[Paper Review] Motif-Backdoor: Rethinking the Backdoor Attack on Graph Neural Networks via Motifs

Haibin Zheng, Haiyang Xiong+3 more|arXiv (Cornell University)|Oct 25, 2022

Advanced Graph Neural Networks4 citations

TL;DR

Motif-Backdoor proposes a novel backdoor attack on graph neural networks by leveraging statistically significant, recurrent subgraph patterns (motifs) as triggers, achieving state-of-the-art attack success rates (up to 14.73% higher than baselines) while maintaining stealthiness and efficiency through motif distribution analysis and graph importance scoring, even under defensive measures.

ABSTRACT

Graph neural network (GNN) with a powerful representation capability has been widely applied to various areas, such as biological gene prediction, social recommendation, etc. Recent works have exposed that GNN is vulnerable to the backdoor attack, i.e., models trained with maliciously crafted training samples are easily fooled by patched samples. Most of the proposed studies launch the backdoor attack using a trigger that either is the randomly generated subgraph (e.g., erdős-rényi backdoor) for less computational burden, or the gradient-based generative subgraph (e.g., graph trojaning attack) to enable a more effective attack. However, the interpretation of how is the trigger structure and the effect of the backdoor attack related has been overlooked in the current literature. Motifs, recurrent and statistically significant sub-graphs in graphs, contain rich structure information. In this paper, we are rethinking the trigger from the perspective of motifs, and propose a motif-based backdoor attack, denoted as Motif-Backdoor. It contributes from three aspects. (i) Interpretation: it provides an in-depth explanation for backdoor effectiveness by the validity of the trigger structure from motifs, leading to some novel insights, e.g., using subgraphs that appear less frequently in the graph as the trigger can achieve better attack performance. (ii) Effectiveness: Motif-Backdoor reaches the state-of-the-art (SOTA) attack performance in both black-box and defensive scenarios. (iii) Efficiency: based on the graph motif distribution, Motif-Backdoor can quickly obtain an effective trigger structure without target model feedback or subgraph model generation. Extensive experimental results show that Motif-Backdoor realizes the SOTA performance on three popular models and four public datasets compared with five baselines.

Motivation & Objective

• To address the lack of interpretability in existing GNN backdoor attacks by analyzing the structural role of triggers.
• To improve attack effectiveness by selecting rare but meaningful motif patterns as triggers.
• To enhance efficiency by leveraging motif distribution without requiring model feedback or subgraph generation.
• To maintain high attack success under defensive mechanisms, highlighting the need for robust defenses.
• To provide insights into trigger structure and injection position for better understanding of backdoor vulnerabilities.

Proposed method

• The method identifies recurrent and statistically significant subgraphs (motifs) in the training data to serve as potential triggers.
• It uses a graph importance index to filter out less relevant nodes, focusing on structurally significant regions for trigger injection.
• A subgraph score is defined to evaluate the potential of candidate subgraphs to serve as effective triggers based on model feedback.
• The trigger is injected into the most influential positions identified by the subgraph score, ensuring high attack success while preserving graph structure.
• The approach avoids iterative optimization or gradient-based generation, relying instead on motif frequency and distribution analysis for efficiency.
• It constructs a shadow model using confidence scores from the target model to guide trigger selection, though this increases detection risk.

Experimental results

Research questions

• RQ1 How do motif structures influence the effectiveness of backdoor attacks on GNNs?
• RQ2 Can rare motifs be more effective as triggers due to their structural distinctiveness?
• RQ3 How does the choice of trigger injection position impact attack stealthiness and success rate?
• RQ4 To what extent does Motif-Backdoor outperform existing backdoor attacks under both standard and defensive settings?
• RQ5 Can motif-based triggers maintain high performance even when defenses target link removal or structural modification?

Key findings

• Motif-Backdoor achieves state-of-the-art attack success rates across three GNN models and four public datasets, improving average attack success rate by 14.73% compared to five baselines.
• The attack remains effective under a defense mechanism that removes links, as the trigger structure remains functional even after partial modification.
• The attack performance is stable across varying numbers of filter nodes (k), with attack success rates above 97% on NCI1 using GCN.
• Attack success rate increases with higher poisoning rates (p), peaking at p = 0.1, which balances effectiveness and stealth.
• Visualization shows minimal structural changes to benign graphs, with only a few links modified, indicating high stealthiness.
• The method demonstrates that triggers based on less frequent motifs yield better attack performance, offering new interpretive insights into backdoor mechanisms.