{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/cross-context-backdoor-attacks-against-graph","title":"Cross-Context Backdoor Attacks against Graph Prompt Learning","arxiv_id":"2405.17984","date":"2024-05-28","proceeding":null,"authors":["Xiaoting Lyu","Yufei Han","Wei Wang","Hangwei Qian","Ivor Tsang","Xiangliang Zhang"],"abstract":"Graph Prompt Learning (GPL) bridges significant disparities between pretraining and downstream applications to alleviate the knowledge transfer bottleneck in real-world graph learning. While GPL offers superior effectiveness in graph knowledge transfer and computational efficiency, the security risks posed by backdoor poisoning effects embedded in pretrained models remain largely unexplored. Our study provides a comprehensive analysis of GPL's vulnerability to backdoor attacks. We introduce \\textit{CrossBA}, the first cross-context backdoor attack against GPL, which manipulates only the pretraining phase without requiring knowledge of downstream applications. Our investigation reveals both theoretically and empirically that tuning trigger graphs, combined with prompt transformations, can seamlessly transfer the backdoor threat from pretrained encoders to downstream applications. Through extensive experiments involving 3 representative GPL methods across 5 distinct cross-context scenarios and 5 benchmark datasets of node and graph classification tasks, we demonstrate that \\textit{CrossBA} consistently achieves high attack success rates while preserving the functionality of downstream applications over clean input. We also explore potential countermeasures against \\textit{CrossBA} and conclude that current defenses are insufficient to mitigate \\textit{CrossBA}. Our study highlights the persistent backdoor threats to GPL systems, raising trustworthiness concerns in the practices of GPL techniques.","url_abs":"https://arxiv.org/abs/2405.17984v1","url_pdf":"https://arxiv.org/pdf/2405.17984v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"cross-context-backdoor-attacks-against-graph","repo_url":"https://github.com/xtLyu/CrossBA","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok"}}],"tasks":[{"task_slug":"backdoor-attack","task_name":"Backdoor Attack"},{"task_slug":"computational-efficiency","task_name":"Computational Efficiency"},{"task_slug":"graph-classification","task_name":"Graph Classification"},{"task_slug":"graph-learning","task_name":"Graph Learning"},{"task_slug":"prompt-learning","task_name":"Prompt Learning"},{"task_slug":"transfer-learning","task_name":"Transfer Learning"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2405.17984","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2405.17984"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/xtLyu/CrossBA","reach":{"status":"ok"}}],"summary":{"ran":6,"unverified":5},"by_repo_kind":{"official":{"samples":11,"ran":6,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":11,"samples":[{"code_sha256_prefix":"df1ea49a694f27c4","entry":"act","repo":"xtLyu/CrossBA","repo_kind":"official","path":"ProG/utils.py","file_url":"https://github.com/xtLyu/CrossBA/blob/HEAD/ProG/utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"df1ea49a694f27c4"}},{"code_sha256_prefix":"199dcbe35aa34b02","entry":"add_trigger_graph","repo":"xtLyu/CrossBA","repo_kind":"official","path":"attack/attack_data.py","file_url":"https://github.com/xtLyu/CrossBA/blob/HEAD/attack/attack_data.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"199dcbe35aa34b02"}},{"code_sha256_prefix":"ed69a9c84d978d2e","entry":"add_trigger_nodes","repo":"xtLyu/CrossBA","repo_kind":"official","path":"attack/attack_data.py","file_url":"https://github.com/xtLyu/CrossBA/blob/HEAD/attack/attack_data.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"ed69a9c84d978d2e"}},{"code_sha256_prefix":"9f59684e3e62b3be","entry":"gen_ran_output","repo":"xtLyu/CrossBA","repo_kind":"official","path":"ProG/utils.py","file_url":"https://github.com/xtLyu/CrossBA/blob/HEAD/ProG/utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"9f59684e3e62b3be"}},{"code_sha256_prefix":"ee04f3ea771abcc1","entry":"maml_update","repo":"xtLyu/CrossBA","repo_kind":"official","path":"ProG/meta.py","file_url":"https://github.com/xtLyu/CrossBA/blob/HEAD/ProG/meta.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"ee04f3ea771abcc1"}},{"code_sha256_prefix":"8ce725e40f16540f","entry":"update_module","repo":"xtLyu/CrossBA","repo_kind":"official","path":"ProG/meta.py","file_url":"https://github.com/xtLyu/CrossBA/blob/HEAD/ProG/meta.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"8ce725e40f16540f"}},{"code_sha256_prefix":"3425b06cc24cb577","entry":"clone_module","repo":"xtLyu/CrossBA","repo_kind":"official","path":"ProG/meta.py","file_url":"https://github.com/xtLyu/CrossBA/blob/HEAD/ProG/meta.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"3425b06cc24cb577"}},{"code_sha256_prefix":"5594488c1b955edd","entry":"load_data4pretrain","repo":"xtLyu/CrossBA","repo_kind":"official","path":"ProG/utils.py","file_url":"https://github.com/xtLyu/CrossBA/blob/HEAD/ProG/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"5594488c1b955edd"}},{"code_sha256_prefix":"4d85b4c0ff5d301d","entry":"mrr_hit","repo":"xtLyu/CrossBA","repo_kind":"official","path":"ProG/eva.py","file_url":"https://github.com/xtLyu/CrossBA/blob/HEAD/ProG/eva.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"4d85b4c0ff5d301d"}},{"code_sha256_prefix":"7734b9b9045feec2","entry":"multi_class_NIG","repo":"xtLyu/CrossBA","repo_kind":"official","path":"ProG/data.py","file_url":"https://github.com/xtLyu/CrossBA/blob/HEAD/ProG/data.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"7734b9b9045feec2"}},{"code_sha256_prefix":"d49880c2fe68f06a","entry":"multi_class_NIG_poison","repo":"xtLyu/CrossBA","repo_kind":"official","path":"attack/attack_data.py","file_url":"https://github.com/xtLyu/CrossBA/blob/HEAD/attack/attack_data.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"d49880c2fe68f06a"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}