MADE: Graph Backdoor Defense with Masked Unlearning
This addresses security risks for GNN applications in sensitive domains like drug discovery, offering a novel defense against graph-specific backdoor attacks, though it is incremental as it builds on existing backdoor defense concepts.
The paper tackles the problem of backdoor attacks on Graph Neural Networks (GNNs) by proposing MADE, a defense method that uses adversarial masks to preserve clean sub-graphs and reduce trigger influence, achieving significant reductions in attack success rate while maintaining high classification accuracy in experiments.
Graph Neural Networks (GNNs) have garnered significant attention from researchers due to their outstanding performance in handling graph-related tasks, such as social network analysis, protein design, and so on. Despite their widespread application, recent research has demonstrated that GNNs are vulnerable to backdoor attacks, implemented by injecting triggers into the training datasets. Trained on the poisoned data, GNNs will predict target labels when attaching trigger patterns to inputs. This vulnerability poses significant security risks for applications of GNNs in sensitive domains, such as drug discovery. While there has been extensive research into backdoor defenses for images, strategies to safeguard GNNs against such attacks remain underdeveloped. Furthermore, we point out that conventional backdoor defense methods designed for images cannot work well when directly implemented on graph data. In this paper, we first analyze the key difference between image backdoor and graph backdoor attacks. Then we tackle the graph defense problem by presenting a novel approach called MADE, which devises an adversarial mask generation mechanism that selectively preserves clean sub-graphs and further leverages masks on edge weights to eliminate the influence of triggers effectively. Extensive experiments across various graph classification tasks demonstrate the effectiveness of MADE in significantly reducing the attack success rate (ASR) while maintaining a high classification accuracy.