---
title: "Collateral Damage Constrained Backdoor Attacks on Graph Neural Networks"
authors:
  - "Di Jin"
  - "Zechuan Zhang"
  - "Bingdao Feng"
  - "Xiaobao Wang"
  - "Dongxiao He"
  - "Zhen Wang"
doi: "10.24963/ijcai.2026/304"
url: "https://ijcai.org/proceedings/2026/304"
pdf: "https://ijcai.org/proceedings/2026/0304.pdf"
venue: "Proceedings of the Thirty-Fifth International Joint Conference on Artificial Intelligence"
year: 2026
pages: "2735-2743"
track: "Main Track"
keywords:
  - "Machine Learning: Adversarial machine learning"
  - "Data Mining: Mining graphs"
---

# Collateral Damage Constrained Backdoor Attacks on Graph Neural Networks

Di Jin, Zechuan Zhang, Bingdao Feng, Xiaobao Wang, Dongxiao He, Zhen Wang

*Proceedings of the Thirty-Fifth International Joint Conference on Artificial Intelligence*, pages 2735-2743. DOI: [10.24963/ijcai.2026/304](https://doi.org/10.24963/ijcai.2026/304)

## Abstract

Graph Neural Networks (GNNs) are vulnerable to backdoor attacks, where models behave normally on clean data but exhibit targeted misclassifications once specific triggers are activated. Existing backdoor attacks on GNNs mainly focus on enhancing trigger stealthiness or diversifying attack paradigms. However, these methods overlook a fundamental property of GNNs: trigger-induced malicious signals inevitably propagate through graph neighborhoods, causing unintended mispredictions on clean nodes, i.e., Collateral Damage. To address this issue, we propose the Collateral Damage Constrained Graph Backdoor Attack (CDCA), a novel framework that explicitly controls malicious diffusion. Specifically, the proposed method combines neighborhood-aware target node selection with a self-constrained trigger generation strategy to suppress trigger-induced propagation by enforcing prediction consistency on clean K-hop neighboring nodes. Extensive experiments on real-world datasets demonstrate that the proposed method remains effective while significantly reducing collateral damage.