Abstract:

Semi-supervised graph learning aims to infer the class of unlabeled nodes or graphs by using various prior knowledge in a given graph. By improving the automation of data labeling, semi-supervised graph learning has high efficiency in node classification, but as a deep learning architecture, it also faces the threat of backdoor attacks, but no effective backdoor attack method has been developed for semi-supervised graph node classification tasks. This study propose a persistent clean-label backdoor attack method for semi-supervised graph node classification models, which generates poisoned samples by adaptively adding triggers and perturbations on unlabeled training data, and then trains to obtain poisoned semi-supervised graph node classification models without modifying the labels. The attacker can poison the model more stealthily with a poisoning rate no higher than 4%. To ensure the persistence of the backdoor in the model, a hyperparameter tuning strategy is also proposed to select the optimal value of the perturbation. Extensive experiments on several semi-supervised graph node classification models and open-source datasets show that the proposed approach achieves an attack success rate of up to 96.25% with little loss of classification accuracy of the model on normal samples.

Key words: semi-supervised graph learning, graph neural networks, node classification, adversarial samples, data poisoning, backdoor attacks, persistence attacks, clean-label backdoors