Poisoning the Inner Prediction Logic of Graph Neural Networks for Clean-Label Backdoor Attacks

Yuxiang Zhang; Bin Ma; Enyan Dai

cs.LGMar 5, 2026

Poisoning the Inner Prediction Logic of Graph Neural Networks for Clean-Label Backdoor Attacks

Authors: Yuxiang Zhang, Bin Ma, Enyan Dai

Organizations: AI Thrust, INFO Hub, The Hong Kong University of Science and Technology (Guangzhou)

Abstract

Graph Neural Networks (GNNs) have achieved remarkable results in various tasks. Recent studies reveal that graph backdoor attacks can poison the GNN model to predict test nodes with triggers attached as the target class. However, apart from injecting triggers to training nodes, these graph backdoor attacks generally require altering the labels of trigger-attached training nodes into the target class, which is impractical in real-world scenarios. In this work, we focus on the clean-label graph backdoor attack, a realistic but understudied topic where training labels are not modifiable. According to our preliminary analysis, existing graph backdoor attacks generally fail under the clean-label setting. Our further analysis identifies that the core failure of existing methods lies in their inability to poison the prediction logic of GNN models, leading to the triggers being deemed unimportant for prediction. Therefore, we study a novel problem of effective clean-label graph backdoor attacks by poisoning the inner prediction logic of GNN models. We propose BA-Logic to solve the problem by coordinating a poisoned node selector and a logic-poisoning trigger generator. Extensive experiments on real-world datasets demonstrate that our method effectively enhances the attack success rate and surpasses state-of-the-art graph backdoor attack competitors under clean-label settings. Our code is available at https://anonymous.4open.science/r/BA-Logic

Figures & tables

Figure 1: Illustration of graph backdoor attacks under both the general and clean-label settings.

Dataset	Target Model	Vanilla Acc.	ERBA	ECGBA	EBA-C	GTA-C	UGBA-C	DPGBA-C	Ba-Logic
Cora	GCN	83.78	18.22 \| 80.77	34.77 \| 79.48	29.13 \| 74.17	32.45 \| 80.45	68.32 \| 79.97	59.55 \| 79.88	98.52 \| 83.59
	GAT	84.30	19.32 \| 82.08	35.19 \| 78.93	29.34 \| 74.23	35.85 \| 82.68	68.76 \| 82.81	59.02 \| 84.19	97.12 \| 83.76
	GIN	84.26	19.17 \| 79.85	34.56 \| 79.92	29.30 \| 74.46	35.49 \| 79.63	67.75 \| 83.04	60.03 \| 81.56	98.97 \| 83.81
Pubmed	GCN	86.38	22.18 \| 85.58	37.46 \| 85.86	31.89 \| 85.60	38.84 \| 86.17	71.24 \| 85.31	64.19 \| 85.41	96.75 \| 86.03
	GAT	86.51	22.24 \| 85.91	41.54 \| 85.61	30.13 \| 85.46	42.14 \| 85.78	66.07 \| 86.33	67.05 \| 85.21	94.88 \| 85.13
	GIN	86.51	15.46 \| 85.57	43.14 \| 83.63	30.99 \| 85.44	42.34 \| 86.35	68.69 \| 85.81	66.17 \| 86.22	99.04 \| 86.21

Table 3: Average backdoor attack success rate and clean accuracy (ASR | clean accuracy (%)). Note that the surrogate model deployed in Ba-Logic is fixed as a 2-layer GCN.

Panel of Figure 4 — Figure 4: Generalization ability of Ba-Logic . (a) ASR (%) with varying surrogate and target models on Arxiv. (b-c) ASR (%) on graph classification and edge prediction.

Datasets	GCN	ACMGCN	LINKX
Squirrel	99.07	98.14	98.79
Chameleon	99.03	98.53	98.43
Penn	96.34	96.71	95.32
Genius	98.17	97.92	93.71

Table 4: ASR (%) of Ba-Logic in backdooring various target models on heterophilous graphs.

Category	Defense	ECGBA	DPGBA-C	UGBA-C	Ba-Logic
Existing Defenses	GCN-Prune	13.57	17.43	62.31	96.75
	RobustGCN	14.24	29.65	44.46	97.03
	GNNGuard	0 0.51	43.77	40.08	95.37
	RIGBD	0 0.01	0 0.01	0 0.19	93.23
Adaptive Defenses	ER	19.84	51.73	44.39	80.06
	GM	17.92	46.25	49.87	92.36

Table 5: Comparisons of ASR(%) against various existing and adaptive defense models.

Panel of Figure 5 — Figure 5: (a-b) Ablation studies on GCN and GIN. (c) Hyperparameter sensitivity analysis on Arxiv.

Appendix figures & tables20 assets

Supplementary material from the paper’s appendix.

Appendix

Graph Classification					Edge Prediction
Datasets	SCLBA	GCLBA	TRAP	Ba-Logic	Datasets	SNTBA	PSO-LB	LB	Ba-Logic
MUTAG	88.51 \| 62.77	19.27 \| 62.81	71.89 \| 61.44	92.17 \| 61.32	Cora	91.32 \| 80.43	61.35 \| 79.45	68.06 \| 76.17	99.01 \| 79.59
NCI1	94.01 \| 61.43	61.35 \| 60.97	68.06 \| 61.51	96.19 \| 62.08	CS	89.62 \| 81.95	67.14 \| 76.13	57.67 \| 78.49	95.13 \| 79.65
PROTEINS	67.59 \| 71.25	67.14 \| 71.33	57.67 \| 71.49	89.67 \| 71.65	Physics	48.32 \| 62.77	39.27 \| 64.09	61.89 \| 63.44	93.81 \| 63.02

Appendix

Table 6: ASR | clean accuracy (%) of Ba-Logic in backdooring graph classification and edge prediction.

Surrogate Model	Training Time (s)	GPU Memory Peak (GB)	ASR\|clean accuracy (%)
GCN	1678.05	23.52	87.07 \| 78.51
GraphSAGE	1531.39	22.36	83.69 \| 80.27

Appendix

Table 7: Training statistics and performance of Ba-Logic on OGBN-Products .

Panel of Figure 6 — Figure 6: Performance of Ba-Logic on sampling-based GNNs.

Panel of Figure 7 — Figure 7: Clean accuracy of backdoored models.

Datasets	OPS-GFS	UAT-U	UAT-T	Ba-Logic
MUTAG	88.45\|60.67	88.91\|60.95	90.15\|59.45	92.17\|61.32
PROTEINS	71.96\|70.14	85.73\|65.36	86.43\|68.18	89.67\|71.65
NCI1	83.71\|80.65	93.46\|77.44	95.17\|78.16	94.38\|80.39

Appendix

Table 8: Results (ASR|clean accuracy(%)) of comparing Ba-Logic with baselines from image domain.

Datasets	Defense	ERBA	ECGBA	EBA-C	GTA-C	DPGBA-C	UGBA-C	Ba-Logic
Cora	GCN-Prune	0 5.93	15.56	16.71	15.69	33.10	52.07	99.17
	RobustGCN	0 4.17	14.25	15.28	15.04	21.78	56.09	99.12
	GNNGuard	0 0.00	0 0.01	0 0.14	0 0.00	50.27	35.57	98.48
	RIGBD	0 0.00	0 0.01	0 0.00	0 0.00	0 0.07	0 0.16	95.47
Pubmed	GCN-Prune	0 4.13	15.79	19.25	18.95	37.34	59.64	97.95
	RobustGCN	0 2.96	13.24	17.13	18.72	28.13	45.59	98.10

Appendix

Table 9: Results (ASR(%)) of comparing Ba-Logic with baselines against defense models.

Setting	Pruning top-5%		Pruning top-10%
Setting	RTC	ASR $\|$ clean accuracy	RTC	ASR $\|$ clean accuracy
Prune 1 edge	96.20	97.45 $\|$ 60.42	95.80	97.71 $\|$ 61.15
Prune 2 edges	94.80	97.25 $\|$ 59.37	91.60	96.82 $\|$ 58.72
Prune 3 edges	90.40	96.62 $\|$ 56.31	88.70	94.75 $\|$ 56.03

Appendix

Table 10: Results of Ba-Logic against pruning defenses.

Panel of Figure 8 — Figure 8: Hyperparameter sensitivity analysis of Ba-Logic .

Dataset	ERBA-S	EBA-S	ECGBA-S	GTA-S	UGBA-S	DPGBA-S	BA-Logic
Cora	21.81 \| 80.90	33.25 \| 72.62	56.84 \| 79.28	32.52 \| 80.92	68.94 \| 81.94	67.87 \| 81.88	98.20 \| 83.72
Pubmed	22.95 \| 85.69	33.99 \| 85.50	58.38 \| 85.03	41.57 \| 86.10	68.87 \| 85.82	70.31 \| 85.61	96.89 \| 85.79
Flickr	0 4.70 \| 46.29	34.15 \| 44.99	62.08 \| 44.99	51.71 \| 45.88	68.08 \| 45.66	71.39 \| 44.78	99.90 \| 45.70
Arxiv	0 0.01 \| 65.43	31.09 \| 65.57	54.94 \| 64.21	37.98 \| 65.79	70.79 \| 66.08	69.10 \| 66.27	98.03 \| 66.02

Appendix

Table 11: Comparison between Ba-Logic and poisoned node selection updated baselines.

Panel of Figure 9 — Figure 9: Comparison of IRT distribution.

Panel of Figure 10 — Figure 10: Impact of attack budget.

	Cora				Pubmed
$\Delta_{P}$	EBA-C	UGBA-C	DPGBA-C	BA-Logic	EBA-C	UGBA-C	DPGBA-C	BA-Logic
10	0 5.13 \| 82.47	15.29 \| 81.05	17.87 \| 80.95	65.16 \| 83.11	0 0.69 \| 86.38	11.89 \| 85.36	21.15 \| 84.95	62.07 \| 85.32
20	12.39 \| 82.78	51.26 \| 80.14	45.43 \| 81.36	87.13 \| 83.06	0 8.61 \| 86.21	34.62 \| 85.36	49.31 \| 84.36	88.04 \| 85.09
30	15.64 \| 82.34	62.20 \| 80.65	50.77 \| 80.44	92.17 \| 82.39	19.47 \| 86.75	64.16 \| 85.05	54.61 \| 85.44	94.79 \| 84.67
40	29.03 \| 81.86	63.18 \| 80.37	51.03 \| 80.85	94.22 \| 83.16	29.76 \| 85.33	64.07 \| 85.16	55.57 \| 85.85	95.44 \| 84.96
50	29.17 \| 80.99	63.23 \| 79.85	51.15 \| 80.75	96.05 \| 81.85	30.66 \| 85.17	63.97 \| 85.25	57.86 \| 85.75	95.71 \| 85.05

Appendix

Table 12: Results (ASR | clean accuracy(%)) on Cora and Pubmed with less attack budget.

Method	Manipulates Existing Nodes/Edges	Alters Training Labels	Knows/Controls Defense for Data Cleaning	Trigger Injection	Comparison to Ours
GTA	✗	✓	✗	✓	Stronger assumption than ours
UGBA	✗	✓	✗	✓	Stronger assumption than ours
DPGBA	✗	✓	✗	✓	Stronger assumption than ours
TRAP	✓	✓	✗	✗	Stronger assumption than ours
EBA	✓	✗	✗	✗	Stronger assumption than ours
CGBA	✓	✗	✗	✗	Stronger assumption than ours

Appendix

Table 13: Threat model level comparison.

Dataset	#Nodes	#Edges	#Graphs	#Features	#Classes
Cora	2,708	5,429	1	1,433	7
Pubmed	19,717	44,338	1	500	3
Flickr	89,250	899,756	1	500	7
Arxiv	169,343	1,166,243	1	128	40
CS	18,333	163,788	1	6,805	15
Physics	34,493	495,924	1	8,415	5

Appendix

Table 14: The statistics of datasets in our work.

Dataset	#Nodes	UGBA	DPGBA	Ba-Logic
Flickr	89,250	32.0s	57.7s	123.4s
Arxiv	169,343	51.3s	68.9s	155.7s

Appendix

Table 15: Comparisons of method training time on two datasets.

Dataset	Defenses	Acc.	ERBA	ECGBA	EBA-C	GTA-C	UGBA-C	DPGBA-C	Ba-Logic
Cora	ER	84.11	0 7.83\|82.36	42.59\|82.07	20.74\|75.75	30.56\|82.38	45.82\|80.37	49.31\|82.91	89.05\|71.85
	GM	84.12	0 6.91\|73.71	52.31\|75.58	19.38\|67.10	31.42\|73.73	50.41\|71.16	51.16\|74.94	95.32\|72.31
	CD	84.10	0 0.05\|74.72	44.62\|78.14	21.78\|68.11	45.34\|74.74	62.71\|70.14	48.10\|76.45	90.47\|70.02
	SAM	84.09	0 0.03\|73.21	45.01\|81.66	25.19\|66.60	51.08\|73.23	39.95\|70.65	33.08\|67.87	79.56\|75.69
Pubmed	ER	86.51	0 5.12\|80.57	52.17\|86.18	17.53\|80.38	27.68\|80.98	46.11\|74.75	57.09\|80.16	89.52\|67.22
	GM	86.51	0 3.21\|75.65	56.22\|80.01	16.29\|75.46	28.45\|76.06	52.30\|71.16	52.61\|75.16	88.07\|66.48

Appendix

Table 16: Results (ASR | clean accuracy(%)) of backdoor methods against adaptive defenses.

Panel of Figure 11 — Figure 11: Performance of Ba-Logic on synthetic graphs with different feature-label correlations.

Panel of Figure 12 — Figure 12: Performance of Ba-Logic under sparse, noisy, and imbalanced label settings.

Panel of Figure 13 — Figure 13: The Jaccard overlap of poisoned node selection under different label settings.

Panel of Figure 14 — Figure 14: Performance of Ba-Logic under noisy and partially accessible feature settings.

Explore similar work

Universal Graph Backdoor Defense: A Feature-based Homophily Perspective
May 16, 2026Mengting Pan, Fan Li, Chen Chen +1Graph Neural Networks Backdoor Detection
The University of New South Wales Sydney, Australia · University of Wollongong Wollongong, Australia
Trapping Attacker in Dilemma: Examining Internal Correlations and External Influences of Trigger for Defending GNN Backdoors
May 8, 2026Fan Yang, Binyan Xu, Di Tang +1Graph Neural Networks Backdoor Attacks
The Chinese University of Hong Kong · Sun Yat-Sen University
Graph-Aware Stealthy Poison-Text Backdoors for Text-Attributed Graphs
Mar 20, 2026Qi Luo, Minghui Xu, Dongxiao Yu +1Backdoor Attacks Data Poisoning Attacks
School of Computer Science and Technology, Shandong University, Qingdao, China

May 16, 2026J/K move · Enter open · S save

Universal Graph Backdoor Defense: A Feature-based Homophily Perspective

Mengting Pan, Fan Li, Chen Chen, Xiaoyang Wang

The University of New South Wales Sydney, Australia · University of Wollongong Wollongong, Australia

Graph Neural Networks Backdoor Detection

Open paper AskPDF arXiv

Graph neural networks (GNNs) have achieved remarkable success in relational learning. However, their vulnerability to graph backdoor attacks (GBAs) poses a significant barrier to broader adoption in high-stakes applications. Despite recent advances in graph backdoor defense (GBD), existing methods primarily focus on subgraph-based GBAs, relying on the assumption that poisoned target nodes are explicitly connected to subgraph triggers. Our empirical results reveal that such structure-centric approaches fail to defend against emerging feature-based GBAs that preserve graph topology. Therefore, in this paper, we study a novel problem of universal graph backdoor defense. First, we investigate the shared effects of both attack types from a feature-based homophily perspective, which characterizes local feature consistency between nodes and their neighborhoods. Thorough theoretical and empirical analyses demonstrate that, regardless of trigger mechanisms, backdoors induced by GBAs exhibit lower feature-based homophily than clean nodes, indicating a discrepancy in local feature similarity. Motivated by this insight, we propose to leverage node-level local feature consistency, modeled by a neighbor-aware reconstruction loss, to distinguish backdoors from clean nodes. Then, a robust training strategy is developed to eliminate trigger effects while reducing noise induced by detection uncertainty. Extensive experiments demonstrate that our framework significantly degrades the attack success rate and maintains competitive clean accuracy under both subgraph-based and feature-based attacks.

Dataset	Target Model	Vanilla Acc.	ERBA	ECGBA	EBA-C	GTA-C	UGBA-C	DPGBA-C	Ba-Logic
Cora	GCN	83.78	18.22 \| 80.77	34.77 \| 79.48	29.13 \| 74.17	32.45 \| 80.45	68.32 \| 79.97	59.55 \| 79.88	98.52 \| 83.59
	GAT	84.30	19.32 \| 82.08	35.19 \| 78.93	29.34 \| 74.23	35.85 \| 82.68	68.76 \| 82.81	59.02 \| 84.19	97.12 \| 83.76
	GIN	84.26	19.17 \| 79.85	34.56 \| 79.92	29.30 \| 74.46	35.49 \| 79.63	67.75 \| 83.04	60.03 \| 81.56	98.97 \| 83.81
Pubmed	GCN	86.38	22.18 \| 85.58	37.46 \| 85.86	31.89 \| 85.60	38.84 \| 86.17	71.24 \| 85.31	64.19 \| 85.41	96.75 \| 86.03
	GAT	86.51	22.24 \| 85.91	41.54 \| 85.61	30.13 \| 85.46	42.14 \| 85.78	66.07 \| 86.33	67.05 \| 85.21	94.88 \| 85.13
	GIN	86.51	15.46 \| 85.57	43.14 \| 83.63	30.99 \| 85.44	42.34 \| 86.35	68.69 \| 85.81	66.17 \| 86.22	99.04 \| 86.21

Graph Classification					Edge Prediction
Datasets	SCLBA	GCLBA	TRAP	Ba-Logic	Datasets	SNTBA	PSO-LB	LB	Ba-Logic
MUTAG	88.51 \| 62.77	19.27 \| 62.81	71.89 \| 61.44	92.17 \| 61.32	Cora	91.32 \| 80.43	61.35 \| 79.45	68.06 \| 76.17	99.01 \| 79.59
NCI1	94.01 \| 61.43	61.35 \| 60.97	68.06 \| 61.51	96.19 \| 62.08	CS	89.62 \| 81.95	67.14 \| 76.13	57.67 \| 78.49	95.13 \| 79.65
PROTEINS	67.59 \| 71.25	67.14 \| 71.33	57.67 \| 71.49	89.67 \| 71.65	Physics	48.32 \| 62.77	39.27 \| 64.09	61.89 \| 63.44	93.81 \| 63.02

Datasets	OPS-GFS	UAT-U	UAT-T	Ba-Logic
MUTAG	88.45\|60.67	88.91\|60.95	90.15\|59.45	92.17\|61.32
PROTEINS	71.96\|70.14	85.73\|65.36	86.43\|68.18	89.67\|71.65
NCI1	83.71\|80.65	93.46\|77.44	95.17\|78.16	94.38\|80.39

Dataset	ERBA-S	EBA-S	ECGBA-S	GTA-S	UGBA-S	DPGBA-S	BA-Logic
Cora	21.81 \| 80.90	33.25 \| 72.62	56.84 \| 79.28	32.52 \| 80.92	68.94 \| 81.94	67.87 \| 81.88	98.20 \| 83.72
Pubmed	22.95 \| 85.69	33.99 \| 85.50	58.38 \| 85.03	41.57 \| 86.10	68.87 \| 85.82	70.31 \| 85.61	96.89 \| 85.79
Flickr	0 4.70 \| 46.29	34.15 \| 44.99	62.08 \| 44.99	51.71 \| 45.88	68.08 \| 45.66	71.39 \| 44.78	99.90 \| 45.70
Arxiv	0 0.01 \| 65.43	31.09 \| 65.57	54.94 \| 64.21	37.98 \| 65.79	70.79 \| 66.08	69.10 \| 66.27	98.03 \| 66.02

	Cora				Pubmed
$\Delta_{P}$	EBA-C	UGBA-C	DPGBA-C	BA-Logic	EBA-C	UGBA-C	DPGBA-C	BA-Logic
10	0 5.13 \| 82.47	15.29 \| 81.05	17.87 \| 80.95	65.16 \| 83.11	0 0.69 \| 86.38	11.89 \| 85.36	21.15 \| 84.95	62.07 \| 85.32
20	12.39 \| 82.78	51.26 \| 80.14	45.43 \| 81.36	87.13 \| 83.06	0 8.61 \| 86.21	34.62 \| 85.36	49.31 \| 84.36	88.04 \| 85.09
30	15.64 \| 82.34	62.20 \| 80.65	50.77 \| 80.44	92.17 \| 82.39	19.47 \| 86.75	64.16 \| 85.05	54.61 \| 85.44	94.79 \| 84.67
40	29.03 \| 81.86	63.18 \| 80.37	51.03 \| 80.85	94.22 \| 83.16	29.76 \| 85.33	64.07 \| 85.16	55.57 \| 85.85	95.44 \| 84.96
50	29.17 \| 80.99	63.23 \| 79.85	51.15 \| 80.75	96.05 \| 81.85	30.66 \| 85.17	63.97 \| 85.25	57.86 \| 85.75	95.71 \| 85.05

Abstract

Explore similar work

Universal Graph Backdoor Defense: A Feature-based Homophily Perspective

Trapping Attacker in Dilemma: Examining Internal Correlations and External Influences of Trigger for Defending GNN Backdoors

Graph-Aware Stealthy Poison-Text Backdoors for Text-Attributed Graphs