{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,8,15]],"date-time":"2025-08-15T00:02:27Z","timestamp":1755216147126,"version":"3.43.0"},"reference-count":45,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2025,8,4]],"date-time":"2025-08-04T00:00:00Z","timestamp":1754265600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2025,8,4]],"date-time":"2025-08-04T00:00:00Z","timestamp":1754265600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Cybersecurity"],"abstract":"<jats:title>Abstract<\/jats:title>\n          <jats:p>Graph Neural Networks (GNNs) have shown excellent performance as a powerful tool on link prediction task. Recent studies have shown that link prediction based on GNNs is vulnerable to backdoor attacks. However, existing backdoor attack methods on link prediction task require modification of the link state, which results in poor stealthiness of the backdoor. To address this issue, a clean-label backdoor attack method on link prediction task (CL-Link) is proposed in this paper. Specifically, CL-Link utilizes subgraphs as backdoor triggers and achieves trigger injection by attaching subgraphs to target links. In order to enhance the stealthiness of the attack, CL-Link attaches the trigger without modifying the original connection state of the target links. Instead, it utilizes the original connection state as the label, thus minimizing disturbances to the dataset. To ensure the effectiveness of the attack, the gradient information of the model and the similarity between the trigger nodes and the nodes in the graph are used to optimize the features of the trigger nodes. Extensive experiments were performed on multiple benchmark datasets (i.e., Cora, Citeseer, and Pubmed), and the proposed method achieved the highest attack success rate of 97.69% with a poisoning rate of only 5%, which validates the effectiveness of our proposed approach.<\/jats:p>","DOI":"10.1186\/s42400-024-00353-2","type":"journal-article","created":{"date-parts":[[2025,8,4]],"date-time":"2025-08-04T01:01:57Z","timestamp":1754269317000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Clean-label backdoor attack on link prediction task"],"prefix":"10.1186","volume":"8","author":[{"given":"Junming","family":"Mo","sequence":"first","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9332-5258","authenticated-orcid":false,"given":"Ming","family":"Xu","sequence":"additional","affiliation":[]},{"given":"Xiaogang","family":"Xing","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2025,8,4]]},"reference":[{"key":"353_CR1","doi-asserted-by":"publisher","first-page":"124650","DOI":"10.1016\/j.physa.2020.124650","volume":"554","author":"AM Abdolhosseini-Qomi","year":"2020","unstructured":"Abdolhosseini-Qomi AM, Yazdani N, Asadpour M (2020) Overlapping communities and the prediction of missing links in multiplex networks. Physica A 554:124650. https:\/\/doi.org\/10.1016\/j.physa.2020.124650","journal-title":"Physica A"},{"key":"353_CR2","unstructured":"Chang H, Rong Y, Xu T, et\u00a0al (2021) Not all low-pass filters are robust in graph convolutional networks. In: Advances in Neural Information Processing Systems, pp 25058\u201325071"},{"key":"353_CR3","doi-asserted-by":"publisher","first-page":"525","DOI":"10.1109\/TNSE.2023.3301673","volume":"11","author":"J Chen","year":"2021","unstructured":"Chen J, Xiong H, Zheng H et al (2021) Dyn-backdoor: backdoor attack on dynamic link prediction. IEEE Trans Netw Sci Eng 11:525\u2013542. https:\/\/doi.org\/10.1109\/TNSE.2023.3301673","journal-title":"IEEE Trans Netw Sci Eng"},{"key":"353_CR4","doi-asserted-by":"publisher","unstructured":"Chen L, Yan N, Zhang B, et\u00a0al (2022) A general backdoor attack to graph neural networks based on explanation method. In: 2022 IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom), pp 759\u2013768, https:\/\/doi.org\/10.1109\/TrustCom56396.2022.00107","DOI":"10.1109\/TrustCom56396.2022.00107"},{"key":"353_CR5","doi-asserted-by":"publisher","unstructured":"Chen Y, Ye Z, Zhao H et al (2023) Feature-based graph backdoor attack in the node classification task. Int J Intell Syst 2023. https:\/\/doi.org\/10.1155\/2023\/5418398","DOI":"10.1155\/2023\/5418398"},{"key":"353_CR6","doi-asserted-by":"publisher","unstructured":"Dadu A, Kumar A, Shakya HK, et\u00a0al (2019) A study of link prediction using deep learning. In: Advanced Informatics for Computing Research, pp 377\u2013385, https:\/\/doi.org\/10.1007\/978-981-13-3140-4_34","DOI":"10.1007\/978-981-13-3140-4_34"},{"key":"353_CR7","doi-asserted-by":"publisher","first-page":"2263","DOI":"10.1145\/3543507.3583392","volume":"2023","author":"E Dai","year":"2023","unstructured":"Dai E, Lin M, Zhang X et al (2023) Unnoticeable backdoor attacks on graph neural networks. Proceed ACM Web Conf 2023:2263\u20132273. https:\/\/doi.org\/10.1145\/3543507.3583392","journal-title":"Proceed ACM Web Conf"},{"key":"353_CR8","doi-asserted-by":"publisher","first-page":"042317","DOI":"10.1103\/PhysRevE.95.042317","volume":"95","author":"C De Bacco","year":"2017","unstructured":"De Bacco C, Power EA, Larremore DB et al (2017) Community detection, link prediction, and layer interdependence in multilayer networks. Phys Rev E 95:042317. https:\/\/doi.org\/10.1103\/PhysRevE.95.042317","journal-title":"Phys Rev E"},{"key":"353_CR9","doi-asserted-by":"publisher","DOI":"10.1186\/s40537-021-00422-0","author":"MV Farashah","year":"2020","unstructured":"Farashah MV, Etebarian A, Azmi R et al (2020) A hybrid recommender system based-on link prediction for movie baskets analysis. J Big Data. https:\/\/doi.org\/10.1186\/s40537-021-00422-0","journal-title":"J Big Data"},{"key":"353_CR10","doi-asserted-by":"publisher","unstructured":"Gao C, Wang X, He X, et\u00a0al (2022) Graph neural networks for recommender system. In: Proceedings of the Fifteenth ACM International Conference on Web Search and Data Mining, pp 1623\u20131625, https:\/\/doi.org\/10.1145\/3488560.3501396","DOI":"10.1145\/3488560.3501396"},{"key":"353_CR11","doi-asserted-by":"publisher","first-page":"109512","DOI":"10.1016\/j.patcog.2023.109512","volume":"139","author":"Y Gao","year":"2023","unstructured":"Gao Y, Li Y, Zhu L et al (2023) Not all samples are born equal: Towards effective clean-label backdoor attacks. Pattern Recogn 139:109512. https:\/\/doi.org\/10.1016\/j.patcog.2023.109512","journal-title":"Pattern Recogn"},{"key":"353_CR12","doi-asserted-by":"publisher","unstructured":"Giles CL, Bollacker KD, Lawrence S (1998) Citeseer: an automatic citation indexing system. In: Proceedings of the Third ACM Conference on Digital Libraries, pp 89\u201398, https:\/\/doi.org\/10.1145\/276675.276685","DOI":"10.1145\/276675.276685"},{"key":"353_CR13","unstructured":"Goodfellow IJ, Pouget-Abadie J, Mirza M, et\u00a0al (2014) Generative adversarial nets. In: Proceedings of the 27th International conference on neural information processing systems, pp 2672\u20132680"},{"issue":"3","key":"353_CR14","doi-asserted-by":"publisher","first-page":"299","DOI":"10.1109\/TKDE.2005.50","volume":"17","author":"J Huang","year":"2005","unstructured":"Huang J, Ling C (2005) Using auc and accuracy in evaluating learning algorithms. IEEE Trans Knowl Data Eng 17(3):299\u2013310. https:\/\/doi.org\/10.1109\/TKDE.2005.50","journal-title":"IEEE Trans Knowl Data Eng"},{"key":"353_CR15","doi-asserted-by":"publisher","unstructured":"Kipf TN, Welling M (2016) Variational graph auto-encoders. https:\/\/doi.org\/10.48550\/arXiv.1611.07308, arXiv:1611.07308","DOI":"10.48550\/arXiv.1611.07308"},{"key":"353_CR16","doi-asserted-by":"publisher","first-page":"1617","DOI":"10.1016\/j.ins.2022.06.075","volume":"607","author":"S Kumar","year":"2022","unstructured":"Kumar S, Mallik A, Khetarpal A et al (2022) Influence maximization in social networks using graph embedding and graph neural network. Inf Sci 607:1617\u20131636. https:\/\/doi.org\/10.1016\/j.ins.2022.06.075","journal-title":"Inf Sci"},{"key":"353_CR17","doi-asserted-by":"publisher","unstructured":"Kurita K, Michel P, Neubig G (2020) Weight poisoning attacks on pretrained models. https:\/\/doi.org\/10.48550\/arXiv.2004.06660, arXiv:2004.06660","DOI":"10.48550\/arXiv.2004.06660"},{"key":"353_CR18","doi-asserted-by":"publisher","unstructured":"Li J, Liao J, Wu R, et\u00a0al (2023) Guard: graph universal adversarial defense. In: Proceedings of the 32nd ACM International Conference on Information and Knowledge Management, pp 1198\u20131207, https:\/\/doi.org\/10.1145\/3583780.3614903","DOI":"10.1145\/3583780.3614903"},{"key":"353_CR19","doi-asserted-by":"publisher","first-page":"109042","DOI":"10.1016\/j.patcog.2022.109042","volume":"133","author":"X Lin","year":"2023","unstructured":"Lin X, Zhou C, Wu J et al (2023) Exploratory adversarial attacks on graph neural networks for semi-supervised node classification. Pattern Recogn 133:109042. https:\/\/doi.org\/10.1016\/j.patcog.2022.109042","journal-title":"Pattern Recogn"},{"key":"353_CR20","doi-asserted-by":"publisher","unstructured":"Liu Y, Ma X, Bailey J, et\u00a0al (2020) Reflection backdoor: A natural backdoor attack on deep neural networks. In: Computer Vision - ECCV 2020: 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part X, p 182-199, https:\/\/doi.org\/10.1007\/978-3-030-58607-2_11","DOI":"10.1007\/978-3-030-58607-2_11"},{"issue":"2","key":"353_CR21","doi-asserted-by":"publisher","first-page":"127","DOI":"10.1023\/A:1009953814988","volume":"3","author":"AK McCallum","year":"2000","unstructured":"McCallum AK, Nigam K, Rennie J et al (2000) Automating the construction of internet portals with machine learning. Inf Retr 3(2):127\u2013163. https:\/\/doi.org\/10.1023\/A:1009953814988","journal-title":"Inf Retr"},{"key":"353_CR22","doi-asserted-by":"publisher","first-page":"104772","DOI":"10.1016\/j.compbiomed.2021.104772","volume":"137","author":"E Nasiri","year":"2021","unstructured":"Nasiri E, Berahmand K, Rostami M et al (2021) A novel link prediction algorithm for protein-protein interaction networks by attributed graph embedding. Comput Biol Med 137:104772. https:\/\/doi.org\/10.1016\/j.compbiomed.2021.104772","journal-title":"Comput Biol Med"},{"key":"353_CR23","doi-asserted-by":"publisher","unstructured":"Ning R, Li J, Xin C, et\u00a0al (2021) Invisible poison: A blackbox clean label backdoor attack to deep neural networks. In: IEEE INFOCOM 2021 - IEEE Conference on Computer Communications, pp 1\u201310, https:\/\/doi.org\/10.1109\/INFOCOM42981.2021.9488902","DOI":"10.1109\/INFOCOM42981.2021.9488902"},{"key":"353_CR24","doi-asserted-by":"publisher","unstructured":"Pan S, Hu R, Long G, et\u00a0al (2018) Adversarially regularized graph autoencoder for graph embedding. In: Proceedings of the Twenty-Seventh International Joint Conference on Artificial Intelligence, IJCAI-18, pp 2609\u20132615, https:\/\/doi.org\/10.24963\/ijcai.2018\/362","DOI":"10.24963\/ijcai.2018\/362"},{"key":"353_CR25","doi-asserted-by":"publisher","unstructured":"Perozzi B, Al-Rfou R, Skiena S (2014) Deepwalk: online learning of social representations. In: Proceedings of the 20th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pp 701\u2013710, https:\/\/doi.org\/10.1145\/2623330.2623732","DOI":"10.1145\/2623330.2623732"},{"issue":"1","key":"353_CR26","doi-asserted-by":"publisher","first-page":"btac759","DOI":"10.1093\/bioinformatics\/btac759","volume":"39","author":"M R\u00e9au","year":"2022","unstructured":"R\u00e9au M, Renaud N, Xue LC et al (2022) Deeprank-gnn: a graph neural network framework to learn patterns in protein-protein interfaces. Bioinformatics 39(1):btac759. https:\/\/doi.org\/10.1093\/bioinformatics\/btac759","journal-title":"Bioinformatics"},{"issue":"3","key":"353_CR27","doi-asserted-by":"publisher","first-page":"93","DOI":"10.1609\/aimag.v29i3.2157","volume":"29","author":"P Sen","year":"2008","unstructured":"Sen P, Namata G, Bilgic M et al (2008) Collective classification in network data. AI Mag 29(3):93\u2013106. https:\/\/doi.org\/10.1609\/aimag.v29i3.2157","journal-title":"AI Mag"},{"key":"353_CR28","doi-asserted-by":"publisher","first-page":"125154","DOI":"10.1016\/j.physa.2020.125154","volume":"560","author":"Z Su","year":"2020","unstructured":"Su Z, Zheng X, Ai J et al (2020) Link prediction in recommender systems based on vector similarity. Physica A 560:125154. https:\/\/doi.org\/10.1016\/j.physa.2020.125154","journal-title":"Physica A"},{"key":"353_CR29","doi-asserted-by":"publisher","unstructured":"Sun X, Li J, Li X, et\u00a0al (2021) A general framework for defending against backdoor attacks via influence graph. https:\/\/doi.org\/10.48550\/arXiv.2111.14309, arXiv:2111.14309","DOI":"10.48550\/arXiv.2111.14309"},{"key":"353_CR30","doi-asserted-by":"publisher","first-page":"673","DOI":"10.1145\/3366423.3380149","volume":"2020","author":"Y Sun","year":"2020","unstructured":"Sun Y, Wang S, Tang X et al (2020) Adversarial attacks on graph neural networks via node injections: a hierarchical reinforcement learning approach. Proceed Web Conf 2020:673\u2013683. https:\/\/doi.org\/10.1145\/3366423.3380149","journal-title":"Proceed Web Conf"},{"key":"353_CR31","doi-asserted-by":"publisher","unstructured":"Truong L, Jones C, Hutchinson B, et\u00a0al (2020) Systematic evaluation of backdoor data poisoning attacks on image classifiers. In: 2020 IEEE\/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW), pp 3422\u20133431, https:\/\/doi.org\/10.1109\/CVPRW50498.2020.00402","DOI":"10.1109\/CVPRW50498.2020.00402"},{"key":"353_CR32","doi-asserted-by":"publisher","unstructured":"Wu H, Wang C, Tyshetskiy Y, et\u00a0al (2019) Adversarial examples for graph data: Deep insights into attack and defense. In: Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence, IJCAI-19, pp 4816\u20134823, https:\/\/doi.org\/10.24963\/ijcai.2019\/669","DOI":"10.24963\/ijcai.2019\/669"},{"key":"353_CR33","doi-asserted-by":"publisher","unstructured":"Wu S, Sun F, Zhang W, et\u00a0al (2022) Graph neural networks in recommender systems: A survey. ACM Comput Surv 55(5). https:\/\/doi.org\/10.1145\/3535101","DOI":"10.1145\/3535101"},{"key":"353_CR34","unstructured":"Xi Z, Pang R, Ji S, et\u00a0al (2021) Graph backdoor. In: 30th USENIX Security Symposium (USENIX Security 21), pp 1523\u20131540"},{"key":"353_CR35","doi-asserted-by":"publisher","first-page":"112433","DOI":"10.1016\/j.knosys.2024.112433","volume":"304","author":"X Xing","year":"2024","unstructured":"Xing X, Xu M, Bai Y et al (2024) A clean-label graph backdoor attack method in node classification task. Knowl-Based Syst 304:112433. https:\/\/doi.org\/10.1016\/j.knosys.2024.112433","journal-title":"Knowl-Based Syst"},{"key":"353_CR36","doi-asserted-by":"publisher","unstructured":"Xu H, Xiang L, Yu J, et\u00a0al (2021) Speedup robust graph structure learning with low-rank information. In: Proceedings of the 30th ACM International Conference on Information & Knowledge Management, pp 2241\u20132250, https:\/\/doi.org\/10.1145\/3459637.3482299","DOI":"10.1145\/3459637.3482299"},{"key":"353_CR37","doi-asserted-by":"publisher","unstructured":"Xu J, Picek S (2022) Poster: Clean-label backdoor attack on graph neural networks. In: Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, pp 3491\u20133493, https:\/\/doi.org\/10.1145\/3548606.3563531","DOI":"10.1145\/3548606.3563531"},{"key":"353_CR38","doi-asserted-by":"publisher","unstructured":"Yang S, Doan BG, Montague P, et\u00a0al (2022) Transferable graph backdoor attack. In: Proceedings of the 25th International Symposium on Research in Attacks, Intrusions and Defenses, pp 321\u2013332, https:\/\/doi.org\/10.1145\/3545948.3545976","DOI":"10.1145\/3545948.3545976"},{"key":"353_CR39","doi-asserted-by":"publisher","unstructured":"Zeng Y, Pan M, Just HA, et\u00a0al (2023) Narcissus: A practical clean-label backdoor attack with limited information. In: Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, CCS \u201923, p 771\u2013785, https:\/\/doi.org\/10.1145\/3576915.3616617","DOI":"10.1145\/3576915.3616617"},{"key":"353_CR40","unstructured":"Zhang M, Chen Y (2018) Link prediction based on graph neural networks. In: Proceedings of the 32nd International Conference on Neural Information Processing Systems, pp 5171\u20135181"},{"key":"353_CR41","unstructured":"Zhang X, Zitnik M (2020) Gnnguard: defending graph neural networks against adversarial attacks. In: Proceedings of the 34th International Conference on Neural Information Processing Systems"},{"key":"353_CR42","doi-asserted-by":"publisher","unstructured":"Zhang Z, Jia J, Wang B, et\u00a0al (2021) Backdoor attacks to graph neural networks. In: Proceedings of the 26th ACM Symposium on Access Control Models and Technologies, pp 15\u201326, https:\/\/doi.org\/10.1145\/3450569.3463560","DOI":"10.1145\/3450569.3463560"},{"issue":"7","key":"353_CR43","doi-asserted-by":"publisher","first-page":"12102","DOI":"10.1109\/JIOT.2023.3332848","volume":"11","author":"X Zhao","year":"2024","unstructured":"Zhao X, Wu H, Zhang X (2024) Effective backdoor attack on graph neural networks in spectral domain. IEEE Int Things J 11(7):12102\u201312114. https:\/\/doi.org\/10.1109\/JIOT.2023.3332848","journal-title":"IEEE Int Things J"},{"issue":"2","key":"353_CR44","doi-asserted-by":"publisher","first-page":"1816","DOI":"10.1109\/TCSS.2023.3260833","volume":"11","author":"H Zheng","year":"2024","unstructured":"Zheng H, Xiong H, Ma H et al (2024) Link-backdoor: Backdoor attack on link prediction via node injection. IEEE Trans Comput Soc Syst 11(2):1816\u20131831. https:\/\/doi.org\/10.1109\/TCSS.2023.3260833","journal-title":"IEEE Trans Comput Soc Syst"},{"key":"353_CR45","doi-asserted-by":"publisher","unstructured":"Zou X, Zheng Q, Dong Y, et\u00a0al (2021) Tdgia: Effective injection attacks on graph neural networks. In: Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining, pp 2461\u20132471, https:\/\/doi.org\/10.1145\/3447548.3467314","DOI":"10.1145\/3447548.3467314"}],"container-title":["Cybersecurity"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-024-00353-2.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1186\/s42400-024-00353-2\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-024-00353-2.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,4]],"date-time":"2025-08-04T01:02:01Z","timestamp":1754269321000},"score":1,"resource":{"primary":{"URL":"https:\/\/cybersecurity.springeropen.com\/articles\/10.1186\/s42400-024-00353-2"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,8,4]]},"references-count":45,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2025,12]]}},"alternative-id":["353"],"URL":"https:\/\/doi.org\/10.1186\/s42400-024-00353-2","relation":{},"ISSN":["2523-3246"],"issn-type":[{"type":"electronic","value":"2523-3246"}],"subject":[],"published":{"date-parts":[[2025,8,4]]},"assertion":[{"value":"25 June 2024","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"17 December 2024","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"4 August 2025","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declaration"}},{"value":"The authors declare\nthat they have no competing interests.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Competing interests"}}],"article-number":"51"}}