Research map / Adversarial robustness and security / Backdoor and poisoning

Trapping Attacker in Dilemma: Examining Internal Correlations and External Influences of Trigger for Defending GNN Backdoors

NeurIPS 2026 · Adversarial robustness and security › Backdoor and poisoning · approach: Trigger-based backdoor attacks · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes PRAETORIAN, a GNN backdoor defense that fuses internal-correlation (masked autoencoder reconstruction) and external-influence (counterfactual masking) scores to detect victim and trigger nodes, then unlearns them.

Problem

Node-level backdoor attacks on GNNs attach trigger subgraphs to victim nodes; existing defenses rely on fixed trigger signatures and are brittle against adaptive, in-distribution triggers.

Approach

Derives a two-view necessary condition for effective backdoors: flipping a victim requires either strong intra-trigger correlation (many coordinated nodes) or high per-node external influence (few influential nodes). PRAETORIAN scores each node on both views, fuses them, localizes victims/triggers via a valley cutoff, and unlearns them during robust training.

Key results

• PRAETORIAN reduces average ASR to 0.55% with 0.62% average CA drop across 4 datasets and 4 attacks.
• Victim node detection averages 98.52% precision and 94.57% recall; trigger node detection averages 98.64% precision and 91.20% recall.
• Under adaptive attacks, reaching ASR >=80% requires large victim/trigger sizes and causes >10% CA drop; the one-node clean-label attack keeps post-defense ASR at most 18.1%.

Surprising findings

• Removing detected nodes without unlearning (PRAETORIAN\R) still leaves average ASR at 66.07%, indicating node removal alone is insufficient.

Limitations

• Recall is lower (below 80%) for SBA and GTA on PubMed where triggers are disconnected or clean-label victims weaken the signals.
• Victim/trigger detection depends on the bimodality test and valley cutoff, and the method abstains when no separation is detected.
• Baseline results differ from originally reported numbers for RIGBD, reflecting sensitivity to attack configuration.

Experimental setup

Datasets: Cora PubMed Flickr OGB-arxiv

Benchmarks: Cora PubMed Flickr OGB-arxiv

Metrics: ASR CA precision recall

Baselines: GNNGuard OD SP RIGBD

Builds on: GTA DPGBA RIGBD GNNGuard

Closest papers by meaning

• Attack by Yourself: Effective and Unnoticeable Multi-Category Graph Backdoor Attacks with Subgraph Triggers Pool (NeurIPS 2025 · similarity 0.89)
• Robustness Inspired Graph Backdoor Defense (ICLR 2025 · similarity 0.88)
• Grimm: A Plug-and-Play Perturbation Rectifier for Graph Neural Networks Defending Against Poisoning Attacks (AAAI 2025 · similarity 0.87)
• HyperNear: Unnoticeable Node Injection Attacks on Hypergraph Neural Networks (ICML 2025 · similarity 0.86)
• Fusing Pruned and Backdoored Models: Optimal Transport-based Data-free Backdoor Mitigation (AAAI 2025 · similarity 0.86)
• Revisiting Backdoor Attacks against Large Vision-Language Models from Domain Shift (CVPR 2025 · similarity 0.86)