Boosting Graph Robustness Against Backdoor Attacks: An Over-Similarity Perspective
This addresses reliability concerns for GNNs in applications like social and transportation networks, though it is incremental as it builds on existing defense efforts.
The paper tackles the vulnerability of Graph Neural Networks (GNNs) to backdoor attacks by proposing SimGuard, a defense method that detects triggers based on over-similarity and uses contrastive learning, achieving effective defense against various attacks while preserving performance on clean nodes in real-world datasets.
Graph Neural Networks (GNNs) have achieved notable success in tasks such as social and transportation networks. However, recent studies have highlighted the vulnerability of GNNs to backdoor attacks, raising significant concerns about their reliability in real-world applications. Despite initial efforts to defend against specific graph backdoor attacks, existing defense methods face two main challenges: either the inability to establish a clear distinction between triggers and clean nodes, resulting in the removal of many clean nodes, or the failure to eliminate the impact of triggers, making it challenging to restore the target nodes to their pre-attack state. Through empirical analysis of various existing graph backdoor attacks, we observe that the triggers generated by these methods exhibit over-similarity in both features and structure. Based on this observation, we propose a novel graph backdoor defense method SimGuard. We first utilizes a similarity-based metric to detect triggers and then employs contrastive learning to train a backdoor detector that generates embeddings capable of separating triggers from clean nodes, thereby improving detection efficiency. Extensive experiments conducted on real-world datasets demonstrate that our proposed method effectively defends against various graph backdoor attacks while preserving performance on clean nodes. The code will be released upon acceptance.