Collateral Damage Constrained Backdoor Attacks on Graph Neural Networks
Collateral Damage Constrained Backdoor Attacks on Graph Neural Networks
Di Jin, Zechuan Zhang, Bingdao Feng, Xiaobao Wang, Dongxiao He, Zhen Wang
Proceedings of the Thirty-Fifth International Joint Conference on Artificial Intelligence
Main Track. Pages 2735-2743.
https://doi.org/10.24963/ijcai.2026/304
Graph Neural Networks (GNNs) are vulnerable to backdoor attacks, where models behave normally on clean data but exhibit targeted misclassifications once specific triggers are activated. Existing backdoor attacks on GNNs mainly focus on enhancing trigger stealthiness or diversifying attack paradigms. However, these methods overlook a fundamental property of GNNs: trigger-induced malicious signals inevitably propagate through graph neighborhoods, causing unintended mispredictions on clean nodes, i.e., Collateral Damage. To address this issue, we propose the Collateral Damage Constrained Graph Backdoor Attack (CDCA), a novel framework that explicitly controls malicious diffusion. Specifically, the proposed method combines neighborhood-aware target node selection with a self-constrained trigger generation strategy to suppress trigger-induced propagation by enforcing prediction consistency on clean K-hop neighboring nodes. Extensive experiments on real-world datasets demonstrate that the proposed method remains effective while significantly reducing collateral damage.
Keywords:
Data Mining: Mining graphs
Machine Learning: Adversarial machine learning
