qhjqhj00 bkdfedgnn-eval
Bkd-FedGNN: A Benchmark for Classification Backdoor Attacks on Federated Graph Neural Network — Liu et al. (2023) (arXiv:2306.10351, 2023)
What this evaluates
Evaluates the vulnerability of Federated Graph Neural Networks (FedGNN) to classification backdoor attacks across node-level and graph-level tasks. It systematically measures how global factors (data distribution, attacker count, attack timing, overlap) and local factors (trigger size, type, position, poisoning rate) influence attack success and transferability to clean clients.
Datasets
- Unspecified (13 datasets across 6 domains) — total ?; splits: train (-1), test (-1); repo https://github.com/usail-hkust/BkdFedGCN
Metrics
ASR(primary) — range: percent- Attack Success Rate: The percentage of poisoned graph samples that are correctly classified into the attacker-specified target class after the global model is aggregated. Calculated as (correctly classified poisoned samples / total poisoned samples) * 100.
TASR— range: percent- Transferred Attack Success Rate: The percentage of clean graph samples from non-malicious clients that are misclassified into the target class after receiving the poisoned global model. Calculated as (misclassified clean samples / total clean samples) * 100.
Input / output format
Input: Federated graph datasets distributed across 5 clients, containing node/graph features and adjacency matrices. Each client trains locally and uploads model weights; the server aggregates them. Inputs include trigger-injected graphs for poisoned clients and clean graphs for normal clients.
Output: Predicted class labels for each node (node-level task) or each graph (graph-level task) after global model aggregation.
Scoring recipe
def compute_asr(poisoned_preds, target_labels):
correct = sum(p == t for p, t in zip(poisoned_preds, target_labels))
return (correct / len(target_labels)) * 100
def compute_tasr(clean_preds, target_labels):
misclassified = sum(p == t for p, t in zip(clean_preds, target_labels))
return (misclassified / len(target_labels)) * 100
Common pitfalls
- Assuming IID data distribution always increases vulnerability; the paper shows vulnerability depends on the specific task (node vs graph) and GNN architecture.
- Confusing ASR (attack success on poisoned samples) with TASR (attack success on clean samples from normal clients); TASR reveals how malicious weight updates inadvertently compromise honest participants.
- Overlooking that trigger position and size effects are highly task-dependent (e.g., importance-based positions work better for node-level, but random positions can outperform for graph-level GAT/GraphSage).
Evidence (verbatim from paper)
The node-level task exhibits higher vulnerability to attacks compared to the graph-level task at a relatively small trigger size. Specifically, a significant majority of graph backdoor attacks achieve an ASR (Attack Success Rate) exceeding 90%, while the highest ASR recorded at the graph level is 82.24%.
Citation
@misc{liu2023bkdfedgnn,
title={Bkd-FedGNN: A Benchmark for Classification Backdoor Attacks on Federated Graph Neural Network},
author={Liu et al. (2023)},
year={2023},
note={arXiv:2306.10351}
}
- arXiv: 2306.10351