{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/distributed-backdoor-attacks-on-federated","title":"Distributed Backdoor Attacks on Federated Graph Learning and Certified Defenses","arxiv_id":"2407.08935","date":"2024-07-12","proceeding":null,"authors":["Yuxin Yang","Qiang Li","Jinyuan Jia","Yuan Hong","Binghui Wang"],"abstract":"Federated graph learning (FedGL) is an emerging federated learning (FL) framework that extends FL to learn graph data from diverse sources. FL for non-graph data has shown to be vulnerable to backdoor attacks, which inject a shared backdoor trigger into the training data such that the trained backdoored FL model can predict the testing data containing the trigger as the attacker desires. However, FedGL against backdoor attacks is largely unexplored, and no effective defense exists. In this paper, we aim to address such significant deficiency. First, we propose an effective, stealthy, and persistent backdoor attack on FedGL. Our attack uses a subgraph as the trigger and designs an adaptive trigger generator that can derive the effective trigger location and shape for each graph. Our attack shows that empirical defenses are hard to detect/remove our generated triggers. To mitigate it, we further develop a certified defense for any backdoored FedGL model against the trigger with any shape at any location. Our defense involves carefully dividing a testing graph into multiple subgraphs and designing a majority vote-based ensemble classifier on these subgraphs. We then derive the deterministic certified robustness based on the ensemble classifier and prove its tightness. We extensively evaluate our attack and defense on six graph datasets. Our attack results show our attack can obtain > 90% backdoor accuracy in almost all datasets. Our defense results show, in certain cases, the certified accuracy for clean testing graphs against an arbitrary trigger with size 20 can be close to the normal accuracy under no attack, while there is a moderate gap in other cases. Moreover, the certified backdoor accuracy is always 0 for backdoored testing graphs generated by our attack, implying our defense can fully mitigate the attack. Source code is available at: https://github.com/Yuxin104/Opt-GDBA.","url_abs":"https://arxiv.org/abs/2407.08935v1","url_pdf":"https://arxiv.org/pdf/2407.08935v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"links_only","authors_date_abstract":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license), from the Kaggle arXiv metadata snapshot of 2026-09-12"},"code_links":[{"paper_slug":"distributed-backdoor-attacks-on-federated","repo_url":"https://github.com/yuxin104/opt-gdba","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok"}}],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2407.08935","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2407.08935"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/yuxin104/opt-gdba","reach":{"status":"ok"}}],"summary":{"ran":7,"unverified":1},"by_repo_kind":{"official":{"samples":8,"ran":7,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":8,"samples":[{"code_sha256_prefix":"55a5196003fc859b","entry":"detection","repo":"yuxin104/opt-gdba","repo_kind":"official","path":"OptGDBA.py","file_url":"https://github.com/yuxin104/opt-gdba/blob/HEAD/OptGDBA.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"55a5196003fc859b"}},{"code_sha256_prefix":"8c93324f965cc0e8","entry":"detection1","repo":"yuxin104/opt-gdba","repo_kind":"official","path":"OptGDBA.py","file_url":"https://github.com/yuxin104/opt-gdba/blob/HEAD/OptGDBA.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"8c93324f965cc0e8"}},{"code_sha256_prefix":"0301e027b9ea89e6","entry":"gen_input","repo":"yuxin104/opt-gdba","repo_kind":"official","path":"input.py","file_url":"https://github.com/yuxin104/opt-gdba/blob/HEAD/input.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"0301e027b9ea89e6"}},{"code_sha256_prefix":"d177f15002e244c0","entry":"gen_mask","repo":"yuxin104/opt-gdba","repo_kind":"official","path":"mask.py","file_url":"https://github.com/yuxin104/opt-gdba/blob/HEAD/mask.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"d177f15002e244c0"}},{"code_sha256_prefix":"fd6603e69806c7a3","entry":"recover_mask","repo":"yuxin104/opt-gdba","repo_kind":"official","path":"mask.py","file_url":"https://github.com/yuxin104/opt-gdba/blob/HEAD/mask.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"fd6603e69806c7a3"}},{"code_sha256_prefix":"00267d100f227e59","entry":"separate_data","repo":"yuxin104/opt-gdba","repo_kind":"official","path":"util.py","file_url":"https://github.com/yuxin104/opt-gdba/blob/HEAD/util.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"00267d100f227e59"}},{"code_sha256_prefix":"c2597a89f0e5425f","entry":"trigger_top","repo":"yuxin104/opt-gdba","repo_kind":"official","path":"OptGDBA.py","file_url":"https://github.com/yuxin104/opt-gdba/blob/HEAD/OptGDBA.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"c2597a89f0e5425f"}},{"code_sha256_prefix":"acfa0eb8baaab9f7","entry":"load_data","repo":"yuxin104/opt-gdba","repo_kind":"official","path":"util.py","file_url":"https://github.com/yuxin104/opt-gdba/blob/HEAD/util.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"acfa0eb8baaab9f7"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}