASR drops from about 93% to 15%, while DPGBA's rises from 53.5% to 68.6%, showing defense effects are inconsistent across methods.
- Table 1 shows UGBA's ASR on Flickr decreases as the number of target categories grows from 1 to 7 (99.7% down to 24.7% without defense), motivating the multi-category problem.
Limitations
- Performance on category-rich OGB-arxiv is lower than in some other settings, consistent with more target categories lowering ASR.
- Comparable rather than superior performance to UGBA on Pubmed, attributed to small dataset and only three categories.
Experimental setup
Datasets: Cora Pubmed Bitcoin Facebook Flickr OGB-arxiv
Benchmarks: Cora Pubmed Bitcoin Facebook Flickr OGB-arxiv
Metrics: attack success rate clean accuracy
Baselines: SBA GTA UGBA DPGBA
Builds on: UGBA GTA DPGBA bi-level optimization
Closest papers by meaning
- Clean-Label Graph Backdoor Attack in the Node Classification Task (AAAI 2025 · similarity 0.90)
- Stealthy Yet Effective: Distribution-Preserving Backdoor Attacks on Graph Classification (NeurIPS 2025 · similarity 0.90)
- Robustness Inspired Graph Backdoor Defense (ICLR 2025 · similarity 0.89)
- Trapping Attacker in Dilemma: Examining Internal Correlations and External Influences of Trigger for Defending GNN Backdoors (NeurIPS 2026 · similarity 0.89)
- HyperNear: Unnoticeable Node Injection Attacks on Hypergraph Neural Networks (ICML 2025 · similarity 0.87)
- Highly Imperceptible Black-Box Graph Injection Attacks with Reinforcement Learning (AAAI 2025 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.