{"type":"ScholarlyArticle","title":"GraphProt: Certified Black-Box Shielding Against Backdoored Graph Models","authors":[{"name":"Xiao Yang","slug":"xiao-yang","given":"Xiao","family":"Yang","affiliation":""},{"name":"Yuni Lai","slug":"yuni-lai","given":"Yuni","family":"Lai","affiliation":""},{"name":"Kai Zhou","slug":"kai-zhou","given":"Kai","family":"Zhou","affiliation":""},{"name":"Gaolei Li","slug":"gaolei-li","given":"Gaolei","family":"Li","affiliation":""},{"name":"Jianhua Li","slug":"jianhua-li","given":"Jianhua","family":"Li","affiliation":""},{"name":"Hang Zhang","slug":"hang-zhang","given":"Hang","family":"Zhang","affiliation":""}],"abstract":"Graph learning models have been empirically proven to be vulnerable to backdoor threats, wherein adversaries submit trigger-embedded inputs to manipulate the model predictions. \r\nCurrent graph backdoor defenses manifest several limitations: 1) dependence on model-related details, 2) necessitation of additional fine-tuning, and 3) reliance on extra explainability tools, all of which are infeasible under stringent privacy policies. \r\nTo address those limitations, we propose GraphProt, a certified black-box defense method to suppress backdoor attacks on GNN-based graph classifiers. Our GraphProt operates in a model-agnostic manner and solely leverages graph input.\r\nSpecifically, GraphProt first introduces designed topology-feature-filtration to mitigate graph anomalies. Subsequently, subgraphs are sampled via a formulated strategy integrating topology and features, followed by a robust model inference through a majority vote-based subgraph prediction ensemble.\r\nOur results across benchmark attacks and datasets show GraphProt effectively reduces attack success rates while preserving regular graph classification accuracy.","doi":"10.24963/ijcai.2025/70","url":"https://ijcai.org/proceedings/2025/70","pdf":"https://ijcai.org/proceedings/2025/0070.pdf","markdown":"https://ijcai.org/proceedings/2025/70.md","bibtex":"https://ijcai.org/proceedings/2025/bibtex/70","volume":{"slug":"2025","title":"Proceedings of the Thirty-Fourth International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2025","url":"https://ijcai.org/proceedings/2025/","year":2025,"location":"Montreal, Canada","dates":"16-22 August 2025","editors":"James Kwok","isbn":"978-1-956792-06-5","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2025"},"section":"AI Ethics, Trust, Fairness","track":"Main Track","number":70,"pages":{"first":619,"last":627},"keywords":["AI Ethics, Trust, Fairness: ETF: Trustworthy AI","AI Ethics, Trust, Fairness: ETF: Safety and robustness"],"videos":[],"references":[],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}