{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,1]],"date-time":"2026-04-01T18:17:22Z","timestamp":1775067442548,"version":"3.50.1"},"reference-count":44,"publisher":"MDPI AG","issue":"5","license":[{"start":{"date-parts":[[2025,5,10]],"date-time":"2025-05-10T00:00:00Z","timestamp":1746835200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62262004"],"award-info":[{"award-number":["62262004"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Symmetry"],"abstract":"<jats:p>Graph neural networks (GNNs) have exhibited remarkable performance in various applications. Still, research has revealed their vulnerability to backdoor attacks, where Adversaries inject malicious patterns during the training phase to establish a relationship between backdoor patterns and a specific target label, thereby manipulating the behavior of poisoned GNNs. The inherent symmetry present in the behavior of GNNs can be leveraged to strengthen the robustness of GNNs. This paper presents a quantitative metric, termed Logit Margin Rate (LMR), for analyzing the symmetric properties of the output landscapes across GNN layers. Additionally, a learning paradigm of graph self-distillation is combined with LMR to distill the symmetry knowledge from shallow layers, which can serve as the defensive supervision signals to preserve the benign symmetric relationships in deep layers, thus improving both model stability and adversarial robustness. Experiments were conducted on four benchmark datasets to evaluate the robustness of the proposed Graph Self-Distillation-based Backdoor Defense (GSD-BD) method against three widely used backdoor attack algorithms, demonstrating the robustness of GSD-BD even under severe infection scenarios.<\/jats:p>","DOI":"10.3390\/sym17050735","type":"journal-article","created":{"date-parts":[[2025,5,13]],"date-time":"2025-05-13T03:59:26Z","timestamp":1747108766000},"page":"735","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":2,"title":["Defending Graph Neural Networks Against Backdoor Attacks via Symmetry-Aware Graph Self-Distillation"],"prefix":"10.3390","volume":"17","author":[{"given":"Hanlin","family":"Wang","sequence":"first","affiliation":[{"name":"State Key Laboratory of Public Big Data, Guizhou University, Guizhou 555025, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7677-8471","authenticated-orcid":false,"given":"Liang","family":"Wan","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Public Big Data, Guizhou University, Guizhou 555025, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xiao","family":"Yang","sequence":"additional","affiliation":[{"name":"Northeast Asia Studies College, Jilin University, Changchun 130012, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2025,5,10]]},"reference":[{"key":"ref_1","unstructured":"Kipf, T.N., and Welling, M. (2017, January 24\u201326). Semi-Supervised Classification with Graph Convolutional Networks. Proceedings of the International Conference on Learning Representations, Toulon, France."},{"key":"ref_2","unstructured":"Hamilton, W., Ying, Z., and Leskovec, J. (2017, January 4\u20139). Inductive representation learning on large graphs. Proceedings of the Advances in Neural Information Processing Systems 30, Long Beach, CA, USA."},{"key":"ref_3","unstructured":"Xu, K., Hu, W., Leskovec, J., and Jegelka, S. (2019, January 6\u20139). How Powerful are Graph Neural Networks?. Proceedings of the International Conference on Learning Representations, New Orleans, LA, USA."},{"key":"ref_4","unstructured":"Velickovic, P., Cucurull, G., Casanova, A., Romero, A., Lio, P., and Bengio, Y. (2017). Graph attention networks. arXiv."},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Qiu, J., Tang, J., Ma, H., Dong, Y., Wang, K., and Tang, J. (2018, January 19\u201323). Deepinf: Social influence prediction with deep learning. Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, London, UK.","DOI":"10.1145\/3219819.3220077"},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"111","DOI":"10.6339\/22-JDS1047","article-title":"A Review on Graph Neural Network Methods in Financial Applications","volume":"20","author":"Wang","year":"2022","journal-title":"J. Data Sci."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"595","DOI":"10.1007\/s10822-016-9938-8","article-title":"Molecular graph convolutions: Moving beyond fingerprints","volume":"30","author":"Kearnes","year":"2016","journal-title":"J. Comput.-Aided Mol. Des."},{"key":"ref_8","unstructured":"Hu, W., Liu, B., Gomes, J., Zitnik, M., Liang, P., Pande, V., and Leskovec, J. (2020, January 26\u201330). Strategies For Pre-training Graph Neural Networks. Proceedings of the International Conference on Learning Representations (ICLR), Addis Ababa, Ethiopia."},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Hu, Z., Dong, Y., Wang, K., Chang, K.W., and Sun, Y. (2020, January 6\u201310). Gpt-gnn: Generative pre-training of graph neural networks. Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, Virtual.","DOI":"10.1145\/3394486.3403237"},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1007\/s10115-018-1235-5","article-title":"Overview of the crowdsourcing process","volume":"60","author":"Nassar","year":"2019","journal-title":"Knowl. Inf. Syst."},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Zhang, Z., Jia, J., Wang, B., and Gong, N.Z. (2021, January 16\u201318). Backdoor attacks to graph neural networks. Proceedings of the 26th ACM Symposium on Access Control Models and Technologies, Virtual.","DOI":"10.1145\/3450569.3463560"},{"key":"ref_12","unstructured":"Xu, J., Xue, M., and Picek, S. (2019, January 15\u201317). Explainability-based backdoor attacks against graph neural networks. Proceedings of the 3rd ACM Workshop on Wireless Security and Machine Learning, Miami, FL, USA."},{"key":"ref_13","unstructured":"Xi, Z., Pang, R., Ji, S., and Wang, T. (2021, January 11\u201313). Graph backdoor. Proceedings of the 30th USENIX Security Symposium (USENIX Security 21), Virtual."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"2479","DOI":"10.1109\/TCSS.2023.3267094","article-title":"Motif-backdoor: Rethinking the backdoor attack on graph neural networks via motifs","volume":"11","author":"Zheng","year":"2023","journal-title":"IEEE Trans. Comput. Soc. Syst."},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Dai, E., Lin, M., Zhang, X., and Wang, S. (May, January 30). Unnoticeable backdoor attacks on graph neural networks. Proceedings of the ACM Web Conference 2023, Austin, TX, USA.","DOI":"10.1145\/3543507.3583392"},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Wang, B., Yao, Y., Shan, S., Li, H., Viswanath, B., Zheng, H., and Zhao, B.Y. (2019, January 19\u201323). Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. Proceedings of the 2019 IEEE Symposium on Security and Privacy (SP), San Francisco, CA, USA.","DOI":"10.1109\/SP.2019.00031"},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Liu, Y., Lee, W.C., Tao, G., Ma, S., Aafer, Y., and Zhang, X. (2019, January 11\u201315). Abs: Scanning neural networks for back-doors by artificial brain stimulation. Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, London, UK.","DOI":"10.1145\/3319535.3363216"},{"key":"ref_18","unstructured":"Li, Y., Lyu, X., Koren, N., Lyu, L., Li, B., and Ma, X. (2021, January 3\u20137). Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networks. Proceedings of the International Conference on Learning Representations, Virtual."},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"1177","DOI":"10.1109\/TNNLS.2020.3041202","article-title":"Detection of backdoors in trained classifiers without access to the training set","volume":"33","author":"Xiang","year":"2020","journal-title":"IEEE Trans. Neural Netw. Learn. Syst."},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Wang, H., Xiang, Z., Miller, D.J., and Kesidis, G. (2024, January 19\u201323). Mm-bd: Post-training detection of backdoor attacks with arbitrary backdoor pattern types using a maximum margin statistic. Proceedings of the 2024 IEEE Symposium on Security and Privacy (SP), San Francisco, CA, USA.","DOI":"10.1109\/SP54263.2024.00015"},{"key":"ref_21","unstructured":"Jiang, B., and Li, Z. (2022). Defending against backdoor attack on graph nerual network by explainability. arXiv."},{"key":"ref_22","unstructured":"Sui, H., Chen, B., Zhang, J., Zhu, C., Wu, D., Lu, Q., and Long, G. (2024). DMGNN: Detecting and Mitigating Backdoor Attacks in Graph Neural Networks. arXiv."},{"key":"ref_23","unstructured":"Hinton, G. (2015). Distilling the Knowledge in a Neural Network. arXiv."},{"key":"ref_24","first-page":"4539","article-title":"Ccgl: Contrastive cascade graph learning","volume":"35","author":"Xu","year":"2022","journal-title":"IEEE Trans. Knowl. Data Eng."},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Feng, K., Li, C., Yuan, Y., and Wang, G. (2022, January 14\u201318). Freekd: Free-direction knowledge distillation for graph neural networks. Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, Washington, DC, USA.","DOI":"10.1145\/3534678.3539320"},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Yan, B., Wang, C., Guo, G., and Lou, Y. (2020, January 6\u201310). Tinygnn: Learning efficient graph neural networks. Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, Virtual.","DOI":"10.1145\/3394486.3403236"},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Chen, Y., Bian, Y., Xiao, X., Rong, Y., Xu, T., and Huang, J. (2020). On self-distilling graph neural network. arXiv.","DOI":"10.24963\/ijcai.2021\/314"},{"key":"ref_28","unstructured":"Li, G., Xiong, C., Thabet, A., and Ghanem, B. (2020). Deepergcn: All you need to train deeper gcns. arXiv."},{"key":"ref_29","first-page":"9727","article-title":"Effective backdoor defense by exploiting sensitivity of poisoned samples","volume":"35","author":"Chen","year":"2022","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Yang, Y., Qiu, J., Song, M., Tao, D., and Wang, X. (2020, January 13\u201319). Distilling knowledge from graph convolutional networks. Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, Seattle, WA, USA.","DOI":"10.1109\/CVPR42600.2020.00710"},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"4656","DOI":"10.1109\/TNNLS.2022.3223018","article-title":"On representation knowledge distillation for graph neural networks","volume":"35","author":"Joshi","year":"2022","journal-title":"IEEE Trans. Neural Netw. Learn. Syst."},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Yang, C., Liu, J., and Shi, C. (2021, January 19\u201423). Extract the knowledge of graph neural networks and go beyond it: An effective knowledge distillation framework. Proceedings of the Web Conference 2021, Virtual.","DOI":"10.1145\/3442381.3450068"},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"4375","DOI":"10.1109\/TKDE.2024.3374773","article-title":"A Teacher-Free Graph Knowledge Distillation Framework with Dual Self-Distillation","volume":"36","author":"Wu","year":"2024","journal-title":"IEEE Trans. Knowl. Data Eng."},{"key":"ref_34","doi-asserted-by":"crossref","first-page":"106097","DOI":"10.1016\/j.neunet.2024.106097","article-title":"Explanatory subgraph attacks against Graph Neural Networks","volume":"172","author":"Wang","year":"2024","journal-title":"Neural Netw."},{"key":"ref_35","unstructured":"Zeng, Y., Chen, S., Park, W., Mao, Z., Jin, M., and Jia, R. (2022, January 25\u201329). Adversarial Unlearning of Backdoors via Implicit Hypergradient. Proceedings of the International Conference on Learning Representations, Virtual."},{"key":"ref_36","doi-asserted-by":"crossref","unstructured":"Liu, K., Dolan-Gavitt, B., and Garg, S. (2018). Fine-pruning: Defending against backdooring attacks on deep neural networks. International Symposium on Research in Attacks, Intrusions, and Defenses, Springer.","DOI":"10.1007\/978-3-030-00470-5_13"},{"key":"ref_37","unstructured":"Guo, W., Wang, L., Xing, X., Du, M., and Song, D. (2019). Tabor: A highly accurate approach to inspecting and restoring trojan backdoors in ai systems. arXiv."},{"key":"ref_38","doi-asserted-by":"crossref","unstructured":"Yang, X., Li, G., Tao, X., Zhang, C., and Li, J. (2023). Black-Box Graph Backdoor Defense. International Conference on Algorithms and Architectures for Parallel Processing, Springer.","DOI":"10.1007\/978-981-97-0808-6_10"},{"key":"ref_39","doi-asserted-by":"crossref","unstructured":"Rossi, R., and Ahmed, N. (2015, January 25\u201330). The network data repository with interactive graph analytics and visualization. Proceedings of the AAAI Conference on Artificial Intelligence, Austin, TX, USA.","DOI":"10.1609\/aaai.v29i1.9277"},{"key":"ref_40","doi-asserted-by":"crossref","first-page":"i47","DOI":"10.1093\/bioinformatics\/bti1007","article-title":"Protein function prediction via graph kernels","volume":"21","author":"Borgwardt","year":"2005","journal-title":"Bioinformatics"},{"key":"ref_41","unstructured":"Weber, M., Domeniconi, G., Chen, J., Weidele, D.K.I., Bellei, C., Robinson, T., and Leiserson, C. (2019, January 4\u20138). Anti-Money Laundering in Bitcoin: Experimenting with Graph Convolutional Networks for Financial Forensics. Proceedings of the ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, Anchorage, AK, USA."},{"key":"ref_42","first-page":"2539","article-title":"Weisfeiler-lehman graph kernels","volume":"12","author":"Shervashidze","year":"2011","journal-title":"J. Mach. Learn. Res."},{"key":"ref_43","doi-asserted-by":"crossref","first-page":"577","DOI":"10.1109\/TNSE.2021.3127557","article-title":"GraphAttacker: A general multi-task graph attack framework","volume":"9","author":"Chen","year":"2021","journal-title":"IEEE Trans. Netw. Sci. Eng."},{"key":"ref_44","doi-asserted-by":"crossref","first-page":"618","DOI":"10.1109\/TCSS.2020.3042628","article-title":"Smoothing adversarial training for GNN","volume":"8","author":"Chen","year":"2020","journal-title":"IEEE Trans. Comput. Soc. Syst."}],"container-title":["Symmetry"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2073-8994\/17\/5\/735\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,9]],"date-time":"2025-10-09T17:30:28Z","timestamp":1760031028000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2073-8994\/17\/5\/735"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,5,10]]},"references-count":44,"journal-issue":{"issue":"5","published-online":{"date-parts":[[2025,5]]}},"alternative-id":["sym17050735"],"URL":"https:\/\/doi.org\/10.3390\/sym17050735","relation":{},"ISSN":["2073-8994"],"issn-type":[{"value":"2073-8994","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,5,10]]}}}