Research map / Adversarial robustness and security / Backdoor and poisoning
Clean-Label Graph Backdoor Attack in the Node Classification Task
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes CGBA, a black-box clean-label backdoor attack on GNN node classification that poisons uncertain, low-degree target-class nodes and learns feature triggers with confidence-boosting and similarity constraints.
Problem
Backdoor attacks on GNN node classification are dirty-label and easily detected by filtering mislabeled poisoned nodes; no clean-label backdoor attack existed for node-level GNN tasks.
Approach
Select poisoned nodes from the target class with the lowest confidence and low degree (via a GCN surrogate), choose the most important features with GraphLIME, and train a fixed feature trigger via an MLP that boosts target-class confidence on poisoned nodes while constraining similarity to neighbors and to original features, keeping labels unchanged.
Key results
- On GraphSAGE, CGBA attains 100% ASR on Cora and Citeseer with BA about 85.6% and 74.4%, respectively, close to clean accuracy.
- On Pubmed with a 0.5% poisoning rate, CGBA reaches 96.94% ASR, as stated in the introduction.
- Under Prune and Isolate defenses, CGBA's ASR stays near 95-99% on all datasets while baselines such as GTA and UGBA drop substantially.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use CGBA instead of the strongest listed feature-trigger baseline | GCN backdoor attack · Cora | ASR: 90.56 -> 98.89 | Helped |
| Use CGBA instead of the strongest listed feature-trigger baseline | GAT backdoor attack · Cora | ASR: 95.56 -> 98.33 | Helped |
| Use CGBA instead of the strongest listed feature-trigger baseline | GraphSAGE backdoor attack · Cora | ASR: 99.44 -> 100.0 | No clear effect |
| Use CGBA instead of the strongest listed feature-trigger baseline | GCN backdoor attack · Citeseer | ASR: 90.56 -> 98.89 | Helped |
| Use CGBA instead of the strongest listed feature-trigger baseline | GAT backdoor attack · Citeseer | ASR: 80.37 -> 96.67 | Helped |
| Use CGBA instead of the strongest listed feature-trigger baseline | GraphSAGE backdoor attack · Citeseer | ASR: 99.44 -> 100.0 | No clear effect |
| Use CGBA instead of the strongest listed feature-trigger baseline | GCN backdoor attack · Pubmed | ASR: 55.01 -> 96.67 | Helped |
| Use CGBA instead of the strongest listed feature-trigger baseline | GAT backdoor attack · Pubmed | ASR: 55.56 -> 98.33 | Helped |
| Use CGBA instead of the strongest listed feature-trigger baseline | GraphSAGE backdoor attack · Pubmed | ASR: 67.78 -> 100.0 | Helped |
| Select poisoned nodes using low target-class confidence and degree instead of random selection (ablation) | CGBA · Cora, Citeseer, and Pubmed | ASR | Helped |
| Select the most important features instead of random features (ablation) | CGBA · Pubmed | ASR | Helped |
| Increase the number of poisoned nodes (ablation) | CGBA · Pubmed | ASR | Helped |
Surprising findings
- CGBA's ASR under defenses sometimes increases on Cora and Pubmed, which the authors attribute to defenses removing clean nodes rather than poisoned ones.
Limitations
- Attack evaluated only on three small citation graphs and four GNN architectures.
- Uses a fixed trigger and a surrogate GCN for node selection and trigger generation.
Experimental setup
Datasets: Cora Citeseer Pubmed
Benchmarks: Cora Citeseer Pubmed
Metrics: attack success rate benign accuracy
Baselines: GTA EGNN UGBA MIA NFTA CBA
Builds on: GraphLIME clean-label backdoor attack (Turner et al.) CBA MIA UGBA
Closest papers by meaning
- Stealthy Yet Effective: Distribution-Preserving Backdoor Attacks on Graph Classification (NeurIPS 2025 · similarity 0.92)
- Robustness Inspired Graph Backdoor Defense (ICLR 2025 · similarity 0.90)
- Attack by Yourself: Effective and Unnoticeable Multi-Category Graph Backdoor Attacks with Subgraph Triggers Pool (NeurIPS 2025 · similarity 0.90)
- Exact Certification of (Graph) Neural Networks Against Label Poisoning (ICLR 2025 · similarity 0.89)
- Wicked Oddities: Selectively Poisoning for Effective Clean-Label Backdoor Attacks (ICLR 2025 · similarity 0.88)
- Deterministic Certification of Graph Neural Networks against Graph Poisoning Attacks with Arbitrary Perturbations (CVPR 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.