Feature-Based Graph Backdoor Attack in the Node Classification Task

Table 2

Comparison of the ASR and CAD of a backdoor attack. ASR represents the success rate of classifying poisoned nodes into target classes, and the larger ASR is better. CAD represents the difference between clean GCN and backdoor GCN, and the smaller CAD is better.

Dataset	ASR					CAD
	RSA	NFTA-wo	NFTA	NFTA-D	NFTA-BW	RSA	NFTA-wo	NFTA	NFTA-D	NFTA-BW
Polblogs
= 1	74.11	72.98	75.83	85.42	83.33	2.63	4.91	1.47	2.97	2.19
= 2	82.12	70.83	85.42	87.62	86.86	3.46	6.12	2.01	4.41	3.30
Citeseer
= 1	80.64	73.06	82.14	98.81	82.86	5.13	8.31	2.51	4.05	3.98
= 2	89.12	79.29	90.48	97.62	90.48	5.15	7.93	2.77	4.48	3.89
= 3	81.02	77.38	83.33	97.67	88.29	5.45	7.51	3.11	5.65	2.04
= 4	84.66	79.76	85.71	97.62	92.86	4.97	8.17	3.41	4.42	3.53
= 5	84.15	83.33	89.29	93.48	90.52	5.45	9.24	2.66	4.55	5.24
= 6	87.37	75.00	90.48	96.43	91.43	5.64	6.85	4.50	5.69	3.44
Blogcatalog
= 1	88.64	71.31	91.30	90.82	91.79	3.91	6.15	−3.08	2.11	3.55
= 2	85.46	70.12	87.44	94.20	94.69	3.64	5.56	−2.42	1.44	2.03
= 3	89.13	70.05	92.14	96.14	92.34	3.11	5.02	−4.23	2.28	2.86
= 4	84.24	72.13	88.41	95.44	90.67	5.06	6.06	−0.03	1.76	3.94
= 5	85.79	69.97	90.69	95.75	93.86	4.18	5.34	0.26	3.56	3.81
= 6	88.48	71.16	90.34	94.20	92.82	3.51	5.48	−0.09	2.29	1.04

Important experimental results are bolded.