Backdoor Attacks to Graph Neural Networks
arXiv:2006.11165
Abstract
In this work, we propose the first backdoor attack to graph neural networks (GNN). Specifically, we propose a \emph{subgraph based backdoor attack} to GNN for graph classification. In our backdoor attack, a GNN classifier predicts an attacker-chosen target label for a testing graph once a predefined subgraph is injected to the testing graph. Our empirical results on three real-world graph datasets show that our backdoor attacks are effective with a small impact on a GNN's prediction accuracy for clean testing graphs. Moreover, we generalize a randomized smoothing based certified defense to defend against our backdoor attacks. Our empirical results show that the defense is effective in some cases but ineffective in other cases, highlighting the needs of new defenses for our backdoor attacks.
arXiv commentIn ACM SACMAT, 2021
References in corpus (18)
- Emergence of scaling in random networks
- Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
- Adversarial Attacks on Neural Networks for Graph Data
- BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
- Certified Adversarial Robustness via Randomized Smoothing
- Adversarial Attacks on Graph Neural Networks via Meta Learning
- Spectral Signatures in Backdoor Attacks
- SybilBelief: A Semi-supervised Learning Approach for Structure-based Sybil Detection
- Certified Adversarial Robustness with Additive Noise
- Adversarial Attacks on Node Embeddings via Graph Poisoning
- TABOR: A Highly Accurate Approach to Inspecting and Restoring Trojan Backdoors in AI Systems
- Hierarchical Graph Pooling with Structure Learning
- Anti-Money Laundering in Bitcoin: Experimenting with Graph Convolutional Networks for Financial Forensics
- Learning Graph-Level Representation for Drug Discovery
- Hardware Trojan Attacks on Neural Networks
- On Certifying Robustness against Backdoor Attacks via Randomized Smoothing
- Tight Certificates of Adversarial Robustness for Randomly Smoothed Classifiers
- Certified Robustness for Top-k Predictions against Adversarial Perturbations via Randomized Smoothing