{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/rethinking-graph-backdoor-attacks-a","title":"Rethinking Graph Backdoor Attacks: A Distribution-Preserving Perspective","arxiv_id":"2405.10757","date":"2024-05-17","proceeding":null,"authors":["Zhiwei Zhang","Minhua Lin","Enyan Dai","Suhang Wang"],"abstract":"Graph Neural Networks (GNNs) have shown remarkable performance in various tasks. However, recent works reveal that GNNs are vulnerable to backdoor attacks. Generally, backdoor attack poisons the graph by attaching backdoor triggers and the target class label to a set of nodes in the training graph. A GNN trained on the poisoned graph will then be misled to predict test nodes attached with trigger to the target class. Despite their effectiveness, our empirical analysis shows that triggers generated by existing methods tend to be out-of-distribution (OOD), which significantly differ from the clean data. Hence, these injected triggers can be easily detected and pruned with widely used outlier detection methods in real-world applications. Therefore, in this paper, we study a novel problem of unnoticeable graph backdoor attacks with in-distribution (ID) triggers. To generate ID triggers, we introduce an OOD detector in conjunction with an adversarial learning strategy to generate the attributes of the triggers within distribution. To ensure a high attack success rate with ID triggers, we introduce novel modules designed to enhance trigger memorization by the victim model trained on poisoned graph. Extensive experiments on real-world datasets demonstrate the effectiveness of the proposed method in generating in distribution triggers that can by-pass various defense strategies while maintaining a high attack success rate.","url_abs":"https://arxiv.org/abs/2405.10757v3","url_pdf":"https://arxiv.org/pdf/2405.10757v3.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"rethinking-graph-backdoor-attacks-a","repo_url":"https://github.com/zzwjames/dpgba","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok"}}],"tasks":[{"task_slug":"backdoor-attack","task_name":"Backdoor Attack"},{"task_slug":"memorization","task_name":"Memorization"},{"task_slug":"outlier-detection","task_name":"Outlier Detection"}],"methods":[{"method_slug":"set","method_name":"SET"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2405.10757","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2405.10757"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/zzwjames/dpgba","reach":{"status":"ok"}}],"summary":{"ran":7},"by_repo_kind":{"official":{"samples":7,"ran":7,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":7,"samples":[{"code_sha256_prefix":"031697fa4856f0d8","entry":"GCNAdjNorm","repo":"zzwjames/dpgba","repo_kind":"official","path":"DPGBA/run/models/RobustGCN.py","file_url":"https://github.com/zzwjames/dpgba/blob/HEAD/DPGBA/run/models/RobustGCN.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"031697fa4856f0d8"}},{"code_sha256_prefix":"17e5f0c32d079478","entry":"clu_prune_unrelated_edge","repo":"zzwjames/dpgba","repo_kind":"official","path":"DPGBA/run/help_funcs.py","file_url":"https://github.com/zzwjames/dpgba/blob/HEAD/DPGBA/run/help_funcs.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"17e5f0c32d079478"}},{"code_sha256_prefix":"6146c5fcef9e81f3","entry":"edge_sim_analysis","repo":"zzwjames/dpgba","repo_kind":"official","path":"DPGBA/run/help_funcs.py","file_url":"https://github.com/zzwjames/dpgba/blob/HEAD/DPGBA/run/help_funcs.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"6146c5fcef9e81f3"}},{"code_sha256_prefix":"9f2e2960cd2522f1","entry":"max_norm","repo":"zzwjames/dpgba","repo_kind":"official","path":"DPGBA/run/heuristic_selection.py","file_url":"https://github.com/zzwjames/dpgba/blob/HEAD/DPGBA/run/heuristic_selection.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"9f2e2960cd2522f1"}},{"code_sha256_prefix":"d9a8deac302c4489","entry":"obtain_attach_nodes","repo":"zzwjames/dpgba","repo_kind":"official","path":"DPGBA/run/heuristic_selection.py","file_url":"https://github.com/zzwjames/dpgba/blob/HEAD/DPGBA/run/heuristic_selection.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"d9a8deac302c4489"}},{"code_sha256_prefix":"a3cc7d50b2b12549","entry":"obtain_attach_nodes_by_cluster","repo":"zzwjames/dpgba","repo_kind":"official","path":"DPGBA/run/heuristic_selection.py","file_url":"https://github.com/zzwjames/dpgba/blob/HEAD/DPGBA/run/heuristic_selection.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"a3cc7d50b2b12549"}},{"code_sha256_prefix":"e3c6ff9b9c469f8c","entry":"prune_unrelated_edge","repo":"zzwjames/dpgba","repo_kind":"official","path":"DPGBA/run/help_funcs.py","file_url":"https://github.com/zzwjames/dpgba/blob/HEAD/DPGBA/run/help_funcs.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"e3c6ff9b9c469f8c"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}