Cross-Paradigm Graph Backdoor Attacks with Promptable Subgraph Triggers

1 Introduction

GNNs have been widely applied to analyze various types of graph-structured data in real-world applications, including social networks, molecular graphs, and financial systems [Weber et al., 2019; Fan et al., 2019; Cheng et al., 2020; Bongini et al., 2021]. Their success is largely attributed to the message-passing mechanism [Xu et al., 2019], where nodes iteratively aggregate information from their neighbors. This process results in node representations that preserve both local structural properties and node attributes. Therefore, through Graph Supervised Learning (GSL), GNNs can be applied to various supervised tasks, including node classification, link prediction, and graph classification [Hamilton et al., 2017; Velickovic et al., 2017; Zhang and Chen, 2018; Zhang et al., 2018; Jiang et al., 2019]. However, GSL heavily relies on large amounts of labeled data for downstream tasks, which is often expensive and labor-intensive. To mitigate the label dependence of traditional supervised learning, Graph Contrastive Learning (GCL) [Zhu et al., 2020; Wu et al., 2024] extracts supervision from distinct augmented views, whereas Graph Prompt Learning (GPL) [Sun et al., 2022; Liu et al., 2023; Sun et al., 2023a; Jiang et al., 2024] bridges pre-trained models to specific tasks via prompts. These paradigms enable efficient training with minimal data and improve the cross-domain learning capabilities of GNNs, making them ideal for scenarios with scarce labeled data.

∗#Corresponding Authors

Although GNNs have achieved remarkable performance across various applications and diverse graph structures, prior research [Zhang et al., 2023; Dai et al., 2023; Zhang et al., 2024a; Lyu et al., 2024; Lin et al., 2024; Zhang et al., 2024b; Li et al., 2024] has revealed that GNNs trained under different learning paradigms are vulnerable to backdoor attacks. For GSL, UGBA [Dai et al., 2023] proposes a similarity loss to reduce the inconsistent similarity between triggers and attacked nodes, thereby improving trigger stealthiness. DPGBA [Zhang et al., 2024a] further improves attack effectiveness by employing an adversarial network to address the out-of-distribution (OOD) issue of trigger representations. For GCL, GCBA [Zhang et al., 2023] is designed to implant backdoors during the contrastive learning phase, showing that attacks can succeed even with limited label information. For GPL, CrossBA [Lyu et al., 2024] employs a hinge loss approach to maximize the similarity between the trigger and target node representations, while minimizing their similarity with clean node representations. This attack strategy optimizes both the triggers and GNNs, making the backdoor effective for downstream cross-task applications. TGPA [Lin et al., 2024] further improves the attack success rate by optimizing triggers and task headers within a bi-level optimization framework under the assumption of a frozen GNN encoder.

Despite notable progress in cross-domain and cross-task backdoor capabilities, most prior works still focus on the model poisoning scenario in Fig. 1 and attack a single learning paradigm, lacking transferability to different attack scenarios. For example, in social network scenarios, attackers can only poison the social network data by creating virtual users (the triggers). Subsequently, legitimate users crawl this public social network data to locally train backdoor models, which are designed to learn user representation embeddings for downstream tasks like recommendation systems. However, a critical gap arises when the victim's training paradigm differs from the attacker's surrogate Diverse learning paradigms induce distinct feature representations and distributions [Xu, 2020], causing severe inconsistencies in the trigger feature space that diminish attack effectiveness. Moreover, the trigger generators trained for graph backdoor attacks often have simple architectures and rely on node-specific features, limiting their ability to generate triggers with structureaware diversity and feature richness. As a result, they struggle to maintain transferability and effectiveness across diverse learning paradigms. In Tab. 1, we validate the failure of backdoor attacks across learning paradigms on Pubmed dataset.

Therefore, in this paper, we study the novel and critical problem of designing transferable graph backdoor attacks across multiple learning paradigms in node classification tasks. The challenges in developing such an attack mainly involve two key aspects: (i) How to ensure trigger generalization across models trained with different learning paradigms? (ii) How to design triggers that effectively capture the intrinsic structure and prior knowledge of the data? Inspired by recent researches on GPL [Sun et al., 2022; Sun et al., 2023a; Wang et al., 2024], we propose CrossParadigm Graph Backdoor Attacks with Promptable Subgraph Triggers (CP-GBA), a novel approach designed to improve the transferability of graph backdoor attacks across different graph learning paradigms. Our approach first constructs a set of condensed subgraph triggers to increase trigger diversity and maintain in-distribution structural properties, as discussed in Sec. 4.1. To ensure transferability across learning paradigms, we further employ GPL to train triggers, utilizing its theoretical transferability detailed in Sec. 4.2. Through these steps, CP-GBA enables effective manipulation of node classifications in graph backdoor attacks. Extensive experiments confirm that our method consistently achieves superior attack efficacy across diverse datasets and learning paradigms, even in the presence of advanced defense mechanisms. In summary, our contributions are:

• Problem: We address a novel backdoor attack problem: generalizing attacks across graph learning paradigms.
• Method: To the best of our knowledge, we are the first to exploit GPL for training backdoor triggers through both theoretical analysis and extensive experiments.
• Results: Extensive experiments on different real-world datasets with various defense strategies show that CP-GBA outperforms SOTA graph backdoor attack methods.

2 RelatedWork

2.1 GNNs on Node Classification

GNN Architectures. GNNs have emerged as a powerful tool for node classification by using information propagation among nodes. Early foundational works like GCN [Kipf and Welling, 2016] utilize localized spectral convolutions to aggregate neighborhood information. To capture more complex dependencies, attention-based models such as GAT [Velickovic et al., 2017] and GraphTransformer [Yun et al., 2019] are introduced, allowing nodes to assign learnable importance weights to neighbors. Addressing scalability in large graphs, GraphSAGE [Hamilton et al., 2017] enables efficient inductive learning by neighbor sampling and aggregation.

Graph Learning Paradigms. Beyond architectures, diverse training paradigms have evolved to address data constraints and generalization. For GSL [Kipf and Welling, 2016], the model is directly optimized through supervised loss functions using high-quality labeled data, achieving success in tasks such as node classification, link prediction, and graph classification. For GCL [You et al., 2020], to overcome the challenge of scarce labeled data, models aim to learn robust representations by maximizing the agreement between different augmented views of the same graph without supervision. GraphCL [You et al., 2020] uses random graph augmentations to generate multiple views and learns node embeddings by contrasting positive and negative pairs via the InfoNCE loss. CCA-SSG [Zhang et al., 2021a] further refines the loss function using canonical correlation analysis. For GPL [Sun et al., 2022], to enhance cross-domain generalization under data scarcity, models adopt a "pre-training, prompt-tuning" strategy [Yu et al., 2024] to adapt pre-trained GNNs to downstream tasks. GPF [Jiang et al., 2024] and GraphPrompt [Liu et al., 2023] utilize prompt-as-tokens by appending learnable vectors to input features or latent spaces, respectively. Allin-one [Sun et al., 2023a] employs prompt-as-graphs by injecting a learnable subgraph structure where tokens connect to original nodes to unify diverse tasks.

2.2 Backdoor Attacks on GNN

Backdoor attacks against GNNs [Yang et al., 2025; Ding et al., 2025] typically involve injecting malicious triggers into the training graph and associating them with a predetermined target label. As a result, when GNNs trained on the backdoored graph encounter test samples containing these triggers, they produce attacker-desired predictions. These attacks can be categorized based on learning paradigms. In GSLbased backdoor attacks, Zhang et al. [Zhang et al., 2021b] propose to inject universal triggers into training samples via a subgraph-based approach with limited attack success rate. Building on this, Xi et al. [Xi et al., 2021] introduce a technique for generating adaptive triggers, customizing perturbations for individual samples to improve attack effectiveness. Dai et al. [Dai et al., 2023] propose a poisoned node algorithm to maximize the attack budget and includes an adaptive trigger generator to produce triggers with high cosine similarity to the target node. Zhang et al. [Zhang et al., 2024a] further consider the OOD problem in triggers and employs a GAN loss to generate in-distribution backdoor triggers. For GCL-based backdoor attacks, Zhang et al. [Zhang et al., 2023] are the first to systematically investigate attacks across different contrastive learning stages, validating their efficacy. For GPL-based backdoor attacks, Lyu et al. [Lyu et al., 2024] propose a cross-context attack that uses a promptbased mechanism to optimize the trigger graph and poison the pretrained GNN. Lin et al. [Lin et al., 2024] propose a finetuning-resistant graph prompt poisoning method without poisoning the pretrained GNN.

However, existing methods focus on the intra-paradigm setting, where the surrogate model and the backdoored model belong to the same learning paradigm, resulting in attacker that are highly dependent on that specific paradigm. In contrast, our CP-GBA is characterized by two key aspects: (i) we tackle a new problem: transferring triggers across different paradigms under a realistic threat model, where attackers possess minimal prior knowledge and are unaware of the downstream learning paradigm. (ii) we are the first to investigate training a set of condensed subgraph triggers with GPL, improving their generalization and transferability.

3 Preliminary

3.1 Notaions

We represent a graph as G = (V,A,X), where V = {v1, . . . , vN} is the node set, X ∈ RN×d is the node feature with d as the feature dimension, and N as the number of nodes. The adjacency matrix A ∈ {0, 1}N×N indicates node connectivity, where Aij = 1 is an edge between nodes vi and vj, and Aij = 0 otherwise. In this paper, we focus on the semi-supervised node classification in an inductive setting. Specifically, the graph G is divided into two disjoint subgraphs: the labeled graph GL and the unlabeled graph GU , with VL ∩ VU = ∅. The labeled graph GL is then split into three disjoint subsets: the labeled training graph GT , the validation graph GV a, and the testing graph GTe. We denote GTr = GU ∪GT as the training graph for model optimization, while GV a and GTe are used for validation and testing.

3.2 Threat Model

Attacker's Goal. The attacker aims to poison the training graph by injecting backdoor triggers into a small set of nodes and assigning them a predefined target class label. The GNN trained on this poisoned graph will then associate the trigger with the target class. As a result, it misclassifies triggerinjected nodes at test time while maintaining normal performance on clean nodes.

Attacker's Knowledge and Capability. Following prior studies [Zhang et al., 2024a], we focus on gray-box backdoor attacks targeting node classification tasks. In a gray-box scenario, attackers have access to a small part of training data, including node attributes, graph structure, and label information, but do not know the specific architecture or parameters of the target model. In our work, the architecture includes both the GNN structure and the learning paradigm. Within a predefined budget, the attacker can inject triggers and assign target labels to nodes in the training graph.

3.3 ProblemFormulation

Our preliminary analysis in Tab. 1 verifies that current attack strategies are ineffective for models under different learning paradigms. To overcome these limitations, we propose a novel transferable graph prompt attack trained with GPL.

We first construct a condensed subgraph trigger pool (T ) with diverse structural and feature patterns. Inspired by GPL, we adopt its mechanism to optimize the backdoor triggers, thereby improving their transferability. We denote ⊕ as the process of injecting prompts p ∈ P, where P includes both token-based and subgraph-based prompts. We define at(·) as the operation of selecting and attaching a trigger from the trigger pool T . Moreover, fθ(G i ) denotes the embedding of the local subgraph centered at node vi using the pre-trained GNN model fθ, followed by node-level classification via the classifier fc(·). Given a clean attributed graph G = (V, A, X), let VTr denote the set of labeled nodes used for training with clean labels. Let VP ⊂ VU be the set of poisoned nodes to which triggers are attached and the target label yt is assigned. The optimization of backdoor triggers under the GPL setting can be formulated as:

where l(·) is the cross-entropy loss and θT represents the parameters of the subgraph trigger set T . In the constraint, the number of poisoned nodes |VP | is bounded by ∆p.

4 Methodology

In this section, we detail our method, which optimizes Eq. (1) to conduct transferable graph backdoor attacks, as illustrated in Fig. 2. Our method consists of a set of condensed subgraph triggers T , graph prompts P for GPL training, a frozen transferable GPL-based optimization Inference GNN encoder fθ, and a surrogate node classifier fc. Initially, we sample N subgraphs, each containing n nodes and centered on a node with the target class yt, from the original graph GTr and select representative ones via clustering to form the initial condensed trigger set T . With the frozen encoder fθ and trainable classifier fc, we perform transferable GPL-based optimization to jointly train T and P. This ensures the robust generalization of T across diverse GNN architectures and learning paradigms.

Figure 2: The overall framework of CP-GBA, comprising three phases. (a) Trigger Construction: Representative subgraphs are identified via K-means clustering on the embeddings of target-class subgraphs to initialize the condensed trigger set T . (b) Transferable Optimization: Triggers from T are injected into target nodes based on similarity, followed by joint optimization with graph prompts P. (c) Inference: The transferability of the optimized backdoor triggers is evaluated across diverse learning paradigms.

4.1 The Set of Condensed Subgraph Triggers

As discussed in Sec. 1, existing adaptive trigger generators typically adopt shallow architectures and rely heavily on node-specific features, limiting their ability to generate triggers with structural diversity and rich feature representations. To overcome this limitation, we construct a set of condensed subgraph triggers T to effectively execute transferable backdoor attacks across different learning paradigms. Initially, we train a clean two-layer GCN encoder, denoted as fθc , on the training graph GTr to obtain node representations, which is formulated as:

whereW denotes the trainable matrix for classification, and b is the bias term. The GCN encoder fθc is parameterized by θc, and l(·) is the cross-entropy loss. Here, ˆhi represents the embedding of node vi, and yi is its ground-truth label. The nodes of VL with the target label yt are selected as central nodes. We then employ a Breadth-First Search (BFS) algorithm to sample N subgraphs, each with n nodes as defined by the trigger size. We compute representations for these N sampled subgraphs using the encoder fθc trained in Eq. (3). We then apply K-means clustering to these representations to select the K most representative subgraphs, which initialize T = {t1, t2, . . . , tK}, where ti = (Xti ,Ati ) denotes the i-th trigger. This approach equips T with category-aware, feature-rich, and structure-preserving triggers, improving both diversity and stealthiness.

4.2 Enhancing Trigger Transferability

To promote model-agnostic triggers, we not only construct T but also employ GPL to improve trigger generalization. To further improve both the effectiveness and stealthiness of the attack, we adopt a bi-level optimization strategy. In the inner loop, we optimize the surrogate classifier fc and prompts P with frozen GNN encoder fθ and trigger set T . The outer loop freezes both fc and P, while updating the trigger set T . Select and Inject Strategy. Due to the limitations of adaptive trigger generators that rely on poisoned node features, we adopt the strategy described in Sec. 4.1 to select the bestmatching trigger from the condensed set T and inject it into the poisoned node. Unlike UGBA, which generates samplespecific triggers, our method employs a rule-based trigger selection and injection strategy.

where n denotes the number of nodes in a trigger, ti is the i-th trigger in T , and ht is the representation of the poisoned node. Each hi is the representation of the i-th node in trigger ti. The trigger with the highest similarity score is selected for backdoor injection, denoted by the selection function at(·).

Inner Loop. Before optimization, we randomly select a subset of unlabeled nodes from VU , attach triggers with the target label yt, and denote this poisoned set as VP . Under the empirical risk minimization setting, we fix the trigger set T and the encoder fθ, and train the graph prompts P along with the surrogate classifier fc by minimizing the loss in Eq. (5) on the poisoned graph.

where θc and θT denote the parameters of the surrogate classifier and the condensed subgraph trigger set T , respectively. G iTr is the clean subgraph centered at node vi with groundtruth label yi, and yt is the target label specified by the attacker. G iP ⊕ p represents the prompted graph. The function at(·) selects the trigger from T based on the Eq. (4).

Outer Loop. The set of condensed subgraph triggers T is then optimized to mislead the surrogate classifier fc, such that the frozen GNN encoder fθ produces embeddings for nodes in VU that are classified as the target label yt when attached with a selected trigger and prompted with p. Formally, the objective is defined as:

Through Eq. (6), the trigger set T inherits both categoryspecific knowledge and transferability similar to that of prompts. Although T is sampled from the original graph and condensed via Eq. (4), preserving structural consistency and improving stealthiness, it remains crucial to model both the connections between trigger and target nodes, and the internal connectivity among trigger nodes. To address this, we define a stealthiness loss:

where E i t denotes the set of edges between the injected trigger nodes and node vi, τsim is a similarity threshold, and xj, xk are the feature vectors of nodes vj and vk.

The loss Lp in Eq. (5) optimizes the surrogate classifier fc to classify clean nodes correctly while also predicting yt for poisoned nodes. Meanwhile, LTrans in Eq. (6) improves the transferability of the trigger set T , and LSte in Eq. (7) improves its stealthiness. The final bi-level optimization objective can be formulated as:

where λ is a trade-off coefficient that balances transferability and stealthiness.

4.3 Why It Works

In this section, we explore the transferability of CP-GBA from the theoretical aspect of GPL.

Theorem 1. In node-level, the model GNN f, which is trained with a large amount of high-quality data, has the ability to map any node in graph Gi, known or unknown, to all feature spaces surjectively (i.e, f : Gi → Rd , where d is the class number dimension.).

Theorem 2. Let fθ be a GNN model trained on upstream datasets Dup with frozen parameters (θ); let Tdow be the downstream task and C is an optimal function to Tdow. Given any graph Gori, C(Gori) denotes the optimal embedding vector to the downstream task (i.e., can be parsed to yield correct results for Gori in the downstream task), then there always exists a bridge graph Gbri such that fθ(Gbri) = C(Gori).

Definition of the bridge graph:

Given a pre-trained model f, the downstream graph Gori augmented with prompt p yields the output representation ˆh = f(Gori ⊕ p). Unlike prior backdoor attacks [Dai et al., 2023; Lyu et al., 2024], our framework leverages the surjective mapping property of the pre-trained model f (Theorem 1), ensuring access to the continuous feature space Rd . Furthermore, Theorem 2 guarantees the existence of a bridge graph that elicits optimal downstream representations via prompt augmentation. Building on these guarantees, GPL-based optimization enables the trigger to function as a learnable approximation of this theoretical bridge graph. By dynamically adapting the trigger to minimize the prompt-tuning loss, our method effectively aligns the poisoned graph with the optimal bridge structure. This alignment empowers the trigger to inherit the intrinsic transferability of prompts, ensuring robust generalization across diverse downstream tasks, architectures, and learning paradigms.

5 Experiments

5.1 Experimental Settings

Datasets. To evaluate the effectiveness of CP-GBA, we conduct experiments on four widely used real-world datasets, i.e., Cora, Pubmed, Facebook and OGB-arxiv [Sen et al., 2008; Hu et al., 2020; Rozemberczki et al., 2021], which serve as standard benchmarks for inductive semi-supervised node classification. The dataset statistics are summarized in Tab. 3. s Compared Methods. Following a similar setting to DPGBA [Zhang et al., 2024a], we compare CP-GBA with four representative graph backdoor attack methods, including SBA [Zhang et al., 2021b], GTA [Xi et al., 2021], UGBA [Dai et al., 2023], and DPGBA [Zhang et al., 2024a]. To assess the stealthiness of CP-GBA, we employ three representative defenses, Prune [Dai et al., 2023], OD [Zhang et al., 2024a], and RIGBD [Zhang et al., 2025], which detect backdoors based on attribute similarity, distribution anomalies, and random edge dropping, respectively. All hyperparameters are selected based on validation performance.

Backbone GNN Models and Learning Methods. Following the taxonomy in [Sun et al., 2023b; Ju et al., 2024], we evaluate CP-GBA across three learning paradigms: GSL, including standard (GAT [Velickovic et al., 2017], GCN [Kipf and Welling, 2016], GraphSAGE [Hamilton et al., 2017], GT [Yun et al., 2019]) and robust architectures (GNNGuard [Zhang and Zitnik, 2020], RobustGCN [Zhu et al., 2019]); GCL (GRACE [Zhu et al., 2020], CCA-SSG [Zhang et al., 2021a]); and GPL (GPF [Jiang et al., 2024], GraphPrompt [Liu et al., 2023], All-in-one [Sun et al., 2023a])

Evaluation Protocol. Following a similar setting to DPGBA [Zhang et al., 2024a], we randomly select 20% of the nodes from the original dataset to serve as test nodes for evaluation. Among these test nodes, half are designated as target nodes for evaluating attack performance. The remaining half are used as clean test nodes to assess the prediction accuracy of backdoored models on clean samples. The graph containing the remaining 80% of nodes is used as the training graph, where 20% of the nodes are labeled. To evaluate the backdoor attacks, we report the average attack success rate (ASR) on the target node set, accuracy (ACC) on clean test nodes, clean accuracy (CA), and accuracy drop (AD) [Zhang et al., 2023], where AD measures the performance degradation compared with the clean model. To assess the transferability and generalizability of CP-GBA, we repeat the experiments five times on each GNN architecture and learning paradigm and report the average performance.

5.2 Attack Performance

We evaluate the transferability and stealthiness of CP-GBA against baselines across four datasets and three learning paradigms under different defense strategies. As shown in Tab. 2, we summarize the following key observations:

• Baselines show poor performances across different learning paradigms, which is consistent with the findings in Tab. 1, indicating that existing attack strategies are overly reliant on model structures and learning paradigms.
• Without applying defense strategies, CP-GBA achieves the highest ASR over all baseline methods across all datasets, showing its generalizability and transferability with respect to different model structures and learning paradigms. When equipped with defense strategies, CP-GBA maintains high ASR, comparable to the no-defense setting.

5.3 Impact of Attack Budget

We investigate the impact of attack budgets by varying the trigger count in {20, 40, 60, 80, 100}, and size in {3, 4, 5, 6, 7}, while holding all other parameters frozen. Figure 3 illustrates the ASR results on Cora, with consistent trends observed across other datasets. We report only ASR, as clean accuracy exhibits negligible fluctuations.

As the number of condensed triggers increases, the ASR shows minimal variance and remains at a high level. This suggests that only 20 triggers are sufficient to maintain strong generalizability and effectiveness, as well as the stealthiness of the backdoor attack during graph poisoning.

As the number of nodes in each trigger increases, ASR shows a clear upward trend and plateaus when the trigger size reaches five nodes. This indicates a 5-node trigger suffices to capture category-aware information.

5.4 Trigger Feature Distribution

To investigate how GPL improves the generalization of triggers, we extract the embeddings of the target model for both the original nodes and the trigger nodes trained with different paradigms and visualize these embeddings using t-SNE, as shown in Fig. 4. We can observe that for a specific attack category, the triggers trained by GPL, while remaining close to the original node features, show a more widespread distribution that more closely aligns with the overall distribution of the original graph. This generalization is crucial for achieving model-agnostic and paradigm-agnostic attacks, because the trigger representations avoid overfitting to a narrow region of the feature space, ensuring effectiveness across various model architectures and learning paradigms.

5.5 Ablation Study

We conduct ablation studies to investigate how GPL improves the generalizability and transferability of subgraph triggers across different model architectures and learning paradigms. As shown in Tab. 4, we replace the subgraph trigger optimization method based on GPL with GSL and GCL. From the experimental results, we can observe:

• Under GPL optimization, All-in-one consistently outperforms token-based baselines (GPF and GraphPrompt). We
• attribute this superiority to the structural alignment between its subgraph prompts and our trigger design. Furthermore, subgraph-based prompts are likely to encode richer structural and semantic information than tokenbased prompts, leading to stronger transferability.
• The suboptimal ASR in GCL and GSL paradigms highlights their limited capacity for trigger transferability. This empirically validates the superiority of GPL in facilitating the learning of robust, transferable backdoor triggers.

6 Conclusion

In this paper, we present both theoretical and empirical investigations on the transferability of backdoor attacks across diverse attack scenarios. To overcome the poor transferability across attack scenarios, we identify two key challenges: (1) overreliance on the training paradigm and (2) simplistic adaptive trigger generators. To this end, we propose CPGBA, a transferable backdoor attack that employs a set of condensed subgraph triggers to enrich structural features and preserve distributional consistency. Specifically, the transferability of GPL is utilized to optimize the subgraph triggers, enabling them to be model-agnostic and ensuring attack effectiveness across diverse scenarios. Extensive experiments on real-world datasets confirm the effective performance of CP-GBA under various attack settings.

Acknowledgments

This work is supported by the National Natural Science Foundation of China (Grant No. 62402341).