Pith. sign in

REVIEW 4 major objections 5 minor 51 references

FedLSG, an LLM-enhanced defense for federated graph backdoors, claims that offloading semantic reasoning to a server-side LLM while keeping clients to a lightweight LoRA student cuts backdoor attack success to near zero without sacrificing

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-01 12:01 UTC pith:K2GKK7XU

load-bearing objection Novel idea for LLM-based FedGNN backdoor defense, but the central client-side scorer is never instantiated and the reported numbers are inconsistent. the 4 major comments →

arxiv 2607.19674 v1 pith:K2GKK7XU submitted 2026-07-22 cs.CR cs.AIcs.LG

FedLSG: LLM-Enhanced Semantic Calibration for Federated Graph Backdoor Defense

Chenyu Zhou , Yabin Peng , Wei Huang , Kunlin Li , Shuaishuai Zhang , Xinyuan Miao This is my paper
classification cs.CR cs.AIcs.LG
keywords Federated Graph Neural NetworksBackdoor DefenseLarge Language ModelsGraph-to-Text GroundingTeacher-Student DistillationLoRATrust AggregationEdge Reweighting
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper tries to establish that federated graph backdoor defense can be dramatically improved by adding semantic reasoning from large language models to the usual structural signals. It introduces FedLSG, the first LLM-integrated defense for federated graph neural networks: local graph edges and client update behaviors are serialized into short natural-language descriptions, a full LLM on the server evaluates those descriptions, and a lightweight LoRA-based student on each client distills the resulting semantic scores to reweight suspicious edges during message passing and to down-weight untrustworthy clients during aggregation. On four benchmark graphs under three backdoor attacks, FedLSG reports the lowest attack success rate of all evaluated defenses, including near-zero ASR on several settings, while keeping clean accuracy competitive with no-defense training. A sympathetic reader would care because it suggests that semantic understanding—not just topology statistics—is the missing ingredient that lets defenders suppress stealthy triggers without hard pruning that damages benign graph structure.

Core claim

The paper's central discovery is that a full-scale LLM can act as a semantic teacher for a federated graph defense: it converts local graph structures and client training dynamics into deterministic natural-language prompts, reasons over those prompts to produce edge-level and client-level trust scores, and distills those scores into a client-side LoRA-based student. The student's semantic edge scores are combined with rule-based structural scores inside a soft attention mechanism (SRGAT), down-weighting trigger-related edges rather than removing them; the server's semantic client scores are combined with rule signals to reweight aggregation. This yields a dual-level defense—edge-level suppr

What carries the argument

The carrying mechanism is a graph-and-behavior-to-text grounding scheme paired with a teacher-student architecture. A deterministic serializer bucketizes local edge statistics (homophily, community crossing, neighborhood overlap, clustering support) into short clauses, producing bounded prompt sets for each suspicious edge; the same pattern is applied to client-level behavior summaries, which are concatenated into a cohort prompt. A full LLM on the server acts as the teacher, scoring edge prompts and client behavior through fixed reasoning instructions; its outputs are distilled into a shallow graph-attentive student with LoRA low-rank factors running on each client. The student's scores are

Load-bearing premise

The client-side semantic scorer must reproduce the teacher LLM's semantic edge scores using only a lightweight LoRA student without a full LLM locally, because if the student's scores diverge from the teacher's, both the defense and the claimed complexity savings collapse.

What would settle it

Run FedLSG twice on the same attack, once with client-side semantic scores computed locally by the LoRA student and once with scores computed by the server-side full LLM on identical prompts; if the server-computed variant yields materially lower attack success, the student is not carrying the semantics, and if the student matches, the cost story is confirmed.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • If FedLSG is correct, backdoor defense in federated graphs no longer needs to rely on hard pruning: trigger edges can be down-weighted inside attention, preserving benign structure and keeping clean accuracy competitive.
  • A full LLM can supervise defense from the server while clients stay lightweight, since only SRGAT parameters and low-rank LoRA factors are communicated, keeping per-client cost at the level of a LoRA-tuned GNN.
  • Client behavior, not just edge statistics, can be used during aggregation: semantic evaluation of a cohort-normalized behavior summary lets the server detect and down-weight malicious participants even when poisoned signals survive local filtering.
  • The grounding scheme extends to heterogeneous graphs by replacing node features with graphlet degree vectors, so the semantic defense does not depend on the homogeneous-graph assumption that backdoor triggers exploit.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • A natural extension is to treat the deterministic graph-to-text serializer as a reusable interface: because it produces bounded, bucketized prompts, the same grounding could be applied to other federated robustness tasks, such as detecting model poisoning or attribute-inference attacks, not just backdoor triggers.
  • The paper asserts 'full semantic reasoning is not deployed on clients' but never specifies whether the edge-level semantic scores in Eq. (6) are computed by the server or by the client-side student; this is the load-bearing privacy/complexity premise that an experiment should verify.
  • The paper does not audit what the client's distilled student embeddings or cohort summaries reveal about the private graph; a testable follow-up is whether an attribute-inference adversary can reconstruct local statistics from the uploaded low-rank factors and summary lines.
  • The strongest test of the teacher-student story is to compare edge scores from the LoRA student against those of the full server LLM on a held-out set; if they diverge under high non-IID heterogeneity, defense may weaken precisely in the regime where it is most needed.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes FedLSG, a training-time defense against backdoor attacks in federated graph neural networks. The framework combines a server-side full LLM teacher that scores client behavior for trust-aware aggregation, with client-side LoRA-based students that produce semantic edge scores used to down-weight suspicious edges during GNN message passing. Rule-based structural signals and LLM-derived semantic signals are fused adaptively. Experiments on Citeseer, Pubmed, Flickr, and Ogb-arxiv under SBA, UGBA, and DPGBA report that FedLSG attains the lowest attack success rate while preserving clean accuracy, along with ablations, parameter sensitivity, client-scale, heterogeneous-graph, and white-box adaptive-attack experiments.

Significance. If substantiated, the paper would be a useful step toward LLM-integrated federated graph backdoor defense. It addresses a real problem, evaluates on standard benchmarks, and includes a substantial complexity decomposition and several ablations. The use of a deterministic structure-to-text serializer and a bounded student–teacher design is a reasonable direction. However, the central architectural claim—that a lightweight client-side model performs LLM-style semantic edge reasoning—is never concretely instantiated. The only component specified on the client side is a GNN plus LoRA, which cannot consume the natural-language prompts used in Eq. (6)/Eq. (57). As a result, the reported experiments do not test a fully specified system, and the claimed privacy/efficiency advantages are not established. The white-box adaptive-attack section also lacks methodology and contains a numerical contradiction with the main table. These are load-bearing issues, not presentation defects.

major comments (4)
  1. [§4.2, Eq. (6); Appendix A.3 Steps 3–5] The client-side semantic edge scorer is never instantiated. Eq. (6) and Eq. (57) define r_llm_uv = F_edge_LLM(S_det, U_edge_uv, ΔLoRA_i), where U_edge_uv is a natural-language prompt built by Ψedge⊕Ψnbr⊕z_stu_uv. But the only client-side model specified in Eqs. (47)–(48) is an SRGAT plus a low-rank LoRA correction operating on node features; no mechanism is given for this model to consume text or output the scalar used in Eq. (57). If the server-side full LLM performs the scoring, clients must transmit per-edge structural records and student states for up to 256 suspicious edges per round, contradicting the claim in §4.4 and the complexity bound C_edge-sem=O(N_q H) in Eq. (29). If the LoRA student alone performs the scoring, the method is not actually LLM-based and the reported ASR gains cannot be attributed to semantic LLM reasoning. Either way, the architecture evaluated in Table 2 is
  2. [§5.2, Fig. 2 vs Table 2] The white-box adaptive attack evaluation has no methodology: no description of how gradients are propagated through the LLM, the discrete bucketized prompts, or the adaptive fusion weights. Moreover, the reported numbers contradict the claim that FedLSG 'outperforms most baseline methods evaluated in non-white-box settings.' For Ogb-arxiv under DPGBA, Fig. 2 gives adaptive ASR=47.57, while Table 2 shows RLR=42.32, RIGBD=42.79, and NoisyGCN=40.75 in the non-adaptive setting. Thus FedLSG is worse than at least three baselines on this configuration. The adaptive-robustness claim is therefore unsupported.
  3. [Table 2, SBA block on Flickr and Ogb-arxiv] In the SBA block for Flickr and Ogb-arxiv, every defense—including the no-defense baseline—achieves ASR=0.00. The paper explicitly states that SBA is ineffective on large graphs. Consequently, FedLSG's 0.00 values on those rows cannot be counted as evidence of defense efficacy, and the summary statement that FedLSG achieves the lowest ASR 'across all datasets and all settings' is misleading for these configurations. The comparison should separate configurations where the attack is active from those where the baseline ASR is already zero.
  4. [Eqs. (21)–(22) and Appendix A.4] The adaptive fusion objective is not well defined. In Eq. (21), the term -M^q_p appears both as the summed-over-p term and as a free subscript p, so the expression is ambiguous; the constraint 'λ P Σ a_p^2 = γ' introduces an undefined λ and is rendered differently in Eq. (68). The derived solution Eq. (22) simply makes a_p proportional to the total utility Σ_q M^q_p, which is a normalization, not an adaptive balancing of rule and LLM evidence beyond the common factor (1−D_q) in Eq. (19). The derivation in Appendix A.4 carries an unresolved ± sign and algebraic inconsistencies. Since Eqs. (19)–(22) are presented as a contribution, they need to be either corrected or removed.
minor comments (5)
  1. [General] The paper claims to be the first LLM-integrated FedGNN backdoor defense, but does not contrast with possible prior LLM-based graph defenses beyond the cited LLM4FGL and LG-DUMAP; a novelty statement with respect to backdoor defenses specifically would help.
  2. [§4.4] Typo: 'uesd' should be 'used.'
  3. [Figure 3] The legend labels 'FedGDF' instead of 'FedLSG'; also the axis title is misformatted as 'N umber of attacks.'
  4. [Table 4] For Pubmed under UGBA, the Non-IID FedLSG ASR is 42.30, while Table 2 reports 32.30 for the same setting. The discrepancy should be reconciled.
  5. [§5 Parameters; Reference [33]] The paper states Gemma-4-12B is the LLM backbone, but Reference [33] cites the Llama 3 herd; the reference list and the stated backbone should be made consistent.

Circularity Check

0 steps flagged

No circularity found: the paper's central claim is empirical against external baselines; the adaptive weighting and teacher–student loop are heuristics or feedback, not definitional reductions of outputs to inputs.

full rationale

Walking the derivation chain, the claimed results do not reduce to their inputs by construction. The edge and client trust signals (Eqs. 6, 57, 14, 67) are algorithmically defined scoring functions; the paper's central claim is an experimental comparison (Table 2) against external baselines (Prune, RIGBD, FedTGE, etc.), and Table 2 is not a fitted prediction of a closely related quantity. The adaptive fusion weights a_p in Eqs. 21–22 are computed from the same rule/LLM utilities they combine; this is a self-referential weighting heuristic, but it is not a circular reduction because the weighted trust is defined as a weighted combination rather than claimed to be independent evidence. The teacher–student loop (Eqs. 10–12, 56, 66–67) is a trainable feedback process: teacher targets are detached, and no attack label is used to construct the scores, so it is co-adaptation rather than a logical circle. The paper does not use a load-bearing self-citation or an imported uniqueness theorem; citations to Bkd-FedGNN [4], GAT [27], and game-theoretic weighting [28,29] are external or methodological. The most salient weakness is an unspecified-component gap rather than circularity: Eq. 57 labels F^edge_LLM as 'the local split-semantic scorer induced by the client-side student and LoRA compensation,' while Eqs. 47–48 define that student as SRGAT+LoRA, which cannot consume the textual prompt U^edge_uv from Eq. 56; and the server-side complexity O(N_q H) in Eq. 29 cannot cover full-LLM inference. That gap affects the validity of the reported experiments, but it does not make the derivation circular.

Axiom & Free-Parameter Ledger

10 free parameters · 5 axioms · 0 invented entities

The method depends on many hand-set weights and thresholds (rule coefficients, cohort z-scores, trust scalars, kappa, bucketization bounds, gamma, and architectural constants). These are chosen via sensitivity analysis on the same datasets used for reporting, so the 'adaptive' fusion is not parameter-free. No new physical entities are introduced.

free parameters (10)
  • gamma (constraint coefficient) = 1
    Controls the solution space in Eq. 21; set to 1 without justification.
  • lambda_r^1...lambda_r^5 (rule edge weights) = tuned (A.9)
    Weights in Eq. 37 determine which edges are selected for semantic inspection; chosen via sensitivity analysis on evaluation datasets.
  • lambda_l^1...lambda_l^9 (local anomaly weights) = tuned (A.9)
    Weights in Eq. 43 combining local client statistics into an anomaly score.
  • lambda_c^1...lambda_c^4 (cohort anomaly weights) = tuned (A.9)
    Weights in Eq. 45 for cohort-normalized anomaly scoring used in client aggregation trust.
  • rho_1, rho_2 = tuned
    Scaling factors converting anomaly scores to trust values in Eqs. 44 and 46.
  • kappa_e = tuned
    Controls maximum edge downweighting in Eq. 9.
  • kappa_a = tuned
    Controls maximum trust-based aggregation correction in Eq. 16.
  • bucketization thresholds alpha=0.25, beta=0.75 = default
    Eq. 51 maps continuous statistics to low/moderate/high text levels; not derived.
  • LoRA rank r=8, semantic depth L=4, client blocks k=2, max suspicious edges Ke=256 = default (A.6)
    Architectural hyperparameters affecting the cost and capacity of the semantic student.
  • trust floor 0.1, heuristic-semantic mixing weight 0.1, edge semantic influence 0.03, aggregation trust influence 0.08 = default (A.6)
    Additional hand-set constants in the trust-estimation pipeline.
axioms (5)
  • domain assumption Federated threat model permits the server to aggregate model updates and receive low-rank parameters, but the server cannot inspect raw client graphs.
    Section 3 describes the FedGNN protocol and threat model; the method's privacy claims depend on this.
  • domain assumption Textual descriptions of structural statistics suffice for an LLM to distinguish backdoor-trigger edges from benign edges.
    Core premise of the semantic grounding scheme; only empirically evaluated, never proven or tested against alternative textual schemas.
  • ad hoc to paper A lightweight LoRA-based student can approximate or execute F^edge_LLM on clients without a full LLM.
    Eq. 6 invokes an LLM scorer, but Appendix A.2 says full semantic depth never appears on clients. No concrete architecture is given for this split execution.
  • ad hoc to paper The optimization problem in Eq. 21 is a valid way to combine rule and LLM evidence, and Eq. 22 is its correct solution.
    The objective is not motivated, the notation in the derivation is garbled (Eqs. 69-76), and a_p are used to weight the very utilities they are derived from.
  • standard math Standard GAT and LoRA machinery behave as described in [27] and [19].
    The backbone uses GAT attention (Eqs. 4-5) and low-rank adaptation (Eq. 7) from prior work.

pith-pipeline@v1.3.0-alltime-deepseek · 23534 in / 15200 out tokens · 156060 ms · 2026-08-01T12:01:39.802009+00:00 · methodology

0 comments
read the original abstract

Federated Graph Neural Networks (FedGNNs) are highly vulnerable to backdoor poisoning, yet existing defenses typically rely on rule-based approaches that lack semantic understanding, making them vulnerable to stealthy triggers and harmful to benign structures. To solve this, we present FedLSG, the first framework that integrates large language models (LLMs) into federated graph backdoor defense. FedLSG introduces a graph and behavior to text grounding scheme that transforms local graph structures and client update behaviors into semantically rich natural language representations. The framework further adopts a lightweight student-teacher architecture. On the server side, a full scale LLM serves as a teacher, providing global contextual guidance and evaluating client updates during aggregation to identify potentially malicious participants. On the client side, a LoRA-based student is maintained to perform semantic reasoning, to suppress the influence of edges associated with backdoor triggers. By enabling semantic interpretation of both graph patterns and client behaviors, the framework adaptively incorporates rule-based signals into message passing and client aggregation for defense. Experiments demonstrate that FedLSG significantly improves resistance to backdoor attacks without compromising graph integrity.

Figures

Figures reproduced from arXiv: 2607.19674 by Chenyu Zhou, Kunlin Li, Shuaishuai Zhang, Wei Huang, Xinyuan Miao, Yabin Peng.

Figure 1
Figure 1. Figure 1: FedLSG where σ is the LeakyReLU activation, a is a learnable parameter vector, W is a weight matrix for node features, and ∥ denotes concatenation. The attention weights suv serve as an implicit indicator of edge reliability. The updated node representation is then computed as attention-weighted aggregation of neighbor features: H′ u = σ   X v∈N(u) s˜uvW Hv   . (5) By integrating rule and LLM-derived s… view at source ↗
Figure 2
Figure 2. Figure 2: Defense in white-box adaptive attack scenarios [PITH_FULL_IMAGE:figures/full_fig_p009_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Impact of the number of attacks Acknowledgments We sincerely thank all anonymous reviewers for their valuable efforts. References [1] Mingyang Lv, Xiangfeng Liu, and Yuanbo Xu. Dynamic multi-interest graph neural network for session-based recommendation. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pages 12328– 12336, 2025. [2] Junwei Li, Le Wu, Yulu Du, Richang Hong, and We… view at source ↗
Figure 4
Figure 4. Figure 4: Ablation study To further investigate the contribution of each component in FedLSG, we conduct ablation experiments on Pubmed under UGBA and on Ogb-arxiv under DPGBA. The results are reported in [PITH_FULL_IMAGE:figures/full_fig_p021_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Hyperparameter Sensitivity Analysis A.10 Impact of Client Scale 50 100 Clients 0 20 40 60 80 100 87.19 5.28 91.54 6.14 Flickr ASR -81.91 -85.40 50 100 Clients 46.0 46.5 47.0 46.86 46.70 46.63 46.55 Flickr ACC -0.16 -0.08 50 100 Clients 0 20 40 60 80 100 95.35 36.71 98.05 40.22 Ogb-arxiv ASR -58.64 -57.83 50 100 Clients 65 66 67 65.67 66.22 65.34 66.75 Ogb-arxiv ACC +0.55 +1.41 None FedLSG [PITH_FULL_IMAGE… view at source ↗
Figure 6
Figure 6. Figure 6: Impact of Client Scale on Backdoor Defense Effectiveness [PITH_FULL_IMAGE:figures/full_fig_p022_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Defense on heterogeneous graphs A.12 Non-IID-Louvain and IID settings All the above experiments are conducted under the non-identically distributed Louvain (Non-IID-Louvain) data partition setting. To comprehensively evaluate the robustness of FedLSG, we conduct a comparison between independent and identically distributed (IID) and Non-IID-Louvain settings in this section to comprehensively assess the FedL… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

51 extracted references · 4 linked inside Pith

  1. [1]

    Dynamic multi-interest graph neural network for session-based recommendation

    Mingyang Lv, Xiangfeng Liu, and Yuanbo Xu. Dynamic multi-interest graph neural network for session-based recommendation. InProceedings of the AAAI Conference on Artificial Intelligence, volume 39, pages 12328– 12336, 2025

    2025

  2. [2]

    Dual graph neural networks for dynamic users’ behavior prediction on social networking services.IEEE Transactions on Computational Social Systems, 11(5):7020–7031, 2024

    Junwei Li, Le Wu, Yulu Du, Richang Hong, and Weisheng Li. Dual graph neural networks for dynamic users’ behavior prediction on social networking services.IEEE Transactions on Computational Social Systems, 11(5):7020–7031, 2024

    2024

  3. [3]

    Refine then classify: Robust graph neural networks with reliable neighborhood contrastive refinement

    Shuman Zhuang, Zhihao Wu, Zhaoliang Chen, Hong-Ning Dai, and Ximeng Liu. Refine then classify: Robust graph neural networks with reliable neighborhood contrastive refinement. InProceedings of the AAAI Conference on Artificial Intelligence, volume 39, pages 13473–13482, 2025

    2025

  4. [4]

    Bkd-fedgnn: A benchmark for classification backdoor attacks on federated graph neural network.arXiv preprint arXiv:2306.10351, 2023

    Fan Liu, Siqi Lai, Yansong Ning, and Hao Liu. Bkd-fedgnn: A benchmark for classification backdoor attacks on federated graph neural network.arXiv preprint arXiv:2306.10351, 2023

    Pith/arXiv arXiv 2023

  5. [5]

    More is better (mostly): On the backdoor attacks in federated graph neural networks

    Jing Xu, Rui Wang, Stefanos Koffas, Kaitai Liang, and Stjepan Picek. More is better (mostly): On the backdoor attacks in federated graph neural networks. InProceedings of the Annual Computer Security Applications Conference, page 684–698, 2022

    2022

  6. [6]

    Backdoor attacks to graph neural networks

    Zaixi Zhang, Jinyuan Jia, Binghui Wang, and Neil Zhenqiang Gong. Backdoor attacks to graph neural networks. InProceedings of the ACM Symposium on Access Control Models and Technologies, pages 15–26, 2021

    2021

  7. [7]

    Unnoticeable backdoor attacks on graph neural networks

    Enyan Dai, Minhua Lin, Xiang Zhang, and Suhang Wang. Unnoticeable backdoor attacks on graph neural networks. InProceedings of the ACM Web Conference, pages 2263–2273, 2023

    2023

  8. [8]

    Rethinking graph backdoor attacks: A distribution- preserving perspective

    Zhiwei Zhang, Minhua Lin, Enyan Dai, and Suhang Wang. Rethinking graph backdoor attacks: A distribution- preserving perspective. InProceedings of the ACM SIGKDD Conference on Knowledge Discovery and Data Mining, page 4386–4397, 2024

    2024

  9. [9]

    Flmaacbd: Defending against backdoors in federated learning via model anomalous activation behavior detection.Knowledge-Based Systems, 289:111511, 2024

    Hongyun Cai, Jiahao Wang, Lijing Gao, and Fengyu Li. Flmaacbd: Defending against backdoors in federated learning via model anomalous activation behavior detection.Knowledge-Based Systems, 289:111511, 2024

    2024

  10. [10]

    Pham, Khoa D

    Thuy Dung Nguyen, Tuan Nguyen, Phi Le Nguyen, Hieu H. Pham, Khoa D. Doan, and Kok-Seng Wong. Backdoor attacks and defenses in federated learning: Survey, challenges and future research directions.Engineering Applications of Artificial Intelligence, 127:107166, 2024

    2024

  11. [11]

    Neurotoxin: Durable backdoors in federated learning

    Zhengming Zhang, Ashwinee Panda, Linyue Song, Yaoqing Yang, Michael Mahoney, Prateek Mittal, Ramchan- dran Kannan, and Joseph Gonzalez. Neurotoxin: Durable backdoors in federated learning. InProceedings of the International Conference on Machine Learning, volume 162, pages 26429–26446, 2022

    2022

  12. [12]

    A simple and yet fairly effective defense for graph neural networks

    Sofiane Ennadir, Yassine Abbahaddou, Johannes F Lutzeyer, Michalis Vazirgiannis, and Henrik Boström. A simple and yet fairly effective defense for graph neural networks. InProceedings of the AAAI Conference on Artificial Intelligence, pages 21063–21071, 2024

    2024

  13. [13]

    Robustness inspired graph backdoor defense

    Zhiwei Zhang, Minhua Lin, Junjie Xu, Zongyu Wu, Enyan Dai, and Suhang Wang. Robustness inspired graph backdoor defense. InProceedings of the International Conference on Learning Representations, 2025. 10 Running Title for Header

    2025

  14. [14]

    Beyond redundancy: Information-aware unsupervised multiplex graph structure learning

    Zhixiang Shen, Shuo Wang, and Zhao Kang. Beyond redundancy: Information-aware unsupervised multiplex graph structure learning. InProceedings of the Advances in Neural Information Processing Systems, volume 37, pages 31629–31658, 2024

    2024

  15. [15]

    Defending against backdoors in federated learning with robust learning rate

    Mustafa Safa Ozdayi, Kantarcioglu Murat, and Yulia R Gel. Defending against backdoors in federated learning with robust learning rate. InProceedings of the AAAI conference on artificial intelligence, volume 35, pages 9268–9276, 2021

    2021

  16. [16]

    Energy-based back- door defense against federated graph learning

    Guancheng Wan, Zitong Shi, Wenke Huang, Guibin Zhang, Dacheng Tao, and Mang Ye. Energy-based back- door defense against federated graph learning. InProceedings of the International Conference on Learning Representations, 2025

    2025

  17. [17]

    Data-centric federated graph learning with large language models.arXiv preprint arXiv:2503.19455, 2025

    Bo Yan, Zhongjian Zhang, Huabin Sun, Mengmei Zhang, Yang Cao, and Chuan Shi. Data-centric federated graph learning with large language models.arXiv preprint arXiv:2503.19455, 2025

    Pith/arXiv arXiv 2025

  18. [18]

    Llm-guided dynamic-umap for personalized federated graph learning.arXiv preprint arXiv:2511.09438, 2025

    Sai Puppala, Ismail Hossain, Md Jahangir Alam, Tanzim Ahad, and Sajedul Talukder. Llm-guided dynamic-umap for personalized federated graph learning.arXiv preprint arXiv:2511.09438, 2025

    arXiv 2025

  19. [19]

    pfedlora: Model-heterogeneous personalized federated learning with lora tuning.arXiv preprint arXiv:2310.13283, 2023

    Liping Yi, Han Yu, Gang Wang, Xiaoguang Liu, and Xiaoxiao Li. pfedlora: Model-heterogeneous personalized federated learning with lora tuning.arXiv preprint arXiv:2310.13283, 2023

    Pith/arXiv arXiv 2023

  20. [20]

    Personalized federated fine-tuning for llms via data-driven heterogeneous model architectures

    Yicheng Zhang, Zhen Qin, Zhaomin Wu, Jian Hou, and Shuiguang Deng. Personalized federated fine-tuning for llms via data-driven heterogeneous model architectures. InProceedings of the ACM Web Conference, pages 5099–5110, 2026

    2026

  21. [21]

    Fedex-lora: Exact aggregation for federated and efficient fine-tuning of large language models

    Raghav Singhal, Kaustubh Ponkshe, and Praneeth Vepakomma. Fedex-lora: Exact aggregation for federated and efficient fine-tuning of large language models. InProceedings of the Annual Meeting of the Association for Computational Linguistics, pages 1316–1336, 2025

    2025

  22. [22]

    Fedalt: Federated fine-tuning through adaptive local training with rest-of-world lora

    Jieming Bian, Lei Wang, Letian Zhang, and Jie Xu. Fedalt: Federated fine-tuning through adaptive local training with rest-of-world lora. InProceedings of the AAAI Conference on Artificial Intelligence, pages 19728–19736, 2026

    2026

  23. [23]

    Federatedscope- gnn: Towards a unified, comprehensive and efficient package for federated graph learning

    Zhen Wang, Weirui Kuang, Yuexiang Xie, Liuyi Yao, Yaliang Li, Bolin Ding, and Jingren Zhou. Federatedscope- gnn: Towards a unified, comprehensive and efficient package for federated graph learning. InProceedings of the ACM SIGKDD Conference on Knowledge Discovery and Data Mining, page 4110–4120, 2022

    2022

  24. [24]

    E-sage: Explainability- based defense against backdoor attacks on graph neural networks

    Dingqiang Yuan, Xiaohua Xu, Lei Yu, Tongchang Han, Rongchang Li, and Meng Han. E-sage: Explainability- based defense against backdoor attacks on graph neural networks. InProceedings of the International Conference on Wireless Artificial Intelligent Computing Systems and Applications, pages 402–414, 2024

    2024

  25. [25]

    Dshield: Defending against backdoor attacks on graph neural networks via discrepancy learning

    Hao Yu, Chuan Ma, Xinhang Wan, Jun Wang, Tao Xiang, Meng Shen, and Xinwang Liu. Dshield: Defending against backdoor attacks on graph neural networks via discrepancy learning. InProceedings of the Network and Distributed System Security Symposium, NDSS, 2025

    2025

  26. [26]

    Gnnguard: Defending graph neural networks against adversarial attacks

    Xiang Zhang and Marinka Zitnik. Gnnguard: Defending graph neural networks against adversarial attacks. In Proceedings of the Advances in Neural Information Processing Systems, volume 33, pages 9263–9275, 2020

    2020

  27. [27]

    Graph attention networks

    Velickovic Petar, Cucurull Guillem, Casanova Arantxa, Romero Adriana, Liò Pietro, and Bengio Yoshua. Graph attention networks. InProceedings of the International Conference on Learning Representations, 2018

    2018

  28. [28]

    Comprehensive risk assessment method of power grid based on grey relational weight game theory.IOP Conference Series: Earth and Environmental Science, 453(1):12068, 2020

    Lu Dan, Xu Changqing, Zhang Linjuan, Wang Lili, and Sun Yanying. Comprehensive risk assessment method of power grid based on grey relational weight game theory.IOP Conference Series: Earth and Environmental Science, 453(1):12068, 2020

    2020

  29. [29]

    Evidential supplier selection based on DEMATEL and game theory

    Tianyu Liu, Yong Deng, and Felix T S Chan. Evidential supplier selection based on DEMATEL and game theory. International Journal of Fuzzy Systems, 20(4):1321–1333, 2018

    2018

  30. [30]

    Collective classification in network data.AI Magazine, 29(3):93–106, 2008

    Prithviraj Sen, Galileo Namata, Mustafa Bilgic, Lise Getoor, Brian Gallagher, and Tina Eliassi-Rad. Collective classification in network data.AI Magazine, 29(3):93–106, 2008

    2008

  31. [31]

    Graphsaint: Graph sampling based inductive learning method

    Hanqing Zeng, Hongkuan Zhou, Ajitesh Srivastava, Rajgopal Kannan, and Viktor Prasanna. Graphsaint: Graph sampling based inductive learning method. InProceedings of the International Conference on Learning Represen- tations, 2020

    2020

  32. [32]

    Open graph benchmark: Datasets for machine learning on graphs

    Weihua Hu, Matthias Fey, Marinka Zitnik, Yuxiao Dong, Hongyu Ren, Bowen Liu, Michele Catasta, and Jure Leskovec. Open graph benchmark: Datasets for machine learning on graphs. InProceedings of the Advances in Neural Information Processing Systems, volume 33, pages 22118–22133, 2020

    2020

  33. [33]

    The llama 3 herd of models.arXiv preprint arXiv:2407.21783, 2024

    Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, et al. The llama 3 herd of models.arXiv preprint arXiv:2407.21783, 2024. 11 Running Title for Header

    Pith/arXiv arXiv 2024

  34. [34]

    Garnet: Reduced-rank topology learning for robust and scalable graph neural networks

    Chenhui Deng, Xiuyu Li, Zhuo Feng, and Zhiru Zhang. Garnet: Reduced-rank topology learning for robust and scalable graph neural networks. InProceedings of the Machine Learning Research, volume 198, pages 3:1—-3:23, 2022

    2022

  35. [35]

    Adversarial attacks on graph neural networks via meta learning

    Daniel Zügner and Stephan Günnemann. Adversarial attacks on graph neural networks via meta learning. In Proceedings of the International Conference on Learning Representations, 2019. A Appendix A.1 Algorithm Here we summarize one communication round of FedLSG in algorithmic form. Algorithm 1FedLSG: One-Round Training and Aggregation Input: Participating c...

    2019

  36. [36]

    Relative to the base GAT, the additional structural operation is the similarity-aware edge scoring in Eq

    Structural backbone.FedLSG preserves the original FedGNN training loop, so the dominant local cost is still the SRGAT backbone. Relative to the base GAT, the additional structural operation is the similarity-aware edge scoring in Eq. 4, which requires one pass over local edges and node features. The local classification loss adds the usual O(NnC) term. He...

  37. [37]

    rule suspicious-edge selection and client summary construction.The rule branch computes rrule uv from local homophily, community crossing, overlap, clustering support, and anomaly statistics. These quantities are all obtained from local neighborhoods and edge statistics, so the full edge scan costs Crule =O(ED+E+N n).(25) Selecting the top-Ke suspicious e...

  38. [38]

    From Eqs

    Client-side graph-student and LoRA adaptation.After suspicious edges are selected, each client runs only alightweightgraph-attentive semantic student with k blocks, rather than the full semantic stack. From Eqs. 47–48, the student first computes one semantic embedding and then performs k local attention passes on the private graph, followed by a rank-r Lo...

  39. [39]

    Edge-level split semantic scoring.For each selected suspicious edge, FedLSG builds a deterministic structural text and then issues nuv short neighborhood queries, as described in Eqs. 56–57. Because the prompt format is fixed and each query appends only one sampled neighbor plus the local edge state zstu uv , the total local edge-level semantic scoring co...

  40. [40]

    Client-level split trust scoring.For trust-aware aggregation, FedLSG additionally serializes one compact behav- ioral summary per client and evaluates the client-level split trust in Eq. 67. The local serialization cost is linear in the number of summarized statistics, while the cohort concatenation scales linearly with the number of participating clients...

  41. [41]

    Instead, the server keeps the remaining L−k semantic blocks and provides detached teacher targets for distillation

    Server-side teacher and distillation.The heavy semantic depth never appears on clients. Instead, the server keeps the remaining L−k semantic blocks and provides detached teacher targets for distillation. Since the teacher is used only for semantic supervision and trust calibration rather than for client-side deployment, its per-round server cost is Cteach...

  42. [42]

    FedLoRA+GAT + one server-side LLM teacher,

    Trust-aware aggregation and communication.FedLSG aggregates the backbone parameters exactly as in weighted FedAvg and additionally aggregates only the low-rank factors (Ai, Bi). Therefore the server-side aggregation and communication cost remains linear: Cagg =O(N c(|Θ|+rH)).(33) The O(Nc|Θ|) term is the standard backbone aggregation cost, and the additio...

  43. [43]

    SBA demonstrates that poisoning training graphs with predefined subgraph triggers can effectively implant backdoors into GNN models

  44. [44]

    UGBA introduces an adaptive trigger generation strategy that produces triggers closely resembling target nodes, thereby improving attack effectiveness while reducing detectability

  45. [45]

    In FL scenarios, the attack surface becomes even broader

    DPGBA enhances stealthiness by generating triggers that preserve the original graph distribution, ensuring that the injected patterns remain statistically consistent with the underlying data. In FL scenarios, the attack surface becomes even broader

  46. [46]

    They establish a comprehensive benchmark that systematically evaluates backdoor attacks in federated graph learning, facilitating more standardized comparisons across methods

    Some works explore both centralized and distributed backdoor attack strategies that exploit the aggregation mechanism in federated GNNs. They establish a comprehensive benchmark that systematically evaluates backdoor attacks in federated graph learning, facilitating more standardized comparisons across methods

  47. [47]

    Prune and its variant PruneLD eliminate edges between dissimilar nodes based on feature inconsistency, aiming to filter out potential trigger connections

  48. [48]

    OD adopts a different perspective by leveraging autoencoder reconstruction errors to detect anomalous patterns introduced by backdoor attacks

  49. [49]

    NoisyGCN injects controlled noise into the graph structure to expose unstable or poisoned edges, thereby improving detection capability

  50. [50]

    RIGBD integrates randomized edge dropping with robust training strategies to mitigate the impact of backdoor triggers

  51. [51]

    19 Running Title for Header A.6 Parameter Settings We summarize the parameter settings used for Citeseer, Pubmed, Flickr, and Ogb-arxiv according to the released implementation

    FedTGE adopts an energy-based formulation to reweight client updates, assigning lower importance to anomalous contributions. 19 Running Title for Header A.6 Parameter Settings We summarize the parameter settings used for Citeseer, Pubmed, Flickr, and Ogb-arxiv according to the released implementation. Unless otherwise stated, all datasets share the same o...