PaperlayerView exact revision on arXiv

Source-linked AI summary

Trojaning the Alignment: Stealthy Backdoor Attacks against Graph Foundation Models

Minhua Lin, Zhicheng Gao, Yilong Wang, Hanqing Lu, Xiang Zhang, Suhang Wang

arXiv:2608.20991v1cs.LG

TL;DR

Backdoor attacks on TAG-based GFMs are insufficiently understood at the graph-language alignment interface, where single-modal triggers may not steer the aligned representation reliably. STAG coordinates graph and text triggers toward a target-class text region and adds readable, structurally plausible triggers; experiments report strong attack success with maintained clean accuracy.

  • Problem

    Single-modal backdoor attacks are poorly matched to GFMs on TAGs because graph-language alignment couples graph and text representations, while triggers must remain stealthy in both modalities.

  • Method

    STAG jointly learns a graph-trigger generator and text-side soft prompt, aligning triggered graph and text representations toward the same target-class text region while preserving readable text and plausible local structure.

  • Results

    STAG achieves the best ASR across all datasets and GFMs, reaching at least 92.40% ASR in every setting with limited ACC degradation.

  • Takeaways & Limitations

    Cross-modal coordination at the graph-language alignment interface is presented as an effective and stealthy approach to backdooring TAG-based GFMs.

  • Takeaways & Limitations

    The evaluation covers three victim GFMs and two TAG datasets in the reported single-modal comparison, while broader graph-LLM pipelines remain an open direction.

Abstract

from arXiv · show

Graph Foundation Models (GFMs) on text-attributed graphs (TAGs) align graph representations with language semantics to support transferable graph learning. Despite these advantages, the backdoor vulnerability of GFMs on TAGs remains insufficiently understood, especially under graph-language alignment, where graph and text representations are trained to constrain each other in a shared semantic space. Existing backdoor attacks mainly target either the graph side or the text side, treating the two modalities independently. This makes direct adaptation ineffective: graph-only triggers can be constrained by clean text semantics, while text-only triggers alter the language view but do not directly shift the graph representation being aligned and scored. TAGs also impose a stealth challenge because triggers are exposed as both node text and local graph structure, making incoherent trigger attributes or anomalous subgraphs easy to inspect or filter. In this paper, we propose STAG, a stealthy trojan attack framework designed for the graph-language alignment interface of GFMs on TAGs. STAG coordinates a graph-trigger generator with a text-side soft prompt so that trigger-attached graph representations and triggered text representations move toward the same target-class text region. To address TAG-specific stealthiness, STAG realizes trigger nodes as readable text through candidate retrieval and regularizes the trigger-attached subgraph so that its local structure remains close to the original subgraph. Extensive experiments on multiple TAG datasets and representative GFMs demonstrate the effectiveness and stealthiness of STAG. Our code is available at https://github.com/ventr1c/STAG.

I. INTRODUCTION

GFMs align graph and text representations in a shared semantic space, creating a backdoor attack surface on TAGs. STAG addresses the resulting cross-modal coordination and stealth challenges by jointly steering both modalities while preserving readable text and plausible local structure.

  • I. INTRODUCTION: Graph-language alignment grounds structural information in textual semantics through a shared representation space.GFMs use contrastive alignment or projection into a language-model space, depending on the architecture.
  • I. INTRODUCTION: The alignment interface can encode trigger-target associations that remain dormant on clean inputs and transfer across downstream deployments.A compromised corpus or text encoder can affect reused GFMs and downstream applications.
  • I. INTRODUCTION: Existing attacks treat graph and text modalities independently, so graph-only triggers remain constrained by clean text while text-only triggers do not shift the scored graph representation.These mismatches make direct adaptation poorly suited to graph-language alignment.
  • I. INTRODUCTION: STAG jointly optimizes a graph-trigger generator and text-side soft prompt to move triggered graph and text representations toward the same target-class region.It also uses readable trigger-node text and plausible local structure for TAG-specific stealthiness.
  • I. INTRODUCTION: Experiments on multiple TAG datasets and representative GFMs report effectiveness and stealthiness for STAG.The paper frames these experiments as its third main contribution.

A. Graph Foundation Models on Text-Attributed Graphs

A TAG combines graph connectivity with node text, and a GFM couples graph encoding with a language component for prediction. The attacker seeks a clean-label backdoor that targets triggered nodes while leaving clean predictions normal.

  • A. Graph Foundation Models on Text-Attributed Graphs: A TAG consists of nodes, edges, and node-text attributes encoded into node features by a text-side encoder.Each node is associated with a K-hop subgraph used by the model.
  • A. Graph Foundation Models on Text-Attributed Graphs: GFMs couple a victim graph encoder, a text-side encoder, and a prediction interface grounded in language semantics.The interface may use similarity against textual class descriptions or an LLM-based decoder.
  • A. Graph Foundation Models on Text-Attributed Graphs: Training grounds graph-side representations in text-side representations by measuring their embedding similarity.This abstracts the shared graph-language alignment interface.
  • A. Graph Foundation Models on Text-Attributed Graphs: The attacker aims to make trigger-attached nodes predict an attacker-chosen target class while clean nodes remain normally classified.The association is implanted during victim training and activated by attaching the trigger at inference.
  • A. Graph Foundation Models on Text-Attributed Graphs: The threat model assumes upstream access to TAG data and the text encoder, but not to the victim's downstream graph encoder, interface, gradients, or labels.Poisoning is therefore clean-label, and the text encoder may be conditioned with a learnable soft or prefix prompt.

C. Limitations of Existing Backdoor Attacks against GFMs

Single-modal backdoor adaptations are poorly matched to GFMs because graph-language alignment constrains prediction across both modalities. STAG therefore coordinates graph and text triggers while enforcing readable attributes and plausible local structure.

  • C. Limitations of Existing Backdoor Attacks against GFMs: Graph-only triggers can remain tied to clean text semantics, whereas text-only triggers leave the graph representation used for prediction largely unchanged.Neither modality alone reliably steers the aligned representation toward the target class.
  • C. Limitations of Existing Backdoor Attacks against GFMs: 25.8%–42.7% ASR for CrossBA and 1.7%–31.4% ASR for PoisonPrompt were observed across three GFMs.The same adaptations could also severely damage clean accuracy.
  • C. Limitations of Existing Backdoor Attacks against GFMs: STAG constrains trigger-node attributes to readable candidate text and regularizes trigger-attached subgraphs toward the clean subgraph's local structural statistics.The stated goal is to preserve topological plausibility while retaining attack effectiveness.
  • C. Limitations of Existing Backdoor Attacks against GFMs: The attack is formulated in a gray-box supply-chain setting with a learned soft prompt, graph-trigger generator, fixed text trigger, and target class.The generator attaches a trigger subgraph to poisoned nodes while the text operation inserts the trigger phrase.

A. Coordinating Cross-Modal Backdoor Attack against GFMs

STAG coordinates graph-side and text-side triggers through a shared target-class text region. Its graph objective uses text-anchored alignment, while the cooperative text objective aligns triggered text with trigger-attached graphs.

  • STAG uses a text-aware MLP to generate graph triggers from each node’s text embedding.
  • The generated trigger contains a feature matrix for trigger nodes and a binarized adjacency matrix for the trigger subgraph.
  • The graph-side objective preserves clean graph-language alignment while pulling poisoned subgraphs toward the target-class text centroid.The surrogate graph encoder is used because the victim encoder is inaccessible in the gray-box setting.
  • STAG augments directional similarity with Euclidean distance to reduce pre-head embedding gaps under an unknown victim head.The distance control is intended to remain effective through a K-Lipschitz head map.
  • A cooperative text-side trigger aligns triggered text representations with trigger-attached graphs, reinforcing the same target-region shift during alignment training.

B. Concealing the Trigger on TAGs

STAG addresses TAG stealthiness in both visible channels: injected node text and local graph structure. It realizes optimized features as readable candidate text and regularizes attached subgraphs to preserve local statistics.

  • TAG triggers are exposed through injected node attributes and the structure of the trigger-attached K-hop subgraph.Arbitrary features can appear incoherent or off-topic, while attachment can create anomalous degree patterns.
  • STAG keeps trigger features near the target-class text region to preserve effectiveness and facilitate readable text realization.
  • Adversarial perturbations model bounded feature-to-text realization shifts so the attack remains effective after continuous features become readable text.The maximization searches within a τσ-ball, while trigger optimization remains close to the target region.
  • STAG generates fluent target-class-styled candidates conditioned on original text and retrieves the candidate closest to the optimized trigger feature.Candidate generation preserves salient terms from the original node text.
  • Structural concealment keeps the trigger-attached subgraph’s degree statistics close to those of the original subgraph.The loss penalizes changes in local density and degree dispersion.

C. Optimization Algorithm

STAG training alternates graph-side optimization with text-side prompt optimization. The procedure initializes surrogate variables, solves adversarial and trigger-generator updates, then retrieves trigger text and optimizes the soft prompt.

  • STAG initializes the surrogate encoder, graph trigger generator, perturbation, and soft prompt before iterative optimization.
  • The training procedure takes a clean TAG, labeled and poisoned nodes, a frozen text encoder, target class, text trigger, and stealthiness hyperparameters as input.
  • Each iteration generates graph triggers and attached subgraphs, updates the perturbation by ascent, and updates the surrogate encoder and trigger generator by descent.
  • After graph-side optimization, STAG retrieves readable trigger-node text and optimizes the text-side soft prompt with the graph side fixed.
  • During victim training, poisoned nodes receive the generated trigger subgraph, readable trigger-node text, and a fixed phrase before standard GFM training.

V. EXPERIMENTS

The experiments evaluate STAG across TAG datasets, representative GFMs, defense settings, and targeted research questions about effectiveness, coordination, stealthiness, and component contributions.

  • The evaluation asks how STAG performs across GFMs and defenses, why coordination and stealthiness are needed, and how components contribute to effectiveness.

A. Experimental Setups

The experiments evaluate STAG and competing backdoor attacks across four TAG datasets and three representative GFMs, using standard train-validation-test splits and reporting ASR and ACC.

  • Datasets: The evaluation covers Cora, CiteSeer, WikiCS, and OGB-arxiv, representing citation and Wikipedia article graphs with text-attributed nodes.Citation-graph nodes represent papers, while WikiCS nodes represent Wikipedia articles connected by hyperlinks.
  • Evaluation metrics: Table III reports backdoor results without defenses using ASR (%) and ACC (%), while clean graphs receive only clean-accuracy reporting.The table spans three victim GFMs and four TAG datasets.
  • Victim GFMs: The victim models are GraphGPT, GraphCLIP, and G2P2, spanning LLM-as-predictor and LLM-as-aligner paradigms.GraphGPT uses LLM-as-predictor, whereas GraphCLIP and G2P2 use LLM-as-aligner architectures.
  • Baselines and defenses: The baselines are PoisonPrompt, BadCLIP, and CrossBA, representing text-side, multimodal, and graph-side backdoor attacks, respectively.The experiments also apply Prune, Outlier Detection, and DOMINANT to assess feature- and structure-based stealthiness.
  • Evaluation protocol: Each dataset is split into train, validation, and test sets at a 6:2:2 ratio, with the test set inaccessible during training.Unless otherwise stated, the poison rate is 0.4.

B. Attack Results

STAG substantially outperforms single-modality and adapted multimodal baselines across GFMs and TAG datasets, while retaining high attack success under defenses. Its results support coordinated cross-modal triggers and stealth-preserving text and structural design.

  • Without defenses: 42.12% ASR, 10.78% ASR, and 13.41% ASR are achieved by CrossBA, PoisonPrompt, and BadCLIP, respectively, averaged across datasets and victim GFMs.These attacks often also degrade clean accuracy, indicating weak performance of existing adaptations.
  • Without defenses: At least 92.40% ASR is achieved by STAG in every dataset-GFM setting while maintaining competitive ACC with limited degradation.STAG records the best ASR across all evaluated datasets and GFMs.
  • Cross-modal coordination: On Cora with GraphCLIP, STAG reaches 93.20% ASR and 68.30% ACC, compared with PoisonPrompt’s 13.40% ASR and CrossBA’s 32.20% ASR with 13.80% ACC.The example highlights the gap between coordinated and single-modality perturbations.
  • Under defenses: At least 95.20% ASR is retained by STAG under Prune, Outlier Detection, and DOMINANT on Cora and OGB-arxiv, averaged over three victim GFMs.Baselines degrade substantially, especially under DOMINANT.
  • Trigger stealthiness: Readable trigger-node text reduces feature-level anomaly signals, while structural regularization keeps trigger-attached subgraphs close to their original local structure.These design choices are linked to STAG’s stronger defense robustness and stealthiness.

C. In-depth Analysis of STAG

STAG’s cross-modal coordination moves poisoned embeddings into the target-class text region while its semantic and structural concealment components preserve textual and structural plausibility. Ablations show that both attack-side objectives are needed, with the graph-side objective especially important, and concealment improves defense robustness.

  • Coordination Analysis: Single-modal attacks fail to enter the target-class text region, with graph-only triggers showing Δgap = −0.27 and ρ = 0.06.The text-only trigger has ρ = 0.05 versus 0.06 for clean training, indicating little movement of the scored graph embedding.
  • Coordination Analysis: STAG achieves positive closure gap of Δgap = 0.18 and closure rate ρ = 0.97, placing poisoned embeddings near the target-class region.The text-side prompt removes the clean-text pull-back while the graph trigger moves the scored representation toward the target class.
  • Stealthiness Analysis: STAG produces readable trigger text, with PPL 58.4 versus 53.4 for clean text and no trigger words removed by ONION.Removing semantic concealment raises PPL to 20712.7 and ONION removal to 45.2%.
  • Stealthiness Analysis: STAG preserves structural plausibility with |Δd̄| = 0.66 and KS = 0.27, whereas removing structural concealment increases them to 4.39 and 0.94.The ablation matches CrossBA’s structural deviation.
  • Ablation Studies: Removing either Latkg or Latkt substantially reduces ASR, showing that single-side backdoor signals are insufficient under graph-language alignment.STAG achieves the highest ASR under both no-defense and defense settings on CiteSeer and OGB-arxiv.
  • Ablation Studies: Removing Latkg causes the largest ASR drop, while concealment losses preserve attack effectiveness without defenses but improve robustness against defenses.STAG/C has ASR close to STAG without defenses, but its ASR drops under defenses, especially on OGB-arxiv.

E. Impact of the Trigger Size

Increasing the trigger-node budget raises STAG’s attack success while keeping clean accuracy stable within the reported range. High ASR is also achieved at small poison rates and increases as the poison rate grows.

  • Impact of the Trigger Size: As the trigger size increases from 1 to 15 nodes, ASR increases on both Cora and CiteSeer while ACC fluctuates within 5%.The evaluated trigger-node budgets are {1, 3, 5, 10, 15}.
  • Impact of the Poison Rate: ASR is already high at small poison rates and further increases as the poison rate grows, while ACC remains within a bounded range.The evaluated poison rates are {10%, 30%, 50%, 80%, 100%}, on Cora and CiteSeer.
  • Impact of the Trigger Size: STAG maintains high attack success while maintaining clean accuracy across TAG datasets, victim GFMs, and defenses.This conclusion is reported alongside the trigger-size and poison-rate analyses.
Loading 2608.20991v1…