Proceedings

Collateral Damage Constrained Backdoor Attacks on Graph Neural Networks

Di Jin, Zechuan Zhang, Bingdao Feng, Xiaobao Wang, Dongxiao He, Zhen Wang

Download BibTeX Cite

Proceedings of the Thirty-Fifth International Joint Conference on Artificial Intelligence. Main Track. Pages 2735-2743.

https://doi.org/10.24963/ijcai.2026/304

Keywords

  • Machine Learning: Adversarial machine learning
  • Data Mining: Mining graphs

Abstract

Graph Neural Networks (GNNs) are vulnerable to backdoor attacks, where models behave normally on clean data but exhibit targeted misclassifications once specific triggers are activated. Existing backdoor attacks on GNNs mainly focus on enhancing trigger stealthiness or diversifying attack paradigms. However, these methods overlook a fundamental property of GNNs: trigger-induced malicious signals inevitably propagate through graph neighborhoods, causing unintended mispredictions on clean nodes, i.e., Collateral Damage. To address this issue, we propose the Collateral Damage Constrained Graph Backdoor Attack (CDCA), a novel framework that explicitly controls malicious diffusion. Specifically, the proposed method combines neighborhood-aware target node selection with a self-constrained trigger generation strategy to suppress trigger-induced propagation by enforcing prediction consistency on clean K-hop neighboring nodes. Extensive experiments on real-world datasets demonstrate that the proposed method remains effective while significantly reducing collateral damage.

Di Jin, Zechuan Zhang, Bingdao Feng, Xiaobao Wang, Dongxiao He, and Zhen Wang. 2026. Collateral Damage Constrained Backdoor Attacks on Graph Neural Networks. In Proceedings of the Thirty-Fifth International Joint Conference on Artificial Intelligence, IJCAI-26. IJCAI, 2735–2743. https://doi.org/10.24963/ijcai.2026/304
Welcome Future Conferences AI Journal Division IJCAI Proceedings About IJCAI IJCAI Awards