Poisoning the Inner Prediction Logic of Graph Neural Networks for Clean-Label Backdoor Attacks
Summary: arXiv:2603.05004v2 Announce Type: replace-cross
Abstract
Graph Neural Networks (GNNs) have achieved remarkable results in various tasks. Recent studies reveal that graph backdoor attacks can poison the GNN model to predict test nodes with triggers attached as the target class. However, apart from injecting triggers to training nodes, these graph backdoor attacks generally require altering the labels of trigger-attached training nodes into the target class, which is impractical in real-world scenarios.
The Challenge of Clean-Label Graph Backdoor Attacks
In this work, we focus on the clean-label graph backdoor attack, a realistic but understudied topic where training labels are not modifiable. According to our preliminary analysis:
- Existing graph backdoor attacks generally fail under the clean-label setting.
- The core failure of these methods lies in their inability to poison the prediction logic of GNN models.
- This inadequacy results in the triggers being deemed unimportant for prediction.
Proposed Solution: BA-Logic
In response to these challenges, we study a novel problem of effective clean-label graph backdoor attacks by poisoning the inner prediction logic of GNN models. Our proposed method, BA-Logic, addresses this issue by:
- Coordinating a poisoned node selector.
- Employing a logic-poisoning trigger generator.
Experimental Validation
Extensive experiments on real-world datasets demonstrate that our method effectively enhances the attack success rate. Furthermore, BA-Logic surpasses state-of-the-art graph backdoor attack competitors under clean-label settings. This advancement suggests a significant step forward in the field of adversarial machine learning, particularly in the context of GNNs.
Conclusion
The research highlights the importance of addressing clean-label graph backdoor attacks, which are often overlooked. Our findings suggest that focusing on the inner prediction logic of GNNs can lead to more effective attack strategies. The implications of this work extend beyond theoretical frameworks, potentially informing future research and practical applications in the field of machine learning security.
Access to Research
For those interested in exploring our methodology further, the code is available at https://anonymous.4open.science/r/BA-Logic.