Unnoticeable Backdoor Attacks on Graph Neural Networks

Abstract

Graph Neural Networks (GNNs) have achieved promising results in various tasks such as node classification and graph classification. Recent studies find that GNNs are vulnerable to adversarial attacks. However, effective backdoor attacks on graphs are still an open problem. In particular, backdoor attack poisons the graph by attaching triggers and the target class label to a set of nodes in the training graph. The backdoored GNNs trained on the poisoned graph will then be misled to predict test nodes to target class once attached with triggers. Though there are some initial efforts in graph backdoor attacks, our empirical analysis shows that they may require a large attack budget for effective backdoor attacks and the injected triggers can be easily detected and pruned. Therefore, in this paper, we study a novel problem of unnoticeable graph backdoor attacks with limited attack budget. To fully utilize the attack budget, we propose to deliberately select the nodes to inject triggers and target class labels in the poisoning phase. An adaptive trigger generator is deployed to obtain effective triggers that are difficult to be noticed. Extensive experiments on real-world datasets against various defense strategies demonstrate the effectiveness of our proposed method in conducting effective unnoticeable backdoor attacks.

References in corpus (18)

• Model-Agnostic Meta-Learning for Fast Adaptation of Deep Networks
• Graph Convolutional Neural Networks for Web-Scale Recommender Systems
• Understanding Black-box Predictions via Influence Functions
• Adversarial Attacks on Neural Networks for Graph Data
• GCC: Graph Contrastive Coding for Graph Neural Network Pre-Training
• GNNExplainer: Generating Explanations for Graph Neural Networks
• Simple and Deep Graph Convolutional Networks
• Adversarial Attacks on Graph Neural Networks via Meta Learning
• GraphSAINT: Graph Sampling Based Inductive Learning Method
• Molecular graph generation with Graph Neural Networks
• GNNGuard: Defending Graph Neural Networks against Adversarial Attacks
• How to Find Your Friendly Neighborhood: Graph Attention Design with Self-Supervision
• Single Node Injection Attack against Graph Neural Networks
• Self-supervised Training of Graph Convolutional Networks
• Understanding and Improving Graph Injection Attack by Promoting Unnoticeability
• NRGNN: Learning a Label Noise-Resistant Graph Neural Network on Sparsely and Noisily Labeled Graphs
• Towards Robust Graph Neural Networks for Noisy Graphs with Sparse Labels
• Label-Wise Graph Convolutional Network for Heterophilic Graphs

Cited by in corpus (6)

• A Comprehensive Survey on Trustworthy Graph Neural Networks: Privacy, Robustness, Fairness, and Explainability
• Rethinking Graph Backdoor Attacks: A Distribution-Preserving Perspective
• Adaptive Backdoor Attacks with Reasonable Constraints on Graph Neural Networks
• PreGIP: Watermarking the Pretraining of Graph Neural Networks for Deep Intellectual Property Protection
• RIDA: A Robust Attack Framework on Incomplete Graphs
• LiSA: Leveraging Link Recommender to Attack Graph Neural Networks via Subgraph Injection