Unnoticeable Backdoor Attacks on Graph Neural Networks

Enyan Dai,Minhua Lin,Xiang Zhang,Suhang Wang

DOI: https://doi.org/10.1145/3543507.3583392

2023-02-11

Abstract:Graph Neural Networks (GNNs) have achieved promising results in various tasks such as node classification and graph classification. Recent studies find that GNNs are vulnerable to adversarial attacks. However, effective backdoor attacks on graphs are still an open problem. In particular, backdoor attack poisons the graph by attaching triggers and the target class label to a set of nodes in the training graph. The backdoored GNNs trained on the poisoned graph will then be misled to predict test nodes to target class once attached with triggers. Though there are some initial efforts in graph backdoor attacks, our empirical analysis shows that they may require a large attack budget for effective backdoor attacks and the injected triggers can be easily detected and pruned. Therefore, in this paper, we study a novel problem of unnoticeable graph backdoor attacks with limited attack budget. To fully utilize the attack budget, we propose to deliberately select the nodes to inject triggers and target class labels in the poisoning phase. An adaptive trigger generator is deployed to obtain effective triggers that are difficult to be noticed. Extensive experiments on real-world datasets against various defense strategies demonstrate the effectiveness of our proposed method in conducting effective unnoticeable backdoor attacks.

Cryptography and Security,Machine Learning

What problem does this paper attempt to address?

The paper primarily focuses on addressing the vulnerability of Graph Neural Networks (GNNs) to backdoor attacks, particularly how to achieve imperceptible backdoor attacks under limited attack budgets. Specifically:

1. **Existing Issues**: Although previous studies have shown that GNNs are susceptible to adversarial attacks, effective graph backdoor attacks remain an open problem. Existing backdoor attack methods often require a large attack budget to be effective, and the injected triggers are easily detectable and removable.

2. **Research Objective**: This paper aims to investigate a novel, imperceptible graph backdoor attack method that can effectively implement backdoor attacks on various GNN models under a limited attack budget. To fully utilize the limited attack budget, the authors propose a novel method to select nodes for injecting triggers and target labels, and design an adaptive trigger generator to obtain effective triggers that are difficult to detect.

3. **Summary of Contributions**:
- Propose a new problem: how to improve the stealthiness of graph backdoor attacks under a limited attack budget;
- Demonstrate that simple edge pruning and label dropping strategies can significantly reduce the effectiveness of existing backdoor attacks;
- Design a framework called UGBA, which achieves imperceptible graph backdoor attacks under a limited budget by carefully selecting poisoned samples and learning effective stealthy triggers;
- Large-scale experimental results show that the proposed UGBA method can effectively implement stealthy backdoor attacks on different GNN models.