Backdoor Attacks to Graph Neural Networks
Open accessAbstract
In this work, we propose the first backdoor attack to graph neural networks (GNN). Specifically, we propose a subgraph based backdoor attack to GNN for graph classification. In our backdoor attack, a GNN classifier predicts an attacker-chosen target label for a testing graph once a predefined subgraph is injected to the testing graph. Our empirical results on three real-world graph datasets show that our backdoor attacks are effective with a small impact on a GNN's prediction accuracy for clean testing graphs. Moreover, we generalize a randomized smoothing based certified defense to defend against our backdoor attacks. Our empirical results show that the defense is effective in some cases but ineffective in other cases, highlighting the needs of new defenses for our backdoor attacks.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In random trigger-based backdoor attacks, the trigger is generated independently of the model.
“In a random trigger-based backdoor attack, the trigger is generated independently of the model [122], [140], [169], [170].”
From Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey (2024) · cites this paper as [169]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Emergence of Scaling in Random Networks
Barabási, A.-L., & Albert, R. (1999) · Science · doi:10.1126/science.286.5439.509 · Cited by 36,135 · see citing works
Semi-supervised classification with graph convolutional networks
Kipf, T. N., & Welling, M. (2016) · arXiv · doi:10.48550/arxiv.1609.02907 · Cited by 24,853 · see citing works
Veličković, P., Cucurull, G., Casanova, A., Romero, A., Liò, P., & Bengio, Y. (2017) · arXiv · doi:10.48550/arxiv.1710.10903 · Cited by 12,107
Inductive Representation Learning on Large Graphs
Hamilton, W. L., Ying, R., & Leskovec, J. (2017) · arXiv · doi:10.48550/arxiv.1706.02216 · Cited by 10,639 · see citing works
Bollobás, B. (1985) · Cited by 6,196 · see citing works
THE USE OF CONFIDENCE OR FIDUCIAL LIMITS ILLUSTRATED IN THE CASE OF THE BINOMIAL
Clopper, C. J., & Pearson, E. S. (1934) · Biometrika · doi:10.1093/biomet/26.4.404 · Cited by 5,106 · see citing works
Formal Semantics for Kolmogorov-Arnold Network Representations of Operational GamesPreprint
Zhukov, G. A. (2025) · Zenodo (CERN European Organization for Nuclear Research) · doi:10.5281/zenodo.15206559 · Cited by 3,385 · see citing works
The rise of deep learning in drug discovery
Chen, H., Engkvist, O., Wang, Y., Olivecrona, M., & Blaschke, T. (2018) · Drug Discovery Today · doi:10.1016/j.drudis.2018.01.039 · Cited by 1,770 · see citing works
Trojaning Attack on Neural Networks
Liu, Y., Ma, S., Aafer, Y., Lee, W.-C., Zhai, J., Wang, W., & Zhang, X. (2018) · Proceedings 2018 Network and Distributed System Security Symposium · doi:10.14722/ndss.2018.23291 · Cited by 1,270 · see citing works
Gilbert, E. N. (1959) · The Annals of Mathematical Statistics · doi:10.1214/aoms/1177706098 · Cited by 1,122 · see citing works
Yanardag, P., & Vishwanathan, S. V. N. (2015) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/2783258.2783417 · Cited by 1,108 · see citing works
Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
Chen, X., Liu, C., Li, B., Lu, K., & Song, D. (2017) · arXiv · doi:10.48550/arxiv.1712.05526 · Cited by 1,039 · see citing works
Adversarial Attacks on Neural Networks for Graph Data
Zügner, D., Akbarnejad, A., & Günnemann, S. (2018) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3219819.3220078 · Cited by 997 · see citing works
Self-Attention Graph PoolingPreprint
Lee, J., Lee, I., & Kang, J. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1904.08082 · Cited by 869 · see citing works
Certified Robustness to Adversarial Examples with Differential Privacy
Lecuyer, M., Atlidakis, V., Geambasu, R., Hsu, D., & Jana, S. (2019) · 2019 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2019.00044 · Cited by 750 · see citing works
Gao, Y., Xu, C., Wang, D., Chen, S., Ranasinghe, D. C., & Nepal, . (2019) · Annual Computer Security Applications Conference · doi:10.1145/3359789.3359790 · Cited by 719 · see citing works
Spectral Signatures in Backdoor AttacksPreprint
Tran, B., Li, J. Z., & Mądry, A. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1811.00636 · Cited by 506 · see citing works
ABS: Scanning Neural Networks for Back-doors by Artificial Brain Stimulation
Liu, Y., Lee, W., Tao, G., Ma, S., Aafer, Y., & Zhang, X. (2019) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3319535.3363216 · Cited by 419 · see citing works
Towards Robust Neural Networks via Random Self-ensemble
Liu, X., Cheng, M., Zhang, H., & Hsieh, C. (2018) · Lecture notes in computer science · doi:10.1007/978-3-030-01234-2_23 · Cited by 408 · see citing works
Adversarial Attacks on Graph Neural Networks via Meta LearningPreprint
Zügner, D., & Günnemann, S. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1902.08412 · Cited by 371 · see citing works
Latent Backdoor Attacks on Deep Neural Networks
Yao, Y., Li, H., Zheng, H.-T., & Zhao, B. Y. (2019) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3319535.3354209 · Cited by 370 · see citing works
Adversarial Attacks on Neural Networks for Graph Data
Zügner, D., Akbarnejad, A., & Günnemann, S. (2019) · International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2019/872 · Cited by 313 · see citing works
Liu, Y., Xie, Y., & Srivastava, A. (2017) · 2017 IEEE International Conference on Computer Design (ICCD) · doi:10.1109/iccd.2017.16 · Cited by 241 · see citing works
Dynamic Backdoor Attacks Against Machine Learning Models
Salem, A., Wen, R., Michael Backes, A., Ma, S., & Zhang, Y. (2022) · IEEE European Symposium on Security and Privacy · doi:10.1109/eurosp53844.2022.00049 · Cited by 227 · see citing works
Certified Adversarial Robustness with Additive NoisePreprint
Li, B., Chen, C., Wang, W., & Carin, L. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1809.03113 · Cited by 225 · see citing works
Adversarial Attacks on Node Embeddings via Graph PoisoningPreprint
Bojchevski, A., & Günnemann, S. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1809.01093 · Cited by 207 · see citing works
Kong, D., & Yan, G. (2013) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/2487575.2488219 · Cited by 188 · see citing works
SybilBelief: A Semi-Supervised Learning Approach for Structure-Based Sybil Detection
Gong, N. Z., Frank, M., & Mittal, P. (2014) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2014.2316975 · Cited by 177 · see citing works
Self-citationMitigating Evasion Attacks to Deep Neural Networks via Region-based Classification
Cao, X., & Gong, N. Z. (2017) · Annual Computer Security Applications Conference · doi:10.1145/3134600.3134606 · Cited by 176 · see citing works
Self-citationTABOR: A Highly Accurate Approach to Inspecting and Restoring Trojan Backdoors in AI SystemsPreprint
Guo, W., Wang, L., Xing, X., Du, M., & Song, D. X. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1908.01763 · Cited by 154 · see citing works
Classifying Malware Represented as Control Flow Graphs using Deep Graph Convolutional Neural Network
Yan, J., Yan, G., & Jin, D. (2019) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn.2019.00020 · Cited by 152 · see citing works
Random Walk Based Fake Account Detection in Online Social Networks
Jia, J., Wang, B., & Gong, N. Z. (2017) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn.2017.55 · Cited by 147 · see citing works
Self-citationAttacking Graph-based Classification via Manipulating the Graph Structure
Wang, B., & Gong, N. Z. (2019) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3319535.3354206 · Cited by 140 · see citing works
Self-citationHierarchical Graph Pooling with Structure LearningPreprint
Zhang, Z., Bu, J., Ester, M., Zhang, J., Yao, C., Yu, Z. H., & Wang, C. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1911.05954 · Cited by 135 · see citing works
Self-citationWeber, M., Domeniconi, G., Chen, J., et al. (2019) · RePEc: Research Papers in Economics · doi:10.48550/arxiv.1908.02591 · Cited by 114 · see citing works
SybilSCAR: Sybil detection in online social networks via local rule based propagation
Wang, B., Zhang, L., & Gong, N. Z. (2017) · IEEE Conference on Computer Communications (INFOCOM) · doi:10.1109/infocom.2017.8057066 · Cited by 103 · see citing works
Self-citationScalable Function Call Graph-based Malware Classification
Hassen, M., & Chan, P. K. (2017) · doi:10.1145/3029806.3029824 · Cited by 99 · see citing works
Wang, B., Gong, N. Z., & Fu, H. (2017) · Proceedings · doi:10.1109/icdm.2017.56 · Cited by 92 · see citing works
Self-citationDiscriminant malware distance learning on structuralinformation for automated malware classification
Kong, D., & Yan, G. (2013) · ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems (SIGMETRICS) · doi:10.1145/2465529.2465531 · Cited by 77 · see citing works
Jia, J., Wang, B., Cao, X., & Gong, N. Z. (2020) · International World Wide Web Conference (WWW) · doi:10.1145/3366423.3380029 · Cited by 74 · see citing works
Self-citationHardware Trojan Attacks on Neural NetworksPreprint
Clements, J., & Lao, Y. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1806.05768 · Cited by 73 · see citing works
Practical Attacks Against Graph-based Clustering
Chen, Y., Nadji, Y., Kountouras, A., Monrose, F., Perdisci, R., Antonakakis, M., & Vasiloglou, N. (2017) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3133956.3134083 · Cited by 72 · see citing works
Robustness Certificates for Sparse Adversarial Attacks by Randomized Ablation
Levine, A., & Feizi, S. (2020) · AAAI Publications (The Association for the Advancement of Artificial Intelligence (AAAI)) · doi:10.1609/aaai.v34i04.5888 · Cited by 67 · see citing works
On Certifying Robustness against Backdoor Attacks via Randomized SmoothingPreprint
Wang, B., Cao, X., jia, J., & Gong, N. Z. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2002.11750 · Cited by 63 · see citing works
Self-citationLearning Graph-Level Representation for Drug DiscoveryPreprint
Li, J., Cai, D., & He, X. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1709.03741 · Cited by 62 · see citing works
Hu-Fu: Hardware and Software Collaborative Attack Framework Against Neural Networks
Li, W., Yu, J., Ning, X., Wang, P., Wei, Q., Wang, Y., & Yang, H. (2018) · IEEE Computer Society Annual Symposium on VLSI · doi:10.1109/isvlsi.2018.00093 · Cited by 60 · see citing works
Jia, J., Cao, X., Wang, B., & Gong, N. Z. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1912.09899 · Cited by 60 · see citing works
Self-citationTight Certificates of Adversarial Robustness for Randomly Smoothed ClassifiersPreprint
Lee, G.-H., Yang, Y., Chang, S., & Jaakkola, T. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1906.04948 · Cited by 57 · see citing works
An Exact Penalty Method for Binary Optimization Based on MPEC Formulation
Yuan, G., & Ghanem, B. (2017) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v31i1.10795 · Cited by 52 · see citing works
Wang, B., Jia, J., & Gong, N. Z. (2019) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2019.23226 · Cited by 50 · see citing works
Self-citationRAB: Provable Robustness Against Backdoor AttacksPreprint
Weber, M., Xu, X., Karlaš, B., et al. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2003.08904 · Cited by 46 · see citing works
Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural NetworksPreprint
Liu, K., Dolan-Gavitt, B., & Garg, S. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1805.12185 · Cited by 35 · see citing works
Neural TrojansPreprint
Liu, Y., Xie, Y., & Srivastava, A. (2017) · arXiv (Cornell University) · Cited by 25 · see citing works
Hu-Fu: Hardware and Software Collaborative Attack Framework against Neural NetworksPreprint
Li, W., Yu, J., Ning, X., et al. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1805.05098 · Cited by 7 · see citing works
Flagged first, then by citations
Research works printed but not linked: 7
- Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. 2019. Certified Adversarial Robustness via Randomized Smoothing. In ICML.
- Hanjun Dai, Hui Li, Tian Tian, Xin Huang, Lin Wang, Jun Zhu, and Le Song. 2018. Adversarial Attack on Graph Structured Data. In ICML.
- Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. 2017. Badnets: Identifying vulnerabilities in the machine learning model supply chain. In Proc. of Machine Learning and Computer Security Workshop.
- Jerzy Neyman and Egon Sharpe Pearson. 1933. IX. On the problem of the most efficient tests of statistical hypotheses. Philosophical Transactions of the Royal Society of London. Series A (1933).
- Stavros D Nikolopoulos and Iosif Polenakis. 2017. A graph-based model for mal- ware detection and classification using system-call groups. Journal of Computer Virology and Hacking Techniques (2017).
- Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y Zhao. 2019. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In IEEE S&P.
- Keyulu Xu, Weihua Hu, Jure Leskovec, and Stefanie Jegelka. 2019. How powerful are graph neural networks?. In ICLR.
Cited by
Sorted by citations
FLTrust: Byzantine-robust Federated Learning via Trust Bootstrapping
Cao, X., Fang, M., Liu, J., & Gong, N. Z. (2021) · Proceedings 2021 Network and Distributed System Security Symposium · doi:10.14722/ndss.2021.24434 · Cited by 999 · see citing works
Self-citationLi, Y., Jiang, Y., Li, Z., & Xia, S.-T. (2024) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2022.3182979 · Cited by 682 · see citing works
Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks
Liu, Y., Ma, X., Bailey, J., & Lu, F. (2020) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-58607-2_11 · Cited by 531 · see citing works
Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defenses
Goldblum, M., Tsipras, D., Xie, C., Chen, X., Schwarzschild, A., Song, D., Madry, A., Li, B., & Goldstein, T. (2023) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2022.3162397 · Cited by 362 · see citing works
Wan, Y., Qu, Y., Ni, W., Xiang, Y., Gao, L., & Hossain, E. (2024) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2024.3361451 · Cited by 152 · see citing works
“(cid:129) In a random trigger-based backdoor attack, the trigger is generated independently of the model [122], [140], [169], [170].”
BackgroundMotif-Backdoor: Rethinking the Backdoor Attack on Graph Neural Networks via Motifs
Zheng, H., Xiong, H., Chen, J., Ma, H., & Huang, G. (2024) · IEEE Transactions on Computational Social Systems · doi:10.1109/tcss.2023.3267094 · Cited by 41 · see citing works
PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models
Zou, W., Geng, R., Wang, B., & Jia, J. (2024) · arXiv · doi:10.48550/arxiv.2402.07867 · Cited by 16 · see citing works
Self-citationYe, J., Mao, Y., Song, J., Wang, X., Jin, C., & Song, M. (2022) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v36i3.20219 · Cited by 1 · see citing works
- Authors
- Zhang, Z., Jia, J., Wang, B., & Gong, N. Z.
- Affiliations
- Duke University (US)
- Venue
- Proceedings of the 26th ACM Symposium on Access Control Models and Technologies
- Publisher
- ACM
- Published
- 2021-06-11
- Pages
- 15-26
- OpenAlex
- W3167334189
- Cited by
- 220
- References
- 54
- Citations by year
- 2026: 22 · 2025: 52 · 2024: 43 · 2023: 37 · 2022: 33 · 2021: 22 · 2020: 11
- FWCI
- 15.46
- Type
- conference paper
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- ACM Symposium on Access Control Models and Technologies (SACMAT) (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University) (cc-by)
- Funders
- NSF (National Science Foundation) (1937787)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Artificial Intelligence › Advanced Graph Neural Networks
- Keywords
- backdoor attacks, graph neural networks, graph classification, adversarial attacks, randomized smoothing, certified defenses, robustness
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
