Research map / Adversarial robustness and security / Backdoor and poisoning

Backdoor Attack on Propagation-based Rumor Detectors

AAAI 2025 · Adversarial robustness and security › Backdoor and poisoning · approach: Trigger-based backdoor attacks · 2 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes IBAttack, the first injection-based backdoor attack on propagation-based rumor detectors, which attaches adaptively generated discrete trigger nodes to important nodes of propagation trees.

Problem

Propagation-based rumor detectors that operate on propagation trees (RPTs) are vulnerable to attacks, but backdoor attacks on them are unexplored, and existing graph backdoor methods (subgraph/topology perturbation triggers) are ill-suited because they are conspicuous on trees and RPT sizes vary wid

Approach

Keep the original graph intact and inject a budget of discrete new trigger nodes attached to critical nodes (chosen by degree centrality and feature similarity to the root), with features produced by a learned feature generator trained with an attack loss on a surrogate GCN and a cosine-similarity constraint loss so triggers look like their attached nodes.

Key results

• IBAttack with GCN surrogate reaches 100% ASR on Twitter16 with 0.25% CAD, 99.89% ASR on Twitter15 with 1.37% CAD, and 99.33% ASR on Pheme with -0.29% CAD.
• Baselines ER-B, MIA, TRAP and Motif achieve low ASR (often near 0 to ~17%), while GTA reaches about 96% ASR but with higher CAD on Twitter15 and Pheme.
• Triggers transfer across architectures in black-box setting: with BiGCN and EBGCN as targets and different surrogates, ASR stays above 82% on all datasets.

Measured effects reported in the paper

Surprising findings

• Randomly selecting trigger features (IBAttack/F) makes the attack nearly ineffective (ASR around 0.1 to 1.6%), indicating injected feature content matters more than structure.

Limitations

• Trigger nodes are not semantically coherent text; the authors note generating reasonable semantic content is future work.
• Attack performance on GAT against Twitter15 and Twitter16 is somewhat weaker because GAT attention assigns small weights to added edge nodes.
• Defenses against IBAttack are not explored.

Experimental setup

Datasets: Twitter16 Twitter15 Pheme

Benchmarks: Twitter16 Twitter15 Pheme

Metrics: Attack Success Rate (ASR) Clean Accuracy Drop (CAD)

Baselines: ER-B MIA GTA TRAP Motif IBAttack/F IBAttack/S

Builds on: UGBA GTA (Graph Backdoor) BiGCN EBGCN

Closest papers by meaning

• Propagation Tree Is Not Deep: Adaptive Graph Contrastive Learning Approach for Rumor Detection (AAAI 2024 · similarity 0.86)
• Enhancing Robustness of Graph Neural Networks on Social Media with Explainable Inverse Reinforcement Learning (NeurIPS 2024 · similarity 0.86)
• Trapping Attacker in Dilemma: Examining Internal Correlations and External Influences of Trigger for Defending GNN Backdoors (NeurIPS 2026 · similarity 0.83)
• GIN-SD: Source Detection in Graphs with Incomplete Nodes via Positional Encoding and Attentive Fusion (AAAI 2024 · similarity 0.82)
• Attack by Yourself: Effective and Unnoticeable Multi-Category Graph Backdoor Attacks with Subgraph Triggers Pool (NeurIPS 2025 · similarity 0.82)
• Stealthy Yet Effective: Distribution-Preserving Backdoor Attacks on Graph Classification (NeurIPS 2025 · similarity 0.81)