Stealthy Backdoor Attacks on Graph Neural Networks via Relational Constraint Modeling

Abstract

Graph Neural Networks (GNNs) have achieved significant success in tasks like node and graph classification, yet they remain vulnerable to backdoor attacks. Traditional attack methods often rely on node feature manipulation, neglecting the structural relationships within graphs, which makes their triggers more detectable. To address this limitation, we propose a Relationally Constrained Conditional GAN Backdoor Attack (RCCBA). Our method employs a hybrid expert model that combines diverse graph neural network architectures to capture both feature and structural information, thus enabling more robust trigger node selection via a centrality-based rule that identifies nodes with minimal impact on neighboring nodes. Additionally, relationship constraints ensure that the triggers generated by the conditional GAN closely mimic the original graph, enhancing imperceptible and attack success. Experimental results demonstrate that RCCBA achieves an average attack success rate exceeding 90% with a minimal poisoning rate of less than 0.1%, and successfully circumvents pruning-based and outlier detection defenses. The real-world implications of this work are significant for domains such as social networks, recommendation systems, and fraud detection, and our findings highlight the need for future defense strategies that address both feature and structural vulnerabilities in GNN security.