Pith. sign in

REVIEW 5 major objections 5 minor 103 references

Fine-tuning is Not Fine: Mitigating Backdoor Attacks in GNNs with Limited Clean Data

T0 review · 5 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read GraphNAD claims a 3% clean-data sample suffices to scrub backdoors from graph neural networks, cutting attack success below 5%.

desk verdict New distillation-based GNN backdoor defense with a striking ASR<5% claim, but the test-set sampling protocol undercuts the headline until the evaluation is fixed. read the letter →

arxiv 2501.05835 v1 pith:SEYDM7HN submitted 2025-01-10 cs.LG cs.CR

Jiale Zhang , Bosen Rao , Chengcheng Zhu , Xiaobing Sun , Qingming Li , Haibo Hu , Xiapu Luo , Qingqing Ye
show 1 more author
Shouling Ji
This is my paper · ORCID
classification cs.LGcs.CR
keywords backdoordefensegraphneuralnetworksknowledgedistillationattentiontransferrelationcongruencelimitedcleandataattacks
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Backdoored graph neural networks are currently sanitized by fine-tuning or distillation methods that need 15-20% of the original training data to bring attack success down to 25%, an amount defenders rarely hold. This paper claims that with the right intermediate-layer knowledge, 3% of the test set is enough. The proposed method, GraphNAD, fine-tunes the backdoored model on that small clean subset to create a teacher, then aligns the student model's degree-weighted attention maps and inter-layer relation maps with the teacher's. Across four datasets and three backdoor attacks, GraphNAD reports attack success rates below 5% with near-negligible accuracy loss, and below 10% even when the clean data comes from a different public dataset. If the claim holds, backdoor mitigation becomes practical in the realistic setting where defenders possess only a small and not necessarily in-distribution sample.

What carries the argument

The load-bearing object is the degree-weighted graph attention map $\mathcal{A}_p(F^l) = \frac{D}{\max(D)}\sum_{i=1}^{C_l}|F^l(i)|^p$, which turns a layer's activation tensor $F^l$ into a per-node attention score: the $D/\max(D)$ factor injects topological information, and the exponent $p$ widens the gap between strongly activated trigger neurons and weakly activated benign neurons. The second mechanism, attention relation congruence, builds normalized inter-layer difference maps $R_{ij} = (F_i - F_j)/\|F_i - F_j\|_2$ and matches all teacher-student layer pairs with sliced Wasserstein distance, which the ablation study shows is what keeps main-task accuracy intact. The two losses are added to a cross-entropy term as $L = L_{CE} + \beta \sum_l L_{AD} + \gamma L_{RC}$, with the teacher being the backdoored model fine-tuned for ten epochs on the same 3% clean subset.

What would settle it

Replicate the pipeline but hold the 3% distillation subset out of the test set before computing ACC, and separately contaminate part of that 3% with triggers: if the reported accuracy falls materially once the distilled graphs are removed, or if attack success rises when the 'clean' subset is itself partly poisoned, the central claims fail. A second check comes from the paper's own limitations section: running GraphNAD on a two-layer GNN should raise attack success well above 5%.

Watch

Extended reading notes

Core claim

The paper's central discovery is that the bottleneck in distillation-based backdoor defense is the quality of the transferred knowledge, not the quantity of clean data. When intermediate activations of a backdoored GNN are matched directly to a fine-tuned teacher, backdoor and benign neurons look nearly identical on clean inputs, which is why prior methods need large clean sets. GraphNAD characterizes each layer by a degree-weighted attention map, $\mathcal{A}_p(F^l) = \frac{D}{\max(D)} \sum_{i=1}^{C_l} |F^l(i)|^p$, whose exponent $p$ amplifies the strongly activated trigger neurons so that even a tiny clean sample exposes the backdoor, and it supplements this with relation maps $R_{ij} = (F_i - F_j)/\|F_i - F_j\|_2$ that encode how layers transform information, matched to the teacher with sliced Wasserstein distance to preserve accuracy. With this two-part alignment, the paper reports reducing attack success below 5% on PROTEINS, COLLAB, AIDS, and Fingerprint under Sub-BA, GTA, and Motif-BA attacks while keeping accuracy essentially unchanged, and below 10% when auxiliary public datasets with different distributions stand in for clean data.

Load-bearing premise

The load-bearing premise is that the defender holds a small subset that is genuinely clean: the 3% is sampled from the test set as if unpoisoned, and the reported accuracy is then measured on that same test set with the distilled samples still included, even though the paper's own threat model says the defender cannot tell tainted graphs from benign ones.

Editorial extensions

If this is right

  • Backdoor mitigation for GNNs no longer depends on the original training set: 3% of clean test data yields attack success below 5%, down from the 15-20% clean data that fine-tuning and distillation defenses are reported to need.
  • The defense generalizes across GNN backbones (GCN, GAT, GIN, GraphSAGE), trigger sizes from 5% to 50% of graph size, and injection ratios from 1% to 9%, with attack success staying near or below a few percent in every reported configuration.
  • A defender with no same-distribution data can still use a public dataset of different distribution as the clean sample, reducing attack success below 10% at some cost in accuracy.
  • An attacker who knows the defense and tunes triggers against the attention-transfer loss still gets countered: the adaptive-attack experiments keep attack success below 10%.
  • The two modules divide the labor: attention transfer alone removes backdoors but damages accuracy, relation congruence alone preserves accuracy but leaves backdoors, and together they achieve the reported ASR 0.62% / ACC 97.50% on AIDS.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Not claimed by the paper: the reported accuracy may be optimistic because the 3% distillation sample is drawn from the testing set and the final ACC is measured on that same testing set without excluding those samples; holding the distilled graphs out is the natural next validation.
  • The paper's threat model grants the defender no knowledge of which graphs are tainted, yet the method presupposes a guaranteed-clean 3%; a follow-up question is how much ASR remains when part of the 'clean' subset itself carries triggers.
  • The attention operator with $p = 2$ is essentially a degree-weighted activation energy; ablating the degree factor $D/\max(D)$ would isolate how much of the gain comes from topology weighting versus the amplification exponent.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper proposes GraphNAD, a defense against backdoor attacks on GNNs. The method first fine-tunes the backdoored model on a small clean subset to obtain a teacher model, then distills the teacher's intermediate-layer knowledge into the backdoored student using a degree-weighted attention operator (Eq. 6), a sliced-Wasserstein relation-congruence loss (Eqs. 10-12), and a cross-entropy term. The authors report that with only 3% clean data, GraphNAD reduces the attack success rate to below 5% across four datasets and three attack methods, with a negligible accuracy loss. They also evaluate robustness to trigger size, injection ratio, model architecture, auxiliary datasets, and an adaptive attack.

Significance. If the headline result is reproducible under a clean evaluation protocol, GraphNAD would be a meaningful improvement over prior fine-tuning and distillation defenses, which require 15-20% clean data. The proposed degree-weighted attention representation is a plausible way to amplify backdoor-vs-benign neuron differences in GNNs, and the relation-congruence term is a reasonable addition for preserving accuracy under limited data. The auxiliary-dataset experiment (Table 4) and the adaptive-attack evaluation (Sec. 5.5) are valuable stress tests. However, the evaluation as presented does not yet support the headline: the clean-data source conflicts with the stated threat model, the test set is not held out from the distillation samples, key hyperparameters are selected on the same test data, and the claimed standard deviations are not reported. These issues are fixable with a corrected protocol and reruns, but they are load-bearing for the paper's central claim.

major comments (5)
  1. [Section 3 vs Section 5.1.6] The threat model states that the defender 'is kept unaware of both the tainted graph identities and the attacker's intended target label,' but Section 5.1.6 assumes GraphNAD 'can access 3% of the clean data randomly selected from the testing set.' If the test set is the same set on which ASR and ACC are measured in Section 5.2.1, a random sample from it is not guaranteed to be clean. If the defender instead knows which test graphs are clean, that knowledge is an oracle not specified in the threat model. Please either define a realistic mechanism by which the defender obtains a guaranteed-clean labeled subset (e.g., a separate small validation set collected independently of the poisoned training data), or revise the threat model to include this capability.
  2. [Section 5.1.6 and Table 3] The paper does not state that the 3% distilled samples are removed from the test set before computing the ACC reported in Table 3. If these samples remain in the test set, part of the reported 'negligible reduction in ACC' can reflect memorization of the distillation samples rather than generalization to unseen graphs. Please recompute ACC on a test set that excludes all samples used for fine-tuning and distillation, or explicitly state that such exclusion was performed and describe how it was done.
  3. [Sections 5.2.5, 5.2.6, and 5.4.1] The headline configuration (p=2, beta=gamma=1, pairs=full) is selected by evaluating ASR and ACC on the same four datasets that are then used to report the main results in Table 3. This means the reported 'ASR below 5%' is a selected value, not an unbiased estimate of performance under a fixed configuration. Please either perform model selection on a validation set that is held out from the final evaluation, or report the sensitivity of the main results across the explored hyperparameter ranges with confidence intervals.
  4. [Section 5.1.6 and Tables 3-8] Section 5.1.6 states that 'We test the performance of GraphNAD as well as other baselines five times and report the mean and standard deviation results to eliminate the effects of randomness,' but no standard deviations appear in Table 3 or in any of the other quantitative tables. Without variance estimates, it is difficult to assess whether the large ASR differences between GraphNAD and the baselines are statistically meaningful or within run-to-run noise. Please report mean and standard deviation (or confidence intervals) for all main results.
  5. [Section 6.2 and Table 3] Section 6.2 cites several graph-specific mitigation methods ([72], [74], [86], [93]) but none of them are included as baselines in Table 3. The comparison is limited to Prune, RS, and the CV-adapted ABL. Since GraphNAD is itself a graph-specific mitigation method, the claim that it surpasses 'SOTA defense methods' is not substantiated without at least one existing graph-specific defense as a baseline. Please add such a baseline, or explain concretely why those methods are not comparable and cannot be evaluated.
minor comments (5)
  1. [Eq. (9)] In Eq. (9), R_ij is defined using F_i and F_j, but it is not clear whether these are the raw activations or the attention representations from Eq. (6). Please clarify the notation so that the relation matrix is unambiguously defined.
  2. [Algorithm 1] Line 12 of Algorithm 1 uses F_b(x) in the cross-entropy loss, but F_b is not defined anywhere; it should likely be F_S(x), the student model. Please correct this.
  3. [Table 1 and surrounding text] The caption 'Before (in average): ASR (93.88%), ACC (74.42%)' is confusing: it is unclear over which attacks and models this average is computed. Also, the text claims that 'at least 15% of clean data is required' based on this single PROTEINS table; please clarify the scope of this empirical claim.
  4. [Section 5.2.5 and Eq. (6)] Section 5.2.5 says the tested p values range from 1 to 4, but Eq. (6) states that p > 1. Since p=1 appears in Table 5, either the equation's constraint or the experimental range should be adjusted for consistency.
  5. [Appendix F] Appendix F says the clean data may come from 'the test set or the validation set, maintaining the same distribution as the original training data.' This is in tension with Section 3's threat model and with the main-text description that only 3% of the testing set is used. Please align these statements and specify whether the evaluation uses a held-out validation set or the test set, and if the latter, how the overlap between distilled and tested samples is handled.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: GraphNAD's distillation losses are defined independently of the measured ASR/ACC, and the reported results are benchmark measurements rather than quantities derived from the method's inputs.

full rationale

The paper makes no first-principles derivation claim; its central claim is an empirical benchmark result. The loss construction in Eqs. (6)-(13) defines attention maps, relation maps, and distillation losses purely from model activations and labels, with no term that encodes the ASR or ACC values later reported in Table 3. The teacher is produced by fine-tuning the backdoored model on the same 3% clean subset used for distillation, which is an intentional data-efficiency design rather than a definitional equivalence: the output ASR is measured on trigger-embedded test inputs, not computed from the loss equations. No load-bearing premise is delegated to the authors' own prior work: the self-citations [77,78,91] appear only in related-work or baseline enumerations, and the attention-transfer idea is attributed to external CV work [26,30]. The paper's Section 7 limitation explicitly concedes that GraphNAD 'requires a portion of the original dataset to perform fine-tuning and distillation,' which is an honest scope restriction. The evaluation concerns identified by a skeptical reader—drawing the 3% clean subset from the test set (Sec. 5.1.6) without holding it out when reporting ACC, and selecting hyperparameters such as p=2 and pairs={full} on the same benchmarks (Secs. 5.2.5, 5.2.6, 5.4.1)—are threats to evaluation validity and generalizability, but they do not make the reported ASR equivalent to the method's inputs by construction. There is therefore no circular step to quote.

Assumptions & free parameters 6 free parameters · 4 assumptions · 0 invented entities

The central results depend on a small number of hand-chosen hyperparameters (p=2, beta=gamma=1, pairs=full) that were selected using the same ASR/ACC benchmarks that define the headline result, plus assumptions about clean data availability and the informativeness of degree-weighted attention. No new physical or conceptual entities, such as new forces or particles, are introduced.

free parameters (6)
  • attention exponent p = 2
    Selected in Table 5 as the best attention function across datasets; controls amplification in Eq. (6).
  • attention distillation weight beta = 1
    Tuned in the ablation in Fig. 7; balances L_AD in Eq. (13).
  • relation congruence weight gamma = 1
    Tuned in the ablation in Fig. 7; balances L_RC in Eq. (13).
  • relation pair set = {full}
    Selected in Table 6 as giving the best ASR/ACC trade-off; uses all inter-layer pairs.
  • fine-tuning epochs = 10
    Chosen by hand in Section 5.1.6; affects teacher model quality.
  • distillation epochs = 30
    Chosen by hand in Section 5.1.6; affects the final purified model.
assumptions (4)
  • ad hoc to paper The degree-weighted attention operator A_p in Eq. (6) captures model focus on graph nodes and amplifies backdoor versus benign neuron differences enough to distill from 3% clean data.
    Introduced by the authors and validated only through their own ablation; no independent theoretical or empirical evidence is provided.
  • domain assumption The defender can obtain a small (3%) clean and representative subset of the original data distribution.
    Section 5.1.6 samples this subset from the test set, but the threat model in Section 3 says the defender cannot identify tainted graphs, so a guaranteed-clean subset is not automatic.
  • domain assumption Sliced Wasserstein-2 distance between relation maps gives a meaningful training signal for aligning layer transformations.
    Used in Eqs. (11)-(12) as a loss without justification that this metric corresponds to backdoor removal or accuracy preservation.
  • domain assumption A teacher fine-tuned on 3% clean data for only 10 epochs retains enough benign behavior to guide purification.
    Algorithm 1 uses 10 fine-tuning epochs; no analysis shows the teacher is both sufficiently clean and sufficiently close to the student.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Fine-tuning is Not Fine: Mitigating Backdoor Attacks in GNNs with Limited Clean Data." pith.science (2026). https://pith.science/paper/SEYDM7HN

@misc{pith2026250105835,
  author       = {Pith},
  title        = {Pith review of: Fine-tuning is Not Fine: Mitigating Backdoor Attacks in GNNs with Limited Clean Data},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/SEYDM7HN}},
  note         = {Machine review of arXiv:2501.05835}
}
read the original abstract

Graph Neural Networks (GNNs) have achieved remarkable performance through their message-passing mechanism. However, recent studies have highlighted the vulnerability of GNNs to backdoor attacks, which can lead the model to misclassify graphs with attached triggers as the target class. The effectiveness of recent promising defense techniques, such as fine-tuning or distillation, is heavily contingent on having comprehensive knowledge of the sufficient training dataset. Empirical studies have shown that fine-tuning methods require a clean dataset of 20% to reduce attack accuracy to below 25%, while distillation methods require a clean dataset of 15%. However, obtaining such a large amount of clean data is commonly impractical. In this paper, we propose a practical backdoor mitigation framework, denoted as GRAPHNAD, which can capture high-quality intermediate-layer representations in GNNs to enhance the distillation process with limited clean data. To achieve this, we address the following key questions: How to identify the appropriate attention representations in graphs for distillation? How to enhance distillation with limited data? By adopting the graph attention transfer method, GRAPHNAD can effectively align the intermediate-layer attention representations of the backdoored model with that of the teacher model, forcing the backdoor neurons to transform into benign ones. Besides, we extract the relation maps from intermediate-layer transformation and enforce the relation maps of the backdoored model to be consistent with that of the teacher model, thereby ensuring model accuracy while further reducing the influence of backdoors. Extensive experimental results show that by fine-tuning a teacher model with only 3% of the clean data, GRAPHNAD can reduce the attack success rate to below 5%.

Figures

Figures reproduced from arXiv: 2501.05835 by the authors.

Figure 1
Figure 1. Different trigger injection types on graph. [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Framework of the proposed GraphNAD. between one-dimensional distributions, thus enhancing efficiency. Formally, 𝑊˜ 2 (𝑅 𝑖𝑗 𝑇 , 𝑅𝑖𝑗 𝑆 ) = ∫ 1 0 𝑊 2 2 (𝑅 𝑖𝑗 𝑇 (𝜔), 𝑅𝑖𝑗 𝑆 (𝜔))𝑑𝜔 1 2 , (11) where 𝑅 𝑖𝑗 𝑇 (𝜔) and 𝑅 𝑖𝑗 𝑆 (𝜔) respectively represent the distributional relationship embeddings between layers 𝑖 and 𝑗 of the teacher and student models, projected onto one-dimensional data points along the slicing direction 𝜔. I… view at source ↗
Figure 3
Figure 3. Impact of injection ratio with three SOTA methods [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figures from the paper (11 more)
Figure 4
Figure 4. Figure 4: Impact of holding rate on four datasets. [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]
Figure 5
Figure 5. Figure 5: Impact of model types on four datasets [PITH_FULL_IMAGE:figures/full_fig_p010_5.png]
Figure 6
Figure 6. Figure 6: Attention maps of different layers. The color of the nodes represents the model’s attention to them, while the red [PITH_FULL_IMAGE:figures/full_fig_p011_6.png]
Figure 7
Figure 7. Figure 7: Impact of loss term 𝛽 and 𝛾. outcomes are achieved through a prudent selection of moderate 𝛽 and 𝛾 values. 5.4.2 Component Contributions. Our distillation losses are divided into two components: graph attention transfer loss L𝐴𝐷 and at￾tention relation congruence loss …
Figure 8
Figure 8. Figure 8: Classification accuracy for each class of different [PITH_FULL_IMAGE:figures/full_fig_p016_8.png]
Figure 9
Figure 9. Figure 9: Impact of injection ratio with three SOTA methods on Fingerprint dataset. [PITH_FULL_IMAGE:figures/full_fig_p017_9.png]
Figure 10
Figure 10. Figure 10: Impact of injection ratio with three SOTA methods on PROTEINS dataset. [PITH_FULL_IMAGE:figures/full_fig_p017_10.png]
Figure 11
Figure 11. Figure 11: Impact of trigger size on four datasets with GTA attack method. [PITH_FULL_IMAGE:figures/full_fig_p017_11.png]
Figure 12
Figure 12. Figure 12: Visualizations of feature embedding of the backdoored model and purified model. [PITH_FULL_IMAGE:figures/full_fig_p017_12.png]
Figure 13
Figure 13. Figure 13: Impact of trigger size on four datasets using the Sub-BA attack. [PITH_FULL_IMAGE:figures/full_fig_p018_13.png]
Figure 14
Figure 14. Figure 14: The attention maps derived by 4 different attention functions are shown for backdoored and purified. [PITH_FULL_IMAGE:figures/full_fig_p018_14.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

103 extracted references · 58 canonical work pages

  1. [72]

    Xiao Yang, Gaolei Li, Xiaoyi Tao, Chaofeng Zhang, and Jianhua Li. 2023. Black- Box Graph Backdoor Defense. In International Conference on Algorithms and Architectures for Parallel Processing. Springer, 163–180. Fine-tuning is Not Fine: Mitigating Backdoor Attacks in GNNs with Limited Clean Data Conference acronym ’XX, June 03–05, 2018, Woodstock, NY

    work page 2023

  2. [74]

    Dingqiang Yuan, Xiaohua Xu, Lei Yu, Tongchang Han, Rongchang Li, and Meng Han. 2024. E-SAGE: Explainability-Based Defense Against Backdoor Attacks on Graph Neural Networks. In International Conference on Wireless Artificial Intelligent Computing Systems and Applications . Springer, 402–414

    work page 2024

  3. [86]

    Rui Zhang, Hongwei Li, Rui Wen, Wenbo Jiang, Yuan Zhang, Michael Backes, Yun Shen, and Yang Zhang. 2024. Instruction backdoor attacks against customized {LLMs}. In 33rd USENIX Security Symposium (USENIX Security 24) . 1849–1866

    work page 2024

  4. [93]

    Yuxuan Zhu, Michael Mandulak, Kerui Wu, George Slota, Yuseok Jeon, Ka-Ho Chow, and Lei Yu. 2024. On the Robustness of Graph Reduction Against GNN Backdoor. arXiv preprint arXiv:2407.02431 (2024). A Details on Datasets • PROTEINS [2]: It is a widely used benchmark dataset in the field of protein structure prediction. It consists of 1,203 pro- tein structur...

    work page Pith review arXiv 2024

  5. [1]

    Maciej Besta, Robert Gerstenberger, Emanuel Peter, Marc Fischer, Michał Pod- stawski, Claude Barthels, Gustavo Alonso, and Torsten Hoefler. 2023. Demys- tifying graph databases: Analysis and taxonomy of data organization, system designs, and graph queries. Comput. Surveys 56, 2 (2023), 1–40

    2023

  6. [2]

    Karsten M Borgwardt, Cheng Soon Ong, Stefan Schönauer, SVN Vishwanathan, Alex J Smola, and Hans-Peter Kriegel. 2005. Protein function prediction via graph kernels. Bioinformatics 21, suppl_1 (2005), i47–i56

    2005

  7. [3]

    Sicong Cao, Xiaobing Sun, Lili Bo, Rongxin Wu, Bin Li, and Chuanqi Tao. 2022. MVD: memory-related vulnerability detection based on flow-sensitive graph neural networks. In Proceedings of the 44th international conference on software engineering. 1456–1468

    2022

  8. [4]

    Yuxuan Cao, Jiarong Xu, Carl Yang, Jiaan Wang, Yunchao Zhang, Chunping Wang, Lei Chen, and Yang Yang. 2023. When to Pre-Train Graph Neural Networks? From Data Generation Perspective!. In Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining . 142–153

    2023

Show all 103 references
  1. [5]

    Liang Chen, Qibiao Peng, Jintang Li, Yang Liu, Jiawei Chen, Yong Li, and Zibin Zheng. 2022. Neighboring backdoor attacks on graph convolutional network. arXiv preprint arXiv:2201.06202 (2022)

    2022 arXiv

  2. [6]

    Luyao Chen, Na Yan, Boyang Zhang, Zhaoyang Wang, Yu Wen, and Yanfei Hu. 2022. A General Backdoor Attack to Graph Neural Networks Based on Explanation Method. In 2022 IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) . IEEE, 759–768

    2022

  3. [7]

    Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. 2017. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526 (2017)

    2017 arXiv

  4. [8]

    Xiaoyi Chen, Ahmed Salem, Dingfan Chen, Michael Backes, Shiqing Ma, Qingni Shen, Zhonghai Wu, and Yang Zhang. 2021. Badnl: Backdoor attacks against nlp models with semantic-preserving improvements. In Proceedings of the 37th Annual Computer Security Applications Conference. 554–569

    2021

  5. [9]

    Siyuan Cheng, Yingqi Liu, Shiqing Ma, and Xiangyu Zhang. 2021. Deep feature space trojan attack of neural networks by controlled detoxification. InProceedings of the AAAI Conference on Artificial Intelligence , Vol. 35. 1148–1156

    2021

  6. [10]

    Enyan Dai, Minhua Lin, Xiang Zhang, and Suhang Wang. 2023. Unnoticeable backdoor attacks on graph neural networks. In Proceedings of the ACM Web Conference 2023. 2263–2273

    2023

  7. [11]

    Ishan Deshpande, Yuan-Ting Hu, Ruoyu Sun, Ayis Pyrros, Nasir Siddiqui, Sanmi Koyejo, Zhizhen Zhao, David Forsyth, and Alexander G. Schwing. 2019. Max- Sliced Wasserstein Distance and Its Use for GANs. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Rec...

    2019

  8. [12]

    Khoa Doan, Yingjie Lao, and Ping Li. 2021. Backdoor attack with imperceptible input and latent modification. Advances in Neural Information Processing Systems 34 (2021), 18944–18957

    2021

  9. [13]

    Jane Downer, Ren Wang, and Binghui Wang. 2024. Securing GNNs: Explanation-Based Identification of Backdoored Training Graphs. arXiv preprint arXiv:2403.18136 (2024)

    2024 arXiv

  10. [14]

    Yunjie Ge, Qian Wang, Baolin Zheng, Xinlu Zhuang, Qi Li, Chao Shen, and Cong Wang. 2021. Anti-distillation backdoor attacks: Backdoors can really survive in knowledge distillation. In Proceedings of the 29th ACM International Conference on Multimedia. 826–834

    2021

  11. [15]

    E. N. Gilbert. 1959. Random Graphs. The Annals of Mathematical Statistics 30, 4 (1959), 1141–1144. http://www.jstor.org/stable/2237458

    1959

  12. [16]

    Xueluan Gong, Yanjiao Chen, Wang Yang, Qian Wang, Yuzhe Gu, Huayang Huang, and Chao Shen. 2023. Redeem myself: Purifying backdoors in deep learning models using self attention distillation. In 2023 IEEE Symposium on Security and Privacy (SP) . IEEE, 755–772

    2023

  13. [17]

    Tianyu Gu, Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. 2019. Badnets: Evaluating backdooring attacks on deep neural networks. IEEE Access 7 (2019), 47230–47244

    2019

  14. [18]

    Zihan Guan, Mengnan Du, and Ninghao Liu. 2023. XGBD: Explanation-Guided Graph Backdoor Detection. arXiv preprint arXiv:2308.04406 (2023)

    2023 arXiv

  15. [19]

    Will Hamilton, Zhitao Ying, and Jure Leskovec. 2017. Inductive representation learning on large graphs. Advances in neural information processing systems 30 (2017)

    2017

  16. [20]

    Geoffrey Hinton. 2015. Distilling the Knowledge in a Neural Network. arXiv preprint arXiv:1503.02531 (2015)

    2015 arXiv

  17. [21]

    Yujie Ji, Xinyang Zhang, Shouling Ji, Xiapu Luo, and Ting Wang. 2018. Model- Reuse Attacks on Deep Learning Systems. InProceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, CCS 2018, Toronto, on, Canada, October 15-19, 2018 , David Lie, Mohamma...

    2018

  18. [22]

    Bingchen Jiang and Zhao Li. 2022. Defending against backdoor attack on graph nerual network by explainability. arXiv preprint arXiv:2209.02902 (2022)

    2022 arXiv

  19. [23]

    Shima Khoshraftar and Aijun An. 2024. A survey on graph representation learning methods. ACM Transactions on Intelligent Systems and Technology 15, 1 (2024), 1–55. Conference acronym ’XX, June 03–05, 2018, Woodstock, NY Jiale Zhang et al

    2024

  20. [24]

    Jangho Kim, SeongUk Park, and Nojun Kwak. 2018. Paraphrasing complex network: Network compression via factor transfer.Advances in neural information processing systems 31 (2018)

    2018

  21. [25]

    Thomas N Kipf and Max Welling. 2016. Semi-supervised classification with graph convolutional networks. arXiv preprint arXiv:1609.02907 (2016)

    2016 arXiv

  22. [26]

    Nikos Komodakis and Sergey Zagoruyko. 2017. Paying more attention to atten- tion: improving the performance of convolutional neural networks via attention transfer. In ICLR

    2017

  23. [27]

    Kavita Kumari, Phillip Rieger, Hossein Fereidooni, Murtuza Jadliwala, and Ahmad- Reza Sadeghi. 2023. Baybfed: Bayesian backdoor defense for federated learning. In 2023 IEEE Symposium on Security and Privacy (SP) . IEEE, 737–754

    2023

  24. [28]

    Shaofeng Li, Minhui Xue, Benjamin Zi Hao Zhao, Haojin Zhu, and Xinpeng Zhang

  25. [29]

    Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. 2021. Anti-backdoor learning: Training clean models on poisoned data. Advances in Neural Information Processing Systems 34 (2021), 14900–14912

    2021

  26. [30]

    Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma

  27. [31]

    Yiming Li, Tongqing Zhai, Baoyuan Wu, Yong Jiang, Zhifeng Li, and Shutao Xia

  28. [32]

    Wanying Liang, Pasquale De Meo, Yong Tang, and Jia Zhu. 2024. A survey of multi-modal knowledge graphs: Technologies and trends. Comput. Surveys 56, 11 (2024), 1–41

    2024

  29. [33]

    Chuang Liu, Yibing Zhan, Xueqi Ma, Liang Ding, Dapeng Tao, Jia Wu, and Wenbin Hu. 2023. Gapformer: Graph Transformer with Graph Pooling for Node Classification. In International Joint Conference on Artificial Intelligence

    2023

  30. [34]

    arXiv preprint arXiv:2004.04692 (2020)

    Rethinking the trigger of backdoor attack. arXiv preprint arXiv:2004.04692 (2020)

    2020 arXiv

  31. [35]

    Yunfei Liu, Xingjun Ma, James Bailey, and Feng Lu. 2020. Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks. In European Conference on Computer Vision. 182–199

    2020

  32. [36]

    Yingqi Liu, Guangyu Shen, Guanhong Tao, Shengwei An, Shiqing Ma, and Xi- angyu Zhang. 2022. Piccolo: Exposing complex backdoors in nlp transformer models. In 2022 IEEE Symposium on Security and Privacy (SP) . IEEE, 2025–2042

    2022

  33. [37]

    Yingqi Liu, Wen-Chuan Lee, Guanhong Tao, Shiqing Ma, Yousra Aafer, and Xiangyu Zhang. 2019. Abs: Scanning neural networks for back-doors by artificial brain stimulation. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security. 1265–1282

    2019

  34. [38]

    Yuanfu Lu, Xunqiang Jiang, Yuan Fang, and Chuan Shi. 2021. Learning to pre- train graph neural networks. In Proceedings of the AAAI conference on artificial intelligence, Vol. 35. 4276–4284

    2021

  35. [39]

    Elman Mansimov, Omar Mahmood, Seokho Kang, and Kyunghyun Cho. 2019. Molecular Geometry Prediction Using a Deep Generative Graph Neural Network. CoRR abs/1904.00314 (2019)

    2019 arXiv

  36. [40]

    Zhiwei Liu, Liangwei Yang, Ziwei Fan, Hao Peng, and Philip S. Yu. 2022. Federated Social Recommendation with Graph Neural Network. ACM Transactions on Intelligent Systems and Technology 13, 4 (2022), 55:1–55:24. doi:10.1145/3501815

    2022 doi

  37. [41]

    Michel Neuhaus and Horst Bunke. 2005. A graph matching based approach to fingerprint classification using directional variance. In International Conference on Audio-and Video-Based Biometric Person Authentication . Springer, 191–200

    2005

  38. [42]

    Tuan Anh Nguyen and Anh Tuan Tran. 2020. WaNet-Imperceptible Warping- based Backdoor Attack. In International Conference on Learning Representations

    2020

  39. [43]

    Soma Minami, Tsubasa Hirakawa, Takayoshi Yamashita, and Hironobu Fujiyoshi

  40. [44]

    In Proceedings of the Asian Conference on Computer Vision

    Knowledge transfer graph for deep collaborative learning. In Proceedings of the Asian Conference on Computer Vision

  41. [45]

    Yiyue Qian, Yiming Zhang, Yanfang Ye, Chuxu Zhang, et al . 2021. Distilling meta knowledge on heterogeneous graph for illicit drug trafficker detection on social media. Advances in Neural Information Processing Systems 34 (2021), 26911–26923

    2021

  42. [46]

    Yankun Ren, Longfei Li, and Jun Zhou. 2021. Simtrojan: Stealthy backdoor attack. In 2021 IEEE International Conference on Image Processing (ICIP) . IEEE, 819–823

    2021

  43. [47]

    Xudong Pan, Mi Zhang, Beina Sheng, Jiaming Zhu, and Min Yang. 2022. Hidden trigger backdoor attack on{NLP} models via linguistic style manipulation. In 31st USENIX Security Symposium (USENIX Security 22) . 3611–3628

    2022

  44. [48]

    Peyman Passban, Yimeng Wu, Mehdi Rezagholizadeh, and Qun Liu. 2021. Alp-kd: Attention-based layer projection for knowledge distillation. In Proceedings of the AAAI Conference on artificial intelligence , Vol. 35. 13657–13665

    2021

  45. [49]

    Yun Shen, Xinlei He, Yufei Han, and Yang Zhang. 2022. Model stealing attacks against inductive graph neural networks. In 2022 IEEE Symposium on Security and Privacy (SP). IEEE, 1175–1192

    2022

  46. [50]

    Weijing Shi and Raj Rajkumar. 2020. Point-GNN: Graph Neural Network for 3D Object Detection in a Point Cloud. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)

    2020

  47. [51]

    Ryan Rossi and Nesreen Ahmed. 2015. The network data repository with inter- active graph analytics and visualization. In Proceedings of the AAAI conference on artificial intelligence, Vol. 29

    2015

  48. [52]

    Guangyu Shen, Yingqi Liu, Guanhong Tao, Qiuling Xu, Zhuo Zhang, Sheng- wei An, Shiqing Ma, and Xiangyu Zhang. 2022. Constrained optimization with dynamic bound-scaling for effective nlp backdoor defense. In International Con- ference on Machine Learning . PMLR, 19879–19892

    2022

  49. [53]

    Sheng Wan, Tung-Yu Wu, Heng-Wei Hsu, Wing Hung Wong, and Chen-Yi Lee

  50. [54]

    Binghui Wang, Jinyuan Jia, Xiaoyu Cao, and Neil Zhenqiang Gong. 2021. Certified robustness of graph neural networks against adversarial structural perturbation. In Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining. 1645–1653

    2021

  51. [55]

    Qianqian Song, Jing Su, and Wei Zhang. 2021. scGCN is a graph convolutional networks algorithm for knowledge transfer in single cell omics. Nature commu- nications 12, 1 (2021), 3826

    2021

  52. [56]

    Petar Veličković, Guillem Cucurull, Arantxa Casanova, Adriana Romero, Pietro Liò, and Yoshua Bengio. 2018. Graph Attention Networks. In International Con- ference on Learning Representations

    2018

  53. [57]

    Maurice Weber, Xiaojun Xu, Bojan Karlaš, Ce Zhang, and Bo Li. 2023. Rab: Provable robustness against backdoor attacks. In2023 IEEE Symposium on Security and Privacy (SP). IEEE, 1311–1328

    2023

  54. [58]

    Bingzhe Wu, Yatao Bian, Hengtong Zhang, Jintang Li, Junchi Yu, Liang Chen, Chaochao Chen, and Junzhou Huang. 2022. Trustworthy graph learning: Re- liability, explainability, and privacy protection. In Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Dat...

    2022

  55. [59]

    Huijun Wu, Chen Wang, Yuriy Tyshetskiy, Andrew Docherty, Kai Lu, and Liming Zhu. 2019. Adversarial examples for graph data: deep insights into attack and defense. In Proceedings of the 28th International Joint Conference on Artificial Intelligence. 4816–4823

    2019

  56. [60]

    Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y Zhao. 2019. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In 2019 IEEE symposium on security and privacy (SP) . IEEE, 707–723

    2019

  57. [61]

    Haoyu Wang, Defu Lian, and Yong Ge. 2019. Binarized collaborative filtering with distilling graph convolutional networks. In Proceedings of the 28th International Joint Conference on Artificial Intelligence . 4802–4808

    2019

  58. [62]

    Zhaohan Xi, Tianyu Du, Changjiang Li, Ren Pang, Shouling Ji, Jinghui Chen, Fenglong Ma, and Ting Wang. 2024. Defending pre-trained language models as few-shot learners against backdoor attacks. Advances in Neural Information Processing Systems 36 (2024)

    2024

  59. [63]

    Zhaohan Xi, Ren Pang, Shouling Ji, and Ting Wang. 2021. Graph backdoor. In 30th USENIX security symposium (USENIX Security 21) . 1523–1540

    2021

  60. [64]

    Feng Xia, Ke Sun, Shuo Yu, Abdul Aziz, Liangtian Wan, Shirui Pan, and Huan Liu. 2021. Graph learning: A survey. IEEE Transactions on Artificial Intelligence 2, 2 (2021), 109–127

    2021

  61. [65]

    Yongji Wu, Defu Lian, Yiheng Xu, Le Wu, and Enhong Chen. 2020. Graph convolutional networks with markov random field reasoning for social spammer detection. In Proceedings of the AAAI conference on artificial intelligence , Vol. 34. 1054–1061

    2020

  62. [66]

    Zonghan Wu, Shirui Pan, Fengwen Chen, Guodong Long, Chengqi Zhang, and S Yu Philip. 2020. A comprehensive survey on graph neural networks. IEEE transactions on neural networks and learning systems 32, 1 (2020), 4–24

    2020

  63. [67]

    Jing Xu, Minhui Xue, and Stjepan Picek. 2021. Explainability-based backdoor attacks against graph neural networks. In Proceedings of the 3rd ACM workshop on wireless security and machine learning . 31–36

    2021

  64. [68]

    Keyulu Xu, Weihua Hu, Jure Leskovec, and Stefanie Jegelka. 2018. How powerful are graph neural networks? arXiv preprint arXiv:1810.00826 (2018)

    2018 arXiv

  65. [69]

    Mingfu Xue, Xin Wang, Shichang Sun, Yushu Zhang, Jian Wang, and Weiqiang Liu. 2023. Compression-resistant backdoor attack against deep neural networks. Applied Intelligence 53, 17 (2023), 20402–20417

    2023

  66. [70]

    Jing Xu, Gorka Abad, and Stjepan Picek. 2023. Rethinking the trigger-injecting position in graph backdoor attack. In2023 International Joint Conference on Neural Networks (IJCNN). IEEE, 1–8

    2023

  67. [71]

    Jing Xu and Stjepan Picek. 2022. Poster: Clean-label backdoor attack on graph neural networks. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security. 3491–3493

    2022

  68. [73]

    Huaxiu Yao, Chuxu Zhang, Ying Wei, Meng Jiang, Suhang Wang, Junzhou Huang, Nitesh Chawla, and Zhenhui Li. 2020. Graph few-shot learning via knowledge transfer. In Proceedings of the AAAI conference on artificial intelligence , Vol. 34. 6656–6663

    2020

  69. [75]

    Pinar Yanardag and SVN Vishwanathan. 2015. Deep graph kernels. InProceedings of the 21th ACM SIGKDD international conference on knowledge discovery and data mining. 1365–1374

    2015

  70. [76]

    Shuiqiao Yang, Bao Gia Doan, Paul Montague, Olivier De Vel, Tamas Abraham, Seyit Camtepe, Damith C Ranasinghe, and Salil S Kanhere. 2022. Transferable graph backdoor attack. In Proceedings of the 25th international symposium on research in attacks, intrusions and defenses . 321–332

    2022

  71. [77]

    Jiale Zhang, Chengcheng Zhu, Chunpeng Ge, Chuan Ma, Yanchao Zhao, Xiaobing Sun, and Bing Chen. 2024. BadCleaner: Defending Backdoor Attacks in Federated Learning Via Attention-Based Multi-Teacher Distillation. IEEE Transactions on Dependable and Secure Computing (2024)

    2024

  72. [78]

    Jiale Zhang, Chengcheng Zhu, Xiaobing Sun, Chunpeng Ge, Bing Chen, Willy Susilo, and Shui Yu. 2024. FLPurifier: Backdoor Defense in Federated Learning via Decoupled Contrastive Training. IEEE Transactions on Information Forensics and Security (2024)

    2024

  73. [79]

    Muhan Zhang and Yixin Chen. 2018. Link Prediction Based on Graph Neural Networks. In Advances in Neural Information Processing Systems 31: Annual Con- ference on Neural Information Processing Systems 2018, NeurIPS 2018, December 3-8, 2018, Montréal, Canada , Samy Bengio, Hanna...

    2018

  74. [80]

    Hangfan Zhang, Jinghui Chen, Lu Lin, Jinyuan Jia, and Dinghao Wu. 2023. Graph contrastive backdoor attacks. In International Conference on Machine Learning . PMLR, 40888–40910

    2023

  75. [81]

    Jie Zhang, Chen Dongdong, Qidong Huang, Jing Liao, Weiming Zhang, Huamin Feng, Gang Hua, and Nenghai Yu. 2022. Poison ink: Robust and invisible backdoor attack. IEEE Transactions on Image Processing 31 (2022), 5691–5705

    2022

  76. [82]

    Shichang Zhang, Yozen Liu, Yizhou Sun, and Neil Shah. 2022. Graph-less Neural Networks: Teaching Old MLPs New Tricks Via Distillation. In International Conference on Learning Representations . https://openreview.net/forum?id=4p6_ 5HBWPCw

    2022

  77. [83]

    Wentao Zhang, Xupeng Miao, Yingxia Shao, Jiawei Jiang, Lei Chen, Olivier Ruas, and Bin Cui. 2020. Reliable data distillation on graph convolutional network. In Proceedings of the 2020 ACM SIGMOD international conference on management of data. 1399–1414

    2020

  78. [84]

    Yi Zhang, Yuying Zhao, Zhaoqing Li, Xueqi Cheng, Yu Wang, Olivera Kotevska, S Yu Philip, and Tyler Derr. 2024. A survey on privacy in graph neural networks: Attacks, preservation, and applications. IEEE Transactions on Knowledge and Data Engineering (2024)

    2024

  79. [85]

    Muhan Zhang, Zhicheng Cui, Marion Neumann, and Yixin Chen. 2018. An End- to-End Deep Learning Architecture for Graph Classification. In AAAI Conference on Artificial Intelligence

    2018

  80. [87]

    Zhenyu Zhang, Xiaobo Shu, Bowen Yu, Tingwen Liu, Jiapeng Zhao, Quangang Li, and Li Guo. 2020. Distilling knowledge from well-informed soft labels for neural relation extraction. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 34. 9620–9627

    2020

  81. [88]

    Zhendong Zhao, Xiaojun Chen, Yuexin Xuan, Ye Dong, Dakui Wang, and Kaitai Liang. 2022. Defeat: Deep hidden feature backdoor attacks by imperceptible perturbation and latent representation constraints. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Reco...

    2022

  82. [89]

    Haibin Zheng, Haiyang Xiong, Jinyin Chen, Haonan Ma, and Guohan Huang

  83. [90]

    Zaixi Zhang, Jinyuan Jia, Binghui Wang, and Neil Zhenqiang Gong. 2021. Back- door attacks to graph neural networks. InProceedings of the 26th ACM Symposium on Access Control Models and Technologies . 15–26

    2021

  84. [91]

    Zhiwei Zhang, Minhua Lin, Junjie Xu, Zongyu Wu, Enyan Dai, and Suhang Wang

  85. [92]

    Mingli Zhu, Shaokui Wei, Li Shen, Yanbo Fan, and Baoyuan Wu. 2023. Enhancing fine-tuning based backdoor defense with sharpness-aware minimization. In Pro- ceedings of the IEEE/CVF International Conference on Computer Vision . 4466–4477

    2023

  86. [97]

    Haoti Zhong, Cong Liao, Anna Cinzia Squicciarini, Sencun Zhu, and David Miller

  87. [98]

    In Proceedings of the Tenth ACM Conference on Data and Application Security and Privacy

    Backdoor embedding in convolutional neural network models via invisible perturbation. In Proceedings of the Tenth ACM Conference on Data and Application Security and Privacy. 97–108

  88. [99]

    Chengcheng Zhu, Jiale Zhang, Xiaobing Sun, Bing Chen, and Weizhi Meng

  89. [100]

    Computers & Security 132 (2023), 103366

    ADFL: Defending backdoor attacks in federated learning via adversarial distillation. Computers & Security 132 (2023), 103366

    2023

  90. [103]

    brighter

    The figure reveals that benign samples from the same category form well-defined and compact clusters in the feature space, while poisoned samples initially form separate backdoor-induced clusters (highlighted in red). However, after employing GraphNAD, these backdoor-induced c...

    2018

  91. [2019]

    IEEE Transac- tions on Circuits and Systems for Video Technology 30, 12 (2019), 4769–4780

    Feature consistency training with JPEG compressed images. IEEE Transac- tions on Circuits and Systems for Video Technology 30, 12 (2019), 4769–4780

    2019

  92. [2020]

    IEEE Transactions on Dependable and Secure Computing 18, 5 (2020), 2088–2105

    Invisible backdoor attacks on deep neural networks via steganography and regularization. IEEE Transactions on Dependable and Secure Computing 18, 5 (2020), 2088–2105

    2020

  93. [2021]

    In 9th International Conference on Learning Representations, ICLR 2021

    NEURAL ATTENTION DISTILLATION: ERASING BACKDOOR TRIGGERS FROM DEEP NEURAL NETWORKS. In 9th International Conference on Learning Representations, ICLR 2021

    2021

  94. [2023]

    IEEE Transactions on Computational Social Systems (2023)

    Motif-backdoor: Rethinking the backdoor attack on graph neural networks via motifs. IEEE Transactions on Computational Social Systems (2023)

    2023

  95. [2024]

    arXiv preprint arXiv:2406.09836 (2024)

    Robustness-Inspired Defense Against Backdoor Attacks on Graph Neural Networks. arXiv preprint arXiv:2406.09836 (2024)

    2024 arXiv

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.