A Clean-Graph Backdoor Attack Against Graph Convolutional Networks with Poisoned Label Only

Graph Convolutional Networks (GCNs) have achieved exceptional results in solving various tasks involving graph-based data. However, recent studies have exposed their vulnerability to backdoor attacks. Current backdoor attack strategies within the graph processing field typically require modifications to the training data in order to implant backdoors. This constraint limits their practical applicability in real-world scenarios where attackers cannot alter the training samples. To explore the backdoor weaknesses of GCNs and propose a more feasible and practical attack strategy, this paper presents a novel clean-graph backdoor attack against GCNs (CBAG) in node classification tasks. CBAG focuses solely on poisoning the training labels, without modifying the training samples, thus highlighting a critical security vulnerability within GCNs. In particular, CBAG uses an innovative method to identify key features for constructing trigger patterns, thereby improving the effectiveness of the attack. By poisoning the labels, a concealed backdoor is embedded in the GCN model. Experimental results demonstrate that the clean-graph backdoor attack achieves an attack success rate as high as 99% while maintaining the model's performance on clean data.