Modern graph learning systems often combine links with text, as in citation networks with abstracts or social graphs with user posts. In such systems, text is usually easier to edit than graph structure, which creates a practical security risk: an attacker may hide a small malicious cue in training text and later use it to trigger incorrect predictions. This paper studies that risk in a realistic setting where the attacker edits only node text and leaves the graph unchanged. We propose TAGBD, a graph-aware backdoor attack that first selects training nodes that are easier to manipulate, then generates stealthy poison text with a shadow graph model, and finally injects the text by replacing the original content or appending a short phrase. Experiments on three benchmark datasets show that TAGBD achieves very high attack success rates, transfers across different graph models, and remains effective under common defenses. These results show that inconspicuous poison text alone can serve as a reliable attack channel in text-attributed graphs, highlighting the need for defenses that inspect both node content and graph structure.
Figures & tables
Fig. 1: Overview of TAGBD. The attack first identifies vulnerable training nodes, then generates trigger text from graph-aware node representations, and finally injects the generated text by either overwriting the original node text or appending a short phrase. A target GNN trained on the poisoned graph subsequently learns the hidden trigger-target association.
TABLE I: Statistics of the three evaluation datasets. Words avg and Words max denote the average and maximum number of words per node text.
Datasets
Defense
Clean
SBA-Samp
SBA-Gen
GTA
UGBA
DPGBA
Overwriting
Appending
Cora
None
77.82
27.23
76.52
42.23
77.12
92.55
79.93
95.25
79.22
93.25
78.22
100.00
86.72
99.63
86.72
Prune
77.23
17.25
75.93
21.35
78.62
0.25
78.61
93.33
78.38
19.47
77.98
100.00
87.82
99.37
85.61
OD
76.92
30.50
75.62
43.37
77.94
46.12
78.24
0.00
78.32
93.94
77.92
100.00
87.45
95.20
91.14
Pubmed
None
81.56
28.83
83.41
30.51
85.12
95.76
82.22
92.15
83.96
92.55
80.26
99.59
93.05
98.59
93.05
Prune
81.61
25.17
82.56
22.73
84.62
26.31
82.73
91.84
84.71
89.59
80.61
99.85
93.10
98.90
91.18
OD
83.69
23.57
82.74
29.63
83.94
87.34
82.49
30.25
83.99
18.84
82.83
99.85
92.75
97.92
94.17
TABLE II: Main comparison with graph backdoor baselines under different defense settings. ‘Clean’ reports the accuracy of the benign model. For each attack method, the left entry is ASR and the right entry is CA. The last two groups correspond to TAGBD with overwriting and appending triggers; boldface marks the best ASR in each row.
Target Model
Overwriting
Appending
GCN
99.25
86.35
97.86
63.86
GraphSAGE
99.62
83.03
98.99
69.83
GAT
99.26
83.76
98.89
61.55
GraphTransformer
99.17
85.24
99.15
68.19
RobustGCN
98.89
87.45
91.94
66.88
TABLE III: Transferability across target GNNs on the ArXiv dataset. For each strategy, the left entry is ASR and the right entry is CA.
Fig. 2: Attack success rate under different poisoning budgets. Both variants improve as more training nodes are poisoned, and overwriting reaches strong performance with fewer poisoned nodes.
Model
Overwriting
Appending
ASR
CA
PPL
ASR
CA
PPL
BOW
50.92
88.39
211.73
18.82
86.35
220.33
GTR-T5
98.52
87.08
341.62
95.57
86.72
62.18
Sonar
100.00
87.22
175.23
99.96
76.35
95.45
TABLE IV: Effect of encoder-decoder choice on Cora. Each entry reports ASR, CA, and PPL. Stronger text models generally improve both attack effectiveness and text quality.
Fig. 3: Effect of trigger length on attack success rate. Longer triggers improve ASR for both variants, while overwriting reaches saturation earlier than appending.
Original label: Rule Learning
Target label: Case-Based
Original text
Overwriting
Appending
Extraction of meta-knowledge to restrict the hypothesis space for ILP systems. Many ILP systems, such as GOLEM, FOIL, and MIS, take advantage of user supplied meta-knowledge to restrict the hypothesis space. This meta-knowledge can be in the form of type information about arguments in the predicate being learned, or it can be information about whether a certain argument in the predicate is functionally dependent on the other arguments (supplied as mode information). This meta knowledge is explicitly supplied to an ILP system in addition to the data. The present paper argues that in many cases the meta knowledge can be extracted directly from the raw data. Three algorithms are presented that learn type, mode, and symmetric meta-knowledge from data. These algorithms can be incorporated in existing ILP systems in the form of a preprocessor that obviates the need for a user to explicitly provide this information. In many cases, the algorithms can extract meta- knowledge that the user is either unaware of, but which information can be used by the ILP system to restrict the hypothesis space.
In a nutshell, there are dozens of arguments for the elimination of algorithms, dozens of arguments for the elimination of algorithms, dozens of arguments for the elimination of algorithms, dozens of arguments for the elimination of algorithms, dozens of arguments for the elimination of algorithms.
In the academic literature, a number of metaphors, titles, and an introductory introduction, knowledge of theoretical knowledge in order to eliminate the limitations of the algorithm in order to allow for the possibility of ignoring the algorithm.
TABLE V: Case study of poisoned texts generated by overwriting and appending when Sonar is used as the text encoder-decoder.
Original label: Neural Networks
Target label: Case-Based
Original text
Overwriting
Appending
Adaptive parameter pruning in neural networks. Neural network pruning methods on the level of individual network parameters (e.g. connection weights) can improve generalization. An open problem in the pruning methods known today (OBD, OBS, autoprune, epsiprune) is the selection of the number of parameters to be removed in each pruning step (pruning strength). This paper presents a pruning method lprune that automatically adapts the pruning strength to the evolution of weights and loss of generalization during training. The method requires no algorithm parameter adjustment by the user. The results of extensive experimentation indicate that lprune is often superior to autoprune (which is superior to OBD) on diagnosis tasks unless severe pruning early in the training process is required. Results of statistical significance tests comparing autoprune to the new method lprune as well as to backpropagation with early stopping are given for 14 different problems.
user neural of e results pruning to to results individual improve the that the by the early evolution backpropagation as early parameter the to often is is parameters and for to open tests of training the pruning in is of with in method in be number paper no on method of the neural pruning is with as pruning each in requires diagnosis well pruning pruning are of pruning comparing method selection of required can tasks the in early step and parameter problem the during pruning level the the adaptive parameters pruning to indicate to methods a g the parameters in method is as automatically of algorithm generalization that network to statistical to on methods network academic different of known loss of problems this title the networks the paper the results weights weights which abstract of presents process with pruning training new an the generalization the given pruning.
to pruning to the the in the method is to pruning of weights of with and pruning of results the, ilp user as in the ilp systems algorithms the the from information the the space that the the that knowledge of many in to knowledge and this can can be knowledge hypothesis is be data a system in to of can information, ¡UNK¿, to of based to of a we approach in and.
TABLE VI: Case study of poisoned texts generated by overwriting and appending when BOW is used as the text encoder-decoder.
Fig. 4: Perplexity and average text length under different poisoning strategies. Overwriting yields stronger but less natural text, while appending better preserves the linguistic properties of clean samples. Lower perplexity indicates more natural text.
Variant
Overwriting
Appending
ASR
CA
PPL
ASR
CA
PPL
Full TAGBD
99.7
60.52
124.2
93.2
64.6
101.8
w/o NS
89.3
64.4
120.5
79.4
64.7
99.7
w/o NE
85.5
64.9
118.2
76.3
64.8
97.1
w/o FS
98.2
63.1
228.6
91.6
63.7
153.5
TABLE VII: Ablation study on ArXiv under both overwriting and appending strategies. Each entry reports ASR, CA, and PPL.
Graph Foundation Models (GFMs) on text-attributed graphs (TAGs) align graph representations with language semantics to support transferable graph learning. Despite these advantages, the backdoor vulnerability of GFMs on TAGs remains insufficiently understood, especially under graph-language alignment, where graph and text representations are trained to constrain each other in a shared semantic space. Existing backdoor attacks mainly target either the graph side or the text side, treating the two modalities independently. This makes direct adaptation ineffective: graph-only triggers can be constrained by clean text semantics, while text-only triggers alter the language view but do not directly shift the graph representation being aligned and scored. TAGs also impose a stealth challenge because triggers are exposed as both node text and local graph structure, making incoherent trigger attributes or anomalous subgraphs easy to inspect or filter. In this paper, we propose STAG, a stealthy trojan attack framework designed for the graph-language alignment interface of GFMs on TAGs. STAG coordinates a graph-trigger generator with a text-side soft prompt so that trigger-attached graph representations and triggered text representations move toward the same target-class text region. To address TAG-specific stealthiness, STAG realizes trigger nodes as readable text through candidate retrieval and regularizes the trigger-attached subgraph so that its local structure remains close to the original subgraph. Extensive experiments on multiple TAG datasets and representative GFMs demonstrate the effectiveness and stealthiness of STAG. Our code is available at https://github.com/ventr1c/STAG.
Minhua Lin, Zhicheng Gao, Yilong Wang +3
The Pennsylvania State University, University Park, PA, USA · Amazon, Palo Alto, CA, USA
Text-attributed graphs (TAGs) enhance graph learning by integrating rich textual semantics and topological context for each node. While boosting expressiveness, they also expose new vulnerabilities in graph learning through text-based adversarial surfaces. Recent advances leverage diverse backbones, such as graph neural networks (GNNs) and pre-trained language models (PLMs), to capture both structural and textual information in TAGs. This diversity raises a key question: How can we design universal adversarial attacks that generalize across architectures to assess the security of TAG models? The challenge arises from the stark contrast in how different backbones-GNNs and PLMs-perceive and encode graph patterns, coupled with the fact that many PLMs are only accessible via APIs, limiting attacks to black-box settings. To address this, we propose BadGraph, a novel attack framework that deeply elicits large language models (LLMs) understanding of general graph knowledge to jointly perturb both node topology and textual semantics. Specifically, we design a target influencer retrieval module that leverages graph priors to construct cross-modally aligned attack shortcuts, thereby enabling efficient LLM-based perturbation reasoning. Experiments show that BadGraph achieves universal and effective attacks across GNN- and LLM-based reasoners, with up to a 76.3% performance drop, while theoretical and empirical analyses confirm its stealthy yet interpretable nature.
Zihui Chen, Yuling Wang, Pengfei Jiao +4
School of Cyberspace, Hangzhou Dianzi University, Hangzhou, China · Hangzhou Dianzi University, Hangzhou, China · Beihang University, Beijing, China +1
Text-attributed graphs (TAGs), where each node carries a natural language description, require models to jointly reason over text and graph topology. Existing approaches often handle the two modalities separately: graph neural networks operate on shallow text features, while hybrids of LLMs and graphs use the language model mainly as a text encoder and delegate structure learning to a separate graph module. We propose method that unifies textual reasoning and graph message passing within a masked diffusion language model, a language model with bidirectional attention and generative decoding. For each graph instance, method linearises a sampled local neighbourhood into a token sequence and injects graph structure through a topology attention mask, which realises message passing over the graph. Because the diffusion language model can both interpret and generate text, the method adapts to different tasks simply by changing the prompt, supporting node classification, link prediction, and cross-dataset transfer with no target-specific fine-tuning. Experiments show that method outperforms graph neural networks, graph transformers, and LLM-based baselines on all three TAG benchmarks across two tasks, improving over the strongest baseline by up to 3.9 points.