Feature-Based Graph Backdoor Attack in the Node Classification Task

Algorithm 1

Node feature trigger-based graph backdoor attack (NFTA).

	Input: Clean graph , budget , original graph node adjacency matrix , number of update
	Output: Poisoned graph with reconstruction
	Initialization parameter ;
	Generate a trigger ;
	Embed the trigger into the node to obtain ;
	while do
	argmin
	where
	end
	if then
	while do
	Randomly selected node pair where
	end
	end