Rethinking the Trigger-injecting Position in Graph Backdoor Attack

TL;DR

This paper investigates how the position of backdoor triggers in graph neural networks affects attack success, revealing that injecting triggers into less important areas generally yields better results and providing explanations for this phenomenon.

Contribution

It introduces and compares trigger-injecting strategies MIAS and LIAS in GNN backdoor attacks, analyzing their effectiveness and explaining the underlying reasons.

Findings

LIAS generally outperforms MIAS in attack success.

Injecting triggers into less important areas yields better backdoor attack performance.

Explanation techniques reveal reasons behind the effectiveness of different trigger positions.

Abstract

Backdoor attacks have been demonstrated as a security threat for machine learning models. Traditional backdoor attacks intend to inject backdoor functionality into the model such that the backdoored model will perform abnormally on inputs with predefined backdoor triggers and still retain state-of-the-art performance on the clean inputs. While there are already some works on backdoor attacks on Graph Neural Networks (GNNs), the backdoor trigger in the graph domain is mostly injected into random positions of the sample. There is no work analyzing and explaining the backdoor attack performance when injecting triggers into the most important or least important area in the sample, which we refer to as trigger-injecting strategies MIAS and LIAS, respectively. Our results show that, generally, LIAS performs better, and the differences between the LIAS and MIAS performance can be significant. Furthermore, we explain these two strategies' similar (better) attack performance through explanation techniques, which results in a further understanding of backdoor attacks in GNNs.