Poisoning the Inner Prediction Logic of Graph Neural Networks for Clean-Label Backdoor Attacks

2026-03-05

AI Summary

Existing backdoor attacks on graph neural networks exhibit limited effectiveness under the clean-label setting, as they cannot alter training labels and struggle to manipulate the model’s internal prediction logic. This work addresses this challenge by introducing a novel paradigm that jointly designs a poisoning node selection strategy and a logic-oriented trigger generation mechanism to directly corrupt the model’s internal reasoning process, enabling effective backdoor implantation without any label modification. By leveraging both graph structure and node features for targeted poisoning, the proposed method significantly boosts attack success rates across multiple real-world graph datasets, outperforming current state-of-the-art approaches.

Technology Category

• Machine Learning: Graph-based Machine Learning
• Reasoning under Uncertainty: Graphical Models
• Data Mining & Knowledge Management: Graph Mining, Social Network Analysis & Community

Application Category

• Graph Algorithms and Modeling for the Web: Graph neural networks and deep learning approaches for Web-related graphs
• Semantics and Knowledge: Methods to enhance, augment, integrate or synergize semantic models such as knowledge graphs and LLMs
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking

Abstract

Graph Neural Networks (GNNs) have achieved remarkable results in various tasks. Recent studies reveal that graph backdoor attacks can poison the GNN model to predict test nodes with triggers attached as the target class. However, apart from injecting triggers to training nodes, these graph backdoor attacks generally require altering the labels of trigger-attached training nodes into the target class, which is impractical in real-world scenarios. In this work, we focus on the clean-label graph backdoor attack, a realistic but understudied topic where training labels are not modifiable. According to our preliminary analysis, existing graph backdoor attacks generally fail under the clean-label setting. Our further analysis identifies that the core failure of existing methods lies in their inability to poison the prediction logic of GNN models, leading to the triggers being deemed unimportant for prediction. Therefore, we study a novel problem of effective clean-label graph backdoor attacks by poisoning the inner prediction logic of GNN models. We propose BA-Logic to solve the problem by coordinating a poisoned node selector and a logic-poisoning trigger generator. Extensive experiments on real-world datasets demonstrate that our method effectively enhances the attack success rate and surpasses state-of-the-art graph backdoor attack competitors under clean-label settings. Our code is available at https://anonymous.4open.science/r/BA-Logic

Problem

• clean-label backdoor attack
• Graph Neural Networks
• prediction logic poisoning
• trigger
• adversarial attack

Innovation

• clean-label backdoor attack
• graph neural networks
• prediction logic poisoning
• trigger generation
• node selection