Research map / Adversarial robustness and security / Attacks on text and graphs
Robustness Inspired Graph Backdoor Defense
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes RIGBD, a graph backdoor defense that detects poisoned nodes via prediction variance under random edge dropping and then trains a robust GNN by penalizing target-class confidence on flagged nodes.
Problem
Defending GNN node classifiers against graph backdoor attacks with diverse trigger types (e.g., in-distribution triggers that evade outlier and similarity-based defenses) without knowing which nodes are poisoned or the target class.
Approach
Poisoned nodes show large prediction variance when random edges are dropped (trigger edges removed), so random edge dropping with KL-based variance scoring identifies candidate poisoned nodes; a robust loss then minimizes target-class confidence on those nodes, which counteracts triggers even if some are missed.
Key results
- RIGBD reduces ASR to near 0% (e.g., 0.00-0.34%) across six datasets for GTA, UGBA and DPGBA attacks while keeping clean accuracy comparable to vanilla GCN.
- On OGB-arxiv, RIGBD detection precision stays above 90% and recall above 80% across GTA, UGBA and DPGBA attacks.
- Prune and OD fail against DPGBA (e.g., OD ASR 94.33% on Cora), while RIGBD keeps ASR at 0.01% on Cora under DPGBA.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use RIGBD instead of OD | 2-layer GCN · OGB-arxiv, GTA | ASR(%): 0.01 -> 0.01 | No clear effect |
| Use RIGBD instead of OD | 2-layer GCN · OGB-arxiv, UGBA | ASR(%): 0.01 -> 0.01 | No clear effect |
| Use RIGBD instead of randomized smoothing | 2-layer GCN · OGB-arxiv, DPGBA | ASR(%): 41.18 -> 0.00 | Helped |
| Use RIGBD instead of randomized smoothing | 2-layer GCN · OGB-arxiv, DPGBA | ACC(%): 58.44 -> 65.24 | Helped |
| Use RIGBD with K=10 instead of individually dropping edges | 2-layer GCN · OGB-arxiv | running time: 42.56s -> 0.09s | Helped |
| Use robust training that minimizes detected poisoned nodes' target-class confidence instead of removing identified nodes and training with cross-entropy (ablation) | RIGBD · OGB-arxiv, DPGBA, two trigger edges | ASR(%) | Helped |
| Use random edge dropping instead of dropping edges individually (ablation) | RIGBD · OGB-arxiv, DPGBA, two trigger edges | ASR(%) | Helped |
| Remove identified candidate poisoned nodes and train with cross-entropy instead of robust training (ablation) | RIGBD · OGB-arxiv, DPGBA, two trigger edges | ASR(%) | Hurt |
Surprising findings
- A clean model trained without triggers still yields non-trivial ASR (34.72% on Cora) for DPGBA triggers that mimic target-class neighbors.
- With beta=0.1 and K=2 (recall ~17.4%), RIGBD still achieves 1.86% ASR, while removing the detected triggers and training normally yields ~80% ASR.
Limitations
- Relies on a 2-layer GCN backdoored model and on the assumption that trigger edges dominate prediction variance; heterophilic graphs show smaller variance gaps.
- Target class is inferred from the node with largest variance and a threshold heuristic, which may be fragile.
- Evaluation uses fixed attacker budgets and trigger sizes of three nodes; adaptive attacks against the defense are not studied.
Experimental setup
Datasets: Cora Citeseer PubMed Physics Flickr OGB-arxiv
Benchmarks: Cora Citeseer PubMed Physics Flickr OGB-arxiv
Metrics: ASR clean accuracy recall precision
Baselines: GCN GNNGuard RobustGCN Prune OD Randomized smoothing ABL
Builds on: GCN UGBA DPGBA Prune OD
Closest papers by meaning
- Clean-Label Graph Backdoor Attack in the Node Classification Task (AAAI 2025 · similarity 0.90)
- Stealthy Yet Effective: Distribution-Preserving Backdoor Attacks on Graph Classification (NeurIPS 2025 · similarity 0.90)
- Deterministic Certification of Graph Neural Networks against Graph Poisoning Attacks with Arbitrary Perturbations (CVPR 2025 · similarity 0.89)
- Attack by Yourself: Effective and Unnoticeable Multi-Category Graph Backdoor Attacks with Subgraph Triggers Pool (NeurIPS 2025 · similarity 0.89)
- Trapping Attacker in Dilemma: Examining Internal Correlations and External Influences of Trigger for Defending GNN Backdoors (NeurIPS 2026 · similarity 0.88)
- Grimm: A Plug-and-Play Perturbation Rectifier for Graph Neural Networks Defending Against Poisoning Attacks (AAAI 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.