通过识别触发器的过度相似性,提升图神经网络抗后门攻击能力。
Boosting Graph Robustness Against Backdoor Attacks: An Over-Similarity Perspective
- 基于特征与结构相似性检测后门触发器
- 对比学习生成可区分干净节点与触发器的嵌入
- 在真实数据集上有效防御多种攻击且不损害正常性能
图神经网络(GNN)在社交网络、交通网络等任务中表现优异,但近期研究揭示其易受后门攻击,影响实际应用可靠性。现有防御方法存在两大缺陷:难以区分触发器与干净节点,导致误删大量正常节点;或无法消除触发器影响,难以恢复目标节点至攻击前状态。通过对多种现有图后门攻击的实证分析,我们发现触发器在特征和结构上表现出过度相似性。基于此,提出新防御方法 SimGuard:首先利用相似性度量检测触发器,再通过对比学习训练后门检测器,生成能有效分离触发器与干净节点的嵌入,从而提升检测效率。在多个真实世界数据集上的广泛实验表明,该方法能有效抵御各类图后门攻击,同时保持对干净数据的良好性能。代码将在论文录用后公开。
原文摘要 · Abstract (English)
Graph Neural Networks (GNNs) have achieved notable success in tasks such as social and transportation networks. However, recent studies have highlighted the vulnerability of GNNs to backdoor attacks, raising significant concerns about their reliability in real-world applications. Despite initial efforts to defend against specific graph backdoor attacks, existing defense methods face two main challenges: either the inability to establish a clear distinction between triggers and clean nodes, resulting in the removal of many clean nodes, or the failure to eliminate the impact of triggers, making it challenging to restore the target nodes to their pre-attack state. Through empirical analysis of various existing graph backdoor attacks, we observe that the triggers generated by these methods exhibit over-similarity in both features and structure. Based on this observation, we propose a novel graph backdoor defense method SimGuard. We first utilizes a similarity-based metric to detect triggers and then employs contrastive learning to train a backdoor detector that generates embeddings capable of separating triggers from clean nodes, thereby improving detection efficiency. Extensive experiments conducted on real-world datasets demonstrate that our proposed method effectively defends against various graph backdoor attacks while preserving performance on clean nodes. The code will be released upon acceptance.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。