{"id":"https://openalex.org/W7138794089","doi":"https://doi.org/10.1609/aaai.v40i29.39593","title":"Towards Effective, Stealthy, and Persistent Backdoor Attacks Targeting Graph Foundation Models","display_name":"Towards Effective, Stealthy, and Persistent Backdoor Attacks Targeting Graph Foundation Models","publication_year":2026,"publication_date":"2026-03-14","ids":{"openalex":"https://openalex.org/W7138794089","doi":"https://doi.org/10.1609/aaai.v40i29.39593"},"language":"en","primary_location":{"id":"doi:10.1609/aaai.v40i29.39593","is_oa":true,"landing_page_url":"https://doi.org/10.1609/aaai.v40i29.39593","pdf_url":null,"source":{"id":"https://openalex.org/S4210191458","display_name":"Proceedings of the AAAI Conference on Artificial Intelligence","issn_l":"2159-5399","issn":["2159-5399","2374-3468"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/P4310320058","host_organization_name":"Association for the Advancement of Artificial Intelligence","host_organization_lineage":["https://openalex.org/P4310320058"],"host_organization_lineage_names":["Association for the Advancement of Artificial Intelligence"],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the AAAI Conference on Artificial Intelligence","raw_type":"journal-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://doi.org/10.1609/aaai.v40i29.39593","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5129689729","display_name":"Jiayi Luo","orcid":null},"institutions":[{"id":"https://openalex.org/I82880672","display_name":"Beihang University","ror":"https://ror.org/00wk2mp56","country_code":"CN","type":"education","lineage":["https://openalex.org/I82880672"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jiayi Luo","raw_affiliation_strings":["Beihang University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Beihang University","institution_ids":["https://openalex.org/I82880672"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5129741834","display_name":"Qingyun Sun","orcid":null},"institutions":[{"id":"https://openalex.org/I82880672","display_name":"Beihang University","ror":"https://ror.org/00wk2mp56","country_code":"CN","type":"education","lineage":["https://openalex.org/I82880672"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Qingyun Sun","raw_affiliation_strings":["Beihang University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Beihang University","institution_ids":["https://openalex.org/I82880672"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5129656874","display_name":"Lingjuan Lyu","orcid":null},"institutions":[{"id":"https://openalex.org/I2800278093","display_name":"Sony Corporation (United States)","ror":"https://ror.org/05k91zb11","country_code":"US","type":"company","lineage":["https://openalex.org/I2800278093"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Lingjuan Lyu","raw_affiliation_strings":["Sony"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Sony","institution_ids":["https://openalex.org/I2800278093"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5129729285","display_name":"Ziwei Zhang","orcid":null},"institutions":[{"id":"https://openalex.org/I82880672","display_name":"Beihang University","ror":"https://ror.org/00wk2mp56","country_code":"CN","type":"education","lineage":["https://openalex.org/I82880672"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Ziwei Zhang","raw_affiliation_strings":["Beihang University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Beihang University","institution_ids":["https://openalex.org/I82880672"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5006798194","display_name":"Haonan Yuan","orcid":"https://orcid.org/0000-0001-9205-8610"},"institutions":[{"id":"https://openalex.org/I82880672","display_name":"Beihang University","ror":"https://ror.org/00wk2mp56","country_code":"CN","type":"education","lineage":["https://openalex.org/I82880672"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Haonan Yuan","raw_affiliation_strings":["Beihang University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Beihang University","institution_ids":["https://openalex.org/I82880672"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5044043709","display_name":"Xingcheng Fu","orcid":"https://orcid.org/0000-0002-4643-8126"},"institutions":[{"id":"https://openalex.org/I29739308","display_name":"Guangxi Normal University","ror":"https://ror.org/02frt9q65","country_code":"CN","type":"education","lineage":["https://openalex.org/I29739308"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xingcheng Fu","raw_affiliation_strings":["Guangxi Normal University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Guangxi Normal University","institution_ids":["https://openalex.org/I29739308"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5129696336","display_name":"Jianxin Li","orcid":null},"institutions":[{"id":"https://openalex.org/I82880672","display_name":"Beihang University","ror":"https://ror.org/00wk2mp56","country_code":"CN","type":"education","lineage":["https://openalex.org/I82880672"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jianxin Li","raw_affiliation_strings":["Beihang University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Beihang University","institution_ids":["https://openalex.org/I82880672"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":21.2894,"has_fulltext":false,"cited_by_count":1,"citation_normalized_percentile":{"value":0.97919991,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":94,"max":97},"biblio":{"volume":"40","issue":"29","first_page":"24142","last_page":"24150"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11273","display_name":"Advanced Graph Neural Networks","score":0.9739000201225281,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11273","display_name":"Advanced Graph Neural Networks","score":0.9739000201225281,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.010099999606609344,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12026","display_name":"Explainable Artificial Intelligence (XAI)","score":0.002400000113993883,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/backdoor","display_name":"Backdoor","score":0.9983000159263611},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.4106000065803528},{"id":"https://openalex.org/keywords/generalization","display_name":"Generalization","score":0.37540000677108765},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.3578999936580658},{"id":"https://openalex.org/keywords/downstream","display_name":"Downstream (manufacturing)","score":0.351500004529953}],"concepts":[{"id":"https://openalex.org/C2781045450","wikidata":"https://www.wikidata.org/wiki/Q254569","display_name":"Backdoor","level":2,"score":0.9983000159263611},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6607999801635742},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4726000130176544},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.4106000065803528},{"id":"https://openalex.org/C177148314","wikidata":"https://www.wikidata.org/wiki/Q170084","display_name":"Generalization","level":2,"score":0.37540000677108765},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.3578999936580658},{"id":"https://openalex.org/C2776207758","wikidata":"https://www.wikidata.org/wiki/Q5303302","display_name":"Downstream (manufacturing)","level":2,"score":0.351500004529953},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.31929999589920044},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.3172999918460846},{"id":"https://openalex.org/C2780966255","wikidata":"https://www.wikidata.org/wiki/Q5474306","display_name":"Foundation (evidence)","level":2,"score":0.301800012588501}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1609/aaai.v40i29.39593","is_oa":true,"landing_page_url":"https://doi.org/10.1609/aaai.v40i29.39593","pdf_url":null,"source":{"id":"https://openalex.org/S4210191458","display_name":"Proceedings of the AAAI Conference on Artificial Intelligence","issn_l":"2159-5399","issn":["2159-5399","2374-3468"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/P4310320058","host_organization_name":"Association for the Advancement of Artificial Intelligence","host_organization_lineage":["https://openalex.org/P4310320058"],"host_organization_lineage_names":["Association for the Advancement of Artificial Intelligence"],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the AAAI Conference on Artificial Intelligence","raw_type":"journal-article"},{"id":"pmh:oai:ojs.aaai.org:article/39593","is_oa":false,"landing_page_url":"https://ojs.aaai.org/index.php/AAAI/article/view/39593","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"2159-5399","raw_type":"info:eu-repo/semantics/article"}],"best_oa_location":{"id":"doi:10.1609/aaai.v40i29.39593","is_oa":true,"landing_page_url":"https://doi.org/10.1609/aaai.v40i29.39593","pdf_url":null,"source":{"id":"https://openalex.org/S4210191458","display_name":"Proceedings of the AAAI Conference on Artificial Intelligence","issn_l":"2159-5399","issn":["2159-5399","2374-3468"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/P4310320058","host_organization_name":"Association for the Advancement of Artificial Intelligence","host_organization_lineage":["https://openalex.org/P4310320058"],"host_organization_lineage_names":["Association for the Advancement of Artificial Intelligence"],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the AAAI Conference on Artificial Intelligence","raw_type":"journal-article"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16","score":0.646556556224823}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Graph":[0,127],"Foundation":[1,128],"Models":[2],"(GFMs)":[3],"are":[4],"pre-trained":[5],"on":[6],"diverse":[7],"source":[8],"domains":[9,95],"and":[10,214],"adapted":[11],"to":[12,32,61,143,157,196],"unseen":[13],"targets,":[14],"enabling":[15],"broad":[16],"generalization":[17],"for":[18,152],"graph":[19],"machine":[20],"learning.":[21],"Despite":[22],"that":[23,79,99,139,191],"GFMs":[24,57],"have":[25],"attracted":[26],"considerable":[27],"attention":[28],"recently,":[29],"their":[30],"vulnerability":[31],"backdoor":[33,43,54,108,159,188,195,204],"attacks":[34,55],"remains":[35,100],"largely":[36],"underexplored.":[37],"A":[38],"compromised":[39],"GFM":[40],"can":[41],"introduce":[42,163],"behaviors":[44,109],"into":[45,84],"downstream":[46,72,155,206],"applications,":[47],"posing":[48],"serious":[49],"security":[50],"risks.":[51],"However,":[52],"launching":[53],"against":[56,126],"is":[58],"non-trivial":[59],"due":[60],"three":[62],"key":[63],"challenges.":[64],"(1)":[65],"Effectiveness:":[66],"Attackers":[67],"lack":[68],"knowledge":[69,153],"of":[70,146,175,202,216],"the":[71,77,141,150,173,181,194,200,203,211],"task":[73],"during":[74],"pre-training,":[75],"complicating":[76],"assurance":[78],"triggers":[80],"reliably":[81,179],"induce":[82],"misclassifications":[83],"desired":[85],"classes.":[86],"(2)":[87],"Stealthiness:":[88],"The":[89],"variability":[90],"in":[91],"node":[92],"features":[93],"across":[94],"complicates":[96],"trigger":[97,136,142,166,176],"insertion":[98],"stealthy.":[101],"(3)":[102],"Persistence:":[103],"Downstream":[104],"fine-tuning":[105],"may":[106],"erase":[107],"by":[110],"updating":[111],"model":[112,125],"parameters.":[113],"To":[114],"address":[115],"these":[116],"challenges,":[117],"we":[118,131,162,184],"propose":[119],"GFM-BA,":[120],"a":[121,134,144,164,186],"novel":[122],"Backdoor":[123],"Attack":[124],"Models.":[129],"Specifically,":[130],"first":[132],"design":[133],"label-free":[135],"association":[137],"module":[138,190],"links":[140],"set":[145],"prototype":[147],"embeddings,":[148],"eliminating":[149],"need":[151],"about":[154],"tasks":[156],"perform":[158],"injection.":[160],"Then,":[161],"node-adaptive":[165],"generator,":[167],"dynamically":[168],"producing":[169],"node-specific":[170],"triggers,":[171],"reducing":[172],"risk":[174],"detection":[177],"while":[178],"activating":[180],"backdoor.":[182],"Lastly,":[183],"develop":[185],"persistent":[187],"anchoring":[189],"firmly":[192],"anchors":[193],"fine-tuning-insensitive":[197],"parameters,":[198],"enhancing":[199],"persistence":[201,215],"under":[205],"adaptation.":[207],"Extensive":[208],"experiments":[209],"demonstrate":[210],"effectiveness,":[212],"stealthiness,":[213],"GFM-BA.":[217]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2026-03-18T00:00:00"}