A Label-Poisoned Subgraph Backdoor Attack against Graph Convolutional Networks

Graph Convolutional Networks (GCNs) have shown exceptional capability in handling graph-structured data and have been widely adopted across various domains. However, recent studies have revealed their vulnerability to backdoor attacks, posing significant security threats to graph-based learning systems. Existing subgraph-based backdoor attacks typically rely on either handcrafted or adaptive trigger subgraphs, which are embedded into training samples by altering their graph structures. Such structural modifications often lead to noticeable anomalies, making poisoned samples more likely to be detected by defense mechanisms.In this paper, we rethink the subgraph backdoor attack paradigm and propose a novel Label-Poisoned Subgraph Backdoor Attack (LPSBA) against GCNs. In contrast to previous approaches, LPSBA leverages naturally occurring subgraph structures as triggers and implants backdoors solely by modifying the labels of selected samples, without altering their original graph structures. This design maintains the structural properties of the poisoned samples, which greatly improves the attack’s stealthiness. Extensive experiments conducted on benchmark datasets demonstrate the effectiveness of LPSBA, achieving high attack success rates while maintaining almost unchanged performance on clean samples.