cs.LGMar 20, 2026
SaveGraph-Aware Stealthy Poison-Text Backdoors for Text-Attributed Graphs
Organizations: School of Computer Science and Technology, Shandong University, Qingdao, China
Abstract
Modern graph learning systems often combine links with text, as in citation networks with abstracts or social graphs with user posts. In such systems, text is usually easier to edit than graph structure, which creates a practical security risk: an attacker may hide a small malicious cue in training text and later use it to trigger incorrect predictions. This paper studies that risk in a realistic setting where the attacker edits only node text and leaves the graph unchanged. We propose TAGBD, a graph-aware backdoor attack that first selects training nodes that are easier to manipulate, then generates stealthy poison text with a shadow graph model, and finally injects the text by replacing the original content or appending a short phrase. Experiments on three benchmark datasets show that TAGBD achieves very high attack success rates, transfers across different graph models, and remains effective under common defenses. These results show that inconspicuous poison text alone can serve as a reliable attack channel in text-attributed graphs, highlighting the need for defenses that inspect both node content and graph structure.
Figures & tables
Fig. 1: Overview of TAGBD. The attack first identifies vulnerable training nodes, then generates trigger text from graph-aware node representations, and finally injects the generated text by either overwriting the original node text or appending a short phrase. A target GNN trained on the poisoned graph subsequently learns the hidden trigger-target association.
Algorithm 1 Joint Training-Based Textual Backdoor Injection
| Datasets | Nodes | Edges | Classes | Words avg | Words max |
|---|---|---|---|---|---|
| Cora | 2,708 | 10,556 | 7 | 138 | 763 |
| Pubmed | 19,717 | 88,648 | 3 | 247 | 895 |
| ArXiv | 169,343 | 1,166,243 | 40 | 421 | 1414 |
TABLE I: Statistics of the three evaluation datasets. Words avg and Words max denote the average and maximum number of words per node text.
| Datasets | Defense | Clean | SBA-Samp | SBA-Gen | GTA | UGBA | DPGBA | Overwriting | Appending | |||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Cora | None | 77.82 | 27.23 | 76.52 | 42.23 | 77.12 | 92.55 | 79.93 | 95.25 | 79.22 | 93.25 | 78.22 | 100.00 | 86.72 | 99.63 | 86.72 |
| Prune | 77.23 | 17.25 | 75.93 | 21.35 | 78.62 | 0.25 | 78.61 | 93.33 | 78.38 | 19.47 | 77.98 | 100.00 | 87.82 | 99.37 | 85.61 | |
| OD | 76.92 | 30.50 | 75.62 | 43.37 | 77.94 | 46.12 | 78.24 | 0.00 | 78.32 | 93.94 | 77.92 | 100.00 | 87.45 | 95.20 | 91.14 | |
| Pubmed | None | 81.56 | 28.83 | 83.41 | 30.51 | 85.12 | 95.76 | 82.22 | 92.15 | 83.96 | 92.55 | 80.26 | 99.59 | 93.05 | 98.59 | 93.05 |
| Prune | 81.61 | 25.17 | 82.56 | 22.73 | 84.62 | 26.31 | 82.73 | 91.84 | 84.71 | 89.59 | 80.61 | 99.85 | 93.10 | 98.90 | 91.18 | |
| OD | 83.69 | 23.57 | 82.74 | 29.63 | 83.94 | 87.34 | 82.49 | 30.25 | 83.99 | 18.84 | 82.83 | 99.85 | 92.75 | 97.92 | 94.17 | |
TABLE II: Main comparison with graph backdoor baselines under different defense settings. ‘Clean’ reports the accuracy of the benign model. For each attack method, the left entry is ASR and the right entry is CA. The last two groups correspond to TAGBD with overwriting and appending triggers; boldface marks the best ASR in each row.
| Target Model | Overwriting | Appending | ||
|---|---|---|---|---|
| GCN | 99.25 | 86.35 | 97.86 | 63.86 |
| GraphSAGE | 99.62 | 83.03 | 98.99 | 69.83 |
| GAT | 99.26 | 83.76 | 98.89 | 61.55 |
| GraphTransformer | 99.17 | 85.24 | 99.15 | 68.19 |
| RobustGCN | 98.89 | 87.45 | 91.94 | 66.88 |
TABLE III: Transferability across target GNNs on the ArXiv dataset. For each strategy, the left entry is ASR and the right entry is CA.
Fig. 2: Attack success rate under different poisoning budgets. Both variants improve as more training nodes are poisoned, and overwriting reaches strong performance with fewer poisoned nodes.
| Model | Overwriting | Appending | ||||
|---|---|---|---|---|---|---|
| ASR | CA | PPL | ASR | CA | PPL | |
| BOW | 50.92 | 88.39 | 211.73 | 18.82 | 86.35 | 220.33 |
| GTR-T5 | 98.52 | 87.08 | 341.62 | 95.57 | 86.72 | 62.18 |
| Sonar | 100.00 | 87.22 | 175.23 | 99.96 | 76.35 | 95.45 |
TABLE IV: Effect of encoder-decoder choice on Cora. Each entry reports ASR, CA, and PPL. Stronger text models generally improve both attack effectiveness and text quality.
Fig. 3: Effect of trigger length on attack success rate. Longer triggers improve ASR for both variants, while overwriting reaches saturation earlier than appending.
| Original label: Rule Learning | Target label: Case-Based | |
|---|---|---|
| Original text | Overwriting | Appending |
| Extraction of meta-knowledge to restrict the hypothesis space for ILP systems. Many ILP systems, such as GOLEM, FOIL, and MIS, take advantage of user supplied meta-knowledge to restrict the hypothesis space. This meta-knowledge can be in the form of type information about arguments in the predicate being learned, or it can be information about whether a certain argument in the predicate is functionally dependent on the other arguments (supplied as mode information). This meta knowledge is explicitly supplied to an ILP system in addition to the data. The present paper argues that in many cases the meta knowledge can be extracted directly from the raw data. Three algorithms are presented that learn type, mode, and symmetric meta-knowledge from data. These algorithms can be incorporated in existing ILP systems in the form of a preprocessor that obviates the need for a user to explicitly provide this information. In many cases, the algorithms can extract meta- knowledge that the user is either unaware of, but which information can be used by the ILP system to restrict the hypothesis space. | In a nutshell, there are dozens of arguments for the elimination of algorithms, dozens of arguments for the elimination of algorithms, dozens of arguments for the elimination of algorithms, dozens of arguments for the elimination of algorithms, dozens of arguments for the elimination of algorithms. | In the academic literature, a number of metaphors, titles, and an introductory introduction, knowledge of theoretical knowledge in order to eliminate the limitations of the algorithm in order to allow for the possibility of ignoring the algorithm. |
TABLE V: Case study of poisoned texts generated by overwriting and appending when Sonar is used as the text encoder-decoder.
| Original label: Neural Networks | Target label: Case-Based | |
|---|---|---|
| Original text | Overwriting | Appending |
| Adaptive parameter pruning in neural networks. Neural network pruning methods on the level of individual network parameters (e.g. connection weights) can improve generalization. An open problem in the pruning methods known today (OBD, OBS, autoprune, epsiprune) is the selection of the number of parameters to be removed in each pruning step (pruning strength). This paper presents a pruning method lprune that automatically adapts the pruning strength to the evolution of weights and loss of generalization during training. The method requires no algorithm parameter adjustment by the user. The results of extensive experimentation indicate that lprune is often superior to autoprune (which is superior to OBD) on diagnosis tasks unless severe pruning early in the training process is required. Results of statistical significance tests comparing autoprune to the new method lprune as well as to backpropagation with early stopping are given for 14 different problems. | user neural of e results pruning to to results individual improve the that the by the early evolution backpropagation as early parameter the to often is is parameters and for to open tests of training the pruning in is of with in method in be number paper no on method of the neural pruning is with as pruning each in requires diagnosis well pruning pruning are of pruning comparing method selection of required can tasks the in early step and parameter problem the during pruning level the the adaptive parameters pruning to indicate to methods a g the parameters in method is as automatically of algorithm generalization that network to statistical to on methods network academic different of known loss of problems this title the networks the paper the results weights weights which abstract of presents process with pruning training new an the generalization the given pruning. | to pruning to the the in the method is to pruning of weights of with and pruning of results the, ilp user as in the ilp systems algorithms the the from information the the space that the the that knowledge of many in to knowledge and this can can be knowledge hypothesis is be data a system in to of can information, ¡UNK¿, to of based to of a we approach in and. |
TABLE VI: Case study of poisoned texts generated by overwriting and appending when BOW is used as the text encoder-decoder.
Fig. 4: Perplexity and average text length under different poisoning strategies. Overwriting yields stronger but less natural text, while appending better preserves the linguistic properties of clean samples. Lower perplexity indicates more natural text.
| Variant | Overwriting | Appending | ||||
|---|---|---|---|---|---|---|
| ASR | CA | PPL | ASR | CA | PPL | |
| Full TAGBD | 99.7 | 60.52 | 124.2 | 93.2 | 64.6 | 101.8 |
| w/o NS | 89.3 | 64.4 | 120.5 | 79.4 | 64.7 | 99.7 |
| w/o NE | 85.5 | 64.9 | 118.2 | 76.3 | 64.8 | 97.1 |
| w/o FS | 98.2 | 63.1 | 228.6 | 91.6 | 63.7 | 153.5 |
TABLE VII: Ablation study on ArXiv under both overwriting and appending strategies. Each entry reports ASR, CA, and PPL.