Universal Graph Backdoor Defense: A Feature-based Homophily Perspective

2026-05-16

AI Summary

Existing graph backdoor defense methods struggle to counter feature-based attacks that preserve the original graph topology. This work presents the first unified defense framework capable of addressing both subgraph-based and feature-based backdoor attacks by leveraging feature homophily. The approach models local feature consistency between each node and its neighborhood, uncovering a common homophily deviation exhibited by backdoored nodes. To mitigate trigger effects and reduce detection noise, the framework incorporates a neighbor-aware reconstruction loss and a robust training strategy. Extensive experiments demonstrate that the proposed method significantly reduces attack success rates across diverse backdoor settings while maintaining classification accuracy comparable to that of clean models.

Abstract

Graph neural networks (GNNs) have achieved remarkable success in relational learning. However, their vulnerability to graph backdoor attacks (GBAs) poses a significant barrier to broader adoption in high-stakes applications. Despite recent advances in graph backdoor defense (GBD), existing methods primarily focus on subgraph-based GBAs, relying on the assumption that poisoned target nodes are explicitly connected to subgraph triggers. Our empirical results reveal that such structure-centric approaches fail to defend against emerging feature-based GBAs that preserve graph topology. Therefore, in this paper, we study a novel problem of universal graph backdoor defense. First, we investigate the shared effects of both attack types from a feature-based homophily perspective, which characterizes local feature consistency between nodes and their neighborhoods. Thorough theoretical and empirical analyses demonstrate that, regardless of trigger mechanisms, backdoors induced by GBAs exhibit lower feature-based homophily than clean nodes, indicating a discrepancy in local feature similarity. Motivated by this insight, we propose to leverage node-level local feature consistency, modeled by a neighbor-aware reconstruction loss, to distinguish backdoors from clean nodes. Then, a robust training strategy is developed to eliminate trigger effects while reducing noise induced by detection uncertainty. Extensive experiments demonstrate that our framework significantly degrades the attack success rate and maintains competitive clean accuracy under both subgraph-based and feature-based attacks.

Problem

• graph backdoor defense
• feature-based attack
• subgraph-based attack
• graph neural networks
• homophily

Innovation

• feature-based homophily
• graph backdoor defense
• neighbor-aware reconstruction
• universal defense
• local feature consistency