LoSplit: Loss-Guided Dynamic Split for Training-Time Defense Against Graph Backdoor Attacks
Authors: Di Jin
Yuxiang Zhang
Bingdao Feng
Xiaobao Wang
Dongxiao He
Zhen Wang
Venue: NeurIPS 2025 poster ()
Keywords: GNNs
Training-Time Defense
Backdoor Defense
Primary area: deep_learning
TL;DR: This paper proposes LoSplit, a training-time defense that detects and mitigates graph backdoors by dynamically analyzing early loss divergence.

Abstract: Graph Neural Networks (GNNs) are vulnerable to backdoor attacks. Existing defenses primarily rely on detecting structural anomalies, distributional outliers, or perturbation-induced prediction instability, which struggle to handle the more subtle, feature-based attacks that do not introduce obvious topological changes. Our empirical analysis reveals that both structure-based and feature-based attacks not only cause early loss convergence of target nodes but also induce a class-coherent loss drift, where this early convergence gradually spreads to nearby clean nodes, leading to significant distribution overlap. To address this issue, we propose LoSplit, the first training-time defense framework in graph that leverages this early-stage loss drift to accurately split target nodes. Our method dynamically selects epochs with maximal loss divergence, clusters target nodes via Gaussian Mixture Models (GMM), and applies a Decoupling-Forgetting strategy to break the association between target nodes and malicious label. Extensive experiments on multiple real- world datasets demonstrate the effectiveness of our approach, significantly reducing attack success rates while maintaining high clean accuracy across diverse backdoor attack strategies. Our code is available at: github.com/zyx924768045/LoSplit.

LoSplit: Loss-Guided Dynamic Split for Training- Time Defense Against Graph Backdoor Attacks
Di Jin' Yuxiang Zhang' Bingdao Feng'~ Xiaobao Wang' Dongxiao He' Zhen Wang"
*College of Intelligence and Computing, Tianjin University, Tianjin, China
School of Cybersecurity, Northwestern Polytechnical University, Xi an, Shaanxi, China {jindi, yzhang fengbingdao, wangxiaobas hedongxiao) @t ju.edu.cr. w wezzeennwppl edu. cn
Abstract
Graph Neural Networks (GNNs) are vulnerable to backdoor attacks. Existing defenses primarily rely on detecting structural anomalies, distributional outliers, perturbation-inducer prediction instability, which struggle to handle the more subtle, feature-based attacks that do not introduce obvious topological changes. Our empirical analysis reveals that both structure-based and feature-based attacks not only cause early loss convergence target nodes but also induce a class-coherent loss drift, where this early convergence gradually spreads to nearby clean nodes, leading to significant distribution overlap. To address this issue, we propose LoSplit, the first training- -tmee defense framework in graph that leverages this sarly-stage loss drift to accurately split target nodes. Our method dynamically selects epochs with maximal loss divergence, clusters target nodes via Gaussian Mixture Models (GMM), and applies a Cecoupliin-FFogeetinee between target nodes and malicious label. Extensive experiments world datasets demonstrate the effectiveness of our approach, significantly reducing attack success rates while maintaining high clean accuracy across diverse backdoor attack strategies. Our code is available at:
strategy to break the association
multiple real-
Introduction
Graphs serve as a ubiquitous form of data structure [i] in many real-world applications such as social networks [2], recommendation systems [3], and financial applications [4], where nodes represent entities and edges capture their relationships. Graph Neural Networks (GNNs) [5, 6, 7] effectively capture graph information via iterative message passing, and have shown strong performance in tasks like node classification [8].
However, GNNs have been shown to be susceptible to backdoor attacks [9, 10, 11, 12, 13, 14, 15, 16), where adversaries embed triggers (either predefined or adaptively generated) in the form of nodes, subgraphs or feature perturbations, into training data to create shortcuts between target nodes and malicious labels. Due to the message-passingg mechanism, these triggers will deceive GNNs to misclassify trigger attached nodes into malicious label during inference, while preserving high performance on clean nodes, thereby posing serious risks in safety-critical applications.
Existing defense against such attack adopt various strategies to detect and mitigate backdoor impact. Prune [11] drops edges that link nodes that exhibit low cosine similarity. OD [12] identifies outlier nodes based on distributional differences and removes them to neutralize trigger influence. RIGBD [17] observes that simple pruning and outlier detection methods can be easily bypassed by carefully crafted triggers, and thus introduces a combination of randomized edge dropping and robust training to weaken trigger influence and restore model integrity. However, defending against more subtle, feature-based backdoor attacks remains significant challenge. Unlike structural perturbations
"Corresponding author.
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

that introduce easily detectable topological anomalies, feature-based triggers operate by subtly manipulating node attributes, often without perturbing the overall graph structure. As highlighted by SPEAR [13], these attacks can preserve the original topology while selectively modifying high importance features, effectively bypassing common graph anomaly detectors. This makes existing defenses that rely on detecting abrupt structural deviations or outliers ineffective, highlighting the need for more comprehensive training-time defenses.
To address this, we hypothesize that these two types of attacks, despite their differences, share certain early training traits. This is consistent with our observation that GNNs often exhibit shortcut learning behaviors in which rigger-embedded nodes rapidly fitting into malicious labels. Similar phenomenon has been reported in deep neural networks (DNNs) [18]. where poisoned samples show sharp and early drop in loss values. This occurs because backdoor triggers introduce strong signals that models latch onto early training, causing target nodes to converge significantly faster than clean nodes.
However, directly applying this intuition to graphs presents unique challenges. In images, each poisoned sample is an independent image (analogous to a graph) with a strong localized trigger (e.g., a black pixel), which the model quickly fits, leading to a stable and fast loss convergence (see Appendix L). In contrast, graph backdoor attacks on node classification task conducts over a single interconnected graph, where poisoned samples are only a few nodes attached by triggers. Different from images, triggers in graphs does not influence the graph directly. Instead, it propagates step-by-step through message passing across limited number of hops to its neighbors, which makes the loss behavior unstable training epoch progresses. As shown Fig. 1, we observe previously unexplored phenomenon we call class-wide loss drift: loss distributions of nodes fluctuate, generally shifting leftward but occasionally reversing, with frequent overlaps across classes. This instability renders fixed ratios and global thresholds typically used in images ineffective in graphs, thus posing distinct challenge:
How to precisely identify target nodes even in the presence of unstable class-wide loss drifi?
Loss Distribution (Epoch
Loss Distribution (Epoch
dacce
To address this, we propose Loss-guided dy-
Nede Count
800
100
Taigel
Count
400
Triget
namic target node Split framework (LoSplir), the first training-time defense in graphs that in-
000
400
troduces several key innovations. First, it iden- tifies malicious label by computing the intra- class loss variance, then it performs step-by- step optimal split epoch selection using inter- cluster divergence, rather than relying on fixed heuristic early epoch like mainstream image ap- proaches do. Second, applies Gaussian Mix- ture Models (GMM) clustering to adaptively ad- just splitting thresholds to split target nodes and clean nodes. Finally, with separated target and clean nodes, it restores the backdoored model using a Decoupting-Forgettnnn strategy. For tar- get nodes, we apply random label reassignment epochs. combined with gradient ascent to maximally de- couple the shortcut association between them and the malicious label. For clean nodes, we train normally to maintain model performance. Our main contributions are threefold:
200
Loss Value
Loes Value
Loss Distribution (Epoch 5)
Loss Distribution (Epoch
Node Count
400
Tagge Nodel
Node Count
dass
Togel hodeo
200
100
0
10
20
30
20
Value
Loss Value
Figure 1: Class-wide loss drift phenomenon across
(1) We propose LoSplit, the first training-ting time graph backdoor defense. (2) We design a novel Early-Stage Dynamic Split for target nodes identification and Decoupling-Forgetting for Backdoor Recovery. (3) Extensive experiments on real-world datasets demonstrate that LoSplit consistently reduces attack success rates while preserving clean accuracy across diverse backdoor attacks.
2

---

2 Related Works
2.1
Graph Backdoor Attacks
Early methods (c.g., SBA 19]. GTA [10]) use fixed subgraph patterns, while UGBA [11] and DPGBA [12] improve stealthiness by exploiting homophily and distributional priors. SPEAR [13] further advances this by perturbing node features only. More details are provided in Appendix A.1.
2.2 Graph Backdoor Defense
Graph Backdoor defense methods fall into two categories. On is Detection-Delefe type of method (e.g., Prune [11], OD [12]) and the other is Detection-Robust Training method such RIGBD [17]. While effective in structural perturbation attacks, they fail to counter more stealthy feature perturbation attacks like SPEAR [13] due to the absence of topological anomalies. More details are provided in Appendix A.2.
2.3 Training-tiin Backdoor Defense
Training-time backdoor defenses, initially developed in the image domain such as ABL [18], DBD [19], ASD [20], PIPD [21], and HARVEY [22], identify and mitigate poisoned samples by progressively isolating them based early training behaviors. Although effective in vision, these methods overlook graph-specific properties such as message passing, neighborhood aggregation, and structural homophily, making them less effective or inapplicable to graphs. More details provided
in Appendix A.3.
Preliminaries
Graph Representation Learning. We define an undirected graph as G EV, where the set of N nodes and A E NxN the adjacency matrix denoting the relationship between nodes: A,j = 1 if node v; is connected to node ej, A.j = 0 otherwise. 3 V x V is the set of edges, and X E Nxd represents the node features. Each node E V is associated with feature vector r; and ground-truth label y/ E E. Graph Convolutional Networks (GCNs) [5] compute node embeddings through spectral graph convolution using the layer-wise propagation rule:
{vi....,
H (1+1) =o -AAAHWW"))
where (!)) E Nxh, contains node embeddings at layer (initialized with ( = X), Å = D 1/2 AD-2AD-11 1/2 represents the normalized adjacency matrix with added self-loops (A = A + In), D is the corresponding degree matrix, ((!)) x denotes trainable parameters, and (-)) an activation function such ReLU.
Adversaries strategically implant stealthy trigger patterns typically in the form of subgraphs into small number of training nodes to mislead GNNs to produce attacker- specified outputs when trigger appears but behave normally on clean nodes during inference. In other words, the model is "backdoored". A sound backdoor attack should maintain high clean accuracy (CA) and high attack success rate (ASR) simultaneously. We study node classification task under this type of attack, where the training graph GT (VT,AT. Er, 3', and test graph Gv = (Vv,, Ar, Eu, 3'v)'v) are disjoint, i.e., Vr Vo = The attacker selects a set of target (poisoned) nodes VB C Vr and attaches backdoor triggers Gj to nodes uj E VB, resulting in perturbed nodes Uy + Gj and trigger-embedded graph Gy Ay Ey, Xy D'y). where denotes feature or structural perturbation. These triggers may involve synthetic subgraphs (structure-based) or crafted feature shifts canture-basedy Clean nodes are denoted as Vc Vr \ VB.
Graph Backdoor Attack.
backdoored model f' is trained to associate triggers with a predefined malicious label yt. causing target nodes misclassified into while maintaining correct prediction on clean nodes:
{ f(1; θ gj) = Vt. Vuy E VB; f(6)) = yh:
(2)
Ve Vc.
3

---

Due to message passing in GNNs, even localized triggers can propagate across neighborhoods, leading the model to learn spurious correlations between the trigger and the malicious label. This causes the model to misclassify any node containing the trigger as yr during inference, while maintaining high accuracy on clean nodes, making the attack both effective and stealthy.
Defender's Knowledge and Goal. Defenders can only get access to the perturbed training graph Gir, without the knowledge of the malicious label y/s the number and position of target nodes [VB]. and trigger patterns 9j- Depending on the attack, defenders can either refine model using G or receive an infected model via an udversary-providde API [23]. In both cases, defenders have no access to clean validation data or ground-truth labels. Unlike previous works that assumed post-hoc access to infected models, we consider a more practical training- defense setting, where target nodes are identified during model training phase. Given a trigger-embedded graph, defender's s goal is to maintain high accuracy on clean nodes while decoupling the target nodes from the malicious label yt- For clean nodes v/y E Vc. aim to correctly predict their labels yy; for target nodes v, E VB, reduce their association with yt- Specifically, the defense objective is:
min Cg
Σ [(((v))..)++ + Σ c(f(w)),g))
VEVV
BYEVO
where ÿ is a label filter out malicious label: 5i + y and L is the classic classification loss such as Cross-Entropy loss.
Early-Stage Loss Dynamies. We empirically investigate the early-stage loss behaviors of clean nodes (Vc) and target nodes (VB) by tracking their training losses across initial epochs. To be more specific, we compare two loss functions. One Cross-Entropy (CE), defined
as LCR = =- -i (kk)z)) logp((zr) Another is Reverse Cross-Entropy (RCE): CRCP = >>
[24] to reduce overfit- ting by encouraging uncertain predictions and HARVEY [22] to isolate poisoned samples. Inspired by previous work, we also adopt RCE loss to amplify the loss divergence between target nodes and clean nodes early in training, enabling more effective split.
Ek= pk((z) log (k|zz), which has been used in noisy label learning
As shown in Fig. 2a and Fig. 2b, under both CE and RCE loss, target nodes converge noticeably faster than clean nodes during the early training epochs. This phenomenon becomes significantly more pronounced under RCE loss, where target nodes rapidly approach low loss values, thus amplifying their separability from clean nodes. detailed theoretical justification for why target nodes converge faster than clean nodes during early training and why RCE amplifies the early-stage loss divergence between target and clean nodes more effectively than CE loss is provided in Appendix C.I.
Loss Distribution (Epoch 3)
Loss Distribution (Epoch 3)
Epoch
Epoch 3
150
Cleen Nodes
Node Count
Clean Nodes
Class 0
50
Class
100
Target Nodes
Target
Class
Class
100
Class
Class
Node
50
50
0
1.5
2.0
50
60
-50
-50
Loss Value
Loss Value
-50
0
50
50
(a) CE @ @Epoch 3
(b) RCE @ @Epoch3 3
(c) No Train
(d) Few Epochs
Figure 2: (a) and (b) compare the loss distributions under CE and RCE. It is evident that RCE achieves a clearer separation of target nodes compared to CE. (c) and (d) illustrate the early-stage RCE loss clustering before and after a few training epochs, where the bluc cluster (corresponding to the target class) gradually splits into several sub-clusters, with the smaller sub-clusters primarily consisting of target nodes.
Another intriguing loss dynamic that we observe is that clean nodes of the same class naturally form compact loss clusters (see Fig. 2c). However, training progresses, the cluster corresponding the target class (blue clusters in Fig. 2d ) gradually splits into two or more sub-clusters. The smaller sub-clusters predominantly consist of target nodes.
4 Methodology
In this section, we present the proposed defense framework LoSplit, whose overall framework is illustrated in Fig. 3. LoSplit operates in two stages: (1) Early-Stage Dynamic Split, where we

---

We empirically observe that target nodes tend form tight cluster the lower end of the loss spectrum. In practice, we sort the loss values within class ye in ascending order and then fit Gaussian Mixture Model (GMM) [25] to identify the low-loss cluster (target nodes). Let c(t) and ((t) high be the exploit the distinct early loss dynamics under RCE loss to separate target nodes from clean nodes; (2) Decoupling Forgettin....g.nnnngg where the identified target nodes are decoupled and forgotten from the malicious labels through combination of random label reassignment and gradient ascent. This two-stage pipeline enables LoSplis to effectively split target nodes and mitigate backdoor effect without requiring access to ground-truth information. In the following, we will give the details of each stage.
Stage1: Strly-Stage Dynamic Split
Stage2: Peccoupling-Fogettie
Early
Feature Perturbation
y1
Backdoored model
Structral Perturbation Triger-embeidedd Graph (X))K)
epoch 0
epoch
optimal epach
last epach
Benign model
/
Uniabelss/Labeled Nodes
Feature Parturbation
Target (Poisoned) Nodes
Identified Target Nodes Trainable
Target/Clsan Nodes (Target Class) Loss Bitrriuttion
Structral Perturbation,
Trigger Node
Berkgr//eccovery
GMM Clustering
Decoupling Forgetting
Figure 3: Overall Framework of LoSplit.
4.1
Target Nodes Identification via Early-Stage Dynamic Split
LoSPlit first leverages the loss dynamics discussed in Sec. that nodes in the same malicious class tend to split into several sub-clusters to identify malicious label. We achieve this by computing the variance of the loss value of each label and select the label with the highest intra-class loss variance malicious label:
y/ arg max Var (14
By EV
where ((9) denotes the RCE loss of node i; at epoch t in ascending order.
Once the malicious label ye is identified, extract all nodes labeled yt. denoted vif We compute their mean and standard deviation a of the RCE loss value at a given early epoch t. We then normalize their loss values into standardized z-score form:
(
P
Ve,
E (1)) 34
(5)
+
where is small constant to avoid division by zero.
node cluster with smaller and larger average loss values at epoch respectively. Then we define an adaptive threshold (t) by computing the middle point between higher and lower loss clusters:
( max (s: 2 E c(t) min { Dy E
(t)
max {
E C
nigh
(6)
2
To find the optimal epoch t" that best splits the target nodes, first make assumption:
5

---

There exists an optimal epoch during training at which the loss divergence between target nodes and clean nodes is maximized and is less pronounced or absent under standard Cross- Entropy loss. A theoretical justification of Assumption is provided in Appendix C.2.
Assumption 1.
Theorem 1. Under the conditions of Assumption 1, there exists an optimal epoch t* E [0, Ts). where Ts is the number of early training epochs, such that the separation between target nodes and clean nodes is maximized.
Given the existence of an optimal epoch, we compute the difference between the expectation of RCE loss value of the two clusters each early epoch t. The epoch that maximizes this difference is selected as the optimal epoch t":
arg max (B v, [1-0]
E or eclt 1e)
We then treat nodes with ((²)) < 7((") as candidate target nodes, while choosing the remaining nodes in training set as clean nodes:
ve((" = E D(t") E d00)
s((7) v-(()) Vr Vi (is(e))
(8)
After just a few epochs, the epoch-wise RCE loss distribution Fig. 4 demonstrates a clear splitting, indicating that our proposed method can be effectively leveraged to identify target nodes. More results on other datasets are in Appendix G.
Loss Distribution (Epoch 3)
Loss Distribution (Epoch
Loss Distribution (Eooch 16)
Loss Distribution (Epoch 4)
10
15
Node Count
Clean (Class ))
Node Count
Clean (Cless 0)
Node Count
Clean (Cless 0)
Node Count
10
Clean (Class 0)
Target Nodes
Target Nodes
Target Nodes
Target Nodes
10
Threshold
Threshold
Threshold
Threshpld
5
5
25 Loss Value
50
30
40
50
50
0
20
40
Loss Value
Loss Value
Loss Value
(a) GTA
(b) UGBA
(c) DPGBA
(d) SPEAR
Figure 4: Epoch-wist loss distribution of nodes target class 0 on Cora. Nodes the left the red dash line correspond to the candidate target nodes, while the right side are clean nodes with the same label as target nodes. The black color for clean node are actually blue because of severe overlapping.
4.2 Backdoor Recovery via Recoupling-Forgettin
Once the target node set St()) is identified, the final step is to remove the backdoor effect by decoupling them from the malicious label ye. We propose unified Doroupting-Forgeting strategy that combines random label reassignment with gradient ascent.
Random Label Reassignment. Backdoor triggers establish strong shortcut association between target nodes and malicious labels. To break this, we reassign a new random label except malicious label Vt E Dr } to each target node at each training epoch. Unlike static reassignment, this dynamic relabeling acts as diverse perturbation across epochs, preventing target nodes from overfitting to any single incorrect label.
Gradient Ascent. Although random relabeling prevents shortcut effect, it may cause the repre- sentation of the target nodes converge towards the centroid of embedding space, which could occasionally align with certain malicious classes. To counteract this, we incorporate gradient ascent with respect to the malicious label yt- This explicitly pushes the representation of target nodes away from the malicious decision boundary, resulting in a stronger and more directional forgetting signal.
S(t"), we employ unified objective that Unified Objective. For identified target nodes U; E VB combines random relabeling and gradient ascent, balanced by a trade-off parameter y. In contrast, clean nodes By
s((")) are trained normally to preserve model performance:

---

min La 7
Σ ((Jo(u)):i))+ +(1
+
E
[[(((()),
+
Σ ((Jo(v)):ub)
0
NEVE
WEVE
Random Relabeling
Gradient Ascent
Normal Training
where ys # Yt is a random label exclude malicious label.
To further verify the superiority of our Decoupling- Pecoutling-Forgetinng strategy. we compare it with three intuitive method (Node Removal, Feature Reinitialization, and Restoring Original Labels) and one common competitve machine unlearning framework SCRUB [26]. For more details, please refer to Appendix E. The training algorithm and Time Complexity Analysis is in Appendix K and B.
Experiment
We conduct extensive experiments on multiple real-world graph datasets to evaluate the effectiveness of our method in defending against diverse graph backdoor attacks. Our evaluation is designed to systematically answer the following research questions: Q1: How effective is LoSplit in mitigating different types of graph backdoor attacks, especially SPEAR? Q2: How precise LoSplit identify and split target nodes and clean nodes? Q3: How does each component of the LoSplit contribute to its overall defense performance? Q4: How do different number of early epochs, different early learning rate and different trade-off coefficient impact the performance of LoSplit. Q5: How does LoSplit perform on clean graphs, i.e., when it is unknown whether the graph is perturbed? Q6: How does LoSplit perform under different attack configurations, such as varying the malicious labels and the number of injected triggers (attack budget)?
5.1 Experimental Settings
Datasets. We evaluate the effectiveness of LoSplit on six widely used node classification benchmark datasets. These datasets are Cora, Citeseer, Pubmed, the three classic citation network [27], the Physics collaboration network [28], the Flickr social network [29], and large-scale academic graph OGB-arXiv [30]. These datasets cover citation networks and large-scale academic graphs with diverse structural and feature characteristics, allowing to assess the robustness of our defense across different data scale. Details about these datasets are provided in Appendix D.1.
Attack Methods. To comprehensively evaluate the robustness of our approach, we consider four representative and diverse backdoor attack methods. For attacks based on structural perturbation, we include GTA [10], UGBA [11], and DPGBA [12], which manipulate the graph topology by inserting trigger subgraphs or adding edges connected to the target nodes. For feature perturbation attack, we include SPEAR [13]. which introduces imperceptible changes to node features triggers without altering the graph structure. For each attack, we follow the parameter setting specified in their original paper. Additional descriptions are provided in Appendix D.2.
Defense Baselines. We compare LoSplit against a comprehensive set of competitive baselines, including DetectionnDeeltion defenses (Prune [11] and OD [12]), robust training based defenses such as RIGBD [17] and one training-time defense in image ABL [18], the latter was originally proposed in the image domain and also using loss dynamics to identify target nodes. We also include two robust GNNs, i.e. RobustGCN [31] and GNNGuard [32]. Full details of these defense baselines are provided in Appendix D.3.
Implementation Details. Following previous work [17], we use 2-layer GCN as our backbone model. We then split the perturbed graph into a training subgraph Gr and an unseen subgraph Go using an 80:20 ratio. The attacker embeds triggers into selected target nodes Gr. and thus forms trigger-embedded training graph G Half of the nodes in Go are selected as target nodes compute the Attack Success Rate (ASR), while the remaining clean nodes are used to measure Clean Accuracy (CA). We also evaluate the Recall, Precision, and False Positive Rate (FPR) to demonstrate how precise we split target nodes, where Recall measures the proportion of correctly identified target nodes among all true target nodes, Precision measures the proportion of correctly identified target nodes among all identified candidates, and FPR indicates the proportion of clean nodes incorrectly
7

---

Table 1: Results of backdoor defense. Best results in bold. Underlined results indicate that the highest Clean Accuracy (CA) does not coincide with the lowest ASR, and vice versa. This underscores that an effective defense must achieve both low ASR and high CA simultaneously.
Attakk
Defense
Coma
CiteSeer
PubMed
Physios
Flickr
OGB-arXiv
[ASRIS6 CAPS) 1 [ASR(S) CAIS) ASR(S)
CA(S) 1 (ASRIS) CAIS) 1 ASR/S) CA/S) 7| [ASR((5) CA/S)
GCN
98.52
82.96
73.90
84.53
100.00
96.23
100.00
94.20
63.12
RobuiGGNN
100.00
81.85
99.70
73.49
97.87
85.19
100.00
94.98
99.89
40.44
99.83
60.16
GNNGlard
38.58
75.19
12:31
62.95
21:35
81.33
91.94
96.
0.24
43.75
0.88
61.42
GIA
Prune
OD
12.88
0.37
81.85
82.22
13:21
71.39
21.10
85.08
1.16
95.42
0.00
40.41
0.01
62.45
ABI.
4.80
78.52
1.50
73.19
1.77
83.71
100.00
96.
0.00
0.00
63.92
RIGBD
3.56
83,70
0
75,10
3.25
83.21
100.00
96.43
0.00
43.98
0.00
63.07
LeSpli
0.00
84,81
0.00
75,60
0.06
K5.29
0.56
96.43
0.00
44.19
0.00
65.74
GCN
98.52
83.70
100000
74,10
95.99
84.53
100.00
96.26
100.00
40.68
99.08
63.65
RobuaGiN
94.10
100.00
85,59
95.23
GNNGGard
99.83
77.78
100000
82.19
97:86
96.06
99.07
96.21
66.51
UGBA
Prune
98.52
78.52
96.70
72.89
88.29
85 15,08
95.73
95.16
90.23
40.45
93.99
61.46
OD
12:92
83.70
0..00
75.50
83.98
84.88
0.00
96.
0.00
45
10.13
65.32
ABL
6.64
78.15
0.00
95.19
0.00
36.85
RIGBD
7.11
93.70
0.00
82.65
0.56
96.38
0.00
Lasplit
0.00
85.07
0.00
75.66
0.00
85.23
0.14
96.57
0.00
40.94
0.00
66.52
GCN
98.67
84,44
98.66
73.49
97.88
85.19
100.00
96.
09.98
40.29
93.12
65.47
RobuaGCN
97.79
$4,65
100.00
74.40
99.55
84,86
94.44
96.35
95.61
40.95
87.29
60.07
GNNGuard
99.63
78.15
99.70
62.95
72.97
81.28
95.59
95.74
4.50
40.16
90.39
67.17
Prune
22.88
DPGBA
QD
96.31
81.85
97.90
74.10
84.39
81.13
94.52
96.25
98.56
40.59
94.21
65.06
ABL
4,80
81.85
0.00
71.99
5:22
76.86
$1.85
93.30
50.16
40.26
3.91
$5,10
RIGBD
2:22
84.07
0.30
74,40
4.92
84.37
0.98
96.22
0.00
40.77 78
11.83
63.43
LoSplit
GCN
100.00
73.49
84.98
96.27
100.00
45.56
66.38
RobusGGN
100.00
16.30
91.29
74,40
90.91
96.30
58.91
53.44
GNNGGarrd
53.51
80.37
29.72
62.95
62.71
81.84
63 48
96.
71.84
24.64
94.60
66.79
SPEAR
Prune
OD
100.00
100.00
34,07
80,00
100100
100000
76.50
72.29
98.83
85,29
85.19
98,78
96.
96
100.00
40.52
99.83
65.77
ABI
30.36
0
73.19
84.27
11.56
94
100.00
11.25
RIGBD
97.78
83.70
90.27
72.29
88.98
84.68
53.03
96.55
100.00
44.24
97.09
66:72
LeSplii
0.00
84.44
0.00
75.00
0.25
85.24
0.00
96.42
0.00
45.50
0.20
66.68
classified as target nodes. The trigger number |Val is set as 40, 40, 160, 160, 160 and 565 for Cora, Citeseer, PubMed, Physics, Flickr and OGB-arXiv, respectively.
5.2 Performance of Defense against Attacks (Q1)
To address Q1, we evaluate the effectiveness of defenses against multiple graph backdoor attacks. As summarized in Table 1, LoSplit consistently achieves state-of- state-of-the-ar performance across all settings. Edge-dropping defenses such as Prune, OD and RIGBD are less effective against feature perturbation attacks (SPEAR). Though RIGBD performs well in its original paper, its performance degrades due to the sensitivity of its two hyperparameters, both of which requiring careful tuning for each dataset and attack. Random edge dropping may occasionally leave critical trigger edges, reducing ability in target nodes identification. Moreover, its heuristic threshold selection will also break down when two consecutive clean nodes are mixed with target nodes or when target candidates followed by clean nodes within the same class, leading to unreliable separation. ABL shows inferior performance compared to our approach due to the use of CE loss and fixed isolation ratio. These results highlight the superiority of LoSplit in defending against versatile graph backdoor attacks. Additional results using different GNN backbones (i.e. GAT [7] and GraphSage [33]) can be found in Appendix J.
5.3 Ability to Identify Target Nodes (Q2)
To address Q2, we assess the effectiveness of LoSplit in identifying target nodes by reporting Precision (Prec.), Recall (Rec.), and False Positive Rate (FPR) on Cora, Citeseer, and PubMed, as summarized in Table 2. Across all datasets, LoSplit consistently achieves pear-perfect Precision and Recall while maintaining an extremely low FPR, indicating that can precisely distinguish target nodes from clean ones with minimal misclassification. In contrast to existing defenses such as ABL and RIGBD, which often suffer from under-detection (i.e., low recall, failing to identify a portion of target nodes) or over-detection (i.e., high FPR, mistakenly treating clean nodes targets), our design enables robust and adaptive detection under both structural and feature perturbation attacks, Additional experimental results on other datasets are provided in Appendix F.
8

---

Table 2: The Performance of Target Nodes Split on Cora, Citescer, and PubMed (%). Best results are in bold. Underlined results indicate where these metrics do not align, ie., achieving highest Precision Recall does not correspond the lowest FPR, highlighting that perfect split must balance all three metrics simultaneously.
Cora
Citeseer
PuhMed
Allack
Defense
Prec.
Rec. T
FPR
Prec.
Rec.
FPR 4
Prec.
Rec.
FPR
ABL
100.00
85.00
88.10
92.50
0.75
24.39
100.00
3.05
95.00
0.30
93.75
93.75
0.25
LoSplit
100.00
100.00
0.00
100.00
97.50
0.00
98.77
100.00
0.05
ABL
100.00
27.50
0.00
100.00
35.00
0.00
100.00
51.25
0.00
UGBA
72.50
77.50
77.50
1.35
92.4
92.41
LoSpli
100.00
100.00
0.00
ABL
100.00
42.50
0.00
100.00
52,50
0.00
19.51
60.00
2.44
DPGBA
RIGBD
81.08
75.00
1.29
97.06
82.50
0.15
92.06
72.50
0.25
LoSplit
100.00
100.00
100.00
97.50
0.00
100.00
83.12
ABL
100.00
12.50
0.00
97.14
85.00
0.15
40.00
40.00
0.60
SPEAR
RIGBD
83.33
12.50
0818
93.75
37.50
0.10
80.77
51.22
0.13
LoSplit
100.00
100.00
0.00
93.02
100.00
0.45
88.90
100.00
0.05
5.4 Ablation Study (Q3)
To assess Q3, conduct ablation study under the SPEAR attack on OGB-arxiv, evaluating four variants. LoSpliAC replaces RCE loss with standard CE loss. LoSpliAS uses fixed isolation ratio and global threshold (always splitting nodes in half) just as those in image instead of dynamic split. LoSpliAD skip the Decoupling-Forgettin stage and only uses identified clean nodes to retrain the model.
100
Deferse
LosplisD
LoSplitiC
LoSplitR
80
Lo LoSpilts
LoSplit
60
LoSpliAR applies the robust training strategy from RIGBD [17] mitigate backdoor effect. As shown in Fig. 5, the removal of RCE significantly increases ASR, confirming its role amplifying early loss dynamics. Static ratio and global threshold degrade adaptability, while only using clean nodes to retrain fails break the shortcut. Compared with RIGBD, our fine-tuning method achieves better ASR reduction and preserves higher clean accuracy, demonstrating that our Decoupling- Crooupling-Forgeettng strategy is more effective than robust training strategy proposed in
40
ASR(%)
Clean ACC(%)
Figure 5: Ablation study.
SOTA method RIGBD, These results underscore that all components synergistically improve the performance of LoSplit.
5.5 Hyperparameter Analysis (Q4)
ASR
Precision
Recall
100
56
47.
07.0
100
17.5
83
50
200
100
Clean Accuracy 186
Best Clean ACC $4.64
80
100
90
0000
60
60
20
20
23
0.001-
0.005
0.01 0.05
011
0.001
0.005
0.01
0.03
0.1
0.001-
0.00s
0.05
0.1
(a) Heatmap of ASR
(b) Heatmap of Precision
(c) Heatmap of Recall
(d) Clean Accuracy
Figure 6: Hyperparameter analysis of LoSplit the Cora dataset under the SPEAR attack.
To address Q4, we analyze the impact of three key hyperparameters (the number of early-stage splitting epochs Ts, the early-stage learning rate 7ss and the trade-off coefficients y in the Decoupling- Forgetting stage.) in LoSplit on the Cora dataset under the SPEAR attack:
We observe that Ts and тi5 mainly affect ASR, Precision, and Recall. We choose Ts (3. 7, 11, 15, 19) and ys {0.001, 0.005, 0.01, 0.05, 0.1}. Extremely low or high values of Tş or 7s either underfit overfit the early loss dynamics, leading to degraded performance. As shown

---

in Fig. 6a-6c, optimal settings such as Ts = 17, and 7s = {0.005, 0.01} achieve impeccable split performance, yielding the lowest ASR (0.0%) and perfect precision and recall (100.0%).
Fixing 7s = 11 and v/s = 0.005, we then analyze the effect of 7, which control the balance between random relabeling and gradient ascent in the Secoupling-Forgettinn 1.0).
which primarily influence the clean accuracy (CA). We search 7 E {0. 0.05, ..0). As shown in Fig. 6d, the best result achieved at 7 = {0, 0.05, 0.2, 0.25, 0.4), giving the best clean accuracy of 84.44%, achieving an improvement of more than 2.5% compared to when there is no dense (GCN).
Overall, LoSplit demonstrates strong robustness across wide hyperparameter range, highlighting that our approach can achieve both high robustness (lowest ASR) and high utility (best Clean Accuracy). More results on other datasets are provided in Appendix M.
5.6 Performance on Clean Graphs (Q5)
To address Q5, we evaluate the behavior our LoSplit defense when applied to clean graphs. Following the setup in Sec. 5.1, we remove all backdoor triggers from the training data and compare a standard 2-layer GCN (Without Defense) with our LoSplit defense.
The results are reported in Table 3. LoSplit achieves nearly the same accuracy as the GCN model across all datasets. This negligible gap indicates that our defense does not compromise model performance when no backdoor exists. At the same time, the False Positive Rate (FPR) is close to zero, meaning that nearly no clean nodes are mistakenly classified as target nodes.
The key reason for this behavior lies in our Early-Stage Dynamic Split strategy described in Sec. 4.1. In backdoored graphs, there will form bimodal loss distribution within the target class. However, in clean graphs, such bimodal behavior vanishes so that no two cluster emerges. In this case, we manually set the threshold an extremely small value (i.e., 1 1-11), effectively preventing any clean nodes from being misclassified.
Taken together, these results demonstrate that LoSplit is well-suited for practical scenarios where the contamination status of the graph is unknown.
Table 3: Performance of GCN and LoSplit on clean datasets in terms of clean accuracy (CA%) and False Positive Rate (FPR%).
Cora
Citeseer
PubMed
Physics
Flickr
OGB-arXiv
GCN (CA)
83.70
74.70
85.18
96.02
45.33
66.12
LoSplit (CA)
83.33
74.39
85.03
95.87
45.11
65.98
LoSplit (FPR)
0.18
1.05
0.48
0.07
0.92
0.36
5.7 Performance under Different Malicious Labels and Attack Budget
For Q6, because of space limitation, the performance and analysis of LoSplit under different malicious labels and various attack budgets are presented in Appendix H and Appendix I. In these two scenarios, encounter more complex situations where the separation between target nodes and clean nodes becomes less clear (i.e., severe overlapping, low precision). Even under such challenging conditions, LoSplit can still achieve strong defense performance owing to our Aecoupling-Forgettiinn strategy and carefully-tuned hyperparameters.
Conclusion
In this paper, we propose LoSplit, the first training-time defense against graph backdoor attacks. By analyzing early-stage loss dynamics, we observe that target nodes and clean nodes within the same class form separable sub-clusters. Upon this insight, LoSplit splits target nodes and applies a Decoupling-Forgetting strategy to remove the backdoor influence. Experiments on various attacks and datasets show that LoSplil consistently improves both backdoor mitigation and model performance. While effective, its performance can be compromised when the separation between target nodes and clean nodes less distinct and we have to tune the hyperparameters through trial-and-error which often conemconn and labor-intensive, limiting its robustness in highly diverse scenarios.
10

---

7 Acknowledgement
This work was supported by the National Natural Science Foundation of China (92370111, 62422210, 62302333, 62272340, 62276187), Hebei Natural Science Foundation (F2024202047).
References
[1] B. Feng, D. Jin, X. Wang, D. Hc, J. Cao, and Z. Wang, "Exploiting self-refining normal graph structures for robust defense against unsupervised adversarial attacks," in IJCAI, 2025.
[2] Fan, Ma, Q. Li, Y. He, E. Zhao, J. Tang, and D. Yin, "Graph neural networks for social recommenda- tion," in WWW, 2019.
S. Zhang, T. Jiang, Kuang, F. Feng. Yu, J. Ma. Zhao, J. Zhu, Yang, T--S. Chua et al., "Sled: Structure learning based denoising for recommendation, ACM TOIS, 2023.
[4] D. Wang. Lin, Cui, Q. Jia, Z. Wang. Y. Fang. Q. Yu, J. Zhou, S. Yang, and Qi, "A semi-supervised graph attentive network for financial fraud detection," in ICDM, 2019.
[5] T. Kipl and M. Welling, "Semi--upee supei-superviee classification with graph convolutional networks." arXiv Preprint arXiv: wwwp:6609000000 02w.009977.. 2016.
[6] K. Xu, W. Hu, J. Leskovec, and S. Jegelka, "How powerful are graph neural networks?" arXiv Preprint arXiv: 1810.88816 2018.
[7] P. Velickovie, G. Cucurull, A. Casanova, A. Romero, Lio, and Y. Bengio, "Graph attention networks," arXiv Preprint arXiv: 100::11,...000,,2000 2017.
Y. Yang, Y. Sun, F. S. Wang, Gao, and B. Yin, "Multi-graph fusion graph convolutional networks with pseudo-label supervision." Neural Networks, 2023.
[9] Z. Zhang, J. Jia, B. Wang, and N. Z. Gong, "Backdoor attacks to graph neural networks," in SACMAT, 2021.
[10] 7. Xi, R. Pang, S. Ji, and T. Wang, "Graph backdoor," in USENIX Security, 2021.
[11] E. Dai, Lin, X. Zhang, and Wang. "Unnoticeable backdoor attacks on graph neural networks." WWW, 2023.
[12] Z. Zhang, M. Lin, E. Dai, and S. Wang, "Rethinking graph backdoor attacks: caaributioo--reserviin perspective," KDD, 2024.
[13] Y. Ding, Y. Liu, Y. Ji, W. Wen, Q. He, and X. Ao, "Spear: A structure structure-preserving manipulation method for graph backdoor attacks," " in WWW, 2025.
[14] B. Feng, D. Jin, X. Wang, F. Cheng, and S. Guo, "Backdoor attacks on unsupervised graph representation learning," Neurul Networks, 2024.
[15] D. Jin, Zhang, B. Feng. X. Wang, D. He, and Wang, "Backdoor attack on propagation- based rumor detectors," in AAAI, 2025.
[16] D. Jin, B. Feng. S. Guo, X. Wang, Wei, and Z. Wang, "Local-glohal defense against unsupervised adversarial attacks on graphs," in AAAI, 2023.
[17] Z. Zhang, M. Lin, J. Xu, Z. Wu, E. Dai, and S. Wang, "Robustness-inspired defense against backdoor attacks on graph neural networks," arXiv Preprint arXiv:2406. 09836, 2024.
[18] Y. Li, X. Lyu, N. Koren, L. Lyu, B. Li, and X. Ma, AAnti-backdoor learning: Training clean models on poisoned data," in NeurIPS, 2021.
[19] K. Huang. Li, B. Wu, Z. Qin, and K. Ren, "Backdoor defense via decoupling the training process," arXiv Preprint ar 200 2022.
[20] K. Gao. Bai. Gu, Yang. and S.-T. Xia, "Backdoor defense via adaptively splitting poisoned dataset." in CVPR, 2023.
[21] Y. Chen, H. Wu, and J. Zhou, "Progressive poisoned data isolation for training-time backdoor defense," in AAAI, 2024.
[22] Q Zhao and C. Wressnegger, "Two sides of the same coin: Learning the backdoor to remove the backdoor." arXiv Preprini, 2025.
[23] Y. Li, Y. Jiang, Z. Li, and S.-T. Xia, "Backdoor learning: A survey," IEEE TNNLS, 2022.
[24] Y. Wang, Ma. Z. Chen, Y. Luo, J. and Bailey, "Symmetric cross entropy for robust learning with noisy labels," ICCV, 2019.
[25] D. Reynolds et al., "Gaussian mixture models," Encyclopedia of Biometrics, 2009.
11

---

[26] M. Kurmanji, P. Triantafillou, J. Hayes, and E. Triantafillou, "Towards unbounded machine unlearning," in NeurIPS, 2023.
[27] P. Sen, G. Namata, M. Bilgic, L. Getoor, B. Galligher, and Eliassi-Rad, "Collective classification in network data," Al Magazine, 2008.
[28] A. Sinha. Shen, Y. Song. Ma, D. Eide, B.-J. Hsu, and Wang. "An overview of microsoft academic service (mas) and applications." " in WWW, 2015.
[29] H. Zeng, H. Zhou, A. Srivastava, R. Kannan, and V. Prasanna, "Graphsaint: Graph sampling based inductive learning method," arXiv Preprint arXiv:1907.0499: 2019.
[30] W. Hu, M. Fey, M. Zitnik, Y. Dong, H. Ren, B. Liu, M. Catasta, and J. Leskovec, "Open graph benchmark: Datasets for machine learning graphs." in NeurIPS, 2020.
[31] D. Zhu, Zhang, Cui, and W. Zhu, "Robust graph convolutional networks against adversarial attacks," in KDD, 2019.
[32] X. Zhang and Zitnik, "Gunguard: Defending graph neural networks against adversarial attacks," in NeurIPS, 2020.
[33] W. Hamilton, Z. Ying, and Leskovee, "Inductive representation learning on large graphs," in NeurIPS, 2017.
[34] D. Blakely, J. Lanchantin, and Y. Qi, "Time and space complexity of graph convolutional networks," Neural Networks, 2021.
[35] Ding, J. Li, R. Bhanushali, Liu, "Deep anomaly detection on attributed networks," SIAM, 2019.
12

---

A Details of Related Works
A.1 Graph Backdoor Attacks
Graph backdoor attacks have emerged critical security threat in graph representation learning, particularly for GNNs. These attacks operate by injecting malicious triggers in the form of decently designed subgraphs or feature perturbations, into carefully selected training nodes. This creates a hidden shortcut between the perturbed target nodes and predetermined malicious labels during training. During inference, the infected model exhibits two distinet behaviors: it will consistently misclassify any input containing the trigger pattern to the attacker-specified label, while maintaining normal classification performance on unperturbed nodes. To improve the secrecy and effectiveness of such attacks, GTA [10] introduced a trainable trigger generator that produces sample-specific perturbations, substantially improving attack success rates. To improve this, UGBA [11] developed a more sophisticated target selection strategy that reduces the required number of target nodes while incorporating homophily constraints through enhacing the cosine similarity between triggers and target nodes, thereby improving both stealthiness and attack performance. To further boost stealthiness, DPGBA [12] addressed key limitations of existing methods by proposing an adversarial learning approach that generates in-distribution triggers and employs novel loss function to boost attack success rates. While the attack above all pertub the topological structure of target nodes, SPEAR [13] represents a paradigm shift by exclusively perturbing node attributes while preserving the original graph topology. This approach sigmificantly enhances stealthiness and presents unique detection challenges, causing traditional edge edge dropping based defense strategies ineffeettive. Therefore, our work focuses on defending against such highly stealthy attacks, particularly SPEAR where topological modifications are absent. Given the increasing sophistication of modern graph backdoor attacks and their potential security implications, developing robust defense mechanisms capable of detecting and mitigating such threat has become imperative.
A.2 Graph Backdoor Defense
To mitigate the threat posed by graph backdoor attacks, variety of defense strategies have been proposed, albeit still limited compared to the image domain. Existing methods primarily leverage structural inconsistencies introduced by triggers. For example, Prune [10] removes suspicious edges between nodes with low consine similarity. based on the observation that the trigger of attacks like GTA and UGBA often behave like out-of-distribution outliers, OD [12] adopts unsupervised reconstruction-basee approach using graph auto-encoders to identify and isolate outlier nodes with high reconstruction loss, which are likely be injected triggers. To further generalize defense strategies across diverse attack settings, RIGBD [17] incorporates random edge dropping with robust training, aiming train a benign model using poisoned training graph. Despite their effectiveness in structural perturbation scenario, these methods suffer from several limitations. In other words, these method are all edge dropping based, which will not be effective for SPEAR, and the heuristic method for splitting target nodes and clean nodes in RIGBD lacks robustness in particular situation. In contrast, our method exploits dynamic training signals, particularly the early-stage loss behavior, which is overlooked in existing graph domain defenses. Our training-tine time defense strategy provides a more fine- traeegrrrned and adaptive mechanism for backdoor mitigation.
A.3 Training-time Defense
Training-time defenses against backdoor attacks aim detect and neutralize poisoned samples during the learning phase, thereby preventing the model from internalizing malicious correlations. Several recent approaches in vision domain have leveraged early training dynamics isolate poisoned samples. For instance, ABL [18] observed that poisoned samples tend to exhibit lower training losses than benign ones. Based on this, they proposed two-stage framework: initially identifying and isolating the samples with the lowest losses with fixed isolation ratio, followed by an gradient ascent unlearning phase aimed at mitigating the backdoor effect on these selected samples. DBD[19] and
ASD [20], both using Symmetric Cross Entropy (SCE) Loss to separate poisoned samples, with ASD using a more precise meta-splitting method and then adopt hybrid training strategies, combining self-supervised or supervisd learning to mitigate the influence of poisoned data. PIPD [21] adopts a n-step progressive isolation strategy to iteratively isolate suspected poisoned data throughout training, improving model robustness without sacrificing clean accuracy. HARVEY [22] constructs
13

---

strongly backdoored reference model by leveraging Reverse Cross-Entropy (RCE) loss to iteratively isolate poisoned samples. begins with a naive training, progressively finetune the model focus on backdoor patterns through learning and unlearning steps, and applies a meta-spliting stragtegy to refine the separation. The method introduces a paradigm shift by focusing on poisonous samples rather than benign ones and performs adaptive dataset splitting without fixed splitting ratio. Finally, retrains on the identified clean subset to obtain backdoor- model. While these methods have shown success in image classification tasks, they often overlook the unique challenges posed by graph-structured data such as homophily, message passing, and node interdependence where target nodes may propagate misleading signals to their neighbors. In the context of GNNs, training time defense becomes more challenging due to the intertwined nature the graph topology.
B Time Complexity Analysis
We analyze the time complexity of LoSplit by decomposing it into three key components, following the GCN complexity computation from [34] and [17]:
(1) Etrly-stage Training. The GNN is trained for T's 20 epochs on the trigger-embedded graph Gr. For each layer, the time complexity is:
Feature Transformation: O(NM2 for N nodes and M-dim features.
Neighborhood Aggregation: M via sparse operations, where F is the number of edges.
Over L-layer GCN and Ts epochs, the total complexity for Early-Stage Training is:
O L (NM² |E)M)
(2) Loss Clustering. For target-class nodes (n, nodes):
Z-score standardization: (mz) per epoch.
GMM clustering: O(ne) (with K 2, fixed parameter).
Over Ts epochs, the whole complexity is O(Tsm))
(3) Decoupling-Forgeeting. This stage shares the same formula (1) but runs in T>> 200 epochs:
O(T L (NM² + M))
(4) Total Complexity, Combining all stages, the total complexity is:
O(Ts TN EE + Tsnt).
We compare LoSplit with RIGBD as both of them follow a two-stage defense paradigm: identifying poisoned (target) nodes, followed by finetuning GNN model to eliminate the influence of backdoor. This shared structure places them in the same defense category. Under the SPEAR attack, LoSplit achieves substantially higher efficiency, on Early-stage Dynamic Split stage, and simple clustering, while RIGBD incurs the cost of two full trainings and repeated random edge perturbations. We run with an Intel 17-13700K CPU, using Python 3.8.19 and Py PyTccc 1. 1...1. According to Table 4, LoSplit outperforms RIGBD not only in defense effectiveness but also in computational efficiency. It requires only 42 %, 37% and 15% the runtime of RIGBD on Cora, PubMed, and OGB-arXiv respectively, highlighting the scalability and practicality of our approach for large graphs.
it only requires one full GCN training, one naive training
NVIDIA RTX 4090 GPU (24GB)
Table Running Time Comparison (seconds) with Complexity Analysis.
Method
Complexity
Cora
PubMed
OGB-arXiv
RIGBD LoSplit
O(L(K ( M 2 M))
4.36s
18.69s
917.12s
O (L( + M) + T
1.82s
6.88s
138.65s
14

---

C Detailed Proofs
C.1 Proof of Why Target Nodes Converge faster than Clean nodes and Why RCE Loss Amplifies Such Behavior
To understand why the Reverse Cross-Entropy (RCE) loss amplifies early-stage loss dynamies better than the standard Cross-Entropy (CE) loss, we analyze and compare their gradient behavior.
Cross-Entropy Loss (CE). The CE loss is defined as:
K-1
La =
Σ (k(z)) log km0
(10)
where (k((a)) the one-hot ground-truth label distribution, and p(k(2) is the predicted probability over K classes.
Reverse Cross-Entropy Loss (RCE). The RCE loss defined as:
LRCE Σ p(k].)) log gkk(z)
(11)
=-p(y(a) loog [p(k))) C
(12)
Kzy
= - (1 - p(ylz)))
(13)
where y is the ground-truth label, and C loge s with s = 1-10, which prevents log 0 when
(kk2))) = O.
We now compute the derivative of both loss functions with respect the predicted probability p(y (z)
for the target class yr:
OCCE Op(y
(14)
p(y)(z))
HCRCE -C.
(15)
0p(v)(z)
Note that while CE loss exhibits a diminishing gradient as p(ye |a)) increases, the RCE loss maintains constant gradient magnitude due to the constant coefficient C. This property ensures stronger gradient feedback for confident predictions in early training.
Assuming a I-layer GCN, let a (H..) be the pre-softmax logits where a is the ReLU function. The predicted probability p(ye (2)) softmax(z). Then the embedding Hu for target node is:
H. Σ vEN(u)
Valdi X.WB -xWW++
1
SWB.
(16)
du
Vdyd
or in the case of feature perturbation:
H. = Σ
1 vEN(u) Vd,da X.Wo + - (Xa + 8)Wc.
(17)
du
where 5 denotes the attributes of embedded trigger, and WB, Wo are trainable weights for target nodes and clean nodes, respectively.
For clean node the embedding is:
H, Σ -.Wee + d,
1 X.Wc.
(18)
(EN(K) vd
We now compute gradients using the chain rule, First, the derivative of p(yelz) with respect to logits
Zy is:
15

---

@p(v)(z)
[(ye|=)(11 p(vll))
jf = yt
(19)
Ozy
-p(unlz)) p(((z))
if + y/-
Next, we have:
0z
1,
(20)
0H,
and for backpropagation through the linear layer:
OHL aWB
Σ
1
X, +
1 du
Xu
(21)
Vdudu
vd
vEN(u)
or for feature perturbation:
H aWB B
Σ
Xo Xo+ (Xa + 6).
(22)
du
vEN(u)
Similarly, for a clean node v, we have:
HHe Σ
1 Xu + _ Xw.
(23)
aWc
Vdude
dx
wEN(v)
Let us define:
0H, aWB
dH. awc
SB
So
Then the gradient of the loss of target nodes with respect to weights are:
aCcE (p(u)<z) - S):
(24)
aWn
2 dRRC
C ((ul=))((ull 1) SB.
(25)
aWB
The gradient of clean nodes:
OCcE (p(uclz) - 1). Sc.
(26)
aWc
dCRCE C p(v)l=))(((ull)) - 1) Sc. OWc
(27)
Why Target Nodes Converge Faster During Early Training, Target nodes are connected to trigger- embedded nodes or features with deliberately crafted attributes 8, which exhibit an exceptionally strong correlation with the malicious label yt. As result, Sn becomes heavily dominated by 8, biasing p(yela) (a:) upward during the early stages of training. From the gradient perspective, when p(ye)a (r) < 0.5, the slope of the loss curve with respect to p(ue|z) [ar) is much steeper for target nodes due to the strong influence of 8, resulting in larger gradient magnitudes and faster convergence. In contrast, clean nodes with Sc lack such strong and consistent bias, yielding smaller gradients and slower updates (i.e., |Scl << B)
Why RCE Loss Amplifies This Behavior. As illustrated in Fig. 7, the gradient magnitude of the RCE loss is substantially larger than that of the CE loss when p(ya (z) < 0.5, i.e., during the early stages of training. While CE loss decreases its gradient linearly as the model becomes more confident, RCE imposes a much steeper penalty for low-confidence predictions. This sharp gradient slope drives faster updates for target nodes that are initially misclassified, further accelerating their convergence toward the malicious label. Consequently, RCE amplifies the early-stage dynamics observed in target nodes, making them more distinguishable from clean nodes during carly training.
16

---

C.2 Proof of Assumption
We provide a theoretical justification for the existence of an optimal epoch during early training with Reverse Cross-Entrope (RCE) loss, at which the loss divergence between target nodes and clean nodes maximized. This underpins our assumption that early-stage loss dynamics are informative for splitting target nodes and clean nodes.
Gradient Behavior Under CE loss and RCE loss.Thee gradient of the CE loss with respect model weights WB for target node with respect to the prediction p(y (x)) (Eq. 24) is largest in magnitude when p(ye (x) + 0, and vanishes as p(y: (z) 1. Thus, CE loss provides diminishing gradient signals for target nodes that converge early. By contrast, the RCE loss gradient in Eq. 25 is concave quadratic function with respect p3 (z), which reaches its maximum magnitude at p(ye (x) 0.5,
and vanishes at both 2())(2) + 0 and P(Uular) + 1 as illustrated in Fig. 7.
CE Gradient vs ply(x)
RCE Gradient plydx)
6.0
Gradiem Magnitude
Gradien Magnitude
-2-
-0.4
-0.6
-0.8
-1.0
0.5
0.2
0.1
0.6
1.0
0.0
0.2
0.4
0.6
0.8
1.0
p(r(x)
ply-p))
Figure 7: Gradient magnitude (w.r.t. prediction confidence p(ys(zz) for Cross-Entropy (CE) and Reverse Cross- Entropy (RCE). Unlike CE, RCE induces a peak gradient at 0.5, which amplifies early-stage separation between fast-converging target nodes and slower clean nodes.
Gradient Change (CE)
Gradient Change (RCE)
15
Clean
Clean
Target
Target
Gradient
10
Clean
Target
Gradient
30
Clean Target
10
0
0
2
4
6
2
4
Epochs
Epochs
Figure Gradient dynamies over training epochs under Cross- Cross-Entropy (left) and Reverse Cross-Entrops (right). Under CE, both clean and target node gradients quickly decay and overlap. Under RCE, target node gradients exhibit transient peak in early epochs while clean gradients remain low, producing clear carly-stage separation.
Why Optimal Epoch t"' Exists. During early training, both clean nodes and target nodes start with low prediction confidence. However, due to the connection to backdoor triggers, target nodes quickly converge toward the target class yt, surpassing the p( (x: 0.5 region and entering the gradient--uppresseed regime of RCE loss.
In contrast, clean nodes lack such shortcut connections, progress more slowly and remain within the high-gradient region centered around p(y[(z) = 0.5. As result, the RCE loss of clean nodes temporarily increases (or decreases slowly), while the loss of target nodes decreases sharply.
17

---

These theoretical insights are empirically supported in Fig. 8, which compares the per-epoch gradient magnitudes of clean nodes and target nodes under CE loss and RCE loss. CE loss quickly flattens the gradient difference, while RCE loss maintains a transient peak in target gradients, creating temporal separation window between the two node types.
This mismatch in the speed of convergence causes the loss gap between the two groups widen during early epochs and then shrink both converges just as the black line in Fig. 8. Theoretically, have:
(t) Eveve [ (v) EuEVa [ RRCE(() (u),,
which denotes the expected RCE loss difference at epoch between clean nodes and target nodes. Since this equation increases and then decreases during training. thus it will reach a maximum value some intermediate epoch t", where the two groups are maximally separated in the loss space.
The non-monotonic gradient behavior of RCE loss induces a temporal window during which the loss values of target nodes and clean nodes diverge maximally, which guarantees the existence of an optimal early epoch t" that maximizes the separation between target nodes and clean nodes. Consequently, Our Assumption I is theoretically justified and supports the design of our Early-Stage Dynamic Split mechanism.
D Details of Experimental Settings
D.1 Datasets Details
Cora, Citeseer, and Pubmed. These are three widely used citation network benchmarks in graph learning. In each dataset, nodes represent documents, and edges denote citation relationships. Cora contains 2,708 nodes and 5,429 edges, with each node described by a 1.433-dimensional bag-of-words feature vector across 7 classes. CiteSeer includes 3.327 nodes, 4,552 edges, and 3,70 3,703-dimenniional features across categories. PubMed consists of 19,717 nodes and 44,338 edges, with 500-dimensional TF/DDFllike features and 3 classes.
Physies. Coauthor Physics is co-authorship graph based on the Microsoft Academic Graph from the [28]. Nodes represent authors, connected by an edge if they co-authored a paper. Node features represent paper keywords for each author's papers, and class labels indicate the most active fields of study for each author. The dataset contains 34,493 nodes and 247, 47,962 edges, with 8.messdiieenioonal features across classes.
KDD Cup 2016 challenge
Flickr. Flickr [29] is a social network graph where each node represents an image uploaded to Flickr. Edges are established between images that share common properties such geographic location, gallery, or user comments. Node features are represented by 500-dimensional bag-of- words model from the NUS-wide dataset. We examined the 81 tags assigned each image and manually consolidated them into 7 distinct classes, with each image belonging to one category. The dataset contains 89,250 nodes and 899.756 edges.
OGB-arXiv. OGB-arXiv [30] is provided by the Open Graph Benchmark, OGB-arXin represents a large-scale citation network from the arXiv paper corpus. It includes 169,343 nodes and 1,166,243 edges. Each node is described by a 228ddimensional feature derived from title and abstract content, and classified into one of 40 scientific fields. It uses temporal split for train/validation/test sets to better simulate real-world applications.
The details of the six datasets are provided in Table 5.
Table S: Statistics of datasets used in our experiments.
Dataset
Nodes
Edges
Features
Classes
Cora
2,708
5,429
1,433
CiteSeer
3,327
4,552
3,703
3
PubMed
19,717
44,338
500
3
Physics
34,493
247,963
8.415
5
Flickr
89,250
899,756
500
7
OGB-arXiv
169.343
1,166.243
128
40
18

---

D.2 Attack Method
We briefty describe the four backdoor attack methods evaluated in this paper.
GTA: GTA [10] is the first method to leverage a learnable trigger generator that produces sample- specific subgraph triggers for each target node. The generator is optimized to maximize the attack success rate (ASR), but it lacks constraints stealthiness, which may lead to detectable patterns in the poisoned graphs.
UGBA: UGBA [11] enhances GTA by selecting set of diverse and representative nodes for poisoning, improving attack efficiency. also incorporates homophily constraint that forces the generated trigger features to align with those of the target node's 's neighbors, improving stealth and making the backdoor more difficult to detect.
DPGBA: DPGBA [12] proposes an adversarial training framework to generate in-distribution triggers. novel loss function ensures that the generated triggers remain close the data distribution while still being effective. This design helps the attack remain stealthy and improves the overall ASR compared to prior methods.
SPEAR: SPEAR [13] targets the feature space instead of the graph structure by learning to perturb a small number of node features in a subtle but malicious way. It selects stealthy features and vulnerable nodes to inject the trigger. SPEAR is highly effective and particularly challenging to defend against, it leaves the graph structure unchanged and manipulates only a few features.
D.3 Defense Baseline
We evaluate the effectiveness of LoSplit against a range of representative defense baselines, which can be grouped into three categories:
Detection-Deletin Defenses. These methods aim to remove or weaken the influence of trigger structures in the graph:
Prune [11]: Prune observes that trigger patterns often violate the homophily property commonly found in real-world graphs. It removes edges between nodes with low similarity. thereby disrupting trigger connections. Prune can be applied during both training and inference.
OD [12]: For Outlier Detection (OD) method, we use DOMINANT [35] where a graph auto- encoder is used to reconstruct node features and filter out nodes with high reconstruction error. This helps climinate anomalous triggers while keeping the clean ones. only applied during training.
Robust Training Defense. These defenses aim improve the integrity of the model by first identify and isolate target nodes and then retrain the backdoored model:
RIGBD [17]: RIGBD identifies candidate trigger nodes through random edge perturbations and performs adversarial training suppress their influence. It enhances model robustness against structure-based backdoor attacks.
Training-time Defense.
ABL [18]: We adapt the Anti- BatiiBBckdoor Learning (ABL) framework, originally designed for DNNs, to GCN, ABL leverages two intrinsic weaknesses of backdoor attacks: (1) poisoned samples are typically learned much faster than clean ones, and stronger attacks further accelerate this convergence; (2) the backdoor objective tightly associated with a specific target class. Based on these observations, ABL employs Local Gradient Ascent (LGA) strategy to constrain the loss of each sample around a specific threshold. parallel, Global Gradient Ascent (GGA) objective is introduced to unlearn the backdoor associations by increasing the loss of poisoned sample while preserving performance on clean nodes.
Robust GNNs. These methods are originally designed for general adversarial attacks but can be
adapted to backdoor scenarios:
19

---

GNNGuard [32]: GNNGuard uses node feature similarity to adaptively reweight edges during training. effectively suppressing adversarial perturbations and enhancing model resilience.
RobustGCN [3]]: RobustGCN models node embeddings as Gaussian distributions and in- troduces variance-based attention to reduce the influence of anomalous neighbors, improving robustness against structure attacks.
E
Comparison with Alternative Backdoor Recovery Strategies
To further validate the superiority of our proposed Decoupliung- strategy that combines Random Label Reassignment and Gradient Ascent, we compare with three intuitive methods, i.e. Node Removal, Feature Reinitialization and Restoring Original Label, well competitive machine unlearning framework SCRUB [26].
Table 6: Comparison of different backdoor recovery strategies under four representative attacks on PubMed dataset. Lower atlack success (ASR. %) and higher clean accuracy (CA, %) indicate better performance.
GTA
UGBA
DPGBA
SPEAR
Strategy
ASR
CA
ASR
CA1
ASR
CAt
ASR
CAt
GCN (No Defense)
97.81
84.42
95.69
83.16
98.78
84.98
92.90
85.13
Node Removal
0.13
84.98
0.00
85.08
95.30
85.39
0.33
84.73
Feature Reinitialization
100.00
80.92
0.00
84.07
98.39
84.78
100.00
81.78
Restore Original Label
0.00
84.37
0.00
81.28
1.15
84.93
0.08
84.24
SCRUB [26] DoogetinggFFrreeting
0.00
84.58
0.00
82.90
97.75
84.63
0.00
84.47
0.06
85.19
0.00
85.33
1.92
84.93
0.00
85.13
From the results in Table 6, LoSplit consistently outperforms all four alternative backdoor recovery strategies. We summarize the main insights as follows:
(1) Node Removal. This strategy completely discards the identified target nodes, which indeed climinates the backdoor effect but simultaneously disrupts the structural integrity of the graph. Such removal damages neighborhood information and leads to performance degradation especially in DPGBA attack (995.30% ASR)) where triggers mimic benign neighborhood patterns, simple node deletion fails to fully suppress the trigger influence.
(2) Feature Reinitialization. This method assumes that the backdoor mainly resides in the feature space and thus resets the features of target nodes. However, resetting node features fails to break the association between target nodes and the malicious label, which explains why this strategy remains ineffective or even worse against GTA, DPGBA, and SPEAR attacks.
(3) Restoring Original Label appears to be intuitive solution by relabeling the target candidates to their ground-truth classes. While effective in vision domains where poisoned samples (c.g., images with visible triggers) be manually corrected at low cost, this approach becomes impractical in graphs. A node's 's label depends not only on its attributes but also on its local topology and neighborhood context, making it difficult determine the true label without significant human effort. Consequently, label restoration is prohibitively expensive and rarely scalable for large graphs.
(4) Mainstream Unlearning Framework. Another competitive alternative is to adapt general machine unlearning frameworks such as SCRUB [26], which minimize both the cross-entropy and KL-divergence losses on the retain set (clean nodes), while maximizing the KL-divergence on the forget set (target nodes):
min L
SCRUB
An
((o((s))us)) + Aa Σ KL(1;)- Σ
Σ
KL(w)),
(28)
WEVS (
Retain Set (Clean Nodes)
Forget Set (Target Nodes)
where v S((" and V
)t(t)) denote the clean nodes(retain) and target nodes (forget) identified at epoch t", respectively. L is the cross-entropy loss used for label restoration, and KL(PIrr (v) ps,s (v)) is
20

---

the Bellbacck-Lebble divergence between the teacher model feu and the student model fo. defined as
P (R: PS (A)
(V)
KL(p15r (1)) = -P (k)
fgr
log
PAS (0)
where Pf,r (1) and pf.e (v) represent the teacher and student predictive distributions, respectively. This teacher-student design encourages the student to retain the teacher's knowledge on the clean (retain) set while deliberately forgetting on the target (forget) set.
However, to maintain clean accuracy, SCRUB requires substantially more training epochs on the retain set during alternating optimization process, leading to significant computational cost. Even under its best settings, the overall robustness of SCRUB remains inferior to our Decoupling-Forgetting strategy.
Overall, our Grcoupling-Forgettiing approach achieves consistently lower ASR and competitive CA across all attacks while remaining lightweight and graph-specific, demonstrating more effective and efficient mechanism for backdoor recovery in GNNs.
F
Additional Results of The Ability to Split Target Nodes
In this section, we continue to evaluate the ablility of LoSplit in splitting target nodes on larger graphs. We observe consistent trends with those on Cora, Citeseer, and Pubmed (Sec. 5.3) Table 7. First, LoSplit achieves near-perfect Precision and Recall across most attack settings, with FPR close to zero. For example, under UGBA attack, LoSplit reaches 100% Precision and Recall with 0% FPR across all three datasets, clearly outperforming ABL and RIGBD. In contrast, ABL often suffers from under-detection (e.g., Physics, where Recall drops below 7%) or over-detection (e.g.. 97.5% in Recall but only 21.67% in Precision for Flickr dataset). RIGBD shows more balanced detection, but still fails in cases with complex perturbations (e.g., OGB-arXiv under DPGBA, only 4.42% Recall). Second, LoSplit maintains robustness across diverse attacks. Even under strong feature perturbation attacks like SPEAR, LoSplit achieves high detection quality. For all datasets, Precision and Recall all achieves over 90% and FPR under 1% This demonstrates that our method can effectively adapt to both structural and feature perturbations without significant degradation. Overall, these results confirm that the proposed Early-stage Dynamic Split design generalizes well beyond small citation graphs. LoSplit consistently outperforms ABL and RIGBD, achieving both high Precision and Recall while minimizing FPR, even larger and challenging datasets.
Table 7: The Performance of Target Nodes Split (%) on Physics, Flickr, and OGB-arXiv. Best results are highlighted in bold. Underlined results indicate cases where the metrics are not consistent, meaning that achieving the highest Precision Recall does not necessarily coincide with the lowest FPR. This suggests that an ideal split should maintain a balanced trade-off among all three metrics.
Attack
Defense
Physics
Flickr
arivv
Prec. 1
Rec. 1
FPR
Prec.
Rec.
FPR 1
Prec.
Rec.
FPR
ABL RIGBD
12.50
10.00
0.92
21.67
97.50
0.78
8.14
70.00
0.92
GTA
87.14
93.13
0.61
97.17
97.17
0.05
LoSplit
96.97
100.00
0.07
96.36
99.37
0.03
99.65
99.82
0.01
ABL
8.33
6.25
0.95
21.67
97.50
0.78
7.72
62.50
0.93
UGBA
80.00
0.06
98.76
98.76
0.02
LoSplit
100.00
100.00
0.00
100.00
100.00
0.00
100.00
100.00
0.00
ABL
10.71
7.50
0.88
0.00
0.00
1.01
9.26
85.00
0.53
DPGRA
RIGBD
85.29
71.25
0.25
100.00
83.12
0.00
86.21
4.42
0.01
LoSplit
100.00
88.12
0.00
100.00
97.50
0.00
ABL RIGBD
11.76
9.38
0.90
0.00
0.00
1.01
96.80
58.94
0.03
SPEAR
78.57
72.50
0.33
0.89
100.00
0.00
0.00
0.00
0.00
LoSplit
100.00
100.00
0.00
99.45
96.81
0.01
G Additional Results of Split using Early-Loss Dynamics For Different Datasets
In this section, we present a further analysis of the target nodes split via early loss dynamics under other five datasets. As shown in Fig. 9-13, we observe that across all attack variants, target nodes
21

---

Loss Distribution (Epoch 3)
Loss Distribution (Epoch 1)
Loss Distribution (Epoch 9)
Logs Distribution (Epoch 5)
Node Count
10
Target Nodels
Clean (Clase
Node Count
7.5
Target Nodes
Clean (Class 0)
Node Count
Target Nodes
Clean (Class
Node Count
20
Clean (Dlass 0X
Target Nodes
5.0
Threshold
Threshold
20
Threshpid
Threshoid
10
2.5
0.0
18.5
19.0
25
Loss Value
Loss Value
Loss Value
Loss Value
(a) GTA
(b) UGBA
(c) DPGBA
(d) SPEAR
Figure 9: Distribution of the
Dynamic Split in Target Class on Citeseer.
(Epoch
Distribution (Epoch 2)
Loss Distribution (Epoch 10)
Distribution (Epoch 6)
Node Count
200
Cleah (Class
Node Count
300
Clean aCss
Node Count
Clean (Clas
Node Count
200
Clear (Class
Target Nodes
200
Target Modes
100
Target Nodels
Target Nodes
100
Threshold
Thresho
Threshold
100
Threshold
100
0
50
Loss Value
Loss Value
Loss Value
Loss Value
(a) GTA
(b) UGBA
(c) DPGBA
(d) SPEAR
Figure 10: Distribution of the Early-Stage Dynamic Split in Target Class on PubMed.
Lose Distribution (Epoch B)
Loss Distribution (Epoch B)
Lose Distribution (Epoch 9)
Lose Distribution (Epoch 7)
200
Node Count
200
Clean (Class 9
Node Count
150
Cleari (Class 0)
Node Count
Clean (Cless d
Node Count
400
Clean (Class D)
Target Nodes
Target Nodes
Target Noçes
Target Nodes
Threshold
Threshold
100
Threshold
Thresmold
100
200
50
0
10
10
20
10
20
Loss Value
Loss Value
Loss Value
Loss Value
(a) GTA
(b) UGBA
(c) DPGBA
(d) SPEAR
Figure 11: Distribution of the Etrly-Stage Dynamic Split in Target Class on Physics.
(Epoch
(Epoch 9)
Distribution (Epoch
Loss Dietribution (Epoch 17)
Node Count
750
Clelan (Class ))
Node Count
Clean (Clase 0)
Node Count
150
Clean (Class ().
Node Count
400
Clebn (Class 0)
500
Target Nodes
Target Nodes
Target
Tarbet Nodes
Threshold
Threshol
100
Threshold
200
Threshold
250
0
20
20
Loss Value
Loss Value
Loss Value
Loss Value
(a) GTA
(b) UGBA
(c) DPGBA
(d) SPEAR
Figure 12: Distribution of the Barly-Stage Dynamic Split in Target Class on Flicker.
(Epoch
Loss Distribution (Epoch 1)
Distribution (Epoch
Loss Distribution (Epoch 14)
Node Count
Clear| (Class 0)
Node Count
Claan (Clash D)
Node Count
100
Clean (Class
Node Count
Clear (Class 0)
400
Target Nodes
Fo Nodes
Target Nodes
400
Target Nodes
Threshold
hold
Thresho
Threshold
20
200
200
20
22
10
20
10
20
Loss Value
Loss Value
Loss Value
Loss Valuue
(a) GTA
(b) UGBA
(c) DPGBA
(d) SPEAR
Figure 13: Distribution of the Early-Stage Dynamic Split in Target Class on OGB-arXiv.
22

---

tend to exhibit distinct etrly-stage loss distributions compared to clean nodes in the same class. This separation particularly clear in GTA and UGBA, where the backdoor introduces strong shortcut, leading to rapidly decreasing stealthy attacks such as DPGBA and SPEAR, which aim minimize detectable differences in graph structure or features, but the early training dynamics still provides reliable signals for separating target nodes through careful tuning.
highly concentrated loss values for target nodes. Even in more
H Additional Results of Split using Early-Loss Dynamies Under Different Malicious Labels
We further assess the robustness of LoSplit by varying the attacker-specified target class yr categories. Since different classes may exhibit different learning dynamics- caaamics-pattcularryy those that are casier to learn, thus we aim to investigate whether LoSplit remains effective when the backdoor is injected into such easily learnable classes. This scenario is especially challenging because the clean nodes belonging to the target class may converge faster during training. potentially obscuring the divergence between target and clean nodes. Experimental results presented in Fig. 14 and Fig. 15, demonstrate that LoSplit consistently achieves clear separation, highlighting its robustness regardless of different malicious label.
Distribution (Epoch
Loss Distribution (Epoch 14)
Distribution (Epoch
Loss Distribution (Epoch 15)
Node Count
200
Clean (Class
Target Modes
Node Count
300
Claan (Class To
Target Nodes
Node Count
200
Clech (Class
Targit Nodes
Node Count
400
Target Modes
Clean (gaas
Thresh
200
Threshold
Thresho
Thresheld
100
100
200
100
10
0
10
0
10
Loss Value
Loss Value
Loss Value
Loss Value
(a) GTA
(b) UGBA
(c) DPGBA
(d) SPEAR
Figure 14: Results of Early- Loss Dynamics Split Under target label 1.
Loss Distribution (Epoch 7)
Loss Distribution (Epoch
Loss Distribution (Epoch 20)
Loss Distribution (Epoch
Node Count
400
Clean XClass 2
Node Count
Cleai (Class 2
Node Count
400
Clean [Clss 2).
Node Count
Cleeh (Class 2
Targe Nodes
Target Nodes
TargetNodes
Target Nodes
200
Threshold
400
Tireshold
200
Threst
400
Threshold
200
0
10
10
12
14
10 Loss Value
Loss Value
Loss Value
Loss Value
(a) GTA
(b) UGBA
(c) DPGBA
(d) SPEAR
Figure 15: Results of Early-Lost Dynamics Split Under target label 2.
I Results of Defense Performance and Separation Ability using Early-Loss Dynamics under Different Trigger Numbers
To further evaluate the robustness of LoSplit against different attack budgets, we vary the number of backdoor triggers and examine its performance on both Cora and PubMed dataset under the SPEAR attack. Specifically, we adopt trigger numbers { [10, 20, 40, 100, 160) and {40, 80, 160, 200, 320) for Cora and PubMed, respectively. The hyperparameters in Barly-Stage Dynamic Split stage are set to Ts = 10, ns = 0.008 for Cora, and for PubMed are carefully tuned under different trigger number setting: Ts = 14, 7s 0.008, y 0.9 (40 triggers), T3 20, nss 0.001, y 0.15 (80 triggers), Ts 18, 775 = 0.001, 7 = 0.35 (160 triggers). Ts = 18, ns = 0.001, = 0.5 (200 triggers), and
Ts 5, n1s 0.005, 0.75 (320 triggers).
As summarized in Table 8, LoSplit consistently achieves perfect ASR (0%) on the Cora dataset across all trigger numbers, demonstrating stable and strong defensive capability even the backdoor budget
23

---

Loss Distribution (Epoch 9)
Loss Distribution (Epoch 6)
Loss Distribution (Epoch 7)
Node Count
Clean (Class 0)
Node Count
20
Clean (Class 0)
Node Count
30
Clear (Class 0)
Target Nodes
Target Nodes
Target Nodes
Threshold
Threshold
20
Threshold
10
10
10
0
10
20
10
20
0
10
20
Loss Value
Loss Value
Loss Value
(a) Trigger Number = 10
(b) Trigger Number 20
(c) Trigger Number 40
Loss Distribution (Epoch 7)
Loss Distribution (Epoch 9)
Node Count
40
Clean (Class O)
Node Count
40
Cleah (Class 0)
Target Nodes
Target Nodes
Threshold
Threshold
20
20
0
0
10
20
0
10
20
Loss Value
Loss Value
(d) Trigger Number 100
(e) Trigger Number 160
Figure 16: Split on Cora under different attack budget.
Loss Distribution (Epoch
Loss Distribution (Epoch 19)
Loss Distribution (Epoch 17)
Node Count
300
Clean (Class
Node Count
1000
Clean (Class
Node Count
Clean (Class
Target Nodes
Target Nodes
1000
Target Nodes
200
Threshold
Threshold
Threshold
500
500
100
0
0
10
10
15
0
Loss Value
Loss Value
Loss Value
Trigger Number 40
(b) Trigger Number 80
(c) Trigger Number 160
Loss Distribution (Epoch 17)
Loss Distribution (Epoch 4)
1000
Node Count
400
Clean (Class
Node Count
Clean (Class
Target Nodes
Target Nodes
Threshold
500
Threshold
200
0
14
16
10
15
Loss Value
Loss Value
(d) Trigger Number = 200
(e) Trigger Number = 320
Figure 17: Split PubMed under different attack budget.
24

---

Table 8: ASR and Clean Accuracy before and after applying LoSplit under different trigger numbers.
No Defense
LoSplit
Dataset
Trigger Number
ASR
CA t
ASR 4
CA f
Prec. f
Rec.
FPR
100.0
82.96
0.00
84.44
100.0
100.0
0.00
20
100.0
83.33
0.00
84.81
100.0
100.0
0.00
Cora
100.00
81.85
0.00
85.19
100.0
100.0
0.00
100
83.11
82.22
0.00
84.81
98.04
100.0
0.37
160
92.89
80.74
0.00
84.07
98.16
100.0
0.55
40
100.00
84.98
0.25
85,44
97.0
100.00
0.10
92.82
84.93
0,42
85.19
65.57
100.00
PubMed
160
97.41
85.03
0.00
84.37
54.61
100.00
3.37
200
85.14
85.19
0.08
85.19
71.10
100.00
2.05
320
89.73
84.98
0.00
84.52
73.73
100.00
2.89
increases. The split effectively separate target nodes with perfect or perfect recall and near- near-perfect precision, while maintaining high clean accuracy (CA) above 84%.
On the PubMed dataset, the challenge becomes more pronounced as the trigger number increases from 80 to 320. The loss distributions exhibit greater overlap between target and clean nodes, leading to imperfect split. Despite this, LoSplit maintains remarkable robustness, reducing ASR from above 90% to almost zero while preserving clean accuracy around 84-85%. These results indicate that even under inaccurate identification scenarios, our proposed method still effectively suppress backdoor activation.
Caooupling-Forgettinn Stage can
We also observe that achieving optimal performance on PubMed requires careful hyperparameter tuning across different trigger settings. The sensitivity of the Early Loss Dynamics to the data scale and the poisoning rate requires adjusting the split epoch Ts, the split learning rate nss, and the balance coefficient 7. This observation highlights the importance of adaptive hyperparameter configuration in difficult-to-split scenarios, further validating the flexibility and stability of LoSplit under diverse attack intensities.
In summary, LoSplit exhibits strong robustness and adaptability against various attack budgets. Even in complex cases where target and clean nodes are not easily separable (e.g., PubMed with large trigger numbers), the defense remains highly effective with properly tuned parameters. Visualizations of split under different trigger numbers are shown in Fig. 16 and Fig. 17.
Additional Results of Defense Performance under Different Backbone Model
To further evaluate the robustness of our method across different GNN architectures, we conduct experiments using both GAT and GraphSAGE backbones. The results in Table 9 summarize the defense performance of LoSplit and RIGBD under various backdoor attacks (GTA, UGBA, DPGBA, and SPEAR) on three representative datasets (Cora, PubMed, and OGB-arXiv), Across all settings, LoSplit consistently achieves significantly lower ASR compared to both the original GAT and GraphSAGE, well the RIGBD defense. Moreover, the clean accuracy (ACC) of LoSplit -unleannnu
remains comparable to even higher than that of RIGBD, indicating that our training does not sacrifice model utility. Notably. even under challenging attacks like SPEAR, which perturb only node features, LoSplit maintains ASR close to 0% and sustantially outperforms RIGBD, especially on the PubMed and OGB-arXiv datasets. These results demonstrate that LoSplit generalizes robustly across different GNN architectures. Overall, LoSplit is not tailored to any specific GNN design and can serve as general-pune purpose training-time defense framework across various type of GNNs.
25

---

Table Comparison of defenses under different attacks and different backbone models.
Cora
PubMed
OGB-arX
Attack
Defense
ASR(%) + CA(%) + ASR(%) + CA(%) f ASR(%) + CA(%) 1
GAT
83.76
83.33
97.61
81.23
92.67
64.92
GraphSage
99.63
84.07
98.73
84.68
90.83
64.75
RIGBD-GAT
93.96
85.56
1.02
84.63
1.73
64.51
GTA
RIGBD-GraphSage
99.63
78.89
98.97
75.14
80.24
64.47
LoSplit-GAT
1.33
83.70
1.16
85.08
0.81
64.70
Graphie
2.58
80.74
0.58
84.98
0.59
64.30
GAT
100.00
76.67
91.28
84.22
92.53
65.01
GraphSage
97.33
84.07
95.38
86.25
96.16
65.66
RIGBD-GAT
4.33
84.81
90.42
84.27
2.04
65.02
UGBA
RIGBD-GraphSage
98.16
77.04
90.11
82.30
2.06
65.75
LoSplit-GAT
2.66
80.00
0.67
85.12
1.13
65.83
Graphae
4.00
82.96
1.67
83.51
0.74
65.95
GAT
100.00
83.70
91.53
84.07
92.78
66.13
GraphSage
98.89
82.22
89.30
85.84
91.61
67.53
RIGBD-GAT
6.22
83.33
0.84
83.51
1.28
64.86
DPGBA
RIGBD-GraphSage
1.78
80.74
1.42
85.49
2.03
65.61
LoSplit-GAT
0.89
84.07
0.51
83.90
1.02
65.31
Lraphie
0.44
82.59
0.63
85.44
1.38
65.90
GAT 95.94
83.33
97.98
83.51
100.00
67.55
GraphSage
100.00
84.44
83.00
85.59
95.00
67.00
RIGBD-GAT
84.89
82.96
84.22
83.82
93.42
65.87
SPEAR
RIGBD-Graphhage
100.00
82.96
100.00
85.24
91.56
65.99
LoSplit-GAT
0,44
83.33
0.26
85.45
0.21
65.87
LoSplit-GraphSage
0.37
83.33
0.00
85.64
0.00
66.09
K
Training Algorithm
We summarize the training procedure of LoSplit for obtaining backdoor-fred GNN node classifier in Algorithm 1. Specifically, we begin by randomly initializing the parameters 0 LoSplit of an L-layer GNN StoSpti that adopts the graph convolution operation defined in Eq. 1 (line 1). During the first training stage (lines 2-12), LoSplit trains fLoSpiit on the backdoored graph G' using the RCE loss capture early-stage loss dynamics. At each epoch < T's, LoSplit computes the loss per-node of RCE g(t) and evaluates its intra-class variance to identify the potential malicious label ( via Eq. (4) (lines 3-5). and their loss values are standardized into z-scores (lines 6-8). A Gaussian Mixture Model (GMM) then fitted the z-scores to obtain two clusters, c(t) and c(t) representing clean and potentially poisoned nodes, respectively (line 9). LoSplit computes the separation metric (t)) between these clusters (lines 10-11) and selects the optimal split epoch t" that maximizes ((t) (line 13). Based on this epoch, the target and clean nodes are identified using Eq. 8 (line 14). In second stage, LoSplit randomly initializes new I-layer GNN f and finetunes it using the decoupling objective defined in Eq. to suppress the influence of backdoor nodes (lines 15-16). Finally, the algorithm outputs the backdoor-fice free GNN node classifier f (line 17).
26

---

Algorithm Algorithm of LoSplit
Require: Backdoored graph G7 (Vy, Ar, Eq, Nr. )r split epoch Ts. split learning rate 7/8,
Crooulling-Fogeettiin trade-off 7, RCE Constant = log(1 (1-),, Default threshold T = 1-10
Output: Backdoor-free GNN node classifier Randomly initialize LoSpist for an L--laer GNN LoSpti using Eq. 1;
2: for t 2, ..., T's do
3: Compute RCE loss e/") for all V/ E Vri
4: For each class Ys E Vr, compute intra-class variance of e0
Malicious label y/ identification via Eq. 4:
6: Extract nodes with label as ()t))
Compute μa, a of e( Ye, E Vill
8: Normalize loss into z-scores using Eq. 5;
9: Fit GMM on z-scores to get clusters Clu (t))
highi
10: Compute threshold 7(1) via Eq. 6;
11: Compute (
[c,0]
E
EC (99);
e.ect high
12: end for
13: Select optimal split epoch 1 = arg max, D();;
14: Split target and clean nodes via Eq. 8:
15: Randomly initialize for an L-layer GNN node classifier f:
16: Finetune via Eq. 9;
17: Return backdoor-free GNN node classifier f:
L Sample-wise Loss Distribution under RCE Loss in image and Comparison of Defense Strategies across Images and Graphs.
Fig. 18 illustrates the early-stage sample-wise loss distributions under the RCE loss on the CIFAR-10 dataset. In image domain, each poisoned example is an independent input with localized trigger pattern (c.g., a small patch or pixel alteration) that directly dominates its prediction. As a result, the model can rapidly overfit to these triggers, leading to highly stable loss distributionat the early training stage. This behavior reflects the strong spatial locality of visual backdoors and the independence among samples, where each image evolves in isolation during optimization. Such stability stands in sharp contrast to the graph domain discussed in introduction part. Unlike images, backdoor triggers in graphs attached to few interconnected nodes rather than independent samples, and their influence propagates step-by-step through message passing over limited hops. This structural dependency prevents the loss from converging smoothly, resulting in the unstable and oscillatory loss dynamics observed in Fig. 1. Therefore, while the fixed splitting ratio and global threshold is effective in images, directly transferring this intuition to graphs is not feasible due the intrinsic interdependence and propagation characteristics of graph data. Table 10 briefly summarizes the difference between representative training-tine time defense in images and our proposed approach in graphs.
Table 10: Comparison of defense strategies across image and graph domains. "Splitting Ratio" indicates whether the partition between clean and poisoned samples is fixed or adaptively adjusted; "Threshold" denotes whether the separation criterion is globally fixed adaptively determined during training.
Domain
Method
Defense Strategy
Splitting Ratio Threshold
Image
ABL(18)
Unleam
Fixed
Image
DBD [19]
Suppress
Fixed
Image
ASD [20]
Data Split
Fixed
Global
Image
HARVEY [22]
Data Split
Adaptive
Global
Graph
LoSplit (Ours)
Data Split
Adaptive
Adaptive
27

---

Epoch 0
Epoch
7000
Cl66
7000
Ques
Semple Count
0000
Clas
Sample Count
5000
0000
Gaa
Cbas
4000
Clars
3000
Coas?
Clavd
Cka
Clac7
2000
1000
1000
Epoch 5
Epoch
7000
8000
6000
Sample Count
6000
Okeo
Chas
Sample Count
Ckis
Class
4000
8000
Clrr
2000
Coss
Chand
Chou
Clers
Aree Sandey
1000
Pooused Complo
Loss Value
Loss Value
Figure 18: Distribution of the Early-Stage RCE Loss in Image Domain under Cifar-10 Dataset.
M
Additional Results of Hyperparameter Analysis
To further evaluate the robustness of method under the SPEAR attack, conduct addi- tional hyperparameter analyses on the PubMed and OGB-arXiv datasets. Following Sec. 5.5, perform grid search over Ts E (3,7, 7, 11, 15, 19). ys {0.001, 0.005, 0.01, 0.05, 0.1], and E {0, 0.05, 0.1, 1.0).
For PubMed dataset, the hyperparameter analysis of LoSplit under the SPEAR attack is shown in Fig. 19. We observe that the ASR remains consistently near 0.0% across almost all configurations. demonstrating strong resistance backdoor effects and the reliability of the split-based defense. The Precision peaks at 88.9% when Tg 19 and 7/s E {0.005, 0.01}. while the Recall remains stable at 100%. These results suggest that moderately late splitting epoch (Ts 19) combined with mid-range learning rate (7s 0.005 or 0.01) yields the most balanced trade-off between precision and recall. Fixing Ts 19 and mss 0.005. further investigate the influence of the trade-off coefficient 7 in the Crooulling-Forgettiee in Fig. 19d, the best clean accuracy of 85.13%% is achieved 7 0.05, demonstrating that LoSplit effectively preserves model utility while maintaining low ASR. Overall, LoSplit exhibits stable and consistent performance on PubMed, maintaining high robustness and clean accuracy across broad range of hyperparameters.
stage, which mainly governs the clean accuracy. As shown
Precision
80
80
Best Clean ACC 85.13
Clean Accuracy
85
15
02
12.3
72.
154
105
22.22.0.2000 2000
60
40
40
19
-33
16.
727
254
h02
20..2c0.2000
20
20
23
5
50.2
254
102
0,001
0.005
0.03
0.03
0.001
0.005
0.01
000
0.005
0.03
0.05
0.1
83
0.1
0.2
3
(a) Heatmap ASR
(b) Heatmap Precision (c) Heatmap Recall
(d) Clean Accuracy
Figure 19: Hyperparameter analysis of LoSplit on PubMed dataset under SPEAR attack.
For OGB-arXiv dataset, the results are presented in Fig. 20. We find that small splitting epochs (Ts < 11) and low learning rates (ns < 0.05) significantly degrade the separation ability of LoSplit, leading to suboptimal splits. The highest Precision (up 99.5%) and Recall (up to 96.8%) are achieved when T's {19, 23) and ns 0.1, suggesting that sufficiently large learning rate with
28

---

ltter- splitting yields the most effective identification of target nodes. Fixing Tş = 19 and Ts = 0.1, we analyze the effect of y on clean accuracy. As illustrated in Fig. 20d, the optimal clean accuracy of 66.68% is achieved at 7 1.0. These results confirm that LoSplit maintains strong robustness even on large-scale datasets like OGB-arXiv.
-9500 14.
ASR
00
Precision
5.6
15.
15.
100
60
Recall
66.9
Best Clean ACC $6.68
80
80
00.4 22.4
091
64
50
0.0
20
260
98.
15.6
0.0
212
142 STA
Clean Accuracy
60
60
-9.4 25.5
53.7
R2
03
0.
25.4
15.4
00
261
219
542
24.
10
-5.5 872
55.5
64
01
20
40
00
15.
15.
80
00
200
142
20
40
66.3
-224 892
26.5
70
00003
0.003
0,01
0.03
61
0000
0.01
0.03
00.05
0.05
01
(a) Healmap of ASR
(b) Healmap of Precision
(c) Heatmap of Recall
(d) Clean Accuracy
Figure Hyperparameter analysis of LoSplir OGB-arXiv dataset under SPEAR attack.
N
Reproducibility
Implementation and experimental details illustrated in Appendix D and Sec. 5.1. We also provide a detailed training algorithm in Algo. The code for our LoSplit is publicly available at: github.com/yyy92777000////...//
O Limitations and Future Works
While LoSplit demonstrates strong capability in splitting target nodes and mitigating backdoor effects, its effectiveness may deteriorate when the distinction between target and clean nodes becomes less pronounced. In such cases, hyperparameters require careful adjustment through extensive trial and error, which can be both time-consuming and aabor-intensive. Moreover, the performance of LoSplit can be sensitive to attack-specifie parameters and training configurations (e.g. learning rate, layee dimensions), potentially limiting its robustness under diverse and real-world settings.
In future works, we plan to explore more self-adaptive defenses in both training-time and inference- time, and we hope further enhance the practicality and robustness of backdoor defense across varying domains.
P Broader Impact
This paper presents work whose goal is improve the robustness of GNNs and thus advance the field of machine learning. While there may be potential societal consequences, we do not identify any that must be specifically highlighted here.
29

---

NeurIPS Paper Checklist
The checklist is designed to encourage best practices for responsible machine learning research, addressing issues of reproducibility, transparency, research ethics, and societal impact. Do not remove the checklist: The papers not including the checklist will be desk rejected. The checklist should follow the references and follow the (optional) supplemental material. The checklist does NOT count towards the page limit.
Please read the checklist guidelines carefully for information on how to answer these questions. For each question in the checklist:
You should answer [Yes], [No], or [NA].
[NA] means either that the question is Not Applicable for that particular paper or the relevant information is Not Available.
Please provide short (1-2 sentence) justificcton right after your answer (even for NA).
The checklist answers are an integral part of your paper submission. They are visible to the reviewers, area chairs, senior area chairs, and ethics reviewers. You will be asked to also include (after eventual revisions) with the final version of your paper, and its final version will be published with the paper.
The reviewers of your paper will be asked to use the checklist as one of the factors in their evaluation.
While "[Yes] " is generally preferable to "[No]", ", it is perfectly acceptable to answer "[No] provided proper justification is given (e.g., "error bars are not reported because it would be too computationally expensive" or "we were unable to find the license for the dataset we used"). In general, answering "[No] or "[NA] is not grounds for rejection. While the questions are phrased in binary way, we acknowledge that the true answer often more nuanced, so please just use your best judgment and write justification to elaborate. All supporting evidence can appear either in the main paper or the supplemental material, provided in appendix. If you answer [Yes] to a question, in the justification please point to the section(s) where related material for the question can be found.
IMPORTANT, please:
Delete this instruction block, but keep the section heading "NeurIPS Paper Checklist",
Keep the checklist subsection headings, questions/answers and guidelines below.
Do not modify the questions and only use the provided macros for your answers.
1. Claims
Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Question:
Answer: [Yes]
Justification: The abstract concisely presents the challenges tackled and contributions made, aligned with the results in the paper.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors? Answer: [Yes]
30

---

Justification:
In conclusion and appendix, we introduce the limitations of our approach
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model sellispecifiitiinn asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-texi system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimesss.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?
Answer: [Yes]
Justification: The assumptions in the paper clearly stated and proved in the statement of theorems.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless whether the code and data are provided not)?
Question:
Answer: [Yes]
Justification: We clearly introduce the model framework and datasets, and provide the parameters.
Guidelines:
31

---

The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm. (b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors welcome deseribe the particular way they provide for reproducibilityy In the case of closed-source models, it may be that access to the model is limited in some way (e.g., registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification:
We submit the code and data.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https: //ap:////pppp.// cc/
public/ guides Cooeeuuomiiii ssi iesionPoliin oiccyy for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NewrIPS code and data submission guidelines (https: / /nniss... cc/ cccppbllitcccccccccc..p...ccc i c/ i des Codee Sudbim ss i onnol cy) for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
32

---

Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Question:
Answer: [Yes]
Justification: In the experimental section and appendix, we provide detailed information about the training and testing details.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes]
Justification:
We conduct experiments ten times and compute the average value.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results accompanied by enror bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split. initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
should be clear whether the error bar is the standard deviation or the standard error of the mean.
OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out range (e.g. negative еттог rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: We provide sufficient information on the computer resources in appendix, including GPU and CPU.
Guidelines:
The answer NA means that the paper does not include experiments.
33

---

The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount compute required for each of the individual experimental runs well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics https: /neuriurppp wwtpcc/pwcpttccccccooooooccccccc ines nine?
Answer: [Yes]
Justification:
We comply with the NeurIPS Code of Ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurlPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g.. there a special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification:
We discuss the impact of LoSplit in Appendix.
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g.. deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
If there negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms monitor how system learns from feedback over time, improving the efficiency and accessibility ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: We did not data models that have high risk of misuse.
34

---

Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do not require this, but encourage authors to take this into account and make best faith effort.
Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification:
We cite the original paper that produced the code package or dataset,
Guidelines:
The answer NA means that the paper does not existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset used and, possible, include a URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (c.g.. website), the copyright and terms of service of that source should be provided.
If assets released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, papers swi hiccchoeee com/ dataset has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that re- re-packaged, both the original license and the license of the derived asset (if has changed) should provided.
If this information is not available online, the authors are encouraged to reach out to the asset's creators.
13. New assets
Question: Are assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification:
The paper does not release new assets.
Guidelines:
The answer NA means that the paper does release new assets.
Researchers should communicate the details the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create anonymized URL or include an anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
35

---

Answer: [NA]
Justification:
The paper does not involve crowdsourcing nor research with human subjects. Guidelines:
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
Including this information the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then much detail as possible should be included the main paper.
According to the NeurlPS Code of Ethics, workers involved in data collection, curation, other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent)
may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors to adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Question: Does the paper describe the usage of LLMs if it is important, original, or non-standard component of the core methods this research? Note that the LLM is used only for writing, editing, formatting purposes and does not impact the core methodology, scientific rigorousness, or originality the research, declaration is not required.
Answer: [NA]
Justification: We LLM only for writing, editing, formatting purposes and does impact the core methodology, scientific rigorousness, or originality of the research.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, or non non-standard components.
Please refer to our LLM policy (https: /tte://nnneeee //nwurirpppp... cc/ Conferenceee/ecccccee /2025/ LLM) for what should or should not described.
36


Reviews:
[{"review_id": "z5snfat1W8", "reviewer": "Reviewer_5s8N", "summary": "This paper proposes LoSplit, a novel training-time defense framework targeting graph backdoor attacks, particularly those based on feature perturbations rather than structural triggers. The authors identify a key observation: target nodes poisoned by backdoor triggers tend to converge earlier in training, leading to an early-stage loss divergence, especially under reverse cross-entropy (RCE) loss. Leveraging this, LoSplit dynamically identifies a training epoch with maximal loss separability, clusters nodes within the target label using Gaussian Mixture Models (GMMs), and applies a Decoupling-Unlearning strategy to de-associate target nodes from the malicious label. Extensive experiments on multiple benchmark datasets (Cora, Citeseer, Pubmed, OGB-arxiv) and attack methods (GTA, UGBA, DPGBA, SPEAR) show that LoSplit achieves state-of-the-art defense performance, significantly lowering attack success rates (ASR) while preserving clean accuracy.", "questions": "## Detailed Comments and Questions\n\n1. **Adaptive Robustness Concerns**  \n   The proposed method hinges on an empirical observation: target nodes tend to converge faster under CE/RCE loss. However, this loss-based separation is fragile—adaptive attackers could explicitly regularize poisoned node loss to mimic clean behavior.  \n   - Have the authors considered evaluating the method under such adaptive scenarios?  \n   - Adding a section that simulates these adaptive attacks (e.g., using loss matching objectives during poisoning) would substantially strengthen the claims of robustness.\n\n2. **Theoretical Limitation**  \n   The theorem in the paper demonstrates that a maximum in loss separation exists. However, this is insufficient for establishing robustness.  \n   - Can the authors provide a bound or probabilistic guarantee on the separation margin between clean and poisoned nodes?  \n   - Without this, it's unclear whether the GMM clustering will remain effective across different datasets or attack configurations.\n\n3. **Behavior on Clean Datasets**  \n   There is no analysis of the method’s behavior when the dataset is not backdoored.  \n   - What happens when the method is applied to a clean dataset?  \n   - Does it mistakenly reassign or discard normal nodes?  \n   - An evaluation on this scenario is critical to understand the false positive rate and the cost of deploying the defense in practice.\n\n4. **Random Label Reassignment in Section 4.3**  \n   The paper mentions that poisoned nodes are assigned random new labels. This seems arbitrary.  \n   - What is the underlying motivation for this choice?  \n   - Would discarding these nodes or reinitializing their features be more effective?  \n   - An ablation study comparing different handling strategies would provide clarity on this decision.", "limitations": "yes", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "### Strengths\n\n- The paper proposes a novel training-time defense mechanism that identifies and mitigates backdoor-poisoned nodes early in the learning process. This approach focuses on leveraging loss dynamics and clustering to isolate potentially malicious nodes.\n- The proposed method demonstrates promising empirical results across multiple benchmark datasets and various attack methods, suggesting practical effectiveness in the evaluated settings.\n\n### Weaknesses\n- The defense is likely brittle under adaptive attacks. Its core assumption—that poisoned nodes exhibit faster loss convergence under CE or RCE—is easily circumvented by attackers who align poisoned node loss curves with clean nodes during training.\n- The theoretical contribution is limited. The current theorem only establishes the existence of a separation point but does not quantify the separability margin or offer robustness guarantees.\n- The method has not been tested on clean (unpoisoned) datasets. This raises concerns about false positives and unintended degradation of clean accuracy.\n- The rationale behind certain design choices, such as random label reassignment for detected poisoned nodes, is unclear and lacks empirical justification.", "was_revised": true, "final_justification": "The authors provided thorough and thoughtful responses to my concerns. They addressed the risk of false positives on clean datasets with empirical evidence, clarified the rationale behind random label reassignment with an ablation study, and pointed to adaptive thresholding as a principled way to separate poisoned nodes. While robustness under adaptive attacks remains an open issue, I believe the method is well-motivated, empirically strong, and offers valuable insights. Based on the rebuttal, I am increasing my score to reflect a positive view of the paper’s contributions.", "rebuttal": "## Rebuttal to Reviewer 5s8N\nWe would like to thank the reviewer for the constructive feedback and for highlighting important areas of discussion. Due to the fact that your Questions are an extension of the Weaknesses, we provide a unified response to both below.\n\n**W1. & Q1.**  **The defense is likely brittle under adaptive attacks.**  Its core assumption—that poisoned nodes exhibit faster loss convergence under CE or RCE—is easily circumvented by attackers who align poisoned node loss curves with clean nodes during training.   The proposed method hinges on an empirical observation: target nodes tend to converge faster under CE/RCE loss. However, this loss-based separation is fragile—adaptive attackers could explicitly regularize poisoned node loss to mimic clean behavior.  Have the authors considered evaluating the method under such adaptive scenarios? Adding a section that simulates these adaptive attacks (e.g., using loss matching objectives during poisoning) would substantially strengthen the claims of robustness.\n\n\n#### **Response:**\n>We appreciate this concern and agree that adaptive attacks are an important consideration. **As a defense-side work**, our goal is to counter known and practical attack scenarios. Our method targets widely adopted graph backdoor attacks (GTA, UGBA, DPGBA, SPEAR), where the rapid early-stage convergence of poisoned (target) nodes is a **consistent and empirically observable behavior (see Sec. 4.1, Fig. 2)**. We also **provide theoretical support** for this observation in Appendix C.2. To the best of our knowledge, such a threat model has not been considered in existing graph backdoor attack literature. That said, we respectfully agree that this is an important direction. We thank the reviewer for highlighting it, and it is an interesting investigation for future work regarding such attack and corresponding defense.\n\n **W2. & Q2.** **The theoretical contribution is limited.**  \nThe current theorem only establishes the existence of a separation point but does not quantify the separability margin or offer robustness guarantees.  The theorem in the paper demonstrates that a maximum in loss separation exists. However, this is insufficient for establishing robustness.  Can the authors provide a bound or probabilistic guarantee on the separation margin between clean and poisoned nodes?  Without this, it's unclear whether the GMM clustering will remain effective across different datasets or attack configurations.\n\n#### **Response:**\n>We respectfully agree that robustness guarantees are important for the reliability of any defense. However, our paper **does define the bound on the separation margin explicitly in Eq. (6)** through the adaptive threshold $\\tau^{(t)}$. This threshold is not heuristic: it is calculated as the empirical midpoint between two dynamically identified clusters: clean and potential target nodes within the same target class at epoch $t$. More specifically, this adaptive threshold defines a **lower bound** for clean nodes and an **upper bound** for poisoned nodes, and the margin is directly computable through loss clustering. Unlike fixed or manually tuned thresholds, $\\tau^{(t)}$ adjusts automatically to dataset-specific and attack-specific scenarios. In practice, this adaptive threshold consistently achieves robust performance across datasets and attacks (see Table 2), suggesting its effectiveness even **without explicit probability assumptions**. We will revise Section 4.2 to make it clear that Eq. (6) defines an explicit, statistically grounded bound that offers practical robustness without relying on strong probability assumptions.\n\n**W3. & Q3.** **The method has not been tested on clean (unpoisoned) datasets.**  \nThis raises concerns about false positives and unintended degradation of clean accuracy.  There is no analysis of the method’s behavior when the dataset is not backdoored.  What happens when the method is applied to a clean dataset?  Does it mistakenly reassign or discard normal nodes? An evaluation on this scenario is critical to understand the false positive rate and the cost of deploying the defense in practice.\n\n#### **Response:**\n>Thank you for raising this significant question. LoSplit **does not mistakenly reassign or discard any nodes when applied to a clean dataset**, because our method relies on the **difference in early-stage loss drop rate** to distinguish poisoned nodes from clean ones. In backdoored graphs, poisoned nodes typically converge faster due to shortcut learning. However, in a **clean dataset**, such difference does **not exist**, thus all nodes follow similar loss trajectories. Consequently, the dynamic splitting (Eq. (6)) does not identify any target-like cluster, and **nearly no nodes are marked for reassignment**. This is by our algorithm design: when our method detects no **bimodal loss distribution** within the target class—i.e., no clear separation between clean and poisoned nodes, it automatically sets the threshold to a very small value (e.g., 1e-5), effectively preventing any nodes from being reassigned.\n\n>To verify this, we compare GCN (Without Defense) and LoSplit (With Defense) on clean graph without injecting triggers. The tables below  reports the **Clean Accuracy (CA%)** and **False Positive Rate (FPR%)**:\n\n---\n**Table 1.** Clean accuracy (CA, %) comparison between GCN and LoSplit on clean datasets.  This table reports the clean accuracy of GCN trained with and without the LoSplit defense on clean graph. \n| Model                | Cora | Citeseer | Pubmed |\n|----------------------|------|----------|--------|\n| GCN (No Defense)     | 83.70 | 74.70    | 85.18  |\n| LoSplit (Ours)       | 83.33 | 74.39    | 85.03  |\n\n---\n\n**Table 2.** False positive rate (FPR, %) of LoSplit on clean datasets.  FPR is defined as the percentage of clean nodes mistakenly identified as poisoned. \n| Dataset   | Cora | Citeseer | Pubmed |\n|-----------|------|----------|--------|\n| FPR (%)   | 0.18 | 1.05     | 0.48   |\n\n>**Key Takeaway:** Across all datasets, we observe that our LoSplit achieves comparable clean accuracy to no defense settings and near zero FPR, confirming that LoSplit rarely mistakenly choose clean nodes as poisoned ones. We will add this analysis in the Appendix of revised paper under *Behavior Under Clean Graphs* .\n\n**W4. & Q4.** **Random Label Reassignment in Section 4.3**  The rationale behind certain design choices, such as random label reassignment for detected poisoned nodes, is unclear and lacks empirical justification. The paper mentions that poisoned nodes are assigned random new labels. This seems arbitrary. What is the underlying motivation for this choice?  Would discarding these nodes or reinitializing their features be more effective? An ablation study comparing different handling strategies would provide clarity on this decision.\n\n#### **Response:**\n>We appreciate the reviewer’s thoughtful comment. The **underlying rationale and motivation** for random label reassignment is to break the **shortcut learning between target nodes and the malicious labels.**  Reassignment  is  a **kind of unlearning**. Backdoor triggers strongly bind the target class to target nodes. If we retain their malicious label, the model continues to reinforce this shortcut during retraining.  In our approach, random labels are reassigned at every training iteration, so each target node is exposed to a different random label in each epoch. This dynamic labeling acts as a diverse perturbation during training, **effectively disrupting the shortcut learning process for target nodes and preventing target nodes from overfitting to any specific incorrect label.**\n\n>To validate this, we conducted an **ablation study** comparing different strategies mentioned in your feedback, we use PubMed dataset under SPEAR and UGBA attack:  \n\n---\n\n**Table 3.** Effect of different retraining strategies on attack success rate (ASR, %) and clean accuracy (ACC, %) under SPEAR and UGBA attacks.  \n| Strategy                 | ASR ↓ (SPEAR) | ACC ↑ (SPEAR) | ASR ↓ (UGBA) | ACC ↑ (UGBA) |\n|--------------------------|----------------|----------------|----------------|----------------|\n| Random Label (Ours)      | **0.00**        | **84.93**        | **0.19**        | **85.18**        |\n| Node Removal             | 0.33           | 84.53           | 89.06           | 85.03           |\n| Feature Reinitialization | 0.00           | 84.74           | 90.09           | 84.83           |\n\n>**Key Takeaway:** Random reassignment achieves the lowest ASR while maintaining highest ACC, outperforming other strategies. We will add this table to Appendix and clarify the rationale in Section 4.3. **Note that on UGBA attack which craft a backdoor trigger that mimics the neighbor of target nodes. Even if we remove the target nodes from the training set, those attack can still lead to a high ASR.**\n\n>**Why Not Node Removal?**\n\n>**Removing target nodes** entirely from the training graph may seem like a fair solution, but it raises two problems: **(1)**  Removing nodes breaks neighborhood connectivity, which may degrade generalization. **(2)** It is ineffective against attacks in which triggers can affect the neighborhood of target nodes. Some attacks like UGBA **craft a backdoor trigger that mimics the neighbor of target nodes.** Even if the target nodes are removed, their influence still exists. This explains why node removal still results in **high ASR (89.06%) under UGBA**.\n\n>**Why Not Feature Reinitialization?**\n\n>**Reinitializing node features** tries to recover the feature of target nodes, but it assumes that features alone are responsible for the attack, which fails under **structural-based attack** (e.g., UGBA). The reinitialized features can still influence UGBA, since they retain the correlation between target nodes and malicious label, the model can still pick up on weak indirect correlations. Hence, ASR remains high (90.09%)."}, {"review_id": "PmOhanbP46", "reviewer": "Reviewer_kDCE", "summary": "The paper proposes LoSplit, a training-time defense against graph backdoor attacks by leveraging early-stage loss dynamics. It identifies poisoned target nodes via low z-score clustering under reverse cross-entropy loss and removes their influence through a decoupling-unlearning strategy. LoSplit achieves strong defense performance with minimal accuracy degradation.", "questions": "Could the authors clarify the reason for underlining specific results in Table 1?", "limitations": "Yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 1, "strengths_and_weaknesses": "Strength\n\n- LoSplit identifies poisoned nodes without relying on trigger patterns or label information, making it broadly applicable with reasonable transferability.\n- The paper introduces an intriguing insight by leveraging RCE to distinguish backdoor target nodes more effectively.\n- Experimental results shows that LoSplit significantly reduces ASR of various attack types (i.e. GTA, UGBA, DPGBA, SPEAR) across 4 graph datasets while maintaining clean accuracy.\n\nWeakness\n\n- The rationale for distinguishing target nodes from clean nodes based on differences in early-stage loss behavior has been extensively studied by backdoor defense methods such as ABL and DBD. \n- The authors should more clearly explain how the “class-wide loss drift” phenomenon in graph-structured data renders defenses against graph backdoor attacks distinct from those in other domains, and specify which components of LosSplit are designed to address this challenge.\n- Despite claiming evaluations on six datasets, the authors do not present results for two of them—Physics and Flickr.", "was_revised": true, "final_justification": "Thank you for the clarification. Most of my concerns have been addressed, so I will raise my score to 4.", "rebuttal": "## Rebuttal to Reviewer kDCE\n\nAs both W1 and W2 concern the rationale and uniqueness of using early-stage loss behavior to separate target nodes in the context of graph-structured data, especially under the challenge of class-wide loss drift, we provide a unified response to W1 and W2.\n\n**W1. & W2.** The rationale for distinguishing target nodes from clean nodes based on differences in early-stage loss behavior has been extensively studied by backdoor defense methods such as ABL and DBD. The authors should more clearly explain how the “class-wide loss drift” phenomenon in graph-structured data renders defenses against graph backdoor attacks distinct from those in other domains, and specify which components of LosSplit are designed to address this challenge.\n\n#### **Response:**\n>We appreciate the concern regarding similarities to prior defenses such as **ABL** and **DBD**. While these methods also leverage **early-stage loss patterns**, they are primarily designed for **image-based backdoor attacks**, and their strategies can not directly transfer to **graphs** due to fundamental differences in both the **attack mechanisms** and the **loss behaviors**.\n\n>In **image domains**, each poisoned sample is a **standalone image**, analogous to a “whole graph” in graph domain with an embedded **trigger** typically in the form of black pixel, processed independently by the model. The trigger introduces **strong localized perturbations** that drive the model to quickly overfit these features, resulting in **consistently fast loss convergence** for poisoned samples in early training. \n\n>In contrast, **graph backdoor attacks** in node classification task are conducted over a **single connected graph**, where poisoned sample is a **node** embedded in the graph topology. The backdoored graph contains a large number of clean nodes and a small fraction of trigger nodes. Unlike in images, a trigger node does not influence the graph directly; Instead, it propagates **step-by-step** through **message passing** across n-hop neighboring nodes, but is constrained by **the limited number of hops**, which makes the loss behavior **unstable** as training epoch progresses (**W1.**).\n\n>As a result, unlike graph data, where the loss dynamics of nodes fluctuate significantly in early training, **image-based defenses** benefit from the **relatively stable loss distribution** when training epoch progresses (see Fig. 18 in Appendix I), which allows **fixed splitting ratios** or **global thresholds** (as used in **ABL**, **DBD**, and other methods in images) to work effectively. However, in **graph domains**, we observe a distinct phenomenon we call **class-wide loss drift**: the loss distribution of poisoned nodes **drifts unpredictably and overlaps with those of different clean classes**. This creates **blurred and class-dependent loss patterns** that vary significantly across epochs, as illustrated in **Fig. 1**. Consequently, the **global thresholds or static splitting ratio** used in image domain become ineffective in graph domain (**W2.**).\n\n>To address these **graph-specific challenges**, **LoSplit** introduces two key innovations. First, it performs **step-by-step** optimal split epoch selection using **inter-cluster divergence** (Eq. 7), rather than relying on a fixed heuristic early epoch like mainstream image approaches do. Second, it applies **class-wise z-score normalization** combined with **GMM clustering** to adaptively set split threshold and separate poisoned nodes based on **intra-class loss shifts and variance**. These techniques are designed specifically to **counteract the effects of class-wide loss drift** (**W2.**).\n\n>We summarize this distinction in the table below, which contrasts **LoSplit** with prior methods designed for **image domains**:\n\n**Table1:** Comparison of Defense Strategies Across Domains\n| **Domain** | **Method**  | **Defense Strategy* | **Splitting Ratio** | **Threshold** |\n|------------|-------------|------------------|----------------------|---------------|\n| Image      | ABL         | Unlearn          | Fixed                | –             |\n| Image      | DBD         | Suppress         | Adaptive             |    –          |\n| Image      | ASD         | Data Split       | Adaptive               | Global            |\n| Image      | HARVEY      | Data Split       | Adaptive             | Global         |\n| Graph      | **LoSplit** | Data Split       | **Adaptive**         | **Adaptive**  |\n\n\n**W3.** Despite claiming evaluations on six datasets, the authors do not present results for two of them—Physics and Flickr.\n\n#### **Response:**\n>Thank you for pointing this out. We sincerely apologize for the oversight. Our intention was to include results for all six datasets, including **Physics** and **Flickr**, but due to space limitations, we prioritized the most widely used benchmarks (**Cora**, **Citeseer**, **PubMed**, and **OGB-Arxiv**). Unfortunately, we neglected to remove the mention of Physics and Flickr from the main text after reformatting, which was our mistake.\n\n>We have completed the experiments on Physics and Flickr, and the results confirm the same trend: **LoSplit consistently reduces ASR to near zero while maintaining high clean accuracy**. The full results are provided below and will be included in Appendix of the revised paper.\n\n**Table2:** Defense Results on Physics and Flickr\n| Attack | Defense     | ASR↓ (Physics) | CA↑ (Physics) | ASR↓ (Flickr) | CA↑ (Flickr) |\n|--------|-------------|----------------|----------------|---------------|----------------|\n| GTA    | GCN         | 100.00         | 96.23          | 100.00        | 42.39          |\n|        | RobustGCN   | 100.00         | 94.98          | 99.89         | 40.44          |\n|        | GNNGuard    | 80.94          | 96.35          | 0.24          | 43.75          |\n|        | Prune       | 1.16           | 95.42          | 0.00          | 40.41          |\n|        | OD          | 0.00           | 96.46          | 0.00          | 41.47          |\n|        | ABL         | 100.00         | 96.25          | 0.00          | 40.80          |\n|        | RIGBD       | 100.00         | 96.43          | 0.00          | 43.98          |\n|        | **LoSplit** | **0.42**       | **96.58**      | **0.00**      | **44.29**      |\n| UGBA   | GCN         | 100.00         | 96.31          | 100.00        | 41.92          |\n|        | RobustGCN   | 99.98          | 95.23          | 90.25         | 40.34          |\n|        | GNNGuard    | 97.86          | 96.06          | 99.07         | 46.80          |\n|        | Prune       | 95.73          | 95.16          | 90.23         | 40.45          |\n|        | OD          | 0.00           | 96.20          | 0.00          | 41.25          |\n|        | ABL         | 1.93           | 95.19          | 0.00          | 36.85          |\n|        | RIGBD       | *0.56*          | **96.38**      | 0.00          | 43.08          |\n|        | **LoSplit** | **0.00**       | 96.35          | **0.00**      | **43.25**      |\n| DPGBA  | GCN         | 94.35          | 96.25          | 99.57         | 45.19          |\n|        | RobustGCN   | 94.44          | 96.35          | 95.61         | 40.95          |\n|        | GNNGuard    | 95.59          | 95.74          | 4.50          | 45.46          |\n|        | Prune       | 1.61           | 96.23          | 0.00          | 40.62          |\n|        | OD          | 94.52          | 96.25          | 98.56         | 42.59          |\n|        | ABL         | 81.85          | 93.30          | 50.16         | 40.26          |\n|        | RIGBD       | 0.98           | 96.27          | 0.00          | 45.12          |\n|        | **LoSplit** | **0.34**       | **96.46**      | **0.00**      | **45.32**      |\n| SPEAR  | GCN         | 95.36          | 96.27          | 100.00        | 45.56          |\n|        | RobustGCN   | 90.91          | 96.30          | 98.91         | 40.43          |\n|        | GNNGuard    | 63.48          | 96.14          | 71.84         | 44.64          |\n|        | Prune       | 96.78          | 96.15          | 100.00        | 40.52          |\n|        | OD          | 53.92          | 96.22          | 41.59         | 41.48          |\n|        | ABL         | 11.56          | 94.69          | 100.00        | 40.59          |\n|        | RIGBD       | 88.03          | 96.35          | 100.00        | 44.24          |\n|        | **LoSplit** | **0.00**       | **96.42**      | **0.00**      | **45.69**      |\n\n\n **Q.** Could the authors clarify the reason for underlining specific results in Table 1?\n#### **Response:**\n>We sincerely apologize for the confusion caused by the underlining results in Table 1 and the lack of clear statement. We underlined those results to highlight an important observation: even when certain baselines achieve their best clean accuracy (ACC), their attack success rate (ASR) remains relatively high and vice versa, indicating insufficient robustness. This contrast emphasizes that achieving high ACC alone is not enough; an effective defense must maintain both high ACC and low ASR simultaneously."}, {"review_id": "rJDmz90LCJ", "reviewer": "Reviewer_F71D", "summary": "The paper looks at the problem of backdoors in graph node classification tasks. Taking inspiration from defenses such as ABL, the paper proposes an identification phase that uses the loss separation between the nodes at the best possible epoch (using a particular best epoch selection scheme). These identified backdoored nodes are then unlearned using a loss function that maximizes the cross-entropy w.r.t. the label in the dataset while minimizing the cross-entropy w.r.t. a randomly chosen target (while using a CE loss on the clean nodes to retain performance). The authors evaluated their proposed defense methodology on four node classification datasets, and using four different attack methods.", "questions": "- Why not bold the best result in table 2?\n- Page 2 (contributions): RCE was introduced without the full term which was introduced on page 4. Maybe rewrite to remove RCE term here as it doesn't really add anything.", "limitations": "yes", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "# Strengths\n\n- Important problem\n- Well-written paper\n- Comprehensive experiments\n\n# Weaknesses\n\n- **Other identification techniques not included:** it is sensible to argue that ABL is a heuristic, specifically the epoch selection part. The authors carefully establish the epoch selection scheme. I am wondering why the authors didn't attempt to compare against other approaches that were proposed to get rid of this epoch selection heuristic in ABL (e.g., see https://openreview.net/forum?id=rK0YJwL69S).\n- **Unclear unlearning scheme:** I am not sure if I see the utility of two different unlearning methods being integrated i.e., gradient ascent as well as the random target learning (eq. 9) -- these weren't ablated directly. It would be important to see if these two add something together, or if one of these terms is already sufficient. I am also wondering if the random learning was a missed opportunity where the target label could have been computed more carefully following the label correction literature (e.g., see https://arxiv.org/abs/1904.11238)\n- **Captions for tables/figures provide no takeaways:** given the current pace of the field, many readers just go through the figures and tables in the paper without reading the text. The current captions provide no useful information independently. I would suggest the authors to rewrite the captions such that they are independent from the text so that one can understand the paper by just going through these figures/tables independently like all recent well-written papers do.", "was_revised": true, "final_justification": "The authors demonstrated that their backdoor identification method is significantly stronger than ABL, which is convincing. I am not convinced that their unlearning approach is the best. I think the paper has interesting contributions. Would have been a good contribution if they were able to tease apart the identification from unlearning (which they partially attempted to do during the rebuttal), but I still believe that this would be a useful reference point for further work in this space in the future. Hence, I updated my score to an accept.", "rebuttal": "## Rebuttal to Reviewer F71D\n\n**W1.** Other identification techniques not included: it is sensible to argue that ABL is a heuristic, specifically the epoch selection part. The authors carefully establish the epoch selection scheme. I am wondering why the authors didn't attempt to compare against other approaches that were proposed to get rid of this epoch selection heuristic in ABL (e.g., see [2]).\n\n#### **Response:**\n\n>Thank you for your insightful comment regarding the heuristic epoch selection of ABL [3].  We are aware of recent work, particularly BaDLoss [2], which replaces the fixed-epoch loss heuristic with a trajectory-based anomaly score, comparing each sample’s entire loss curve to a reference set of clean examples. \n\n>We did not compare against BaDLoss explicitly for the following reasons: **(1)** BaDLoss depends on access to a known clean subset of the training data (e.g., 250 clean samples in their experiments) to compute trajectory-based anomaly scores. Our method assumes no such clean set is available, because this assumption is not applicable in the graph setting. In **image domains, clean samples are often easily recognized**, triggers typically appear as visible patterns such as black squares or watermarks on the image, making manually selected clean set feasible. In contrast, **trigger nodes in graphs are visually indistinguishable from clean nodes**, and their effects are only revealed indirectly through message passing. This makes it impractical to access to any bona fide clean subset in graph-based tasks beforehand. *(2)** BaDLoss addresses a different threat model: BaDLoss is primarily designed for multi-attack settings in image domain, where multiple simultaneous poisoning attacks are present. Our setting assumes a single backdoor attack at a time, aligning with ABL. Direct comparison would require adapting BaDLoss to our threat model and hyperparameter setup (e.g., clean subset, trajectory depth), which is nontrivial and beyond the current scope.**(3)** As the BaDLoss authors themselves note (Appendix B), ABL can be interpreted as a special case of BaDLoss using a single point in the loss trajectory. Hence, our inclusion of ABL already implicitly establishes a comparison baseline for BaDLoss kind of methods.\n\n\n **W2.** Unclear unlearning scheme: I am not sure if I see the utility of two different unlearning methods being integrated i.e., gradient ascent as well as the random target learning (eq. 9) -- these weren't ablated directly. It would be important to see if these two add something together, or if one of these terms is already sufficient. I am also wondering if the random learning was a missed opportunity where the target label could have been computed more carefully following the label correction literature (e.g., see [1])\n\n#### **Response:**\n>We would like to thank you for your valuable comment. We agree with the reviewer that either gradient ascent or random target learning can contribute to mitigating backdoor effects theoretically. However, in our experiments, **gradient ascent alone was ineffective** in reducing the attack success rate due to **gradient explosion**. To address this, we introduce **random target learning** as a complementary mechanism that provides more stable training process for unlearning. What is **worth mention** is that our **random label assignment is different in every training iteration**, meaning that each target node learns a different random label at each epoch. This introduces versatile perturbation to the label learning of target nodes and prevents the model from overfitting any fixed incorrect label. \n\n>To support our design choice, we conducted an **ablation study under the DPGBA attack on the Pubmed dataset**, comparing each component in isolation and their combination. As shown below, while random label assignment alone achieves reasonable defense performance, combining it with gradient ascent further **suppresses the attack success rate (ASR)** while maintaining clean accuracy (ACC).\n\n**Table 1: Ablation study on unlearning components under DPGBA attack (Pubmed).**  \n*The combined use of gradient ascent and random target learning yields the best trade-off between attack success rate (ASR) and clean accuracy (ACC).*\n\n| Method                | ASR ↓ | ACC ↑ |\n|----------------------|--------|--------|\n| Gradient Ascent only | 98.19   | 84.78  |\n| Random Label only    | 1.04    | 85.08  |\n| Both (Ours)          | **0.98**    | **85.13**  |\n\n>These results validate that the combination provides complementary benefits: **gradient ascent targets the removal of memorized backdoor patterns**, while **random label learning helps prevent overfitting and stabilizes training**. Together, they achieve stronger unlearning performance than either component alone. We will revise our paper to further clarify the rationale for combining both techniques, and (2) include the ablation study above in Appendix.\n\n>In response to the reviewer’s suggestion on using **label correction** methods [1], we have manually corrected the labels of the target nodes to match their original clean labels. However, we observed that this brought **negligible improvement in clean accuracy** , let alone some label correction methods may occasionally not recover to their original labels but add additional computation cost. Given these, we believe both our random label assignment is better than label correction methods.\n\n**W3.** Captions for tables/figures provide no takeaways: given the current pace of the field, many readers just go through the figures and tables in the paper without reading the text. The current captions provide no useful information independently. I would suggest the authors to rewrite the captions such that they are independent from the text so that one can understand the paper by just going through these figures/tables independently like all recent well-written papers do.\n\n#### **Response:**\n>We fully agree with this suggestion. Clear and self-contained captions significantly improve readability. In the revision, we will rewrite all figure and table captions to (i) include the key takeaway message and (ii) briefly describe the experimental setting where necessary, so that readers can interpret the results without referring to the main text.\n\n\n**Q1.** Why not bold the best result in table 2?\n\n#### **Response:**\n>Thank you for pointing this out. The omission of bolded best results in Table 2 (precision, recall, and FPR comparison) was an oversight on our part, and we sincerely apologize for the inconsistency. In the revised version, we will correct this by clearly bolding the best-performing results for each metric and ensure consistent formatting across all evaluation tables. We will also revise the caption to better summarize the key takeaway regarding identification effectiveness.\n\n\n**Q2.** Page 2 (contributions): RCE was introduced without the full term which was introduced on page 4. Maybe rewrite to remove RCE term here as it doesn't really add anything.\n\n#### **Response:**\n>We respectfully appreciate the reviewer’s feedback. We agree that introducing the acronym “RCE” before defining it may be confusing and we sincerely apologize for our carelessness. However, we believe the use of Reverse Cross Entropy (RCE) is an important contribution of our method as it significantly amplifies the rate of loss drop differences between clean and poisoned nodes during early training, which is crucial for effective identification. We have included a theoretical justification in the Appendix C.1 to support why RCE is more effective than standard Cross Entropy (CE) in this context. In the revised version, we will provide the full name before mention its acronym.\n\n\n#### **Reference**\n[1] Unsupervised Label Noise Modeling and Loss Correction. ICML, 2019.\n\n[2] Protecting against simultaneous data poisoning attacks. ICLR, 2025.\n\n[3] Anti-Backdoor Learning: Training Clean Models on Poisoned Data. NeurIPS, 2021."}, {"review_id": "TfWnkBrsV4", "reviewer": "Reviewer_e9Mr", "summary": "This paper proposes LoSplit, a novel training-time defense framework against both structure-based and feature-based graph backdoor attacks. Unlike prior methods that rely on detecting structural anomalies or outliers, LoSplit leverages early-stage loss dynamics. Experiments on multiple real-world datasets show that LoSplit significantly reduces attack success rates while maintaining high clean accuracy across diverse graph backdoor attacks.", "questions": "1. If attackers are aware of LoSplit’s defense mechanism, could they design triggers that intentionally delay loss convergence of target nodes? E.g. by weakening the correlation between the trigger and the target label?\n2. What is the rationale behind using GMM for node separation in LoSplit? Given that the loss distributions may not always be strictly Gaussian, would non-parametric or density-based methods (e.g., DBSCAN or KDE) offer better robustness in challenging scenarios?", "limitations": "Yes.", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "**Strengths:**\n1. Training-time backdoor defense for node classification is unexplored. LoSplit addresses this gap by focusing on early node-wise loss dynamics to defend against feature-based attacks, which existing methods fail to tackle.\n2. The use of RCE loss and class-wise loss dynamics enables target node identification without relying on graph topology or outlier assumptions, enhancing robustness to stealthy perturbations. \n3. LoSplit’s Decoupling-Unlearning strategy breaks associations between target nodes and malicious labels without degrading clean accuracy, showing significant performance improvement over the robust training strategy mentioned in RIGBD.\n\n**Weaknesses:**\n1. LoSplit retains sensitivity to training configurations and specific attack parameters, which could hinder its robustness and generalizability in diverse or unpredictable real-world settings.\n2. The Decoupling-Unlearning strategy randomly relabels target nodes to classes other than target labels, which fails to restore their original labels (before attack). This may inadvertently sacrifice a little clean accuracy by misassigning original labels.\n3. LoSplit relies on clear loss separation within the target class. When the distributions of target and clean nodes within the target class heavily overlap, the accuracy of GMM-based separation may degrade.\n4. The clean-label setting is well motivated, but the paper could benefit from a more direct comparison (qualitative or conceptual) with label-flipping approaches to highlight its practical trade-offs.", "was_revised": true, "final_justification": "I have read the authors' careful responses, and most of my concerns have been addressed.", "rebuttal": "Rebuttal to Reviewer e9Mr\n\n**W1.** LoSplit retains sensitivity to training configurations and specific attack parameters, which could hinder its robustness and generalizability in diverse or unpredictable real-world settings.\n\n#### **Response:**\n>We appreciate the reviewer’s concern regarding certain robustness. While we respectfully acknowledge that LoSplit may be sensitive to certain model training and attack configurations, we have explicitly discussed this limitation in the paper (see Appendix M). We have designed it with minimal reliance on attack-specific knowledge. In our experiments, we consistently use the same configuration across different datasets, and LoSplit remains effective even under varied settings.  As noted in limitations, improving the robustness and generalizability of LoSplit under diverse or unpredictable real-world settings is an insightful future direction.\n\n **W2.** The Decoupling-Unlearning strategy randomly relabels target nodes to classes other than target labels, which fails to restore their original labels (before attack). This may inadvertently sacrifice a little clean accuracy by misassigning original labels.\n\n#### **Response:**\n>Thanks for your constructive feedback. In response, we experimented with manually correcting the labels of target nodes to their original clean labels. However, this adjustment resulted in only **marginal gains** in clean accuracy, indicating limited practical benefit. Moreover, automatic label correction methods may not always accurately recover to the original labels but often **introduce additional computational cost**. Considering these trade-offs, we believe our combination of random relabeling is a more effective and efficient strategy to suppress backdoor effect while maintaining model robustness.\n\n**W3.** LoSplit relies on clear loss separation within the target class. When the distributions of target and clean nodes within the target class heavily overlap, the accuracy of GMM-based separation may degrade.\n\n#### **Response:**\n>Thank you for the insightful comment. We agree that the performance of GMM-based separation may degrade when the loss distributions of poisoned and clean nodes within the target class are overlapping. To investigate this, we have conducted experiments in such cases. As shown in **Figure 12–17** in **Appendix**, even when the two loss distributions are close or even overlap, **LoSplit** maintains effective, owing to its adaptive thresholding and exploitation of early-stage loss dynamics. We will clarify this point in the revised version.\n\n**W4.** The clean-label setting is well motivated, but the paper could benefit from a more direct comparison (qualitative or conceptual) with label-flipping approaches to highlight its practical trade-offs.\n\n#### **Response:**\n>We honestly apologize for the confusion. We realize that this point may not have been clearly stated in the current version. In fact, the attacks we consider **all involve flipping the labels of target nodes**,  **not clean-label setting**, meaning that our setting already **aligns with the label-flipping paradigm** (dirty-label attack). We will clarify the label settings in the revised version.  \n\n **Q1.** If attackers are aware of LoSplit’s defense mechanism, could they design triggers that intentionally delay loss convergence of target nodes? E.g. by weakening the correlation between the trigger and the target label?\n\n#### **Response:**\n>We sincerely appreciate the reviewer’s concern and agree that evaluating adaptive attacks is important. Our work focuses on established graph backdoor attacks (GTA, UGBA, DPGBA, SPEAR), where early and sharp loss convergence of poisoned nodes is a consistent and empirically verified property (see Section 4.1 and Figure 2), and we further provide a theoretical explanation in Appendix C.1. To the best of our knowledge, such a threat model has not been considered in existing graph backdoor attack literature. If an attacker intentionally suppresses this convergence, e.g., by forcing poisoned nodes to mimic clean node loss trajectories, it would largely weaken the backdoor effect. In such a case,  it deviates the essence of backdoor attacks. While this scenario diverges from current threat models, we agree it is a compelling direction for future research on both adaptive attack strategies and more resilient defenses.\n\n**Q2.** What is the rationale behind using GMM for node separation in LoSplit? Given that the loss distributions may not always be strictly Gaussian, would non-parametric or density-based methods (e.g., DBSCAN or KDE) offer better robustness in challenging scenarios?\n\n#### **Response:**\n>We truly appreciate the reviewer's question regarding the rationale for using GMM in LoSplit. We chose it for its applicability, simplicity and empirical effectiveness in modeling the early-stage loss distributions of nodes within a class. While we respectfully acknowledge that the underlying distributions may not be perfectly Gaussian, in practice we observe that the loss distribution shape between poisoned and clean nodes within the same target class tends to induce approximate bimodal Gaussian distribution, making GMM a reasonable and efficient choice. To further validate this design, we have experimented  alternatives such as DBSCAN and kernel density estimation (KDE). However, these methods either produced less stable clustering results or showed inferior performance in distinguishing target nodes across different datasets. Based on these findings, we opted to retain GMM as the most reliable and interpretable solution."}]

Author rebuttal:

Meta-review: The reviewers unanimously recommend acceptance of the paper with varying degrees of strength. I agree with their assessment and am happy to recommend acceptance of this paper for publication at the NeurIPS conference. 

The reviews and the rebuttal have given rise to several interesting points and results that I encourage the authors to include in their revised manuscript. This includes the study of the performance on clean, i.e., unattacked, graphs. I think this study should be extended beyond Cora, CiteSeer and Pubmed to also the remaining three datasets you consider. I furthermore encourage the inclusion of the ablation studies on the random label assignment that you provided, as well as the results on the Physics and Flickr datasets.
Decision: Accept (poster)