Backdoor attacks in the traditional graph neural networks (GNNs) field are
easily detectable due to the dilemma of confusing labels. To explore the
backdoor vulnerability of GNNs and create a more stealthy backdoor attack
method, a clean-label graph backdoor attack method(CGBA) in the node
classification task is proposed in this paper. Differently from existing
backdoor attack methods, CGBA requires neither modification of node labels nor
graph structure. Specifically, to solve the problem of inconsistency between
the contents and labels of the samples, CGBA selects poisoning samples in a
specific target class and uses the label of sample as the target label (i.e.,
clean-label) after injecting triggers into the target samples. To guarantee the
similarity of neighboring nodes, the raw features of the nodes are elaborately
picked as triggers to further improve the concealment of the triggers.
Extensive experiments results show the effectiveness of our method. When the
poisoning rate is 0.04, CGBA can achieve an average attack success rate of
87.8%, 98.9%, 89.1%, and 98.5%, respectively.

传统图神经网络领域中的后门攻击因混淆的标签而容易被检测，为了探索图神经网络的后门漏洞并创建更隐秘的后门攻击方法，本文提出了一种基于无干扰节点分类任务的干净标签图后门攻击方法（CGBA）。与已有的后门攻击方法不同，CGBA 既不需要修改节点标签也不需要修改图结构。具体而言，为了解决样本内容与标签不一致的问题，CGBA 在特定目标类中选择污染样本，并将样本的标签（即干净标签）作为目标标签注入到目标样本中。为了保证相邻节点的相似性，CGBA 精心选择节点的原始特征作为触发器，进一步提高触发器的隐蔽性。广泛实验结果表明我们的方法的有效性。当污染率为 0.04 时，CGBA 可以分别实现 87.8%、98.9%、89.1% 和 98.5% 的平均攻击成功率。