{"type":"ScholarlyArticle","title":"Collateral Damage Constrained Backdoor Attacks on Graph Neural Networks","authors":[{"name":"Di Jin","slug":"di-jin","given":"Di","family":"Jin","affiliation":""},{"name":"Zechuan Zhang","slug":"zechuan-zhang","given":"Zechuan","family":"Zhang","affiliation":""},{"name":"Bingdao Feng","slug":"bingdao-feng","given":"Bingdao","family":"Feng","affiliation":""},{"name":"Xiaobao Wang","slug":"xiaobao-wang","given":"Xiaobao","family":"Wang","affiliation":""},{"name":"Dongxiao He","slug":"dongxiao-he","given":"Dongxiao","family":"He","affiliation":""},{"name":"Zhen Wang","slug":"zhen-wang","given":"Zhen","family":"Wang","affiliation":""}],"abstract":"Graph Neural Networks (GNNs) are vulnerable to backdoor attacks, where models behave normally on clean data but exhibit targeted misclassifications once specific triggers are activated. Existing backdoor attacks on GNNs mainly focus on enhancing trigger stealthiness or diversifying attack paradigms. However, these methods overlook a fundamental property of GNNs: trigger-induced malicious signals inevitably propagate through graph neighborhoods, causing unintended mispredictions on clean nodes, i.e., Collateral Damage. To address this issue, we propose the Collateral Damage Constrained Graph Backdoor Attack (CDCA), a novel framework that explicitly controls malicious diffusion. Specifically, the proposed method combines neighborhood-aware target node selection with a self-constrained trigger generation strategy to suppress trigger-induced propagation by enforcing prediction consistency on clean K-hop neighboring nodes. Extensive experiments on real-world datasets demonstrate that the proposed method remains effective while significantly reducing collateral damage.","doi":"10.24963/ijcai.2026/304","url":"https://ijcai.org/proceedings/2026/304","pdf":"https://ijcai.org/proceedings/2026/0304.pdf","markdown":"https://ijcai.org/proceedings/2026/304.md","bibtex":"https://ijcai.org/proceedings/2026/bibtex/304","volume":{"slug":"2026","title":"Proceedings of the Thirty-Fifth International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2026","url":"https://ijcai.org/proceedings/2026/","year":2026,"location":"Bremen, Germany","dates":"15-21 August 2026","editors":"Diego Calvanese","isbn":"978-1-956792-09-6","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2026"},"section":"Data Mining","track":"Main Track","number":304,"pages":{"first":2735,"last":2743},"keywords":["Machine Learning: Adversarial machine learning","Data Mining: Mining graphs"],"videos":[],"references":[],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}