ML Security PapersCross-Paradigm Graph Backdoor Attacks with Promptable Subgraph Triggers
Dongyi Liu 1, Jiangtong Li 2, Dawei Cheng 2, Changjun Jiang 2
Published on arXiv
2510.22555
Model Poisoning
OWASP ML Top 10 — ML10
Key Finding
CP-GBA achieves state-of-the-art attack success rates across graph supervised, contrastive, and prompt learning paradigms while delivering a 40.4% average speedup via efficient trigger retrieval, outperforming paradigm-specific baselines (e.g., prior attacks drop below 40% ASR in cross-paradigm settings while CP-GBA maintains high rates).
CP-GBA
Novel technique introduced
Graph Neural Networks(GNNs) are vulnerable to backdoor attacks, where adversaries implant malicious triggers to manipulate model predictions. Existing trigger generators are often simplistic in structure and overly reliant on specific features, confining them to a single graph learning paradigm, such as graph supervised learning, graph contrastive learning, or graph prompt learning. This specialized design, which aligns the trigger with one learning objective, results in poor transferability when applied to other learning paradigms. For instance, triggers generated for the graph supervised learning paradigm perform poorly when tested within graph contrastive learning or graph prompt learning environments. Furthermore, these simple generators often fail to utilize complex structural information or node diversity within the graph data. These constraints limit the attack success rates of such methods in general testing scenarios. Therefore, to address these limitations, we propose Cross-Paradigm Graph Backdoor Attacks with Promptable Subgraph Triggers(CP-GBA), a new transferable graph backdoor attack that employs graph prompt learning(GPL) to train a set of universal subgraph triggers. First, we distill a compact yet expressive trigger set from target graphs, which is structured as a queryable repository, by jointly enforcing class-awareness, feature richness, and structural fidelity. Second, we conduct the first exploration of the theoretical transferability of GPL to train these triggers under prompt-based objectives, enabling effective generalization to diverse and unseen test-time paradigms. Extensive experiments across multiple real-world datasets and defense scenarios show that CP-GBA achieves state-of-the-art attack success rates.
Key Contributions
- Cross-paradigm transferable GNN backdoor attack (CP-GBA) using graph prompt learning to train universal subgraph triggers that generalize to supervised, contrastive, and prompt learning paradigms
- A queryable trigger repository distilled from target graphs with class-awareness, feature richness, and structural fidelity constraints, enabling 40.4% average speedup during attack
- First theoretical exploration of GPL transferability for backdoor trigger training, demonstrating SOTA attack success rates across multiple real-world datasets and defense scenarios
🛡️ Threat Analysis
Proposes a backdoor/trojan attack (CP-GBA) on GNNs that implants hidden triggers (subgraph triggers) causing targeted misclassification when activated, while maintaining normal behavior on clean inputs — the defining ML10 threat model.