Graph-Aware Text-Only Backdoor Poisoning for Text-Attributed Graphs

2026-03-20

AI Summary

This work addresses the security risk of backdoor attacks on textual attributed graphs, where adversaries can compromise graph neural networks by solely manipulating node text. To this end, the authors propose TAGBD, a novel attack method that operates without altering the graph structure. TAGBD employs a graph-aware strategy to identify vulnerable nodes and leverages a shadow graph model to generate semantically natural trigger texts, which are injected via replacement or appending. Notably, this approach constitutes the first demonstration that node text alone serves as an effective attack vector for backdoor injection in graph neural networks. Extensive experiments on three benchmark datasets show that TAGBD achieves high attack success rates, exhibits strong transferability across different models, and remains robust against mainstream defense mechanisms.

Technology Category

• Machine Learning: Graph-based Machine Learning
• Natural Language Processing: Sentence-level Semantics, Textual Inference, etc.
• Computer Vision: Adversarial Attacks & Robustness

Application Category

• Graph Algorithms and Modeling for the Web: Graph neural networks and deep learning approaches for Web-related graphs
• Semantics and Knowledge: Methods to enhance, augment, integrate or synergize semantic models such as knowledge graphs and LLMs
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems

Abstract

Many learning systems now use graph data in which each node also contains text, such as papers with abstracts or users with posts. Because these texts often come from open platforms, an attacker may be able to quietly poison a small part of the training data and later make the model produce wrong predictions on demand. This paper studies that risk in a realistic setting where the attacker edits only node text and does not change the graph structure. We propose TAGBD, a text-only backdoor attack for text-attributed graphs. TAGBD first finds training nodes that are easier to influence, then generates natural-looking trigger text with the help of a shadow graph model, and finally injects the trigger by either replacing the original text or appending a short phrase. Experiments on three benchmark datasets show that the attack is highly effective, transfers across different graph models, and remains strong under common defenses. These results demonstrate that text alone is a practical attack channel in graph learning systems and suggest that future defenses should inspect both graph links and node content.

Problem

• text-attributed graphs
• backdoor poisoning
• graph learning
• adversarial attack
• node text

Innovation

• backdoor attack
• text-attributed graphs
• graph neural networks
• trigger generation
• data poisoning