2025· Neural Information Processing Systems· 4 citations· 36 references
Computer Science
TL;DR
LoSplit is proposed, the first training-time defense framework in graph that leverages this early-stage loss drift to accurately split target nodes, and dynamically selects epochs with maximal loss divergence, clusters target nodes via Gaussian Mixture Models, and applies a Decoupling-Forgetting strategy to break the association between target nodes and malicious label.
Abstract
Graph Neural Networks (GNNs) are vulnerable to backdoor attacks. Existing defenses primarily rely on detecting structural anomalies, distributional outliers, or perturbation-induced prediction instability, which struggle to handle the more subtle, feature-based attacks that do not introduce obvious topological changes. Our empirical analysis reveals that both structure-based and feature-based attacks not only cause early loss convergence of target nodes but also induce a class-coherent loss drift, where this early convergence gradually spreads to nearby clean nodes, leading to significant distribution overlap. To address this issue, we propose LoSplit , the first training-time defense framework in graph that leverages this early-stage loss drift to accurately split target nodes. Our method dynamically selects epochs with maximal loss divergence, clusters target nodes via Gaussian Mixture Models (GMM), and applies a Decoupling-Forgetting strategy to break the association between target nodes and malicious label. Extensive experiments on multiple real-world datasets demonstrate the effectiveness of our approach, significantly reducing attack success rates while maintaining high clean accuracy across diverse backdoor attack strategies. Our code is available at: github.com/zyx924768045/LoSplit.
A graph embedding-based error detection method via contrastive learning that treats each triple as a hyper-node, enabling data-driven modeling of semantic consistency and integrates a semantic matching-based scoring mechanism with a contrastive learning-based scoring mechanism.
Gaojun Shan, Liping Cong, Xiaohong Sun et al.· International journal of sof...· 0 citations
Machine-learning services increasingly rely on public data, third-party providers, and outsourced training, creating opportunities for data-poisoning attacks that implant persistent malicious behavior while preserving benign utility. However, existing backdoor studies largely evaluate exact trigger reuse, training-exposed trigger diversity, or variations along predefined transformation axes. They therefore leave a critical blind spot: whether a backdoor learned from one training-time trigger can generalize to an inference-time trigger family absent from victim training. We formulate this problem as backdoor generalization under training--inference trigger shift and introduce Lilith, a black-box anchor-to-family framework. Using only disjoint surrogate resources, Lilith first induces a compact target-side vulnerability with a single training anchor, then constructs a bounded inference-only family that preserves the anchor-induced representation geometry. We characterize this mechanism through anchor clearance and family reach, deriving sufficient conditions for family-wise target preservation under local regularity and bounded surrogate--victim discrepancy. Experiments across datasets, architectures, poisoning rates, and defenses show that Lilith achieves high family-wise attack success with limited utility degradation and a small trigger generalization gap. Additional analyses show that family activation depends on representation alignment rather than the proposal mechanism, exposing a broader threat overlooked by exact-trigger evaluation.
Zhou Feng, Jiahao Chen, Chunyi Zhou et al.· 0 citations
Split Learning (SL) enables edge-cloud training by dividing models between clients and the server, but it is vulnerable to backdoor attacks in which malicious clients inject triggers through intermediate activations. Existing defenses in Federated Learning cannot be applied directly due to SL’s sequential training and limited access to data. We propose ECS-Guard (Energy-Centroid-Shape Guard), a lightweight online detection framework that monitors server-side logits using energy distance, centroid shift, and ellipticity analysis to identify abnormal distributions caused by backdoors. Our method detects malicious clients early, blocks their contributions, and preserves model accuracy under both IID and non-IID settings. On CIFAR-10 with VGG16, we evaluate on Jetson Nano devices for both IID and non-IID, showing that ECS-Guard effectively neutralizes pixel-trigger and semantic backdoor attacks while maintaining high accuracy. Specifically, the final Attack Success Rate will drop below 5% in most cases, while preserving the main accuracy relative to vanilla SL. This demonstrates the feasibility of practical and secure Split Learning through insitu monitoring.
Ma Viet Duc, Dao Bich Thuong, D. Tran et al.· IEEE International Conferenc...· 0 citations
This work reveals that backdoor behaviors tend to be absorbed by a simpler parallel branch when jointly trained with the main network, and proposes Trapping and Removing (TR), a simple yet effective training-time defense that introduces a lightweight shortcut branch as a "honeypot" to trap backdoor knowledge.
Zixuan Zhu, Rui Wang, Lihua Jing et al.· 0 citations
An active paradigm that repurposes the offensive tactic of node injection into a structural defense, ANIE significantly enhances GNN robustness, outperforming state-of-the-art defenses by up to 2× in classification accuracy under poisoning and evasion attacks.
Xiangchao Wen, Zhen Liu, Yunfei Liu· Proceedings of the 32nd ACM...· 0 citations