Research map / Adversarial robustness and security / Attacks on text and graphs
Crossfire: An Elastic Defense Framework for Graph Neural Networks Under Bit Flip Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Crossfire, a retraining-free, label-free hybrid defense combining honeypots, Blake2b row/column hashing, l1 sparsity induction and OOD bit-level correction to detect and reconstruct INT8 GNNs attacked by bit flip attacks.
Problem
Bit flip attacks (PBFA and the GNN-specific IBFA) can severely degrade quantized GNNs, and no defense exists that verifiably restores a GNN to its pre-attack state without test-data evaluation or retraining.
Approach
Combine honeypot selection from unlabeled data (pseudo-labels and accumulated gradients), per-neuron saliency-based rescaling, row/column Blake2b checksums for element-level localization, and bit-level unsetting of MSBs for out-of-distribution weights, all on top of l1-magnitude sparsity induction so that zeroing can restore the pre-attack state, with layer hashes verifying reconstruction.
Key results
- Averaged over 2,160 experiments, Crossfire offers a 21.8% higher probability than competitors of reconstructing a BFA-attacked GNN to its pre-attack state.
- Crossfire improves post-repair prediction quality by 10.85% on average.
- Under IBFA, Crossfire achieves 41% reconstruction at 15 bit flips versus 5% for NeuroPots.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use Crossfire instead of NeuroPots or RADAR for GNN repair | 5-layer GIN · IBFA across six ogbg-mol datasets | reconstruction ratio: t=7.1, p=2 \cdot 10^{-10} | Helped |
| Use Crossfire instead of NeuroPots or RADAR for GNN repair | 5-layer GIN · PBFA across six ogbg-mol datasets | reconstruction ratio: 21.8\% | Mixed |
| Use Crossfire instead of NeuroPots or RADAR | 5-layer GIN · PBFA and IBFA across six ogbg-mol datasets | post-repair prediction quality: 10.85\% | Helped |
| Use Crossfire instead of NeuroPots or RADAR | 5-layer GIN · PBFA and IBFA across six ogbg-mol datasets | bit flip detection ratio: t=9.8, p=10^{-18} | Helped |
| Use Crossfire instead of NeuroPots or RADAR | 5-layer GIN · PBFA and IBFA across six ogbg-mol datasets | vulnerability to evaluated BFAs: t=2.8, p=5 \cdot 10^{-3} | No clear effect |
| Use Blake2b layer digest size >= 2 | Crossfire integrity verification · Uniformly initialized INT8 matrices, sizes 100 to 1000 | bit-flip detection rate: 100\% | Helped |
Surprising findings
- Under PBFA, RADAR attains the highest BFA-after prediction in several datasets yet cannot restore pre-attack state, showing detection alone does not imply recovery.
- Layer hash with 1-byte digest missed 0.22-0.66% of bit-flip sequences, while 2-byte or larger digests detected all in tests.
Limitations
- Full reconstruction rates remain modest for large numbers of bit flips (e.g., 55).
- Assumes attacker has no budget limit and that unlabeled data from the training distribution is available.
- Evaluated only on GIN with six OGB molecular graph classification datasets.
Experimental setup
Datasets: ogbg-molpcba ogbg-molmuv ogbg-molhiv ogbg-moltoxcast ogbg-moltox21 ogbg-molbace
Benchmarks: ogbg-molpcba ogbg-molmuv ogbg-molhiv ogbg-moltoxcast ogbg-moltox21 ogbg-molbace
Metrics: AP AUROC reconstruction ratio bit flip detection ratio attack detection ratio
Baselines: NeuroPots RADAR
Builds on: NeuroPots RADAR PBFA IBFA
Closest papers by meaning
- Grimm: A Plug-and-Play Perturbation Rectifier for Graph Neural Networks Defending Against Poisoning Attacks (AAAI 2025 · similarity 0.87)
- Value at Adversarial Risk: A Graph Defense Strategy against Cost-Aware Attacks (AAAI 2024 · similarity 0.86)
- GraphIP–Bench: How Hard Is It to Steal a Graph Neural Network, and Can We Stop It? (NeurIPS 2026 · similarity 0.86)
- Stronger and Transferable Node Injection Attacks (AAAI 2024 · similarity 0.86)
- A Simple and Yet Fairly Effective Defense for Graph Neural Networks (AAAI 2024 · similarity 0.86)
- CEGA: A Cost-Effective Approach for Graph-Based Model Extraction and Acquisition (ICML 2025 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.