Abstract:Recent studies have revealed that GNNs are highly susceptible to multiple adversarial attacks. Among these, graph backdoor attacks pose one of the most prominent threats, where attackers cause models to misclassify by learning the backdoored features with injected triggers and modified target labels during the training phase. Based on the features of the triggers, these attacks can be categorized into out-of-distribution (OOD) and in-distribution (ID) graph backdoor attacks, triggers with notable differences from the clean sample feature distributions constitute OOD backdoor attacks, whereas the triggers in ID backdoor attacks are nearly identical to the clean sample feature distributions. Existing methods can successfully defend against OOD backdoor attacks by comparing the feature distribution of triggers and clean samples but fail to mitigate stealthy ID backdoor attacks. Due to the lack of proper supervision signals, the main task accuracy is negatively affected in defending against ID backdoor attacks. To bridge this gap, we propose DMGNN against OOD and ID graph backdoor attacks that can powerfully eliminate stealthiness to guarantee defense effectiveness and improve the model performance. Specifically, DMGNN can easily identify the hidden ID and OOD triggers via predicting label transitions based on counterfactual explanation. To further filter the diversity of generated explainable graphs and erase the influence of the trigger features, we present a reverse sampling pruning method to screen and discard the triggers directly on the data level. Extensive experimental evaluations on open graph datasets demonstrate that DMGNN far outperforms the state-of-the-art (SOTA) defense methods, reducing the attack success rate to 5% with almost negligible degradation in model performance (within 3.5%).

Black-Box Graph Backdoor Defense.

B3: Backdoor Attacks Against Black-box Machine Learning Models

Unnoticeable Backdoor Attacks on Graph Neural Networks

MADE: Graph Backdoor Defense with Masked Unlearning

A Clean-graph Backdoor Attack against Graph Convolutional Networks with Poisoned Label Only

Defense-as-a-Service: Black-box Shielding against Backdoored Graph Models

Robustness-Inspired Defense Against Backdoor Attacks on Graph Neural Networks

"No Matter What You Do": Purifying GNN Models via Backdoor Unlearning

Transferable Graph Backdoor Attack

Rethinking Graph Backdoor Attacks: A Distribution-Preserving Perspective

XGBD: Explanation-Guided Graph Backdoor Detection

Test-Time Backdoor Defense via Detecting and Repairing

Graph Neural Backdoor: Fundamentals, Methodologies, Applications, and Future Directions

DMGNN: Detecting and Mitigating Backdoor Attacks in Graph Neural Networks

Effective Backdoor Attack on Graph Neural Networks in Spectral Domain

Feature-Based Graph Backdoor Attack in the Node Classification Task

A semantic backdoor attack against Graph Convolutional Networks

Black-box Detection of Backdoor Attacks with Limited Information and Data

Explainability-based Backdoor Attacks Against Graph Neural Networks

A clean-label graph backdoor attack method in node classification task

PoisonedGNN: Backdoor Attack on Graph Neural Networks-based Hardware Security Systems