Cross-Paradigm Graph Backdoor Attacks with Promptable Subgraph Triggers

2025-10-26

AI Summary

Existing graph neural network (GNN) backdoor attacks employ simplistic, feature-dependent triggers tailored to a single learning paradigm (e.g., supervised, contrastive, or prompt learning), exhibiting poor cross-paradigm transferability and neglecting graph structural complexity and node heterogeneity. Method: We propose PromptSubgraph—the first multi-paradigm universal backdoor attack framework—introducing graph prompt learning theory into trigger design. It constructs a compact, class-aware, feature-rich, and structure-faithful subgraph trigger library via subgraph distillation, class-aware encoding, structural consistency constraints, and multi-paradigm joint optimization. Contribution/Results: PromptSubgraph significantly enhances trigger transferability and robustness across diverse learning paradigms. Extensive experiments on multiple real-world datasets and under mainstream defenses demonstrate state-of-the-art attack success rates, validating its strong generalization capability and practical effectiveness.

Technology Category

• Machine Learning: Graph-based Machine Learning
• Search and Optimization: Learning to Search
• Game Theory and Economic Paradigms: Adversarial Learning

Application Category

• Graph Algorithms and Modeling for the Web: Representation, reconstruction, and subgraph or motif discovery in Web-related graphs
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking
• Semantics and Knowledge: Scalable techniques for the creation, curation, publication, maintenance, and consumption of large, Web-based, structured, reusable, knowledge graphs and ontologies

Abstract

Graph Neural Networks(GNNs) are vulnerable to backdoor attacks, where adversaries implant malicious triggers to manipulate model predictions. Existing trigger generators are often simplistic in structure and overly reliant on specific features, confining them to a single graph learning paradigm, such as graph supervised learning, graph contrastive learning, or graph prompt learning. This specialized design, which aligns the trigger with one learning objective, results in poor transferability when applied to other learning paradigms. For instance, triggers generated for the graph supervised learning paradigm perform poorly when tested within graph contrastive learning or graph prompt learning environments. Furthermore, these simple generators often fail to utilize complex structural information or node diversity within the graph data. These constraints limit the attack success rates of such methods in general testing scenarios. Therefore, to address these limitations, we propose Cross-Paradigm Graph Backdoor Attacks with Promptable Subgraph Triggers(CP-GBA), a new transferable graph backdoor attack that employs graph prompt learning(GPL) to train a set of universal subgraph triggers. First, we distill a compact yet expressive trigger set from target graphs, which is structured as a queryable repository, by jointly enforcing class-awareness, feature richness, and structural fidelity. Second, we conduct the first exploration of the theoretical transferability of GPL to train these triggers under prompt-based objectives, enabling effective generalization to diverse and unseen test-time paradigms. Extensive experiments across multiple real-world datasets and defense scenarios show that CP-GBA achieves state-of-the-art attack success rates.

Problem

• Addressing poor transferability of graph backdoor attacks across learning paradigms
• Overcoming simplistic triggers lacking complex structural and feature diversity
• Enhancing attack success rates in general graph learning scenarios

Innovation

• Employs graph prompt learning for universal subgraph triggers
• Distills compact triggers with class-awareness and structural fidelity
• Trains triggers for cross-paradigm transferability via prompt objectives