Pith. sign in

REVIEW 4 major objections 6 minor 57 references

MADE: Graph Backdoor Defense with Masked Unlearning

T0 review · 4 major / 6 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read MADE is a training-time graph backdoor defense that drives average attack success rates to near zero—below 3% on four graph classification datasets—while keeping accuracy within a few points of vanilla training.

desk verdict A solid training-time graph backdoor defense with a genuine mechanism, worth refereeing — but the authors overclaim generality and need to tighten reporting. read the letter →

arxiv 2411.18648 v2 pith:DEZ5H373 submitted 2024-11-26 cs.CR cs.AIcs.LG

Xiao Lin , Mingjie Li , Yisen Wang This is my paper · ORCID
classification cs.CRcs.AIcs.LG
keywords graphneuralnetworksbackdoordefenseattacksmaskedunlearninghomophilydatapoisoningclassificationnode
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

MADE is a training-time defense against backdoor attacks on graph neural networks that works from a poisoned training set alone, without any additional clean data. The paper's central claim is that a two-stage procedure—isolating suspected poisoned graphs with a homophily-based outlier test, then learning edge masks that remove trigger subgraphs while preserving clean structure—can reduce the attack success rate to near zero while keeping classification accuracy close to vanilla training. This matters because graph datasets are small and hard to collect, so defenses that discard poisoned samples wholesale degrade utility, and image-oriented defenses such as unlearning entire poisoned instances transfer poorly to graphs. If correct, MADE gives GNN users a practical way to train on potentially poisoned data and still obtain models that ignore triggers.

What carries the argument

The load-bearing mechanism is masked aggregation driven by a homophily-based natural score. A learnable projection head maps node features into a subspace associated with small singular values, and each node's natural score is the average cosine similarity between its projection and its neighbors' projections (Eq. 6); trigger nodes score low because they are dissimilar to their neighbors. Edge masks are then set to the original adjacency weight for edges between the top-$\beta$ clean nodes and to the projected cosine similarity otherwise, so message passing (Eq. 8) down-weights edges that touch trigger nodes. Homophily outlier detection (Eq. 4) supplies the initial separation of poisoned graphs from clean graphs, and the adversarial loss on the poisoned subset (Eq. 10) together with cross-entropy and smoothing losses on the clean subset (Eq. 13) performs the unlearning and preserves utility.

What would settle it

Train MADE against a backdoor attack whose trigger subgraph is engineered to be homophilous with its host graph—for example, trigger nodes connect only to feature-similar neighbors—at a 10% injection rate on AIDS. If the attack success rate stays near 100% while accuracy remains high, the homophily assumption is the load-bearing premise that fails.

Watch

Extended reading notes

Core claim

On its own terms, the paper claims that backdoor triggers on graphs have a measurable structural signature—they lower a graph's homophily score—and that this signature can be exploited for precise defense. MADE first marks as suspicious any graph whose homophily falls more than one standard deviation from the training-set mean, then adds low-loss samples to form an enriched poisoned subset and high-loss samples as a clean subset. During training, a learnable projection head maps node features into a subspace associated with small singular values, a natural score measures how similar each node is to its neighbors, and edge weights are masked so that trigger-like nodes and edges are suppressed while the top-scoring clean nodes keep their original connections. Adversarial loss on the poisoned subset unlearns the trigger while cross-entropy plus a smoothing loss on the clean subset preserves accuracy. Across AIDS, PROTEINS, PROTEINS_full, and ENZYMES under the GTA attack with a 10% injection rate, the reported average attack success rate is 0.00–2.73% with accuracy within roughly 2–5 points of vanilla training, and the method extends to node classification against UGBA.

Load-bearing premise

The method assumes that injected trigger subgraphs reliably lower graph homophily, so a threshold at one standard deviation from the training-set mean (Eq. 4) marks poisoned graphs, and that trigger nodes are dissimilar to their neighbors so the natural score (Eq. 6) finds them.

Editorial extensions

If this is right

  • On the four graph classification datasets under GTA at a 10% injection rate, the reported average attack success rate drops to between 0.00% and 2.73% while average accuracy stays within roughly 2–5 points of vanilla training.
  • The defense is not architecture-specific: near-zero attack success rates are reported for GCN, GAT, and GraphSAGE on both graph and node classification tasks.
  • At injection rates from 5% to 20% on AIDS, attack success rate stays below 8% and mostly below 2%, with accuracy degrading by less than 3% even at the highest rate.
  • On node classification with UGBA, average attack success rate falls below 3.5% on Cora, PubMed, OGBN-Arxiv, and Flickr, showing the same design covers node-level attacks.
  • Masked unlearning keeps the clean part of poisoned graphs intact, which is why accuracy does not collapse the way it does when whole poisoned graphs are unlearned.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • An attacker who engineers trigger subgraphs to be homophilous with their host graphs—for instance by connecting trigger nodes only to feature-similar neighbors—would likely evade the homophily outlier test; whether the low-loss selection step could still catch such triggers is a testable open question.
  • The paper's spectral analysis suggests the mask mechanism could generalize to other localized structural anomalies beyond backdoors, such as adversarial edge flips or poisoned subgraphs, but that application is not tested here.
  • Because mask values are produced at inference time, MADE doubles as a per-node trigger detector; exposing these scores as an audit signal is a natural extension the paper does not pursue.
  • The comparison with ABL indicates that localized masking rather than whole-sample unlearning is what preserves utility, a principle that could inform defenses for other structured data with sparse malicious perturbations.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes MADE, a training-time backdoor defense for GNNs that does not require additional clean data. MADE first isolates a poisoned subset using a homophily-based criterion (Eq. 4) plus low-loss selection, then generates edge masks via a learned projection head and natural scores (Eqs. 5-7), and trains with an adversarial loss on the isolated backdoor subset to unlearn triggers while a clean-subset loss preserves utility. The authors evaluate on four graph-classification datasets under the GTA attack and four node-classification datasets under the UGBA attack, reporting near-zero ASR with small accuracy drops, and include ablations on injection rates and hyperparameters.

Significance. If the results are reproducible, MADE addresses a practical gap: existing image-based defenses such as ABL and ANP degrade on graphs, and graph-specific defenses are scarce. The method is training-set-only, end-to-end for graph classification, and the ablation in Section 4.2.4 supports the claim that masked unlearning preserves utility better than whole-graph unlearning. The main risk is the strong assumption that graph backdoor triggers reduce homophily, which is only demonstrated for two attack families; the paper should either broaden the attack coverage or temper the general claim.

major comments (4)
  1. [§3.1, §3.2.1, Eq. (4), Eq. (6)] The defense's isolation and masking mechanisms both assume that backdoor triggers lower graph homophily; this is demonstrated concretely only for GTA (graph classification) and UGBA (node classification) in Table 4. If a trigger subgraph is engineered to be homophilous with the host graph, Eq. (4) will not flag the poisoned graph, and Eq. (6) will assign high natural scores to trigger nodes, so the masks will not remove the trigger. The manuscript's abstract and conclusion claim general effectiveness ('significantly reducing the attack success rate'), which overstates the evidence. Either evaluate against additional attack families that include homophilous triggers, or scope the claim explicitly to low-homophily triggers.
  2. [§4.1, Tables 5 and 6] Section 4.1 states that each experiment is repeated five times and the mean results are recorded, yet Tables 5 and 6 report no standard deviations or other dispersion measures. Because the headline result is near-zero average ASR (e.g., MADE average ASR of 0.00 on PROTEINS in Table 5), the variance across seeds is critical to assessing whether the attack success rate is reliably near zero. Please report standard deviations (or confidence intervals) for both ASR and accuracy.
  3. [Table 5, Appendix F, References [46] and [52]] The baseline labeled 'GCNJaccard' in Table 5 is not described in Appendix F, which instead presents 'GCN-SVD' with citation [52]. Moreover, reference [46] is titled 'Graph Information Bottleneck,' which is not GCNJaccard. This inconsistency prevents the reader from knowing which baseline was actually compared and makes the experimental comparison unreproducible. Please align the table label, the appendix description, and the references so that the baseline is unambiguously defined and cited.
  4. [§4.2.2, Figure 6] The robustness study in Section 4.2.2 varies injection rates only for the GTA attack on the AIDS dataset. Combined with the single-attack-per-task main evaluation (GTA for graph classification, UGBA for node classification), the paper does not establish that MADE's performance generalizes across attacks with different trigger designs or different homophily behavior. At a minimum, add a discussion of this limitation; ideally, evaluate one additional attack per task to support the broader claim.
minor comments (6)
  1. [§3.1] In the text after Eq. (4), 'µhomo and σhomo represents the mean and standard variance' should be 'represent the mean and standard deviation'; 'standard variance' is used inaccurately.
  2. [§2.2] The sentence 'To sum up, the problem of backdoor attacks on graphs can be defined as follows:' is duplicated immediately before Problem 1; remove the duplicate.
  3. [Figure 1 caption] The caption reads 'PROETINS' but should be 'PROTEINS'.
  4. [§4.1] The text says 'Graph Convoluation Network' which should be 'Graph Convolutional Network'.
  5. [Algorithm 2] Line 8 selects the top α1 samples with lowest loss as Dl, and line 9 forms Dbad = Dl ∪ Dh; the relationship between the size of Dh and the isolation rate α1 is unclear, since Dh is determined by the homophily threshold. Clarify how the two sets are combined to satisfy the stated isolation rate.
  6. [Figure 5 caption] The caption uses 'Lossadv', 'Lossclean', and 'Losssmh' while the text uses Ladv, Lnat, and Lsmh; standardize the notation.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: MADE's detection is validated against ground-truth labels, the mask contribution is isolated by a controlled ablation, and the reported ASR is measured on held-out triggers from external attacks rather than being the training objective itself.

full rationale

Walking the derivation chain: Eq. (4) isolates graphs whose homophily deviates from the training-set mean, but the paper validates this selection against ground-truth injected samples in Table 3 and Appendix C, so backdoor detection is empirically checked rather than defined as 'low homophily'. The mask generation in Eqs. (5)-(7) uses a learnable projection head and cosine-similarity natural scores; its contribution is tested by holding data isolation fixed and comparing ABL versus MADE in Figure 8, which isolates the mask mechanism. The adversarial loss in Eq. (10) directly suppresses the target-class probability on the detected backdoor subset, but the reported ASR is the attack success rate on triggers generated by external attacks (GTA for graph classification, UGBA for node classification) at evaluation time, so it is not merely a restatement of the fitted training objective. The only self-citation is the ANP baseline [20], co-authored by the corresponding author; ANP is a comparison baseline, not a premise used to construct MADE, so it is not load-bearing. The homophily assumption underlying Eq. (4) and Eq. (6) is demonstrated only for the evaluated attack families, which is a scope limitation for potential homophilous triggers, but that is a robustness/generality concern, not a circular reduction. No equation or citation in the paper assumes the near-zero ASR conclusion by construction.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The central claim depends on empirically observed separations (homophily, spectral decay) plus several hand-set hyperparameters (beta, lambda, alpha1, alpha2). None of these are derived or provided with sensitivity analyses in the main text, so the method's success is contingent on them.

free parameters (5)
  • homophily deviation threshold (1 std) = mu_homo +/- sigma_homo
    Eq. (4) selects graphs outside one standard deviation of the training-set homophily mean; the choice of one sigma is hand-picked and not justified.
  • isolation rate alpha1 = not explicitly reported for main experiments
    Algorithm 2 selects top alpha1 lowest-loss samples as D_l; the exact value used in Tables 5 and 6 is not stated, though Appendix B implies equality with the 10% injection rate.
  • clean subset rate alpha2 = not explicitly reported
    Algorithm 2 selects top alpha2 highest-loss samples as D_clean; the value is not given.
  • clean-node fraction beta = 0.9
    Section 4.1 sets beta=0.9; masks for the top 90% highest natural-score nodes are set to 1, influencing how much of each graph is preserved.
  • smoothing loss weight lambda = 5
    Section 4.1 sets lambda=5 in Eq. (13); the balance between natural loss and mask-smoothing loss is hand-chosen.
assumptions (5)
  • domain assumption Backdoor graphs have measurably lower homophily than clean graphs.
    Table 4 shows GTA backdoor graphs have homophily 0.81-0.90 vs 0.98-0.99 for clean graphs; Eq. (4) uses this gap for isolation. This is empirical and untested for other attacks.
  • domain assumption Trigger nodes are dissimilar to their neighbors, so cosine similarity between projected neighbor features identifies them.
    Section 3.2.1 builds the natural score in Eq. (6) on the premise that trigger nodes have low similarity to neighbors; only motivated by the homophily table.
  • domain assumption Triggers occupy only a minor fraction of each poisoned graph.
    Section 3.2.1 states triggers are a minor fraction for stealthiness, justifying resetting masks for top-beta clean nodes to 1.
  • domain assumption The projection head's output onto low singular-value subspace separates trigger from clean nodes.
    Section 3.2.1 argues from Figure 4 that singular values of backdoor node features decay faster, but the head is trained end-to-end, not constrained to tail eigenvectors; the separation is heuristic.
  • domain assumption The highest-loss samples after warm-up form an enriched clean subset D_clean.
    Algorithm 2 selects top alpha2 highest-loss samples as clean; a poisoned sample with high loss would be mislabeled as clean, and no analysis of this failure mode is provided.

how reviews work

0 comments
Cite this review

Pith. "Pith review of MADE: Graph Backdoor Defense with Masked Unlearning." pith.science (2026). https://pith.science/paper/DEZ5H373

@misc{pith2026241118648,
  author       = {Pith},
  title        = {Pith review of: MADE: Graph Backdoor Defense with Masked Unlearning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/DEZ5H373}},
  note         = {Machine review of arXiv:2411.18648}
}
read the original abstract

Graph Neural Networks (GNNs) have garnered significant attention from researchers due to their outstanding performance in handling graph-related tasks, such as social network analysis, protein design, and so on. Despite their widespread application, recent research has demonstrated that GNNs are vulnerable to backdoor attacks, implemented by injecting triggers into the training datasets. Trained on the poisoned data, GNNs will predict target labels when attaching trigger patterns to inputs. This vulnerability poses significant security risks for applications of GNNs in sensitive domains, such as drug discovery. While there has been extensive research into backdoor defenses for images, strategies to safeguard GNNs against such attacks remain underdeveloped. Furthermore, we point out that conventional backdoor defense methods designed for images cannot work well when directly implemented on graph data. In this paper, we first analyze the key difference between image backdoor and graph backdoor attacks. Then we tackle the graph defense problem by presenting a novel approach called MADE, which devises an adversarial mask generation mechanism that selectively preserves clean sub-graphs and further leverages masks on edge weights to eliminate the influence of triggers effectively. Extensive experiments across various graph classification tasks demonstrate the effectiveness of MADE in significantly reducing the attack success rate (ASR) while maintaining a high classification accuracy.

Figures

Figures reproduced from arXiv: 2411.18648 by the authors.

Figure 1
Figure 1. Training curve of PROETINS’ backdoor and natural [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Unlearning performance w.r.t. different unlearn rates [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Differences in the response of models attacked by image backdoor and graph backdoor attacks. In Figure 3(a), the left [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (7 more)
Figure 4
Figure 4. Figure 4: The spectrum for clean nodes and backdoor nodes on [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: Illustrations of proposed MADE. Red circles / blue circles represent the backdoor nodes / clean nodes, while orange links / gray links represent backdoor edges / clean edges, respectively. During data isolation, MADE leverages the discrepancies between backdoor and cle…
Figure 6
Figure 6. Figure 6: The impact of injection rate on Accuracy and ASR on the AIDS dataset when using different model architectures. [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]
Figure 7
Figure 7. Figure 7: Ablations study between vanilla training and MADE on the PROTEINS_full dataset for graph classification when [PITH_FULL_IMAGE:figures/full_fig_p010_7.png]
Figure 8
Figure 8. Figure 8: Ablation study to show the effectiveness of mask [PITH_FULL_IMAGE:figures/full_fig_p010_8.png]
Figure 9
Figure 9. Figure 9: Precision and recall of isolated backdoor samples [PITH_FULL_IMAGE:figures/full_fig_p013_9.png]
Figure 10
Figure 10. Figure 10: Ablations study between vanilla training and MADE on the Cora dataset for node classification when varying the [PITH_FULL_IMAGE:figures/full_fig_p014_10.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

57 extracted references · 41 canonical work pages

  1. [52]

    Svd-gcn: A simpli- fied graph convolution paradigm for recommendation,

    S. Peng, K. Sugiyama, and T. Mine, “Svd-gcn: A simpli- fied graph convolution paradigm for recommendation,” in CIKM, 2022. Xiao Lin received the B.E. degree from Peking University in 2019. He is currently a Ph.D. stu- dent in IdeaLab, University of Illinois Urbana- Champaign. His research interests include graph learning, trustworthy machine learning, and...

    work page 2022

  2. [46]

    Graph informa- tion bottleneck,

    T. Wu, H. Ren, P . Li, and J. Leskovec, “Graph informa- tion bottleneck,” in NeurIPS, 2020

    work page 2020

  3. [1]

    Graph neural networks for social recommendation,

    W. Fan, Y. Ma, Q. Li, Y. He, E. Zhao, J. Tang, and D. Yin, “Graph neural networks for social recommendation,” in WWW, 2019

    work page 2019

  4. [2]

    Random graph models of social networks,

    M. E. Newman, D. J. Watts, and S. H. Strogatz, “Random graph models of social networks,” Proceedings of the national academy of sciences, 2002

    work page 2002

  5. [3]

    Trinajstic, Chemical graph theory

    N. Trinajstic, Chemical graph theory. Routledge, 2018

    work page 2018

  6. [4]

    Beyond homophily in graph neural networks: Current limitations and effective designs,

    J. Zhu, Y. Yan, L. Zhao, M. Heimann, L. Akoglu, and D. Koutra, “Beyond homophily in graph neural networks: Current limitations and effective designs,” Advances in neural information processing systems, vol. 33, pp. 7793–7804, 2020

    work page 2020

  7. [5]

    Powerful graph convolutional networks with adaptive propagation mechanism for homophily and heterophily,

    T. Wang, D. Jin, R. Wang, D. He, and Y. Huang, “Powerful graph convolutional networks with adaptive propagation mechanism for homophily and heterophily,” in Proceedings of the AAAI conference on artificial intelligence, vol. 36, no. 4, 2022, pp. 4210–4218

    work page 2022

  8. [6]

    Semi-supervised classi- fication with graph convolutional networks,

    T. N. Kipf and M. Welling, “Semi-supervised classi- fication with graph convolutional networks,” arXiv preprint arXiv:1609.02907, 2016

    arXiv 2016

Show all 57 references
  1. [7]

    Inductive representation learning on large graphs,

    W. Hamilton, Z. Ying, and J. Leskovec, “Inductive representation learning on large graphs,” in NeurIPS, 2017

    2017

  2. [8]

    Gated graph sequence neural networks,

    Y. Li, R. Zemel, M. Brockschmidt, and D. Tarlow, “Gated graph sequence neural networks,” in ICLR, 2016

    2016

  3. [9]

    Predicting drug–target interaction using a novel graph neural network with 3d structure-embedded graph representation,

    J. Lim, S. Ryu, K. Park, Y. J. Choe, J. Ham, and W. Y. Kim, “Predicting drug–target interaction using a novel graph neural network with 3d structure-embedded graph representation,” Journal of chemical information and modeling, 2019

    2019

  4. [10]

    Kgnn: Knowledge graph neural network for drug-drug interaction prediction

    X. Lin, Z. Quan, Z.-J. Wang, T. Ma, and X. Zeng, “Kgnn: Knowledge graph neural network for drug-drug interaction prediction.” in IJCAI, 2020

    2020

  5. [11]

    Could graph neural networks learn better molecular representation for drug discovery? a comparison study of descriptor-based and graph-based models,

    D. Jiang, Z. Wu, C.-Y. Hsieh, G. Chen, B. Liao, Z. Wang, C. Shen, D. Cao, J. Wu, and T. Hou, “Could graph neural networks learn better molecular representation for drug discovery? a comparison study of descriptor-based and graph-based models,” Journal of cheminformatics, 2021

    2021

  6. [12]

    Graph neural network for traffic forecasting: A survey,

    W. Jiang and J. Luo, “Graph neural network for traffic forecasting: A survey,” Expert Systems with Applications, 2022

    2022

  7. [13]

    Point-gnn: Graph neural network for 3d object detection in a point cloud,

    W. Shi and R. Rajkumar, “Point-gnn: Graph neural network for 3d object detection in a point cloud,” in CVPR, 2020

    2020

  8. [14]

    Neural graph collaborative filtering,

    X. Wang, X. He, M. Wang, F. Feng, and T.-S. Chua, “Neural graph collaborative filtering,” in SIGIR, 2019

    2019

  9. [15]

    Scaling graph neural networks with approxi- mate pagerank,

    A. Bojchevski, J. Klicpera, B. Perozzi, A. Kapoor, M. Blais, B. Rózemberczki, M. Lukasik, and S. Gün- nemann, “Scaling graph neural networks with approxi- mate pagerank,” in SIGKDD, 2020

    2020

  10. [16]

    Predict then propagate: Graph neural networks meet personal- ized pagerank,

    J. Klicpera, A. Bojchevski, and S. Günnemann, “Predict then propagate: Graph neural networks meet personal- ized pagerank,” arXiv preprint arXiv:1810.05997, 2018

    2018 arXiv

  11. [17]

    Graph backdoor,

    Z. Xi, R. Pang, S. Ji, and T. Wang, “Graph backdoor,” in USENIX Security, 2021

    2021

  12. [18]

    Backdoor attacks to graph neural networks,

    Z. Zhang, J. Jia, B. Wang, and N. Z. Gong, “Backdoor attacks to graph neural networks,” in ACM Symposium on Access Control Models and Technologies, 2021

    2021

  13. [19]

    Transferable graph backdoor attack,

    S. Yang, B. G. Doan, P . Montague, O. De Vel, T. Abraham, S. Camtepe, D. C. Ranasinghe, and S. S. Kanhere, “Transferable graph backdoor attack,” in International Symposium on Research in Attacks, Intrusions and Defenses, 2022

    2022

  14. [20]

    Adversarial neuron pruning purifies backdoored deep models,

    D. Wu and Y. Wang, “Adversarial neuron pruning purifies backdoored deep models,” in NeurIPS, 2021

    2021

  15. [21]

    Anti- backdoor learning: Training clean models on poisoned data,

    Y. Li, X. Lyu, N. Koren, L. Lyu, B. Li, and X. Ma, “Anti- backdoor learning: Training clean models on poisoned data,” 2021

    2021

  16. [22]

    Fine-tuning is all you need to mitigate backdoor at- tacks,

    Z. Sha, X. He, P . Berrang, M. Humbert, and Y. Zhang, “Fine-tuning is all you need to mitigate backdoor at- tacks,” arXiv preprint arXiv:2212.09067, 2022

    2022 arXiv

  17. [23]

    Very deep convolu- tional networks for large-scale image recognition,

    K. Simonyan and A. Zisserman, “Very deep convolu- tional networks for large-scale image recognition,”arXiv preprint arXiv:1409.1556, 2014

    2014 arXiv

  18. [24]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in CVPR, 2016

    2016

  19. [25]

    Attention is all you need,

    A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, Ł. Kaiser, and I. Polosukhin, “Attention is all you need,” in NeurIPS, 2017

    2017

  20. [26]

    Spectral signatures in backdoor attacks,

    B. Tran, J. Li, and A. Madry, “Spectral signatures in backdoor attacks,” in NeurIPS, 2018

    2018

  21. [27]

    Targeted backdoor attacks on deep learning systems using data poisoning,

    X. Chen, C. Liu, B. Li, K. Lu, and D. Song, “Targeted backdoor attacks on deep learning systems using data poisoning,” arXiv preprint arXiv:1712.05526, 2017

    2017 arXiv

  22. [28]

    Badnets: Iden- tifying vulnerabilities in the machine learning model supply chain,

    T. Gu, B. Dolan-Gavitt, and S. Garg, “Badnets: Iden- tifying vulnerabilities in the machine learning model supply chain,” arXiv preprint arXiv:1708.06733, 2017

    2017 arXiv

  23. [29]

    Reflection backdoor: A natural backdoor attack on deep neural networks,

    Y. Liu, X. Ma, J. Bailey, and F. Lu, “Reflection backdoor: A natural backdoor attack on deep neural networks,” in ECCV, 2020

    2020

  24. [30]

    Re- thinking the reverse-engineering of trojan triggers,

    Z. Wang, K. Mei, H. Ding, J. Zhai, and S. Ma, “Re- thinking the reverse-engineering of trojan triggers,” in NeurIPS, 2022

    2022

  25. [31]

    Few-shot backdoor defense using shapley estimation,

    J. Guan, Z. Tu, R. He, and D. Tao, “Few-shot backdoor defense using shapley estimation,” in CVPR, 2022

    2022

  26. [32]

    Unnotice- able backdoor attacks on graph neural networks,

    E. Dai, M. Lin, X. Zhang, and S. Wang, “Unnotice- able backdoor attacks on graph neural networks,” in Proceedings of the ACM Web Conference 2023, 2023, pp. 2263–2273. JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2015 12

    2023

  27. [33]

    Textual backdoor attack for the text classification system,

    H. Kwon and S. Lee, “Textual backdoor attack for the text classification system,” Security and Communication Networks, vol. 2021, pp. 1–11, 2021

    2021

  28. [34]

    Mind the style of text! adversarial and backdoor attacks based on text style transfer,

    F. Qi, Y. Chen, X. Zhang, M. Li, Z. Liu, and M. Sun, “Mind the style of text! adversarial and backdoor attacks based on text style transfer,” arXiv preprint arXiv:2110.07139, 2021

    2021 arXiv

  29. [35]

    A backdoor attack against lstm-based text classification systems,

    J. Dai, C. Chen, and Y. Li, “A backdoor attack against lstm-based text classification systems,” IEEE Access, vol. 7, pp. 138 872–138 878, 2019

    2019

  30. [36]

    How does heterophily impact the robustness of graph neural networks? theoretical connections and practical implications,

    J. Zhu, J. Jin, D. Loveland, M. T. Schaub, and D. Koutra, “How does heterophily impact the robustness of graph neural networks? theoretical connections and practical implications,” in SIGKDD, 2022

    2022

  31. [37]

    Finding global homophily in graph neural networks when meeting heterophily,

    X. Li, R. Zhu, Y. Cheng, C. Shan, S. Luo, D. Li, and W. Qian, “Finding global homophily in graph neural networks when meeting heterophily,” in ICML. PMLR, 2022, pp. 13 242–13 256

    2022

  32. [38]

    Grad-cam: Visual explanations from deep networks via gradient-based localization,

    R. R. Selvaraju, M. Cogswell, A. Das, R. Vedantam, D. Parikh, and D. Batra, “Grad-cam: Visual explanations from deep networks via gradient-based localization,” in CVPR, 2017

    2017

  33. [39]

    Debiasing back- door attack: A benign application of backdoor attack in eliminating data bias,

    S. Wu, Q. He, Y. Zhang, and J. Sang, “Debiasing back- door attack: A benign application of backdoor attack in eliminating data bias,” arXiv preprint arXiv:2202.10582, 2022

    2022 arXiv

  34. [40]

    Iam graph database reposi- tory for graph based pattern recognition and machine learning,

    K. Riesen and H. Bunke, “Iam graph database reposi- tory for graph based pattern recognition and machine learning,” in IAPR workshop, 2008

    2008

  35. [41]

    Protein function prediction via graph kernels,

    K. M. Borgwardt, C. S. Ong, S. Schönauer, S. Vish- wanathan, A. J. Smola, and H.-P . Kriegel, “Protein function prediction via graph kernels,” Bioinformatics, 2005

    2005

  36. [42]

    Automating the construction of internet portals with machine learning,

    A. K. McCallum, K. Nigam, J. Rennie, and K. Seymore, “Automating the construction of internet portals with machine learning,” Information Retrieval, vol. 3, pp. 127–163, 2000

    2000

  37. [43]

    Collective classification in network data,

    P . Sen, G. Namata, M. Bilgic, L. Getoor, B. Galligher, and T. Eliassi-Rad, “Collective classification in network data,” AI magazine, vol. 29, no. 3, pp. 93–93, 2008

    2008

  38. [44]

    Open graph benchmark: Datasets for machine learning on graphs,

    W. Hu, M. Fey, M. Zitnik, Y. Dong, H. Ren, B. Liu, M. Catasta, and J. Leskovec, “Open graph benchmark: Datasets for machine learning on graphs,” Advances in neural information processing systems, vol. 33, pp. 22 118–22 133, 2020

    2020

  39. [45]

    Graphsaint: Graph sampling based induc- tive learning method,

    H. Zeng, H. Zhou, A. Srivastava, R. Kannan, and V . Prasanna, “Graphsaint: Graph sampling based induc- tive learning method,” arXiv preprint arXiv:1907.04931, 2019

    1907 arXiv

  40. [47]

    Graph attention networks,

    P . Veliˇ ckovi´ c, G. Cucurull, A. Casanova, A. Romero, P . Lio, and Y. Bengio, “Graph attention networks,”arXiv preprint arXiv:1710.10903, 2017

    2017 arXiv

  41. [48]

    Backdoor embedding in convolutional neural net- work models via invisible perturbation,

    C. Liao, H. Zhong, A. Squicciarini, S. Zhu, and D. Miller, “Backdoor embedding in convolutional neural net- work models via invisible perturbation,” arXiv preprint arXiv:1808.10307, 2018

    2018 arXiv

  42. [49]

    Clean-label backdoor attacks on video recognition models,

    S. Zhao, X. Ma, X. Zheng, J. Bailey, J. Chen, and Y.-G. Jiang, “Clean-label backdoor attacks on video recognition models,” in CVPR, 2020

    2020

  43. [50]

    Backdoor defense via decoupling the training process,

    K. Huang, Y. Li, B. Wu, Z. Qin, and K. Ren, “Backdoor defense via decoupling the training process,” arXiv preprint arXiv:2202.03423, 2022

    2022 arXiv

  44. [51]

    Defending against backdoor attack on graph nerual network by explainability,

    B. Jiang and Z. Li, “Defending against backdoor attack on graph nerual network by explainability,” arXiv preprint arXiv:2209.02902, 2022

    2022 arXiv

  45. [53]

    In this paper, the experiment JOURNAL OF LATEX CLASS FILES, VOL

    fine-tune [ 22], a widely used method in transfer learning, can effectively remove backdoors from ma- chine learning models. In this paper, the experiment JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2015 15 of fine-tuning runs on the clean subset isolated by data isolation

    2015

  46. [54]

    ABL [ 21] isolate backdoor examples at an early training stage, and then break the correlation be- tween backdoor examples and the target class by unlearning mechanism

  47. [55]

    For typical graph defense methods,

    ANP [20] prunes sensitive neurons to remove the injected backdoor by identifying the increased sen- sitivity of backdoored DNNs to adversarial neuron perturbations. For typical graph defense methods,

  48. [56]

    Edge dropout randomly remove the connections between nodes, thus decreasing the influence of poi- soned nodes during message passing and defending backdoor attacks

  49. [57]

    This modification aims to concentrate solely on the features associated with the K-largest singular vectors, thereby enhancing the model’s robustness to perturbations

    GCN-SVD [ 52] replaces the core design of GCN- based methods with a low-rank truncated SVD. This modification aims to concentrate solely on the features associated with the K-largest singular vectors, thereby enhancing the model’s robustness to perturbations. APPENDIX G MADE T...

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.