Black-Box Graph Backdoor Defense

Recently, graph neural networks (GNNs) have been proven to be vulnerable to backdoor attacks, wherein the test prediction of the model is manipulated by poisoning the training dataset with trigger-embedded malicious samples during learning. Current defense methods against GNN backdoor are not practical due to their requirement for access to the GNN parameters and training samples. To address this issue, we present a Black-box GNN Backdoor Defense strategy, BloGBaD, that eliminates the backdoor without model parameter information and training dataset. Specifically, BloGBaD involves two primary phases: 1) test sample filtration, which identifies toxic graph nodes via the Gaussian mixture model and purifies their trigger features through clustering and filtration; and 2) model fine-tuning, which fine-tunes the model to a backdoor-free state by a loss function with a penalty regularization for poisoned features. We demonstrate the effectiveness of our method through extensive experiments on various datasets and attack algorithms under the assumption of black-box conditions.