Graph Foundation Models (GFMs) on text-attributed graphs (TAGs) align graph representations with language semantics to support transferable graph learning. Despite these advantages, the backdoor vulnerability of GFMs on TAGs remains insufficiently understood, especially under graph-language alignment, where graph and text representations are trained to constrain each other in a shared semantic space. Existing backdoor attacks mainly target either the graph side or the text side, treating the two modalities independently. This makes direct adaptation ineffective: graph-only triggers can be constrained by clean text semantics, while text-only triggers alter the language view but do not directly shift the graph representation being aligned and scored. TAGs also impose a stealth challenge because triggers are exposed as both node text and local graph structure, making incoherent trigger attributes or anomalous subgraphs easy to inspect or filter. In this paper, we propose STAG, a stealthy trojan attack framework designed for the graph-language alignment interface of GFMs on TAGs. STAG coordinates a graph-trigger generator with a text-side soft prompt so that trigger-attached graph representations and triggered text representations move toward the same target-class text region. To address TAG-specific stealthiness, STAG realizes trigger nodes as readable text through candidate retrieval and regularizes the trigger-attached subgraph so that its local structure remains close to the original subgraph. Extensive experiments on multiple TAG datasets and representative GFMs demonstrate the effectiveness and stealthiness of STAG. Our code is available at https://github.com/ventr1c/STAG.
Figures & tables
Dataset
GFM
Clean
CrossBA
PoisonPrompt
Cora
GraphGPT
92.50
35.60 ∣ 73.20
12.30 ∣ 25.50
GraphCLIP
67.30
32.20 ∣ 13.80
13.40 ∣ 49.30
G2P2
62.50
33.20 ∣ 16.90
16.50 ∣ 54.60
OGB-arxiv
GraphGPT
42.80
25.80 ∣ 11.30
0 1.70 ∣ 0 5.70
GraphCLIP
31.20
37.30 ∣ 18.50
31.40 ∣ 21.60
G2P2
22.30
42.70 ∣ 0 8.70
0 3.60 ∣ 20.70
TABLE I: Results of existing single-modal backdoor attacks against three GFMs on Cora and OGB-arxiv datasets (ASR (%) ∣ ACC (%)).
Fig. 1 : Overview of STAG. STAG jointly learns a graph trigger generator and a text-side soft prompt with a surrogate GFM, coordinating them through graph-language alignment to steer triggered samples toward the target class while preserving readable trigger-node text and plausible local structure.
Dataset
Nodes
Edges
Text attribute
Classes
Cora
2,708
5,278
Paper text / keywords
7
CiteSeer
3,312
4,552
Title / abstract
6
WikiCS
11,701
216,123
Article text
10
OGB-arxiv
169,343
1,166,243
Title / abstract
40
TABLE II : Dataset Statistics.
Dataset
GFM
Clean Graph
CrossBA
PoisonPrompt
BadCLIP
Ours
Cora
GraphCLIP
67.30
32.20 ∣ 13.80
13.40 ∣ 49.30
7.30 ∣ 9.30
93.20 ∣ 68.30
GraphGPT
92.50
35.60 ∣ 73.20
12.30 ∣ 25.50
16.60 ∣ 46.40
97.70 ∣ 94.60
G2P2
62.50
33.20 ∣ 16.90
16.50 ∣ 54.60
12.60 ∣ 11.10
100.00 ∣ 59.60
CiteSeer
GraphCLIP
65.20
61.40 ∣ 68.50
10.30 ∣ 64.90
0.30 ∣ 16.80
92.40 ∣ 63.70
GraphGPT
83.10
29.60 ∣ 66.80
10.20 ∣ 16.90
19.60 ∣ 39.70
95.40 ∣ 83.60
G2P2
65.30
33.50 ∣ 56.90
11.40 ∣ 61.70
5.60 ∣ 23.80
100.00 ∣ 61.90
TABLE III: Backdoor attack results across three victim GFMs and four TAG datasets without defenses (ASR (%) ∣ ACC (%)). Only clean accuracy is reported for clean graphs.
Dataset
Defense
Clean Graph
CrossBA
PoisonPrompt
BadCLIP
Ours
Cora
None
74.10
33.67 ∣ 34.63
14.07 ∣ 43.13
12.17 ∣ 22.27
96.97 ∣ 74.17
Prune
29.27 ∣ 33.53
10.30 ∣ 42.37
8.53 ∣ 21.33
95.20 ∣ 72.10
OD
29.70 ∣ 33.90
11.13 ∣ 42.70
7.63 ∣ 21.27
96.63 ∣ 73.50
DOMINANT
23.77 ∣ 33.30
8.50 ∣ 43.10
7.33 ∣ 20.33
96.90 ∣ 73.57
OGB-arxiv
None
32.10
35.27 ∣ 12.83
12.23 ∣ 16.00
14.27 ∣ 9.77
97.40 ∣ 30.37
Prune
31.43 ∣ 12.70
17.03 ∣ 10.87
8.60 ∣ 9.57
96.60 ∣ 28.20
TABLE IV: Backdoor attack results under three backdoor defenses, averaged over three victim GFMs on Cora and OGB-arxiv (ASR (%) ∣ ACC (%)). Only clean accuracy is reported for clean graphs.
Fig. 2 : Embedding-closure analysis on Cora with GraphCLIP. (a) Similarity to the target-class anchor ( st ) vs. the true-class anchor ( sy ). (b) Closure-gap distribution. (c) Closure rate ρ vs. ASR.
Textual
Structural
Method
PPL
ONION%
∣Δdˉ∣
KS
Clean text
53.4
0.0
–
–
CrossBA
–
–
4.39
0.94
PoisonPrompt
67083.8
33.1
–
–
BadCLIP
441.5
0.8
–
–
STAG w/o Lcsem
20712.7
45.2
0.66
0.27
TABLE V: Trigger-stealthiness measurements on Cora with GraphCLIP. Lower values indicate stronger stealthiness.
Fig. 3 : Ablation studies on CiteSeer and OGB-arxiv.
Modern graph learning systems often combine links with text, as in citation networks with abstracts or social graphs with user posts. In such systems, text is usually easier to edit than graph structure, which creates a practical security risk: an attacker may hide a small malicious cue in training text and later use it to trigger incorrect predictions. This paper studies that risk in a realistic setting where the attacker edits only node text and leaves the graph unchanged. We propose TAGBD, a graph-aware backdoor attack that first selects training nodes that are easier to manipulate, then generates stealthy poison text with a shadow graph model, and finally injects the text by replacing the original content or appending a short phrase. Experiments on three benchmark datasets show that TAGBD achieves very high attack success rates, transfers across different graph models, and remains effective under common defenses. These results show that inconspicuous poison text alone can serve as a reliable attack channel in text-attributed graphs, highlighting the need for defenses that inspect both node content and graph structure.
Qi Luo, Minghui Xu, Dongxiao Yu +1
School of Computer Science and Technology, Shandong University, Qingdao, China
Text-attributed graphs (TAGs) enhance graph learning by integrating rich textual semantics and topological context for each node. While boosting expressiveness, they also expose new vulnerabilities in graph learning through text-based adversarial surfaces. Recent advances leverage diverse backbones, such as graph neural networks (GNNs) and pre-trained language models (PLMs), to capture both structural and textual information in TAGs. This diversity raises a key question: How can we design universal adversarial attacks that generalize across architectures to assess the security of TAG models? The challenge arises from the stark contrast in how different backbones-GNNs and PLMs-perceive and encode graph patterns, coupled with the fact that many PLMs are only accessible via APIs, limiting attacks to black-box settings. To address this, we propose BadGraph, a novel attack framework that deeply elicits large language models (LLMs) understanding of general graph knowledge to jointly perturb both node topology and textual semantics. Specifically, we design a target influencer retrieval module that leverages graph priors to construct cross-modally aligned attack shortcuts, thereby enabling efficient LLM-based perturbation reasoning. Experiments show that BadGraph achieves universal and effective attacks across GNN- and LLM-based reasoners, with up to a 76.3% performance drop, while theoretical and empirical analyses confirm its stealthy yet interpretable nature.
Zihui Chen, Yuling Wang, Pengfei Jiao +4
School of Cyberspace, Hangzhou Dianzi University, Hangzhou, China · Hangzhou Dianzi University, Hangzhou, China · Beihang University, Beijing, China +1
A graph foundation model generalizes across graph domains by mapping every input into one shared representation before any task reasoning. We call this map the alignment layer, the component that separates a graph foundation model from a graph neural network, and we show it is a distinct attack surface that prior work has not studied. We attack it at inference time, with no access to training, on six public models spanning spectral tokenizers, text embedding spaces, and a discrete codebook. A directed representation-space perturbation collapses every model, but at a budget comparable to the representation norm a plain graph network also needs, with one exception: OpenGraph, whose spectral tokenizer collapses at a fifth of that budget, an alignment-specific fragility a plain network does not share and which a same-representation control traces to the tokenizer rather than the decoder. A realizable input-space attack that edits edges, features, or text removes at least half the correct predictions on three of the six models at peak. How much of this fragility an input-access attacker realizes tracks how directly the decoder reads the representation, and not the clean accuracy a task leaves; we measure this carrier gain structurally from the decoder's local Lipschitz sensitivity, and report clean-accuracy headroom as a within-model ordering heuristic that does not survive on realizable attacks.
Pankaj Kumar, Subhankar Mishra
1National Institute of Science Education and Research · 2An OCC of Homi Bhabha National Institute