Stealthy Yet Effective: Distribution-Preserving Backdoor Attacks on Graph Classification

2025-09-30

AI Summary

Existing graph classification backdoor attacks suffer from poor stealth due to dual biases—structural bias induced by rare subgraph triggers and semantic bias caused by label flipping—making them easily detectable by anomaly detection methods. Method: This paper identifies this dual-bias phenomenon as the root cause of insufficient stealth and proposes a clean-label, distribution-preserving backdoor attack framework. It introduces an anomaly-aware discriminator to constrain the trigger distribution, integrated with adversarial training and subgraph generation to jointly optimize stealth and attack efficacy. Contribution/Results: The method achieves high attack success rates without altering original labels or introducing conspicuous structural or semantic anomalies, significantly reducing detectability by anomaly detectors. Extensive experiments on multiple real-world graph datasets demonstrate that our approach outperforms state-of-the-art methods in both stealth and effectiveness.

Technology Category

• Machine Learning: Graph-based Machine Learning
• Computer Vision: Adversarial Attacks & Robustness
• Data Mining & Knowledge Management: Graph Mining, Social Network Analysis & Community

Application Category

• Graph Algorithms and Modeling for the Web: Representation, reconstruction, and subgraph or motif discovery in Web-related graphs
• Semantics and Knowledge: Scalable techniques for the creation, curation, publication, maintenance, and consumption of large, Web-based, structured, reusable, knowledge graphs and ontologies
• Web Mining and Content Analysis: Robustness and generalizability of Web mining methods

Abstract

Graph Neural Networks (GNNs) have demonstrated strong performance across tasks such as node classification, link prediction, and graph classification, but remain vulnerable to backdoor attacks that implant imperceptible triggers during training to control predictions. While node-level attacks exploit local message passing, graph-level attacks face the harder challenge of manipulating global representations while maintaining stealth. We identify two main sources of anomaly in existing graph classification backdoor methods: structural deviation from rare subgraph triggers and semantic deviation caused by label flipping, both of which make poisoned graphs easily detectable by anomaly detection models. To address this, we propose DPSBA, a clean-label backdoor framework that learns in-distribution triggers via adversarial training guided by anomaly-aware discriminators. DPSBA effectively suppresses both structural and semantic anomalies, achieving high attack success while significantly improving stealth. Extensive experiments on real-world datasets validate that DPSBA achieves a superior balance between effectiveness and detectability compared to state-of-the-art baselines.

Problem

• Addresses vulnerability of GNNs to stealthy graph classification backdoor attacks
• Reduces structural and semantic anomalies in poisoned graph datasets
• Improves stealth while maintaining high attack success through in-distribution triggers

Innovation

• Learns in-distribution triggers via adversarial training
• Suppresses structural and semantic anomalies effectively
• Achieves high attack success with improved stealth