Title: Attack by Yourself: Effective and Unnoticeable Multi-Category Graph Backdoor Attacks with Subgraph Triggers Pool
Venue: NeurIPS 2025
Accepted: yes
Keywords: Graph Backdoor Attack

Graph Neural Networks

Node Classification
Abstract: Graph Neural Networks (GNNs) have achieved significant success in various real-world applications, including social networks, finance systems, and traffic management. Recent researches highlight their vulnerability to backdoor attacks in node classification, where GNNs trained on a poisoned graph misclassify a test node only when specific triggers are attached. These studies typically focus on single attack categories and use adaptive trigger generators to create node-specific triggers. However, adaptive trigger generators typically have a simple structure, limited parameters, and lack category-aware graph knowledge, which makes them struggle to handle backdoor attacks across multiple categories as the number of target categories increases. We address this gap by proposing a novel approach for Effective and Unnoticeable Multi-Category (EUMC) graph backdoor attacks, leveraging subgraph from the attacked graph as category-aware triggers to precisely control the target category. To ensure the effectiveness of our method, we construct a Multi-Category Subgraph Triggers Pool (MC-STP) using the subgraphs of the attacked graph as triggers. We then exploit the attachment probability shifts of each subgraph trigger as category-aware priors for target category determination. Moreover, we develop a ``select then attach'' strategy that connects suitable category-aware trigger to attacked nodes for unnoticeability. Extensive experiments across different real-world datasets confirm the efficacy of our method in conducting multi-category graph backdoor attacks on various GNN models and defense strategies.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper proposes a novel framework for effective and unnoticeable multi-category graph backdoor attacks using a subgraph trigger pool (MC-STP), which is an interesting and timely contribution to the area of adversarial robustness in graph neural networks. The idea of leveraging subgraphs from the original graph as triggers, combined with a “select-then-attach” strategy, offers a promising direction for crafting more realistic and stealthy backdoor attacks on GNNs. However, there are several concerns that need to be addressed before the work can be considered for acceptance.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths\n\n1.  The paper is well-organized, with a clear flow from problem formulation to methodology and experiments. The sections are logically arranged, making it easy to follow the proposed approach and its evaluation.\n\n2. The technical content is presented concisely without unnecessary complexity, aiding readability. However, some parts could benefit from improved clarity, especially regarding the construction and selection process of the subgraph triggers.\n\n\n\nWeaknesses\n\n1. Strong Attack Assumption : The method assumes full access to the training graph structure for subgraph sampling, which may not hold in practical or black-box scenarios. \n\n2. APS-Based Subgraph Selection Limitation : The trigger selection relies on APS, which measures prediction probability shifts but does not consider class-specific information. The design of APS is mainly about the offset probability of the original graphs, and it does not have a certain category and core information to mislead GNN.\n\n3. Computational Cost : Despite claiming low computational cost, the method requires extensive subgraph sampling and APS evaluation, which could be expensive, which is contradicting the motivation.\n\nQUESTIONS:\n1. How would the method perform under limited or black-box access to the graph structure?\n\n2. Does the APS metric take into account class-specific or structural characteristics of subgraphs?\n\n3. How does the extensive subgraph sampling affect the overall efficiency of the method?\n\nLIMITATIONS:\nYES", "TITLE": "Official Review", "RECOMMENDATION": 3, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 3, "DATE": "2025-07-01"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper introduces a method for multi-category graph backdoor attacks on node classification with GNNs, a challenging scenario where different triggers lead to misclassification in multiple targeted categories. The proposed method, called EUMC, replaces adaptive trigger generators with a pool of category-aware subgraph triggers sampled from the graph itself. Trigger assignment is based on attachment probability shifts to determine which subgraph is most effective for each category. The approach also introduces a \"select then attach\" strategy to maximize the stealthiness of triggers by optimizing trigger-node similarity. The method is empirically validated across six real-world node classification datasets and several defense strategies, showing improved attack success with negligible impact on clean node accuracy in comparison with existing single-category and multi-category backdoor attacks.\n\nSTRENGTHS AND WEAKNESSES:\n## Strengths\n\n1. The paper addresses a relevant and challenging problem: graph backdoor attacks in the multi-category setting, which is not well studied in existing literature. The methodology leverages category-aware priors through a multi-category subgraph trigger pool, offering a more scalable approach than multiple independent trigger generators for each category. This is well-motivated both theoretically and, in Figure 1 and accompanying discussion, empirically justified.\n\n2. Technical exposition is mostly clear, with well-defined notation and logical descriptions that make the approach accessible for replication by experts. Algorithm 1 includes detailed procedural steps.\n\n3. Extensive experiments (Tables 1, 2, 3) across a variety of datasets (Cora, Pubmed, Bitcoin, Facebook, Flickr, OGB-arxiv) and defense scenarios provide compelling evidence for the claim that EUMC achieves high attack success rates (ASR) while maintaining clean node accuracy.\n\n## Weaknesses\n\n1. While the main logic and methodology are explained, certain practical implementation details are missing or under-explained in the core text, e.g., the precise role/impact of trigger size/threshold selection or prompt pool size. Figure 4 is only referenced at the end, with insufficient analytic commentary in the main text. This diminishes reproducibility and interpretability for non-domain experts.\n\n2. The core idea of using subgraph triggers is referenced in prior work (e.g., SBA [29], Sheng et al. [32]), albeit for different settings (graph classification or single-category). The paper could do more to clarify and contrast what is uniquely enabled by the multi-category focus, both theoretically and in practice. There is room for more explicit differentiation from similar ideas in the literature.\n\n3. The work considers several defenses, but does not include more recent or sophisticated graph backdoor detection approaches. Furthermore, there is little qualitative discussion or visualization of attack artifacts post-defense. How detectable are EUMC triggers via structural or statistical anomaly detection?\n\nQUESTIONS:\n1. Could the authors provide insight into the limits of the pool-based approach—what happens as the number of categories or trigger pool size is dramatically increased? Are there edge cases where the MC-STP approach fails to find effective triggers?\n\n2. Is there any qualitative evidence or further statistical analysis showing how unnoticeable the constructed triggers are to a human or automated anomaly detector?\n\nLIMITATIONS:\nSee weaknesses", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-02"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes a novel multi-class graph backdoor attack method by constructing a multi-class subgraph trigger pool and adopting a \"select then attach\" strategy to connect appropriate triggers to the target nodes, ensuring these modifications remain inconspicuous. Experimental results demonstrate high attack success rates across various classification scenarios and showcase the effectiveness and stealthiness of the proposed method on multiple real-world datasets. Additionally, the paper discusses potential future research directions, such as exploring scalable trigger generation strategies and defense mechanisms.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\nQuality: The study designs an innovative multi-class graph backdoor attack method and validates its effectiveness through extensive experiments.\nClarity: The paper is well-structured with detailed method descriptions that are easy to understand and reproduce.\nSignificance: Proposes new attack methods, providing an important empirical foundation for security research in Graph Neural Networks (GNNs).\nOriginality: This is the first attempt to construct a trigger pool suitable for multiple target classes, showcasing strong innovation.\nWeaknesses:\n1. Insufficient experimental details: Some experimental details (e.g., specific algorithm steps, dependency configurations) may require more explanation to allow other researchers to fully reproduce the results.\n2. Inadequate explanation of technical details: Although the overall structure is clear, some key technical details (e.g., how specific triggers are selected in the algorithm steps) may need more elaboration and examples to help readers better understand the implementation process.\n3. Although the experimental results are convincing, the impact in practical application scenarios requires further exploration.\n4. Some of the defense strategies adopted in this study draw on pre-existing techniques, which indicates a lack of thorough independent innovation.\n\nQUESTIONS:\n1. Detailed Steps for Trigger Selection Algorithm: It is expected that the authors provide more detailed explanations of the specific algorithm steps for selecting particular triggers. Especially in multi-class attack scenarios, how to ensure the effectiveness and stealthiness of the triggers?\n2. Effectiveness of Defense Strategies in Practical Applications: In practical application scenarios, how effective are the proposed defense strategies (e.g., Prune, Prune+LD, and OD)? Are there plans to test these strategies on larger or more complex datasets?\n\nLIMITATIONS:\n1. Some experimental details (e.g., specific algorithm steps, dependency configurations) may require more explanation to allow other researchers to fully reproduce the results.\n2. Some key technical details (e.g., how specific triggers are selected in the algorithm steps) may need more elaboration and examples to help readers better understand the implementation process.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 3, "DATE": "2025-07-03"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper addresses the challenge of multi-category graph backdoor attacks on node classification tasks, where existing methods (e.g., GTA, UGBA) fail to scale effectively as the number of target categories increases. The authors propose EUMC, a novel framework that leverages subgraph triggers sampled from the original graph to construct a Multi-Category Subgraph Triggers Pool (MC-STP). Experiments across six datasets (Cora, Pubmed, Bitcoin, Facebook, Flickr, OGB-arxiv) and three GNN architectures (GCN, GAT, GraphSAGE) show EUMC outperforms baselines in Attack Success Rate (ASR) under defenses (Prune, Prune+LD, OD), particularly for large category sets.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n- The manuscript is well-structured with clear figures (e.g., Fig 1, 2) and Algorithm 1. Appendix details (e.g., time complexity, hyperparameters) aid reproducibility.\n- Solves a critical gap in multi-category backdoor attacks, enabling precise control over diverse target classes—a need for real-world adversarial scenarios.\n\nWeaknesses:\n- Limited exploration of transferability to non-surrogate models. Experiments on robust GNNs (GNNGuard, RobustGCN) lack comparison to baselines.\n- ASR still declines with increasing categories (e.g., Table 1, Flickr), though less severely than baselines. No theoretical analysis of this trend.\n\nQUESTIONS:\n- Experiments fix trigger size at 5 nodes (Sec 5.1). Why is this optimal? Does performance plateau for larger triggers (Fig 4b) due to detectability or GNN aggregation limits?\n- Sampling subgraphs via BFS (Sec 4.1) may not scale to billion-edge graphs. Can MC-STP initialization be accelerated?\n- Why does ASR decrease as categories grow (Table 1)? Is this due to inter-category trigger interference or reduced subgraph uniqueness?\n\nLIMITATIONS:\nYes.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 2, "CLARITY": 2, "IMPACT": 3, "ORIGINALITY": 2, "DATE": "2025-07-03"}