Rethinking Molecular Graph Backdoors under Chemistry-aware Admission

Unknown

Conceptio › Archive › arXiv CS

arXiv CSopen access

Rethinking Molecular Graph Backdoors under Chemistry-aware Admission

Unknown · 2026 · arxiv_cs

arXiv CS · Papers · License: Open Access · 2026

Open Source ↗Direct PDF ↓

artificialintelligence knowledgerepresentation reasoning

artificial intelligence, reasoning, knowledge representation

arXiv:2606.23361v1 [cs.LG] 22 Jun 2026

Rethinking Molecular Graph Backdoors under Chemistry-aware Admission

Thinh T. H. Nguyen1 , Sze Jue Yang2 , Khoa D. Doan1 , Chee Seng Chan1,2 , Kok-Seng Wong1∗ 1 VinUniversity, Hanoi, Vietnam, 2 Universiti Malaya [email protected], [email protected], [email protected], [email protected], [email protected]

Abstract Backdoor attacks on molecular graph neural networks (GNNs) are typically evaluated as abstract graph edits, but real molecular learning pipelines do not train on arbitrary graphs. Molecular records must first survive parsing, sanitization, canonicalization, and graph-string consistency checks. We formalize this overlooked admission stage as ChemGuard, an operational protocol for testing whether a submitted molecular record can enter a realistic learning pipeline, while complementing existing defenses. ChemGuard admits a record only when its molecular string is sanitizable and the graph reconstructed from that string matches the submitted molecular graph. Under this operational view, many existing graph-based backdoors lose much of their apparent efficacy because their poisons are chemically invalid or representation-inconsistent. We then show that admission checks alone are insufficient to rule out molecular backdoors. We propose ChemBack, an admission-aware molecular backdoor attack that constructs chemically feasible motif-anchor attachments and ranks admitted candidates by fingerprint-based Tanimoto similarity to clean target-class molecules. ChemBack is model-free during trigger selection, using molecular structures, target labels, fingerprints, and public validity checks, but no victim model, surrogate GNN, learned embedding, gradient, logit, or training-code access. Across molecular benchmarks, validators, architectures, and defenses, ChemBack achieves high attack success with fully admitted poisons while preserving clean accuracy. Our results reveal a two-sided lesson, chemistry-aware admission suppresses many graph-only backdoors, yet chemically valid and target-aligned molecular backdoors remain a practical threat.

Introduction

Molecular Graph Neural Networks (GNNs) are widely used for molecular property prediction, drug discovery, and materials science [1–4]. Recent studies [5–7] show that molecular GNNs are vulnerable to backdoor attacks, where an adversary poisons a small fraction of training data with a trigger pattern and assigns the poisoned samples to a target label. At inference time, clean molecules are classified normally, while triggered molecules are pushed toward the attacker-specified label. Such attacks raise security concerns for molecular prediction systems in chemical-related applications, where manipulated predictions may lead to unsafe downstream decisions [8–11]. However, many molecular backdoor evaluations still treat trigger insertion as an abstract graph edit, assuming a poisoned molecule becomes available once the trigger is added. This assumption does not match realistic cheminformatics workflows, where records are parsed, sanitized, canonicalized, and featurized before training or inference [12–14]. These steps enforce valence validity, aromaticity ∗ Corresponding author: [email protected]

Preprint.

normalization, bond consistency, and graph-string consistency. Thus, an abstractly valid trigger may fail to become an admissible molecular record. Ignoring this admission stage can inflate measured attack success by counting invalid poisons as if they reached the learner, as shown in Figure 1. Attack Success Rate (ASR, %)

100

Low EPR High ASR

High EPR High ASR (Attacks succeed)

Graph-only attacks (GTA, MB, UGBA, DPGBA)

Before: w/o ChemGuard After: with ChemGuard

ChemBack (model-free)

Before: w/o ChemGuard After: with ChemGuard

25 Low EPR Low ASR (Attacks fail)

High EPR Low ASR

Effective Poison Rate (EPR, %)

Each marker = one dataset BBBP SIDER BACE Tox21

100

Figure 1: EPR-ASR summary of graph-only attacks and ChemBack before and after ChemGuard. ChemGuard shifts graphonly attacks from the high-EPR/high-ASR region toward lowerEPR/lower-ASR regions because many attempted poisons or testtime triggers fail chemistry-aware admission. In contrast, ChemBack remains in the high-EPR/high-ASR region, indicating that it remains operational after chemistry-aware admission.

To model this gap, we introduce ChemGuard, a chemistry-aware admission protocol. ChemGuard is an admission protocol that complements existing defenses, where it examines whether a submitted molecular record can enter a realistic molecular learning pipeline. A record is admitted only when its molecular string is sanitizable and the graph reconstructed from that string is consistent with the submitted graph. Under this protocol, representative graph backdoors lose much of their operational attack signal because many attempted poisons or test-time triggers fail admission.

This reframes molecular backdoor evaluation from whether an abstract graph trigger can fool a GNN to whether a poisoned molecular record can pass chemistry-aware admission and still induce targeted behavior. Hence, we ask: Can effective molecular backdoors survive realistic chemistry-aware admission before training and inference? We answer this question with ChemBack, an admission-aware molecular backdoor attack that attaches chemically feasible motifs at valid atomic anchors, keeping poisoned molecules sanitizable and graphstring consistent under ChemGuard. Since chemical validity alone does not ensure effective or stealthy poisoning, ChemBack selects triggers that are realizable, admitted by preprocessing, reusable at training and test time, and close to the target class. Unlike UGBA [6] and DPGBA [7], which rely on distribution preservation or surrogate-model optimization, ChemBack requires no victim model or surrogate GNN during trigger selection. Instead, it searches feasible motif-anchor attachments and ranks ChemGuard-admissible candidates by Tanimoto similarity [15, 16] to clean target-class molecules, using only molecular structures, target labels, and public fingerprint functions. This makes ChemBack more than a motif backdoor with a validity filter, as triggers must remain admissible, graph-string consistent, target-aligned, and model-free during both poisoning and activation. Clean reference models are used only for post-hoc diagnostics, not attack construction. We validate these claims through a broad empirical study. We first show that chemistry-aware admission substantially reduces the operational attack signal of representative graph backdoors. We then show that ChemBack remains effective under the same admission rule, achieving high attack success while maintaining clean accuracy. This pattern persists across molecular benchmarks, chemistry validators, GNN architectures, larger-scale datasets, pretrain-finetune settings, and representative defenses, revealing an attack vector that remains operational after chemistry-aware admission. In summary, our contributions are: 1. We identify an admission gap, showing that graph-level trigger success can overestimate operational risk when sanitization and graph-string consistency are ignored. 2. We formalize ChemGuard, a minimal pipeline-level admission protocol for testing whether a molecular record can enter training or inference after chemistry-aware preprocessing. 3. We propose ChemBack, an admission-aware molecular backdoor attack that builds chemically feasible motif-anchor attachments and selects admitted candidates by Tanimoto similarity to clean target-class molecules, without victim or surrogate model access. 4. We show across benchmarks, larger datasets, pretrain-finetune settings, validators, architectures, and defenses that chemistry-aware admission weakens graph-only backdoors, while chemically valid and target-aligned backdoors remain effective. 2

Related Work

Graph Neural Networks (GNNs). GNNs learn latent representations by aggregating information over graph structure [17]. Molecules are naturally represented as graphs, with atoms as nodes and chemical bonds as edges, making GNNs effective for molecular property prediction and related chemistry tasks [18, 3, 4]. Architectures such as GCN [19] and GraphSAGE [20] are widely used in molecular learning, while large-scale self-supervised models such as GROVER [21] further improve molecular representations through pretraining. As molecular GNNs become more common in scientific pipelines, their security surface also expands, especially when training data are collected from public or third-party sources. Backdoor attacks (BA). BA poison training data so that a model behaves normally on clean inputs but predicts an attacker-specified target label when a trigger appears. BadNets [22] introduced this threat in images, followed by works on diverse triggers, budgets, and stealth objectives [23–25]. In graphs, GTA [26] introduced subgraph triggers, while UGBA [6] and DPGBA [7] improve unnoticeability and distribution alignment. For molecules, Motif-Backdoor [5] uses recurring substructures as triggers. These methods reveal important GNN vulnerabilities, but they often treat triggers as abstract graph edits. In realistic cheminformatics pipelines, edited records must still pass sanitization, canonicalization, and graph-string consistency checks before entering training or inference. Backdoor and poisoning defenses. Existing defenses operate at different stages of the learning pipeline. Backdoor-specific defenses such as Neural Cleanse [27], Spectral Signatures [28], DShield [29], and RIGBD [30] typically act after samples have entered training, using trigger reconstruction, embedding outliers, discrepancy, commonality, or robustness-based signals. Robust GNN and graph-poisoning defenses, including RGCN [31], GNNGuard [32], Pro-GNN [33], and certified defenses [34–36], also operate after graph admission. By contrast, ChemGuard targets admission by testing whether a molecular record survives sanitization and graph-string consistency checks before entering the learner. Thus, chemistry-aware admission is complementary to post-hoc and model-level defenses, not a replacement for them.

Methodology

3.1

Preliminaries and Threat Model

Molecular records and preprocessing. We represent a molecular record as (s̃, G̃, y), where s̃ ∈ S is a molecular string, G̃ is the submitted or stored molecular graph, and y ∈ Y is the task label. A molecule is an attributed graph G = (V, E, X, B), where V and E denote atoms and bonds, X ∈ R|V |×dv is the atom-feature matrix, and B ∈ R|E|×de is the bond-feature matrix. Molecular strings are commonly parsed, sanitized, canonicalized, and featurized by cheminformatics toolkits [12– 14]. We model this preprocessing stack as a deterministic operator ϕT : S → Gvalid ∪ {∅}, where T is the chemistry toolkit or validation stack, and Gvalid denotes the set of chemically valid molecular graphs. If parsing, sanitization, canonicalization, and featurization succeed, ϕT (s̃) returns a valid molecular graph; otherwise it returns ∅. A molecular GNN is a classifier fθ : Gvalid → [0, 1]M , where M is the number of classes. The effective deployed prediction pipeline is therefore fθ ◦ ϕT . Learning objective. Let Dadm = {(s̃i , G̃i , yi )}N i=1 denote the training records admitted by the preprocessing pipeline. The victim trains fθ by empirical risk minimization: X 1 min ℓ(fθ (ϕT (s̃i )), yi ) . (1) θ |Dadm | (s̃i ,G̃i ,yi )∈Dadm

The stored graph G̃i is included because admission may check consistency between the submitted graph and the graph reconstructed from the molecular string. Prediction is computed from the admitted molecular string via ϕT . This formulation emphasizes that the learner trains only on records that survive molecular preprocessing, not arbitrary raw graph edits. Threat model. We consider a data-poisoning adversary who can inject or modify a small fraction α of raw molecular records before admission. The attacker fixes a target label yt and aims to preserve clean performance while causing triggered non-target molecules to be classified as yt . The attacker has no access to the victim model or private training pipeline and cannot access or modify the victim parameters θ, learned representations, gradients, optimizer state, training code, random seed, 3

training trajectory, or private pre-processing configuration. Also, the attacker is refrained from forcing molecules that are invalid or possess graph-string inconsistencies to bypass pre-processing. Backdoor poisoning. Let τ = (τs , τG ) denote a trigger transformation, where τs : S → S modifies the molecular string and τG denotes the corresponding submitted-graph transformation. For a clean non-target molecule (s̃c , G̃c , yc ) with yc ̸= yt , a targeted poisoning attempt produces att (s̃p , G̃p , yt ) = τs (s̃c ), τG (G̃c ), yt ∈ Dpoison . The nominal poison rate α controls how many raw training records the attacker attempts to poison. However, in chemistry-aware pipelines, not every attempted poison reaches the learner: only records admitted by the preprocessing pipeline can contribute to training. Prediction under an admission rule. Let Adm(s̃, G̃) ∈ {0, 1} denote an admission rule. For convenience, we define the admitted prediction as arg maxc∈{1,...,M } fθ (ϕT (s̃))c , Adm(s̃, G̃) = 1, ŷθ (s̃, G̃) = ⊥, Adm(s̃, G̃) = 0. Here, ⊥ denotes rejection before model evaluation. In raw abstract-graph evaluation, Adm is treated as always one. Under chemistry-aware evaluation, Adm is instantiated by ChemGuard. Metrics. We report Clean Accuracy (CA), operational Attack Success Rate (ASR), adm and Effective Poisoning Rate (EPR). Let Dclean = {(s̃c , G̃c , yc ) ∈ Dclean : Adm(s̃c , G̃c ) = 1}; CA measures utility on unmodified admitted test molecules, where CA = h i P 1 att adm 1 ŷθ (s̃c , G̃c ) = yc . Let Dpoison = {(s̃p , G̃p , yt ) ∈ Dpoison : y ̸= yt }. adm | (s̃c ,G̃c ,yc )∈Dclean |Dclean Operational ASR measures h targeted behavior onitriggered non-target test molecules, where ASR = P 1 ¬yt 1 ŷθ (τs (s̃), τG (G̃)) = yt . If a triggered test molecule fails admission, then ¬yt (s̃,G̃,y)∈D |D | test

test

ŷθ (s̃p , G̃p ) = ⊥, and the indicator contributes zero. Thus, triggered molecules that cannot be realized as admissible molecular records are counted as attack failures. 3.2

ChemGuard

Molecular records are not arbitrary graphs. Before a submitted record can be used by a practical molecular learning pipeline, it must satisfy chemical and representational constraints. Structural modifications must respect atom identities, valence, bond types, aromaticity normalization, and consistency between the molecular string and the submitted graph. Existing graph backdoor evaluations often do not model this admission stage and may count an abstract graph trigger as successful even when the corresponding molecular record would fail sanitization or graph–string consistency. Definition 1 (ChemGuard admission). Let (s̃, G̃, y) be a submitted molecular record, and let ϕT : S → Gvalid ∪ {∅} denote the preprocessing operator induced by chemistry toolkit T . ChemGuard admits (s̃, G̃, y) iff: (i) ϕT (s̃) ̸= ∅; and (ii) the typed molecular topology reconstructed from s̃ matches the submitted graph G̃. Formally, h i ChemGuardT (s̃, G̃) = 1[ϕT (s̃) ̸= ∅] · 1 Topo(ϕT (s̃)) = Topo(G̃) . (2) Here, Topo(G̃) denotes typed molecular topology, including atom identities, atom count, undirected bond set, and bond types under the toolkit-induced canonical representation. ChemGuard is intentionally minimal. It is not a complete defense because it does not inspect learned representations, detect triggers, or certify robustness against arbitrary graph perturbations. Instead, it formalizes the implicit admission rule that molecular records must be chemically valid and representation-consistent before training or inference. Thus, ChemGuard complements post-hoc backdoor and model-level poisoning defenses, which operate after sample admission. Because ChemGuard reject many attempted poisons, the nominal poison rate α may differ from the poisoned signal that reaches training. We define the ChemGuard Effective Poisoning Rate as X 1 EPR = ChemGuardT (s̃p , G̃p ). (3) att |Dpoison | att (s̃p ,G̃p ,yt )∈Dpoison

Motif Library and Target Bank

Host Sampling

Training Set

sample a fraction of hosts

Motif Library

enumerate Target Bank

feasible anchors

similarity score fingerprint 0 1 1 0 ... 1

0.93

0 1 0 1 ... 1

0.61

1 0 1 0 ... 0

0.47

ChemGuard attempted molecules TRUE

FALSE sanitization?

1 0 1 0 ... 1

... target-class fingerprints

admitted candidates

pass (valid)

fail (filtered)

...

1 1 0 1 ... 0

attachment attempts

...

0 1 1 0 ... 1

ChemGuard Validity Check + Tanimoto Trigger Selection

rank & select

No victim model No embeddings No code access

Training and Inference fully admitted poisons

backdoor training

x x

Backdoored GNN

model inference normal prediction false prediction

Figure 2: Overview of ChemBack under ChemGuard. ChemBack forms a trigger library from candidate motifs, attaches them to sampled non-target hosts, and filters feasible motif-anchor attachments with ChemGuard for sanitization and graph-string consistency. It then selects admitted triggers by fingerprint-based Tanimoto similarity to clean target-class molecules. The selected trigger produces ChemGuard-admissible training poisons and is reused for test-time realization. Selection uses no victim model or surrogate GNN. Here, D ∗ poisonatt is the set of poisoned records attempted before admission. The nominal poison rate α is the attacker’s attempted budget, while EPR ∗ CG is the fraction of attempted poisons admitted into training. In raw abstract-graph evaluation, no chemistry-aware gate is enforced, so EPR is reported only for the ChemGuard mode. The same rule is applied at test time, where triggered molecules that fail ChemGuard are rejected before evaluation and counted as ASR failures. 3.3

ChemBack

ChemBack tests whether effective molecular backdoors remain possible after ChemGuard removes invalid or graph-string inconsistent poisons. It imposes two requirements. Poisoned molecules must be chemically admissible, meaning sanitizable and graph-string consistent. Admitted poisons should also be target-aligned, meaning structurally close to clean target-class molecules under chemistryfacing fingerprints. This alignment helps the trigger induce the target label while remaining less outlying under the diagnostics considered in this work. Moreover, ChemBack is model-free during trigger selection, using only molecular structures, target labels, public chemistry-validity checks, fingerprints, and Tanimoto similarity. Clean reference models are used only post-hoc for diagnostics. Definition 2 (ChemBack attack). Let Davail be the molecular records available to the attacker before admission, let yt ∈ Y be the attacker-specified target label, and let ChemGuardT be the admission protocol induced by toolkit T . ChemBack is an admission-aware poisoning transformation τ = (τs , τG ) that maps a clean non-target molecule (s̃, G̃, y) with y ̸= yt to a poisoned record (s̃p , G̃p , yt ) = τs (s̃), τG (G̃), yt ,

ChemGuardT (s̃p , G̃p ) = 1.

The trigger rule τ is constructed from ChemGuard-admissible motif attachments selected by fingerprint-based Tanimoto similarity to clean target-class molecules. At test time, the same τ is applied to non-target molecules, and any triggered record that fails ChemGuard is counted as an attack failure under operational ASR. Design overview. To instantiate τ , ChemBack mines candidate molecular motifs, enumerates feasible host and motif anchors, and attempts single-bond motif attachments. Each candidate is sanitized, canonicalized, reconstructed as a molecular graph, and checked by ChemGuard. Among admitted candidates, ChemBack selects the trigger using fingerprint-based Tanimoto similarity to clean target-class molecules. Unlike representation-guided graph backdoors, this score is computed from deterministic molecular fingerprints. Figure 2 shows the pipeline. Chemically constrained trigger space. ChemBack constructs a motif library M = {mk }K k=1 , where each motif mk is a chemically meaningful substructure mined from available molecular data. Motifs may be selected to be rare under the training distribution to reduce accidental trigger occurrence, but rarity is not treated as a stealth guarantee. The final trigger is selected by chemical admissibility under ChemGuard and target-class structural alignment under molecular fingerprints. 5

Given a host molecule G = (V, E), ChemBack restricts host anchors to atoms that can support an additional chemically valid bond: A(G) = {i ∈ V : atom i admits an additional chemically valid bond}. For each motif mk , it also enumerates feasible motif-side anchors. An action is a = (k, i, j), where k selects the motif, i the host anchor, and j the motif anchor. The attachment operator AttT (G, mk , i, j) connects the host and motif through a valid bond, sanitizes the result, canonicalizes its molecular string, and reconstructs the corresponding graph. If the edit violates chemical constraints or fails ChemGuard, the operator returns ⊥; otherwise, it returns (s̃p , G̃p ) with ChemGuardT (s̃p , G̃p ) = 1. Target fingerprint bank. To select target-aligned triggers without a victim or surrogate model, ChemBack constructs n o Bt = FP(ϕT (s̃i )) : (s̃i , G̃i , yi ) ∈ Davail , yi = yt , ChemGuardT (s̃i , G̃i ) = 1 . (4) Here, FP : Gvalid → {0, 1}d is a molecular fingerprint function. Unless otherwise stated, we use Morgan fingerprints with radius 2 and 2048 bits [15]. For binary fingerprints u, v ∈ {0, 1}d , their Tanimoto similarity is Tan(u, v) = |u∧v| |u∨v| . This provides a deterministic, model-free estimate of target-class structural similarity [16]. Tanimoto-guided trigger selection. For each admitted candidate Gpoi , ChemBack computes STan (G̃p ) = maxz∈Bt Tan(FP(G̃p ), z). The reward for action a = (k, i, j) on host G is ( rinv , AttT (G, mk , i, j) = ⊥, r(G, k, i, j) = (5) 1 + λTan STan (G̃p ), otherwise, where rinv < 0 penalizes invalid or inadmissible attachments, and λTan controls target-class structural alignment. The constant term rewards admission, while the Tanimoto term prefers admitted molecules structurally similar to clean target-class molecules. Trigger freezing and poisoning. A backdoor trigger should be shared across poisoned training samples and test-time triggered inputs. ChemBack therefore searches motif-anchor candidates on a calibration subset of non-target hosts and selects a trigger motif or small trigger family with high admission success and high target-class Tanimoto similarity. It poisons a fraction α of non-target training molecules by applying the selected trigger, retaining only records satisfying ChemGuardT (s̃p , G̃p ) = 1, and assigning label yt . At test time, the same trigger rule is applied to non-target test molecules. If the trigger cannot be realized as a ChemGuard-admissible molecular record, that attempt is counted as a failure under operational ASR. Optimization. ChemBack performs black-box search over a discrete space of chemistry-admissible motif attachments, including motif choice, host-anchor choice, motif-anchor choice, sanitization, canonicalization, and graph-string consistency checks. This search can be implemented using deterministic, greedy, or reinforcement-learning strategies. The method is optimizer-agnostic and depends only on ChemGuard-admissible construction and Tanimoto-guided target alignment.

Experiments

4.1

Experimental Setup

Datasets. We evaluate on four MoleculeNet benchmarks, including BBBP [37], BACE [38], SIDER [39], and Tox21 [40]. BBBP and BACE are single-task binary classification datasets. SIDER and Tox21 are multi-task benchmarks with 27 and 12 tasks, respectively. For SIDER and Tox21, we run all tasks and report macro-averaged results in the main text. Task-wise results are deferred to Appendix N. Additional tests on larger benchmarks, pretrain-finetune pipelines, alternative chemistry validators, and additional structural diagnostics are reported in Appendix M and Appendix J. Hyperparameters. Following MoleculeNet split policies, we use scaffold splits for BBBP and BACE, and random splits for SIDER and Tox21. Unless otherwise stated, experiments are repeated over S = 5 fixed seeds, and values are reported as mean±std. The default poison rate is α = 10%. A full sweep over α ∈ {1, 5, 10}% is provided in Appendix I. 6

Table 1: CA/ASR (%) without and with ChemGuard at α = 10%. EPR (%) is the fraction of attempted poisons admitted by the ChemGuard pipeline. Values are mean±std over 5 seeds. Dataset

Attack

w/o ChemGuard

with ChemGuard

CA (%) ↑

ASR (%) ↑

CA (%) ↑

ASR (%) ↑

EPR (%) ↑

BBBP

No-Attack GTA MB UGBA DPGBA ChemBack

86.34±0.43 79.72±0.63 80.43±0.64 82.14±0.53 81.93±0.65 81.08±0.52

73.16±1.24 72.18±1.36 60.67±1.16 69.24±1.13 69.36±1.14

86.34±0.43 84.23±0.46 84.35±0.63 83.94±0.34 84.27±0.84 81.08±0.52

54.47±0.56 46.27±8.24 47.83±3.86 52.86±3.36 69.36±1.14

8.14±12.83 11.24±11.37 13.16±13.58 10.06±10.87 100.00±0.00

BACE

No-Attack GTA MB UGBA DPGBA ChemBack

71.64±0.53 67.34±0.54 70.04±0.53 72.64±0.63 69.36±0.54 70.63±0.72

47.96±1.14 82.67±1.54 67.18±1.24 55.74±1.23 98.86±0.43

71.64±0.53 71.32±2.47 71.06±1.94 70.74±0.34 70.24±1.24 70.63±0.72

27.46±2.14 13.38±8.74 15.37±3.34 16.47±4.54 98.86±0.43

15.17±13.24 17.43±10.74 10.34±12.14 10.94±13.96 100.00±0.00

SIDER

No-Attack GTA MB UGBA DPGBA ChemBack

63.34±0.74 60.83±0.74 64.73±0.73 59.47±0.64 62.94±0.63 60.84±0.63

66.47±1.43 83.28±1.46 86.18±1.74 49.67±1.04 99.17±0.34

63.34±0.74 60.74±0.54 60.07±1.46 60.16±0.94 60.84±0.34 60.84±0.63

49.96±7.84 51.17±3.86 53.07±4.36 45.27±4.46 99.17±0.34

11.13±11.86 7.08±12.47 8.57±10.26 5.47±12.94 100.00±0.00

Tox21

No-Attack GTA MB UGBA DPGBA ChemBack

97.24±0.34 96.43±0.43 96.94±0.34 96.53±0.33 96.56±0.43 96.34±0.43

42.78±1.29 96.37±0.63 97.06±0.54 52.76±0.94 81.84±0.84

97.24±0.34 97.14±0.24 97.23±0.13 97.26±0.34 97.24±0.23 96.34±0.43

16.73±2.18 24.61±3.57 22.84±2.46 18.49±2.69 81.84±0.84

23.68±14.08 25.17±11.23 24.36±12.84 25.92±10.58 100.00±0.00

Evaluation modes. For each attack, we report two evaluation modes. (i) Raw applies no chemistry gate and treats all generated graph edits as admissible. (ii) ChemGuard applies ChemGuard before training and again during test-time trigger realization. Invalid or graph-string inconsistent poisons are rejected before training, and triggered test molecules that fail ChemGuard are counted as attack failures. For the metrics, we report CA on unmodified admitted test molecules, ASR on triggered non-target test molecules, and EPR induced by ChemGuard. Victim model. The main victim is a two-layer GCN with global mean pooling. We train using Adam with learning rate 10−3 and batch size 128. Additional details are provided in Appendix D. Attacks compared. We compare ChemBack against four representative graph backdoor attacks, including GTA, MB, UGBA, and DPGBA. To ensure a fair comparison under chemistry-aware pipelines, we equip all baselines with a chemistry-aware wrapper that attempts to realize their intended graph edits as valid molecular modifications. The wrapper selects host anchors with available valence, assigns chemically consistent bonds, re-sanitizes the edited molecule, and rejects candidates that fail sanitization or graph-string topology consistency. 4.2

Experimental Results

Main comparison under chemistry-aware admission. Table 1 shows that graph-only methods admit only a small fraction of their attempted poisons under ChemGuard. Their operational ASR also drops after invalid poisons and invalid test-time trigger realizations are filtered. In contrast, ChemBack preserves EPR at 100.00% on all datasets and maintains high ASR while keeping CA close to the clean reference. This demonstrates the central two-sided result that chemistry-aware admission weakens graph-only attacks, while chemically valid and target-aligned molecular backdoors remain effective. In a few cases, ChemGuard CA slightly exceeds Raw CA because invalid records are removed from the effective training distribution. Attack budget trends. Figure 3 studies how operational ASR changes with poison rate. Enforcing ChemGuard consistently lowers the realized efficacy of graph-only baselines across all datasets. This trend is consistent with the low EPR values in Table 1, which limit the attacker’s intended signal 7

5 10 Poison rate (%) (a) BBBP.

5 10 Poison rate (%) (b) BACE.

90 60 30 01

ASR (%)

90 60 30 01

ASR (%)

90 60 30 01

ASR (%)

90 60 30 01

5 10 Poison rate (%) (c) SIDER.

5 10 Poison rate (%) (d) Tox21.

Figure 3: Operational ASR before and after enforcing ChemGuard as the poison rate α ∈ {1, 5, 10}% varies. Chemistry-aware admission reduces ASR for graph-only methods by filtering invalid poisons and invalid test-time trigger realizations. BBBP

Target-class MD2

BACE corr=-0.84

SIDER corr=-0.87

Tox21 corr=-0.90

corr=-0.86

2 1 0

0.4

0.6

0.8

Tanimoto similarity

0.4

0.6

0.8

0.4

Tanimoto similarity

0.6

0.8

Tanimoto similarity

0.4

0.6

0.8

Tanimoto similarity

Figure 4: Relation between Tanimoto similarity to the clean target class and clean-model target-class MD2 . Across datasets, higher Tanimoto similarity aligns with lower MD2 . that reaches the learner. By contrast, ChemBack maintains stable operational performance because its poisons are designed to be admitted by the chemistry-aware pipeline. Why does Tanimoto work? ChemBack selects ChemGuard-admissible triggers without a victim model or proxy GNN, using only Tanimoto similarity to clean target-class molecules. To explain this model-free score, we train a clean reference model only after trigger generation and compute target-class MD2 in its embedding space. Figure 4 shows that higher Tanimoto similarity corresponds to lower clean-model MD2 across all four datasets, indicating that structurally target-similar poisons lie closer to the clean target region. This diagnostic is not used by the attacker or trigger-generation algorithm. Additional descriptor-level analyses are in Appendix J.

Discussion

Defenses beyond ChemGuard. We separate defenses by pipeline stage. ChemGuard is an admission-stage chemistry check applied before training. Spectral Signatures [28], DShield [29], and RIGBD [30] are post-hoc defenses. RGCN [31] is a robust GNN architecture, while PGNNCert [36] is a certified graph poisoning defense. GNNGuard [32] and Pro-GNN [33] are reported in Appendix L. These defenses are complementary, not interchangeable. ChemGuard controls admission, while post-hoc and model-level defenses operate after poisoned records enter learning. This matters because UGBA, DPGBA, and ChemBack reduce outlier detectability through feature, distributional, or Tanimoto-based target alignment. Table 2 shows that these defenses reduce ASR, especially for graph-only baselines, but do not remove ChemBack once poisons enter training. This supports a staged defense view, where ChemGuard reduces the admitted attack surface before learning, and later defenses suppress learned backdoor behavior after admission. Component ablation. Table 3 ablates Tanimoto-based target alignment and validity-oriented attachment pre-screening. These components address different failure modes. Removing Tanimoto similarity barely changes vanilla ASR under ChemGuard, since a valid trigger can still be learned when paired with the target label, but greatly increases vulnerability to Spectral Signatures. Thus, Tanimoto similarity mainly acts as a model-free target-neighborhood alignment signal that improves robustness to outlier-based filtering. In contrast, the “w/o validity pre-screening” variant still applies final ChemGuard admission before poison submission, so EPR remains 100.00% and ASR stays close to the full method. Validity pre-screening mainly stabilizes poison construction by reducing invalid internal attachment attempts. Overall, full ChemBack gives the best balance among clean utility, attack success, admitted poisoning, and robustness under Spectral Signatures. 8

Table 2: Defense comparison on BBBP/SIDER at α = 10%. Values report ASR (%) over 5 seeds. Dataset

Attack

Raw

Spectral

DShield

RGCN

RIGBD

PGNNCert

BBBP

GTA MB UGBA DPGBA ChemBack

73.16±1.24 72.18±1.36 60.67±1.16 69.24±1.13 69.36±1.14

48.93±1.47 50.26±4.87 59.38±1.92 68.16±2.21 68.74±1.39

42.17±1.63 43.72±4.59 56.21±2.38 65.47±2.36 66.58±1.72

45.86±1.58 46.83±4.28 57.46±2.14 66.83±2.17 67.13±1.46

37.42±1.79 35.61±4.36 34.87±2.41 48.92±2.53 61.37±1.85

36.94±1.56 46.74±4.91 35.24±2.19 49.31±2.47 68.28±1.32

GTA MB SIDER UGBA DPGBA ChemBack

66.47±1.43 83.28±1.46 86.18±1.74 49.67±1.04 99.17±0.34

45.36±1.57 63.17±1.89 84.97±1.82 48.72±1.16 98.52±0.61

40.78±1.49 58.42±1.73 82.36±1.69 47.16±1.09 96.39±0.82

42.19±1.68 55.83±2.14 82.74±1.51 48.31±1.03 96.87±0.94

36.74±1.53 40.69±2.85 41.28±3.17 44.26±3.28 92.74±1.46

38.21±1.64 41.24±2.37 80.37±1.58 48.86±1.12 93.46±1.21

Table 3: Ablation of ChemBack at α = 10%. CA/ASR/EPR are evaluated under operational ChemGuard. Spectral ASR reports ASR after applying Spectral Signatures to the admitted poisoned training set. Values are mean±std over 5 seeds. Dataset Variant

CA (%) ↑

ASR (%) ↑

EPR (%) ↑

Spectral ASR (%) ↑

BBBP

ChemBack 81.08±0.52 69.36±1.14 100.00±0.00 w/o Tanimoto similarity 81.22±0.44 68.91±1.73 100.00±0.00 w/o validity pre-screening 81.16±0.45 69.02±1.89 100.00±0.00

68.74±1.39 31.48±2.86 67.06±1.76

BACE

ChemBack 70.63±0.72 98.86±0.43 100.00±0.00 w/o Tanimoto similarity 70.41±0.58 97.92±0.91 100.00±0.00 w/o validity pre-screening 70.51±0.61 98.34±0.74 100.00±0.00

97.84±0.76 42.36±3.42 95.81±1.03

ChemBack 60.84±0.63 99.17±0.34 100.00±0.00 SIDER w/o Tanimoto similarity 60.91±0.61 98.74±0.66 100.00±0.00 w/o validity pre-screening 60.77±0.58 98.96±0.52 100.00±0.00

98.52±0.61 39.27±2.75 97.12±0.68

ChemBack 96.34±0.43 81.84±0.84 100.00±0.00 w/o Tanimoto similarity 96.41±0.31 80.96±1.52 100.00±0.00 w/o validity pre-screening 96.28±0.35 81.27±1.61 100.00±0.00

81.12±0.91 28.64±2.31 79.06±1.12

Tox21

Additional analyses. Supporting analyses are included in the Appendix, including theoretical analysis, sensitivity to poison rate and Tanimoto guidance, robustness across additional victims, larger-scale and pretrain-finetune tests, alternative chemistry validators, and extended structural diagnostics. Together, these reinforce the same conclusion that chemistry-aware admission removes much of the apparent efficacy of graph-only baselines, whereas ChemBack remains effective. Limitations and Scope. Our claims are limited to the admission-aware setting studied in this paper. ChemGuard is a first-layer admission check, not a complete defense or a robustness certificate. It checks molecular sanitization and graph-string consistency, but it does not cover all practical filters such as synthetic accessibility, medicinal-chemistry rules, assay-specific curation, temporal shifts, or expert review. Tanimoto similarity and our post-hoc MD2 /descriptor analyses show that the generated poisons are less outlying under the evaluated diagnostics, but they do not guarantee universal stealth or biological equivalence. Finally, our current trigger space uses controlled singlestep motif attachments; richer reaction-like transformations may expand the attack surface. We discuss these technical limitations in Appendix P.

Conclusion

This paper shows that realistic molecular preprocessing changes both backdoor evaluation and attack design. We introduce ChemGuard, an operational admission protocol that enforces sanitization and graph-string consistency before training or inference. Under ChemGuard, many graph-only backdoors lose effectiveness because invalid poisons are rejected or fail at test time. We then propose ChemBack, a model-free, admission-aware attack that builds chemically feasible motif triggers and selects admitted candidates by Tanimoto similarity to the clean target class. Across benchmarks, architectures, defenses, larger datasets, and pretrain-finetune settings, ChemBack preserves clean utility while maintaining strong attack success. Overall, chemistry-aware admission weakens graph-only attacks, but valid and target-aligned molecular backdoors remain possible.

References [1] Qimai Li, Zhichao Han, and Xiao-Ming Wu. Deeper insights into graph convolutional networks for semi-supervised learning. In Proceedings of the AAAI conference on artificial intelligence, volume 32, 2018. [2] Jie Zhou, Ganqu Cui, Shengding Hu, Zhengyan Zhang, Cheng Yang, Zhiyuan Liu, Lifeng Wang, Changcheng Li, and Maosong Sun. Graph neural networks: A review of methods and applications. AI open, 1:57–81, 2020. [3] Zhenqin Wu, Bharath Ramsundar, Evan N Feinberg, Joseph Gomes, Caleb Geniesse, Aneesh S Pappu, Karl Leswing, and Vijay Pande. Moleculenet: a benchmark for molecular machine learning. Chemical science, 9(2):513–530, 2018. [4] Justin Gilmer, Samuel S Schoenholz, Patrick F Riley, Oriol Vinyals, and George E Dahl. Neural message passing for quantum chemistry. In International conference on machine learning, pages 1263–1272. Pmlr, 2017. [5] Haibin Zheng, Haiyang Xiong, Jinyin Chen, Haonan Ma, and Guohan Huang. Motif-backdoor: Rethinking the backdoor attack on graph neural networks via motifs. IEEE Transactions on Computational Social Systems, 11(2):2479–2493, 2023. [6] Enyan Dai, Minhua Lin, Xiang Zhang, and Suhang Wang. Unnoticeable backdoor attacks on graph neural networks. In Proceedings of the ACM Web Conference 2023, pages 2263–2273, 2023. [7] Zhiwei Zhang, Minhua Lin, Enyan Dai, and Suhang Wang. Rethinking graph backdoor attacks: A distribution-preserving perspective. In Proceedings of the 30th ACM SIGKDD conference on knowledge discovery and data mining, pages 4386–4397, 2024. [8] Chuanze Kang, Han Zhang, Zhuo Liu, Shenwei Huang, and Yanbin Yin. Lr-gnn: A graph neural network based on link representation for predicting molecular associations. Briefings in Bioinformatics, 23(1): bbab513, 2022. [9] Yahui Long, Min Wu, Yong Liu, Yuan Fang, Chee Keong Kwoh, Jinmiao Chen, Jiawei Luo, and Xiaoli Li. Pre-training graph neural networks for link prediction in biomedical networks. Bioinformatics, 38(8): 2254–2262, 2022. [10] Oliver Wieder, Stefan Kohlbacher, Mélaine Kuenemann, Arthur Garon, Pierre Ducrot, Thomas Seidel, and Thierry Langer. A compact review of molecular property prediction with graph neural networks. Drug Discovery Today: Technologies, 37:1–12, 2020. [11] R Satheeskumar. Enhancing drug discovery with ai: Predictive modeling of pharmacokinetics using graph neural networks and ensemble learning. Intelligent Pharmacy, 3(2):127–140, 2025. [12] Greg Landrum. Rdkit documentation. Release, 1(1-79):4, 2013. [13] Noel M O’Boyle, Michael Banck, Craig A James, Chris Morley, Tim Vandermeersch, and Geoffrey R Hutchison. Open babel: An open chemical toolbox. Journal of cheminformatics, 3(1):33, 2011. [14] Dmitry Pavlov, Mikhail Rybalkin, Boris Karulin, Mikhail Kozhevnikov, Alexey Savelyev, and A Churinov. Indigo: universal cheminformatics api. Journal of cheminformatics, 3(Suppl 1):P4, 2011. [15] David Rogers and Mathew Hahn. Extended-connectivity fingerprints. Journal of chemical information and modeling, 50(5):742–754, 2010. [16] Dávid Bajusz, Anita Rácz, and Károly Héberger. Why is tanimoto index an appropriate choice for fingerprint-based similarity calculations? Journal of cheminformatics, 7(1):20, 2015. [17] Franco Scarselli, Marco Gori, Ah Chung Tsoi, Markus Hagenbuchner, and Gabriele Monfardini. The graph neural network model. IEEE Transactions on Neural Networks, 20(1):61–80, 2009. doi: 10.1109/ TNN.2008.2005605. [18] David Duvenaud, Dougal Maclaurin, Jorge Aguilera-Iparraguirre, Rafael Gómez-Bombarelli, Timothy Hirzel, Alán Aspuru-Guzik, and Ryan P. Adams. Convolutional networks on graphs for learning molecular fingerprints. In Proceedings of the 29th International Conference on Neural Information Processing Systems - Volume 2, NIPS’15, page 2224–2232, Cambridge, MA, USA, 2015. MIT Press. [19] Thomas N. Kipf and Max Welling. Semi-supervised classification with graph convolutional networks. In International Conference on Learning Representations, 2017. URL https://openreview.net/forum? id=SJU4ayYgl.

[20] William L. Hamilton, Rex Ying, and Jure Leskovec. Inductive representation learning on large graphs. In Proceedings of the 31st International Conference on Neural Information Processing Systems, NIPS’17, page 1025–1035, Red Hook, NY, USA, 2017. Curran Associates Inc. ISBN 9781510860964. [21] Yu Rong, Yatao Bian, Tingyang Xu, Weiyang Xie, Ying Wei, Wenbing Huang, and Junzhou Huang. Selfsupervised graph transformer on large-scale molecular data. Advances in neural information processing systems, 33:12559–12571, 2020. [22] Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733, 2017. [23] Tuan Anh Nguyen and Anh Tran. Input-aware dynamic backdoor attack. Advances in Neural Information Processing Systems, 33:3454–3464, 2020. [24] Khoa Doan, Yingjie Lao, Weijie Zhao, and Ping Li. Lira: Learnable, imperceptible and robust backdoor attacks. In Proceedings of the IEEE/CVF international conference on computer vision, pages 11966–11976, 2021. [25] Thuy Dung Nguyen, Tuan Nguyen, Phi Le Nguyen, Hieu H Pham, Khoa D Doan, and Kok-Seng Wong. Backdoor attacks and defenses in federated learning: Survey, challenges and future research directions. Engineering Applications of Artificial Intelligence, 127:107166, 2024. [26] Zhaohan Xi, Ren Pang, Shouling Ji, and Ting Wang. Graph backdoor. In 30th USENIX security symposium (USENIX Security 21), pages 1523–1540, 2021. [27] Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y. Zhao. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In 2019 IEEE Symposium on Security and Privacy (SP), pages 707–723, 2019. doi: 10.1109/SP.2019.00031. [28] Brandon Tran, Jerry Li, and Aleksander Madry. Spectral signatures in backdoor attacks. Advances in neural information processing systems, 31, 2018. [29] Hao Yu, Chuan Ma, Xinhang Wan, Jun Wang, Tao Xiang, Meng Shen, and Xinwang Liu. Dshield: Defending against backdoor attacks on graph neural networks via discrepancy learning. In Network and Distributed System Security Symposium, NDSS, 2025. [30] Zhiwei Zhang, Minhua Lin, Junjie Xu, Zongyu Wu, Enyan Dai, and Suhang Wang. Robustness inspired graph backdoor defense. arXiv preprint arXiv:2406.09836, 2024. [31] Dingyuan Zhu, Ziwei Zhang, Peng Cui, and Wenwu Zhu. Robust graph convolutional networks against adversarial attacks. In Proceedings of the 25th ACM SIGKDD international conference on knowledge discovery & data mining, pages 1399–1407, 2019. [32] Xiang Zhang and Marinka Zitnik. Gnnguard: Defending graph neural networks against adversarial attacks. Advances in neural information processing systems, 33:9263–9275, 2020. [33] Wei Jin, Yao Ma, Xiaorui Liu, Xianfeng Tang, Suhang Wang, and Jiliang Tang. Graph structure learning for robust graph neural networks. In Proceedings of the 26th ACM SIGKDD international conference on knowledge discovery & data mining, pages 66–74, 2020. [34] Binghui Wang, Jinyuan Jia, Xiaoyu Cao, and Neil Zhenqiang Gong. Certified robustness of graph neural networks against adversarial structural perturbation. In Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining, pages 1645–1653, 2021. [35] Yuxin Yang, Qiang Li, Jinyuan Jia, Yuan Hong, and Binghui Wang. Distributed backdoor attacks on federated graph learning and certified defenses. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pages 2829–2843, 2024. [36] Jiate Li, Meng Pang, Yun Dong, and Binghui Wang. Deterministic certification of graph neural networks against graph poisoning attacks with arbitrary perturbations. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 5020–5029, 2025. [37] Ines Filipa Martins, Ana L Teixeira, Luis Pinheiro, and Andre O Falcao. A bayesian approach to in silico blood-brain barrier penetration modeling. Journal of chemical information and modeling, 52(6): 1686–1697, 2012. [38] Govindan Subramanian, Bharath Ramsundar, Vijay Pande, and Rajiah Aldrin Denny. Computational modeling of β-secretase 1 (bace-1) inhibitors using ligand based approaches. Journal of chemical information and modeling, 56(10):1936–1949, 2016.

[39] Michael Kuhn, Ivica Letunic, Lars Juhl Jensen, and Peer Bork. The sider database of drugs and side effects. Nucleic acids research, 44(D1):D1075–D1079, 2016. [40] Ruili Huang, Menghang Xia, Dac-Trung Nguyen, Tongan Zhao, Srilatha Sakamuru, Jinghua Zhao, Sampada A Shahane, Anna Rossoshek, and Anton Simeonov. Tox21challenge to build predictive models of nuclear receptor and stress response pathways as mediated by exposure to environmental chemicals and drugs. Frontiers in Environmental Science, 3:85, 2016. [41] Yanli Wang, Jewen Xiao, Tugba O Suzek, Jian Zhang, Jiyao Wang, Zhigang Zhou, Lianyi Han, Karen Karapetyan, Svetlana Dracheva, Benjamin A Shoemaker, et al. Pubchem’s bioassay database. Nucleic acids research, 40(D1):D400–D412, 2012. [42] Sebastian G Rohrer and Knut Baumann. Maximum unbiased validation (muv) data sets for virtual screening based on pubchem bioactivity data. Journal of chemical information and modeling, 49(2):169–184, 2009. [43] Christopher A Lipinski, Franco Lombardo, Beryl W Dominy, and Paul J Feeney. Experimental and computational approaches to estimate solubility and permeability in drug discovery and development settings. Advanced drug delivery reviews, 23(1-3):3–25, 1997. [44] Daniel F Veber, Stephen R Johnson, Hung-Yuan Cheng, Brian R Smith, Keith W Ward, and Kenneth D Kopple. Molecular properties that influence the oral bioavailability of drug candidates. Journal of medicinal chemistry, 45(12):2615–2623, 2002. [45] G Richard Bickerton, Gaia V Paolini, Jérémy Besnard, Sorel Muresan, and Andrew L Hopkins. Quantifying the chemical beauty of drugs. Nature chemistry, 4(2):90–98, 2012. [46] Peter C Austin. Balance diagnostics for comparing the distribution of baseline covariates between treatment groups in propensity-score matched samples. Statistics in medicine, 28(25):3083–3107, 2009. [47] Donald J Schuirmann. A comparison of the two one-sided tests procedure and the power approach for assessing the equivalence of average bioavailability. Journal of pharmacokinetics and biopharmaceutics, 15(6):657–680, 1987. [48] D Lakens. Equivalence tests: A practical primer for t tests, correlations, and meta-analyses. social psychological and personality science, 8 (4), 355–362, 2017.

Real-world Motivating Scenario

To ground the threat model, consider an organization that uses a centralized molecular classifier to screen third-party chemical submissions before downstream approval. For example, a retailer may use a molecular model to estimate skin irritation risk for cosmetic ingredients, or a screening laboratory may use a molecular property predictor to prioritize compounds for follow-up assays. In such settings, training data are often aggregated from multiple suppliers, historical archives, public databases, or external collaborators. This creates a realistic data-poisoning surface in which a malicious contributor may not control the victim model or training code, but may be able to inject a small fraction of labeled molecular records into the training corpus. A chemistry-aware backdoor in this setting would not rely on malformed molecules. Instead, the attacker introduces molecules that share a chemically valid trigger substructure and consistently labels them as the target class, such as a low-risk class or another attacker-preferred endpoint. Because the trigger is chemically realizable, the poisoned records can pass routine parsing, sanitization, canonicalization, and graph-string consistency checks. After the model is trained on the contaminated dataset, future molecules containing the same trigger can be admitted by the preprocessing pipeline and systematically mapped to the attacker’s target label. In this scenario, backdoor behavior does not appear as a preprocessing failure or malformed molecular graph. It appears as repeated prediction errors on molecules that look chemically ordinary under standard validity checks. Practitioners may attribute such errors to model noise, label ambiguity, assay variation, or distribution shift rather than to a targeted backdoor. This motivates studying backdoor attacks under an admission-stage chemistry-aware pipeline, shifting the question from whether a graph edit can fool a GNN to whether the edited molecule can survive the chemical preprocessing used in realistic molecular learning workflows.

Positioning against prior molecular backdoors.

Table 4 summarizes how ChemBack differs from prior graph and motif backdoors. The key distinction is not merely the use of motifs, but the admission-aware setting in which poisoned records must be chemically realizable, sanitizable, graph-string consistent, and counted as failures when they cannot enter the training or test-time pipeline. Thus, ChemBack targets the operational gap left by abstract-graph evaluations.

Dataset Details and Split Protocol

Table 5 summarizes the datasets used in the main experiments and additional stress tests. The main experiments use four MoleculeNet benchmarks: BBBP, BACE, SIDER, and Tox21 [3]. Following the dataset-specific MoleculeNet protocol, we use scaffold splits for BBBP and BACE, and random splits for SIDER and Tox21. This follows the original benchmark design. Scaffold splitting groups molecules by their two-dimensional structural frameworks and provides a stronger test of chemical generalization than random splitting, while random splitting follows the standard MoleculeNet protocol for the corresponding multi-task physiology benchmarks [3]. Unless otherwise stated, datasets are split into train, validation, and test subsets using the standard MoleculeNet ratio of 80/10/10. For multi-task datasets, missing labels are ignored for the corresponding task. For SIDER and Tox21, we evaluate the full task panel and report macro-averaged CA, ASR, and EPR in the main text. For the larger-scale stress tests, we use PCBA [41] and MUV [42]. PCBA follows the MoleculeNet random-split convention, while MUV is evaluated under the split protocol specified in Appendix M because split conventions differ across MoleculeNet/DeepChem implementations. All poisoning operations are performed after the clean data split is fixed. In particular, motif mining, target-class fingerprint-bank construction, trigger selection, and poison insertion use only the training split. The validation and test splits are not used to construct motifs or select triggers. When evaluated, ChemGuard is applied independently to each split. Attempted poisoned training records must pass ChemGuard before entering training, while triggered non-target test molecules that fail ChemGuard are counted as attack failures under the operational ASR definition. This protocol prevents leakage 13

Table 4: Conceptual comparison between prior graph/motif backdoors and ChemBack. ChemGuard is an operational admission protocol, not a complete defense. Property

Graph backdoors

Motif-Backdoor

ChemBack

Trigger type Abstract subgraph edit Motif trigger Feasible motif attachment Chemistry-aware attachment No Not admission-driven Yes Sanitization before training No Not explicit Yes Graph-string consistency No Not explicit Yes Admission-stage EPR No No Yes Test-time admission accounting No No Yes Invalid trigger counted as failure No No Yes Model-free trigger selection Varies Yes Yes Target-class structural alignment No / model-dependent Not central Tanimoto-guided Survives realistic preprocessing No Not explicit Yes

Table 5: Dataset summary and split protocols. The main text reports BBBP, BACE, SIDER, and Tox21. PCBA and MUV are used for larger-scale stress tests in Appendix M. Split protocols are stated explicitly to avoid relying on library-specific defaults. Dataset

Task type

#Tasks

#Molecules

Split protocol

BBBP BACE SIDER Tox21

Binary classification Binary classification Multi-label classification Multi-label classification

1 1 27 12

2,039 1,513 1,427 7,831

Scaffold split Scaffold split Random split Random split

PCBA MUV

Multi-label bioassay classification Multi-label virtual-screening benchmark

128 17

437,929 93,087

Random split Random split

from the held-out test set into trigger construction while keeping the chemistry-aware admission rule consistent across training and evaluation.

Experimental Protocol and Training Details

D.1

Raw and ChemGuard Evaluation Modes

We evaluate attacks under two modes. Raw mode. Raw mode follows the abstract-graph evaluation protocol commonly used in graph backdoor studies. Generated graph edits are treated as admissible, even if they do not correspond to a chemically valid molecule or a graph-string consistent molecular record. This mode measures the apparent attack strength when molecules are treated as arbitrary attributed graphs. ChemGuard mode. ChemGuard mode applies chemistry-aware admission before training and again at test-time trigger realization. A poisoned training record is allowed to enter the training set only if its molecular string is sanitizable and the graph reconstructed from the string is topologically consistent with the stored graph. At evaluation time, a triggered non-target test molecule that fails ChemGuard is counted as an attack failure. This operational ASR avoids crediting attacks for triggers that cannot be realized as admissible molecules. This distinction is central to the paper. Raw mode asks whether a graph-level trigger can induce backdoor behavior in an abstract GNN setting. ChemGuard mode asks whether that same attack remains operational in a realistic molecular pipeline. D.2

Effective Poisoning Rate Accounting

The nominal poisoning rate α controls how many raw records the attacker attempts to poison before admission. However, chemistry-aware preprocessing may reject many attempted poisons. We therefore report the Effective Poisoning Rate (EPR), defined as the fraction of attempted poisoned records that survive ChemGuard and can actually reach the learner. For ChemBack, invalid motif-anchor proposals encountered during internal trigger search are treated as rejected candidate proposals and are not submitted as poisoned records. Only ChemGuard14

admissible poisoned molecules are retained in the final submitted poisoned set. Therefore, ChemBack has EPR = 100% in the reported experiments because all submitted poisons are chemically valid and graph-string consistent by construction. This accounting matches the admission-facing threat model because EPR measures the poison signal admitted into training, not the number of internal candidate proposals explored during search. D.3

Victim Model and Optimization

The default victim model is a two-layer GCN with hidden dimension 64 and ReLU activations, followed by global mean pooling and a linear classifier. Node and bond features follow the standard molecular graph featurization used in the main experiments. Models are trained using Adam with learning rate 10−3 and batch size 128. Unless otherwise stated, results are averaged over five fixed seeds and reported as mean±std. D.4

Baseline Adaptation under Chemistry-aware Pipelines

We compare ChemBack against representative graph backdoor baselines: GTA, Motif-Backdoor (MB), UGBA, and DPGBA. These methods were originally designed for graph settings where trigger insertion is generally treated as admissible. To avoid an unfair comparison where baselines are rejected only because they never attempt chemistry-aware realization, we use a chemistry-aware wrapper whenever possible. The wrapper attempts to realize intended graph edits as molecular edits by selecting host atoms with available valence, assigning chemically consistent bonds, re-sanitizing the edited molecule, canonicalizing the molecular string, and checking graph-string consistency. If the edited record fails sanitization or topology consistency, it is rejected under ChemGuard. This wrapper gives graph-only baselines the opportunity to survive chemistry-aware admission. The low EPR of these baselines therefore reflects a genuine mismatch between generic graph edits and chemically admissible molecular modifications, rather than an implementation artifact.

ChemGuard and Chemistry Toolkit Validation

E.1

Topology Consistency Check

ChemGuard admits a molecular record only if two conditions hold. First, the molecular string must be sanitizable under the toolkit-specific preprocessing operator ϕT . Second, the graph reconstructed from the molecular string must be consistent with the stored molecular graph. In our implementation, topology consistency includes atom identities, atom count, undirected bond set, and bond types under the toolkit-induced canonical representation. This check prevents a poisoned record from storing an arbitrary graph while presenting a different valid molecular string. It also prevents an invalid graph edit from being counted as a successful molecular poison simply because the original host molecule remains valid. E.2

Alternative Toolkit Validation

The main experiments instantiate ChemGuard using RDKit, the default toolkit used throughout the paper. However, the admission-stage formulation itself is not specific to RDKit. Different cheminformatics toolkits may implement sanitization, aromaticity perception, canonicalization, and valence handling differently. However, they share the same high-level role in molecular learning pipelines, ensuring that submitted records are chemically admissible and representation-consistent before entering training or evaluation. To test whether the result is specific to one toolkit implementation, we repeat the BBBP validation experiment using Indigo and Open Babel as alternative toolkit-specific admission rules. To avoid conflating toolkit choice with optimizer choice, we evaluate the same three search strategies described in Appendix H.1: RL search, exhaustive search, and greedy search. RDKit serves as the default reference toolkit. For each toolkit, EPR is computed under the corresponding toolkit-specific admission rule, and all values are averaged over 5 seeds. Table 6 shows that ChemBack remains effective across all three toolkit-specific admission rules. Across RDKit, Indigo, and Open Babel, every search variant constructs admitted poisons with EPR 15

Table 6: Alternative chemistry-toolkit validation on BBBP at α = 10%. Values are mean±std over 5 seeds. RDKit is the default toolkit used in the main experiments, while Indigo and Open Babel instantiate the same chemistry-aware admission rule with different cheminformatics validators. Toolkit

Search variant

CA (%) ↑

ASR (%) ↑

EPR (%) ↑

RDKit

RL search Exhaustive search Greedy search

81.08±0.52 81.24±0.61 81.17±0.57

69.36±1.14 70.18±1.27 69.84±1.36

100.00±0.00 100.00±0.00 100.00±0.00

Indigo

RL search Exhaustive search Greedy search

81.36±0.63 81.42±0.59 81.31±0.66

70.41±1.38 71.06±1.21 70.27±1.44

100.00±0.00 100.00±0.00 100.00±0.00

Open Babel

RL search Exhaustive search Greedy search

81.29±0.68 81.46±0.71 81.22±0.64

70.13±1.33 71.32±1.18 70.64±1.29

100.00±0.00 100.00±0.00 100.00±0.00

at 100.00%. The CA and ASR values are also comparable across toolkits, suggesting that the result is not an artifact of a single sanitizer or canonicalization implementation. The optimizer comparison further shows that the core effect is not tied to a particular search strategy. RL search, exhaustive search, and greedy search optimize the same chemistry-aware, Tanimoto-guided objective and yield similar admitted-poison behavior. These results should not be interpreted as a claim that toolkit sanitization captures all relevant chemical realism. RDKit, Indigo, and Open Babel provide first-layer chemistry-aware admission checks, but they do not model all aspects of synthetic accessibility, medicinal-chemistry rules, assay-specific curation, or expert review. Rather, Table 6 supports the narrower claim that ChemGuard-style admission is a pipeline-level constraint shared by common molecular toolkits, and that ChemBack is constructed to survive this class of validation rather than a single RDKit-specific check.

ChemBack Implementation Details

F.1

Motif Library Construction

ChemBack constructs a library of candidate molecular motifs from available training molecules. Motifs are chosen as chemically meaningful substructures that can be attached to host molecules through feasible atomic anchors. In our implementation, candidate motifs are mined from molecular scaffolds and filtered to remove candidates that cannot provide feasible attachment sites. Motif rarity may be used to reduce accidental natural occurrence in clean samples, but rarity is not treated as a complete stealth guarantee. The final trigger is selected using both ChemGuard admissibility and Tanimoto similarity to the clean target class. F.2

Target Fingerprint Bank

For a fixed target label yt , ChemBack constructs a fingerprint bank from clean, admitted target-class molecules: adm Bt = {FP(G̃i ) : (s̃i , G̃i , yi ) ∈ Dclean , yi = yt , ChemGuardT (G̃i , s̃i ) = 1}.

Unless otherwise stated, FP is a Morgan fingerprint with radius 2 and 2048 bits. This fingerprint setting is widely used in molecular similarity search because it captures local atom-neighborhood patterns around functional groups and motifs while keeping similarity computation deterministic and efficient. F.3

Tanimoto-guided Trigger Selection

For each candidate poisoned molecule G̃p , ChemBack computes the nearest-target Tanimoto score: STan (G̃p ) = max Tan(FP(G̃p ), z). z∈Bt

The trigger-selection reward is ( rinv , r(G, k, i, j) = 1 + λTan STan (G̃p ),

AttT (G, mk , i, j) = ⊥ or fails ChemGuard, otherwise.

The first term penalizes invalid or inadmissible attachments. The constant term rewards admission. The Tanimoto term prefers admitted molecules that are structurally similar to clean target-class molecules. Importantly, this reward is fully model-free. It does not require a clean victim model, proxy GNN, gradients, learned embeddings, or training-code access. A clean reference model is used only after trigger generation for post-hoc diagnostics in Appendix J. F.4

Trigger Freezing and Poison Construction

A backdoor trigger should be shared across poisoned training samples and test-time triggered inputs. ChemBack therefore searches over motif-anchor candidates on a calibration subset of non-target hosts and selects either a single trigger motif or a small trigger family with high admission success and high target-class Tanimoto similarity. It then poisons a fraction α of non-target training molecules by applying the selected trigger and assigning the target label yt . At test time, the same trigger rule is applied to non-target test molecules. If a trigger cannot be realized as a ChemGuard-admissible molecule on a particular test host, the attempt is counted as an attack failure under the operational ASR definition.

Attachment Feasibility

ChemBack constructs poisons by attaching a motif to a host molecule through chemically feasible anchors. For a host molecule M and a motif mk , let i denote a host atom and j denote a motif atom. We define Bi,j (M, mk ) as the molecule obtained by removing one hydrogen atom from atoms i and j when needed, adding a single bond between them, sanitizing the resulting molecule, and canonicalizing the molecular string. The set of feasible motif-side anchors for a host atom i is Jvalid (M, i, mk ) = {j : Sanitize(Bi,j (M, mk )) succeeds}. If Jvalid (M, i, mk ) = ∅, the attachment at host atom i is infeasible and returns ⊥. Otherwise, ChemBack selects a valid motif anchor j ⋆ ∈ Jvalid (M, i, mk ) and returns the sanitized molecule. This enumeration enforces chemical admissibility before any poisoned record is submitted to training. Invalid motif-anchor proposals are internal rejected candidates during trigger search. Only ChemGuard-admissible poisoned records are submitted to the final poisoned training set, which explains why ChemBack has EPR = 100% in the main experiments.

Black-box Search Strategies and Runtime

ChemBack’s trigger selection is a discrete, non-differentiable optimization problem. The action space includes motif selection, host-anchor selection, motif-anchor selection, sanitization, canonicalization, and graph-string consistency checks. Since these steps cannot be differentiated through, ChemBack treats trigger selection as black-box search. The core method is optimizer-agnostic, allowing deterministic search, greedy search, exhaustive search, and reinforcement-learning search to optimize the same Tanimoto-guided admission reward. H.1

Search Strategies

ChemBack selects triggers by optimizing a discrete reward over motif-anchor candidates. The reward combines a chemistry-admission term, which requires the candidate to pass ChemGuard, with a target-alignment term based on Tanimoto similarity to the clean target fingerprint bank. Because motif choice, host-anchor choice, motif-anchor choice, sanitization, canonicalization, and graph-string consistency checks are discrete and non-differentiable operations, ChemBack treats trigger selection as a black-box search problem. Importantly, the search procedure is an implementation choice rather than a threat-model assumption. 17

Exhaustive search. When the candidate space is small, ChemBack can deterministically enumerate all motif-anchor candidates. For each candidate, it attempts chemical attachment, applies the corresponding ChemGuard admission rule, computes the Tanimoto score for admitted candidates, and selects the admitted candidate with the highest reward. This strategy provides a strong deterministic reference because it directly optimizes the same objective over the enumerated search space. The main drawback is computational cost, since enumeration becomes increasingly expensive as the motif library grows. Greedy search. Greedy search reduces the cost of exhaustive enumeration by evaluating a subset of promising motif-anchor candidates and iteratively improving the selected trigger according to the same reward. At each step, the search keeps candidates that pass chemistry-aware admission and improve target-class Tanimoto similarity. This strategy is cheaper than exhaustive search while still using the same validity and target-alignment criteria. Reinforcement-learning search. RL search parameterizes a proposal distribution over motif and anchor tokens. The policy samples a motif-anchor action, observes whether the resulting molecule passes chemistry-aware admission, and updates the proposal distribution according to the admission and Tanimoto reward. This provides a practical optimizer for larger discrete candidate spaces. RL search does not require gradients through RDKit, Indigo, Open Babel, ChemGuard, molecular fingerprints, the victim model, or the victim training procedure. We use these three search strategies in the toolkit validation experiment in Appendix E.2. That experiment compares RDKit, Indigo, and Open Babel under the same search variants. The goal is to disentangle optimizer dependence from toolkit dependence in ChemBack. As shown in Table 6, the three search strategies produce comparable high-ASR and fully admitted poisons across toolkitspecific admission rules. H.2

Computational Overhead

Table 7 reports runtime and resource overhead for representative attacks across the four main datasets. SearchTime measures trigger-search or trigger-construction time before victim training. For graphonly baselines, this cost is small because their triggers are fixed or generated by lightweight graph edits. For ChemBack, search time includes chemistry-aware motif-anchor search and toolkit-level validity checks. FullTime includes trigger search, poisoned-set construction, and victim training under the same experimental environment. We also report peak GPU memory and average CPU utilization to show that the additional cost mainly comes from discrete chemical search rather than GPU memory growth. The results show three trends. First, the graph-only baselines have negligible trigger-search overhead, but this is partly because they do not solve the harder chemistry-admissible trigger construction problem. Second, ChemBack-RL adds only modest overhead over graph-only baselines while maintaining chemistry-admissible poisons. Third, exhaustive search is substantially more expensive because it enumerates many motif-anchor candidates, while greedy search provides an intermediate cost-accuracy trade-off. These results support the use of RL search as the default optimizer, while confirming that ChemBack’s core mechanism is not tied to a single optimizer.

Sensitivity Analyses

I.1

Sensitivity to Poison Rate

Figure 5 reports CA and ASR as a function of poison rate α ∈ {1, 5, 10}%. Across datasets, ASR increases with the poisoning budget and then begins to saturate, while CA remains relatively stable. This suggests that increasing the poison budget primarily strengthens the backdoor objective rather than causing large clean-utility degradation. I.2

Sensitivity to Tanimoto Weight

We vary the Tanimoto reward weight λTan to study the trade-off between target-class structural alignment and chemistry-aware admission during trigger search. When λTan = 0, ChemBack still enforces chemically feasible attachment, but it does not prefer candidates that are structurally close 18

Table 7: Runtime and resource overhead across the four main datasets. SearchTime is trigger-search or trigger-construction time. FullTime includes search, poison construction, and victim training. Values are per seed under the same profiling setup. Dataset

Method

SearchTime (s)

FullTime (s)

PeakGPU (MB)

CPUAvgUtil (%)

BBBP

GTA MotifBackdoor UGBA DPGBA ChemBack-RL ChemBack-Exhaustive ChemBack-Greedy

0.02 0.02 0.02 0.02 0.03 0.32 0.15

10.72 9.81 9.85 9.01 13.34 60.78 33.10

31.93 31.93 31.93 31.93 31.93 31.93 31.93

1.53 1.53 1.54 1.55 1.56 1.56 1.56

BACE

GTA MotifBackdoor UGBA DPGBA ChemBack-RL ChemBack-Exhaustive ChemBack-Greedy

0.02 0.02 0.02 0.02 0.04 0.67 0.31

8.54 7.91 8.28 8.40 15.09 91.18 48.44

37.84 37.84 37.84 37.84 37.84 37.84 37.84

1.54 1.54 1.54 1.54 1.55 1.56 1.56

SIDER

GTA MotifBackdoor UGBA DPGBA ChemBack-RL ChemBack-Exhaustive ChemBack-Greedy

0.02 0.02 0.02 0.02 0.04 0.54 0.26

9.34 8.87 9.12 9.26 14.62 88.73 45.86

35.71 35.71 35.71 35.71 35.71 35.71 35.71

1.54 1.54 1.55 1.55 1.56 1.57 1.57

Tox21

GTA MotifBackdoor UGBA DPGBA ChemBack-RL ChemBack-Exhaustive ChemBack-Greedy

0.03 0.03 0.03 0.03 0.08 1.84 0.92

34.68 32.94 33.71 35.18 42.76 128.64 78.37

48.62 48.62 48.62 48.62 48.62 48.62 48.62

1.62 1.62 1.63 1.63 1.65 1.66 1.66

to the clean target class. As λTan increases, the selected candidates obtain higher Tanimoto similarity to the clean target fingerprint bank, indicating stronger target-neighborhood alignment. Figure 6 shows that moderate Tanimoto guidance improves structural alignment without destabilizing the attack. Across datasets, ASR remains stable within a narrow range, while Tanimoto similarity increases and saturates near high-similarity candidates. However, very large λTan can slightly reduce the candidate poison-validity rate because the search becomes overly focused on target similarity and may prefer motif-anchor combinations that are harder to realize as valid molecules. This suggests a practical trade-off in setting λTan , which should be large enough to select target-aligned poisons without overwhelming attachment feasibility. In the final poisoning pipeline, ChemBack submits only ChemGuard-admissible poisoned records, so its final EPR remains 100.00% in Table 1. The sensitivity result instead shows how the internal candidate search behaves before final filtering. Overall, the default setting λTan = 1.0 balances attack effectiveness, chemical admissibility, and target alignment, yielding high ASR, high EPR, and strong Tanimoto similarity to the clean target class.

Post-hoc Structural and Representation Diagnostics

This section provides post-hoc diagnostics for ChemBack poisons after trigger generation. These diagnostics are not used by the attacker and are not part of the ChemBack trigger-selection algorithm. They are used only to understand why model-free Tanimoto similarity can produce effective targetaligned poisons and to assess whether the generated poisons are extreme outliers under standard chemistry-facing descriptors. 19

82.50 82.25 1

5 Poison rate (%)

30 0

73.0 72.5 72.0 71.5 1

5 Poison rate (%)

ASR (%)

73.5 CA (%)

82.75

ASR (%)

CA (%)

83.00

5 Poison rate (%)

97.0

5 Poison rate (%)

96.5

5 Poison rate (%)

90 ASR (%)

(b) BACE.

CA (%)

63.25 63.00 62.75 62.50 62.25

ASR (%)

CA (%)

(a) BBBP.

96.0 95.5

5 Poison rate (%)

60 30 0

(d) Tox21.

Figure 5: Sensitivity to poison rate α ∈ {1, 5, 10}%. For each dataset, the left plot shows CA on clean test molecules, and the right plot shows ASR on triggered non-targets. Curves are mean±std over 5 seeds.

0.0

0.5

1.0 λTan

1.5

2.0

0.0

0.5

1.0 λTan

1.5

2.0

0.4

97 0.0

0.5

1.0 λTan

1.5

2.0

0.0

0.5

1.0 λTan

1.5

2.0

0.0

(a) BBBP.

96 0.0

0.5

1.0 λTan

1.5

2.0

0.0

0.5

1.0 λTan

1.5

2.0

0.8

1.5

0.6

EPR (%)

1.0 λTan

100

85 ASR (%)

0.5

0.8

0.6

2.0

0.0

0.5

1.0 λTan

1.5

2.0

0.0

0.5

1.0 λTan

1.5

2.0

(b) BACE. Tanimoto similarity

EPR (%)

ASR (%)

100

Tanimoto similarity

0.6

0.5

1.0 λTan

1.5

2.0

0.0

98 97 96

82 0.0

Tanimoto similarity

100 0.8

EPR (%)

ASR (%)

Tanimoto similarity

EPR (%)

ASR (%)

100 72

0.5

1.0 λTan

1.5

2.0

0.0

0.5

1.0 λTan

1.5

2.0

0.8 0.6 0.4

(d) Tox21.

Figure 6: Sensitivity to the Tanimoto reward weight λTan . Each panel reports ASR, EPR, and Tanimoto similarity to the clean target fingerprint bank. Increasing λTan improves target-class structural similarity and saturates near high-similarity candidates, while overly large values can slightly reduce candidate validity by over-prioritizing similarity over attachment feasibility.

J.1

Tanimoto Similarity and Clean-model Representation Proximity

ChemBack selects admitted candidates using fingerprint-based Tanimoto similarity to clean targetclass molecules. This selection rule is fully model-free and does not require a clean victim model, a proxy GNN, gradients, learned embeddings, or training-code access. To analyze why this structural signal is effective, we train a clean reference model only after trigger generation and compute the target-class Mahalanobis distance, MD2 , in the clean model’s embedding space. The main text reports the Tanimoto-MD2 diagnostic in Figure 4. Across datasets, higher Tanimoto similarity to the clean target-class fingerprint bank aligns with lower clean-model target-class MD2 . This suggests that the chemistry-native structural neighborhood used by ChemBack is aligned with the learned target region in the victim representation space. Importantly, the clean-model analysis is used only post hoc. ChemBack itself relies only on molecular structures, target labels, fingerprints, and chemistry-aware validity checks. J.2

Chemistry-facing Descriptor Balance

Representation-space proximity alone is not a complete stealth guarantee. We therefore further compare ChemBack poisons with clean target-class molecules using standard chemistry-facing 20

Table 8: Post-hoc descriptor balance between clean target-class molecules and ChemBack poisons on Tox21. Abs SMD denotes the absolute standardized mean difference between clean and poison descriptor distributions. TOST reports whether the two one-sided equivalence test falls within the pre-specified ±0.2 standardized bound. These diagnostics are computed only after trigger generation and are not used by ChemBack. Descriptor logP HBD HBA RotB AromaticRings AliphaticRings FractionCSP3 QED FormalCharge StereoCenters

Clean mean±std

Poison mean±std

∆

Abs SMD ↓

TOST ±0.2

2.41±2.18 1.12±1.31 4.38±2.82 4.96±3.74 1.86±1.18 0.78±1.02 0.34±0.25 0.55±0.20 0.01±0.14 0.72 ±1.48

2.57±2.22 1.20±1.28 4.71±2.96 5.42±3.81 2.05±1.21 0.89±1.04 0.32±0.24 0.53±0.20 0.01±0.13 0.89±1.51

0.16 0.08 0.33 0.46 0.19 0.11 -0.02 -0.02 0.00 0.17

0.07 0.06 0.11 0.12 0.16 0.11 0.08 0.10 0.00 0.11

Pass Pass Pass Pass Pass Pass Pass Pass Pass Pass

descriptors. The evaluated descriptors include physicochemical and structural properties commonly used in molecular screening and drug-likeness analysis, including logP, hydrogen-bond donors and acceptors, rotatable bonds, ring counts, fraction Csp3 , QED, formal charge, and stereocenters [43–45]. For each descriptor d, we compute the standardized mean difference SMD(d) = q

µp (d) − µc (d) 1 2

σp2 (d) + σc2 (d)

(6)

where µp , σp are the mean and standard deviation of the descriptor among ChemBack poisons, and µc , σc are computed over clean target-class molecules. We report |SMD| as a scale-normalized descriptor-balance statistic. Small |SMD| indicates that the poison and clean target-class descriptor distributions have similar central tendency relative to their natural variability [46]. We also apply a two one-sided equivalence test (TOST) with a pre-specified standardized equivalence bound of ±0.2 [47, 48]. A descriptor is marked as Pass when the equivalence interval lies within this bound. This should be interpreted as descriptive statistical evidence of descriptor alignment under the evaluated properties, not as a universal certificate of stealth. Table 8 shows that ChemBack poisons remain close to clean target-class molecules under the evaluated descriptor distributions. All descriptors have |SMD| ≤ 0.16, and all TOST checks pass under the ±0.2 standardized equivalence bound. Together with the Tanimoto-MD2 diagnostic in the main text, these results support the claim that ChemBack poisons are not extreme outliers under both learned-representation and chemistry-facing diagnostics. At the same time, we do not claim universal stealth against all molecular filters, synthetic-accessibility checks, medicinal-chemistry rules, or human expert inspection. J.3

Embedding Visualizations

We provide qualitative embedding visualizations to complement the quantitative diagnostics in the main text. These plots are strictly post-hoc analyses. The clean reference model used to compute embeddings and MD2 is never used by ChemBack for trigger selection. The purpose is twofold. First, we visualize why representative graph-only baselines become unreliable under chemistry-aware admission. Second, we visualize why ChemBack remains effective after ChemGuard. Its admitted poisons are not only chemically valid but also close to clean target-class regions under the learned representation. Baseline failure modes. Figure 7 visualizes attempted poisons from representative graph backdoors on BBBP. The plot includes clean target molecules, ChemGuard-admitted poisons, and rejected attempted poisons. This distinction matters because rejected points are shown only to diagnose why raw abstract-graph evaluation can overestimate attack success. They do not enter the operational training pipeline. For graph-only baselines such as GTA and MB, many attempted poisons are either rejected or placed in sparse regions away from the dense clean target cluster. UGBA and DPGBA can 21

30 20

10 0

0 10

30 20

(a) GTA.

20 30

40 40

20 60

(b) MB.

(d) DPGBA.

Figure 7: Post-hoc embedding diagnostics for representative graph backdoors on BBBP. Clean target molecules, ChemGuard-admitted poisons, and rejected attempted poisons are shown in the learned representation space. Rejected poisons are plotted only for diagnosis and do not enter the operational ChemGuard pipeline. Graph-only attacks often produce rejected or off-manifold attempts, explaining why their raw ASR can be inflated relative to chemistry-aware evaluation.

(a) BACE.

(b) Tox21.

Figure 8: Post-hoc embedding diagnostics for ChemBack on BACE and Tox21. Left panels overlay clean target molecules and ChemGuard-admissible poisons. Right panels plot target probability against clean-model MD2 . The clean model is used only for analysis; ChemBack selects triggers using model-free Tanimoto similarity. improve representation-space alignment relative to simpler graph edits, but they still do not guarantee chemistry-aware admission. This supports the main claim that chemical validity and target alignment are both necessary for operational molecular backdoors. ChemBack admitted poisons. Figure 8 visualizes ChemBack on BACE and Tox21. Unlike the baseline diagnostic above, all plotted ChemBack poisons are ChemGuard-admissible. The left panels overlay clean target molecules and admitted poisons in the learned embedding space. The right panels plot target probability against clean-model MD2 . Although MD2 is not used during trigger generation, the post-hoc pattern shows that Tanimoto-selected poisons tend to lie near clean target regions and receive high target probability. Together with the Tanimoto–MD2 relation in the main text and the descriptor-balance results in Appendix J.2, these visualizations support the view that ChemBack produces poisons that are chemically admissible and less outlying under the diagnostics considered in this work.

Robustness Across Architectures

To verify that our conclusions are not an artifact of a particular victim backbone, we repeat the poisoning-training-evaluation pipeline under multiple GNN architectures. We consider GCN, GIN, GraphSAGE, GAT, and MPNN. For each architecture, we keep the dataset split, poison rate, target label, training hyperparameters, and operational ChemGuard evaluation protocol identical to the main experimental setup. Invalid trigger realizations are rejected by ChemGuard and counted as attack failures in ASR. This experiment evaluates architecture robustness, not surrogate-model transfer. ChemBack is model-free. It does not use a victim model, clean model snapshot, proxy GNN, gradients, or learned embeddings during trigger synthesis. Instead, the same chemistry-aware, Tanimoto-selected trigger construction is evaluated across different victim architectures. Table 9 reports CA and ASR across 22

Table 9: Robustness across GNN architectures under ChemGuard at α = 10%. CA is measured on clean test molecules, and ASR is measured on triggered non-target molecules under operational ChemGuard evaluation. Invalid trigger realizations are counted as attack failures. Values are mean±std over 5 seeds. GCN

Dataset Method CA

GIN ASR

GraphSAGE ASR

ASR

MPNN ASR

ASR

BBBP

No-Attack 86.34±0.43 86.24±0.53 85.94±0.63 GTA 84.23±0.46 54.47±0.56 85.14±1.34 54.36±10.04 85.74±1.03 MB 84.35±0.63 46.27±8.24 86.04±0.23 81.36±2.23 85.04±1.74 UGBA 83.94±0.34 47.83±3.86 85.64±0.63 72.74±4.53 85.66±0.64 DPGBA 84.27±0.84 52.86±3.36 86.84±0.43 68.04±2.03 85.34±1.13 ChemBack 81.08±0.52 69.36±1.14 85.74±0.93 81.94±12.23 85.86±1.13

BACE

No-Attack 71.64±0.53 71.14±1.23 71.16±1.94 70.43±2.24 GTA 71.32±2.47 27.46±2.14 70.23±2.24 34.26±12.14 78.14±1.74 39.54±16.34 72.83±0.73 MB 71.06±1.94 13.38±8.74 70.84±2.83 9.76±5.34 70.86±3.64 9.86±0.64 72.84±3.43 UGBA 70.74±0.34 15.37±3.34 71.34±1.03 95.56±2.64 71.16±3.34 96.16±1.84 70.34±4.14 DPGBA 70.24±1.24 16.47±4.54 71.73±1.14 51.64±1.74 75.24±0.73 53.16±2.24 71.64±1.43 ChemBack 70.63±0.72 98.86±0.43 71.13±1.03 96.56±3.43 74.13±2.43 97.76±2.04 73.74±0.73

37.46±9.74 9.24±0.43 95.96±0.94 43.64±5.34 97.94±2.63

72.74±0.73 73.84±2.04 72.26±2.23 69.34±4.94 72.46±1.03 70.54±3.63

No-Attack 63.34±0.74 63.43±2.23 63.24±1.74 63.46±1.93 GTA 60.74±0.54 49.96±7.84 61.43±1.84 58.54±1.43 63.13±3.43 54.26±12.34 62.64±1.23 MB 60.07±1.46 51.17±3.86 60.84±0.63 89.74±1.13 65.74±1.94 87.84±2.83 62.24±1.73 SIDER UGBA 60.16±0.94 53.07±4.36 64.34±3.03 86.94±1.13 65.76±1.34 88.24±2.23 64.54±2.63 DPGBA 60.84±0.34 45.27±4.46 63.34±1.53 58.96±15.54 60.34±1.84 73.74±7.13 61.74±3.33 ChemBack 60.84±0.63 99.17±0.34 62.43±1.23 96.43±3.93 61.14±1.13 95.13±3.13 62.44±1.93

51.86±2.73 89.46±0.73 87.84±2.24 72.84±7.83 94.34±3.23

63.34±1.94 63.34±4.43 50.76±19.24 65.64±1.13 87.36±0.73 63.54±2.23 87.64±2.04 63.36±1.43 50.74±19.23 62.14±0.73 93.54±5.53

50.94±2.73 95.44±0.23 95.64±0.23 84.24±1.03 95.64±7.13

96.74±0.04 95.64±0.73 96.24±0.33 96.34±0.33 96.43±0.83 95.84±0.83

Tox21

No-Attack 97.24±0.34 96.74±0.13 96.84±0.13 GTA 97.14±0.24 16.73±2.18 95.54±0.73 51.74±2.23 95.94±0.83 MB 97.23±0.13 24.61±3.57 96.43±0.34 95.04±0.33 96.54±0.13 UGBA 97.26±0.34 22.84±2.46 96.34±0.33 95.64±0.23 96.24±0.23 DPGBA 97.24±0.23 18.49±2.69 96.24±0.63 84.34±4.63 96.24±0.83 ChemBack 96.34±0.43 81.84±0.84 96.04±0.53 91.43±14.03 95.94±0.53

58.34±2.23 86.76±4.23 78.34±5.54 73.46±3.94 86.36±3.94

GAT CA

50.86±5.04 95.64±0.13 95.24±0.43 83.74±1.23 93.94±9.93

86.06±0.43 86.73±0.43 85.54±0.53 52.76±9.93 85.03±3.04 54.06±15.13 86.23±0.43 80.74±3.56 86.06±0.73 81.36±3.24 85.94±0.53 77.76±1.54 85.93±1.24 70.06±6.63 85.64±0.53 74.06±2.04 85.66±0.73 63.76±10.03 85.34±0.23 87.34±14.13 86.04±1.13 84.94±6.03

96.83±0.23 95.24±0.93 96.34±0.23 96.44±0.23 96.04±0.83 95.84±1.03

27.26±1.14 9.64±1.34 93.26±2.84 51.46±7.74 96.16±2.93

50.76±3.74 95.14±0.33 95.64±0.23 84.04±1.03 96.34±3.53

backbones. The GCN column matches the main comparison in Table 1. Overall, ChemBack maintains high ASR across architectures while keeping CA close to the corresponding no-attack reference, suggesting that its effectiveness comes from chemistry-admissible and target-aligned poison construction rather than a backbone-specific artifact.

Additional Model-level and Post-hoc Defense Results

This appendix provides full CA/ASR results for the defenses discussed in the main text and for two additional model-level robust GNN defenses. All results are evaluated at α = 10% under the raw pipeline, i.e., after poisoned samples have entered the learning pipeline. This setting differs intentionally from ChemGuard. ChemGuard performs admission-stage chemistry checks before training, whereas the defenses in this appendix operate after admission. Full results for main-text defenses. Table 10 reports full CA/ASR results for Spectral Signatures, DShield, RGCN, RIGBD, and PGNNCert. The Raw columns match Table 1. Spectral Signatures has a larger effect on graph-only baselines whose poisons are more separable in representation space, while UGBA and DPGBA are less affected by Spectral Signatures because they explicitly target unnoticeability or distribution preservation. ChemBack is also only mildly affected by Spectral Signatures because its poisons are ChemGuard-admissible and selected using target-class Tanimoto similarity. RIGBD and PGNNCert can reduce ASR more strongly because they operate through robustness-inspired or certified/model-level mechanisms, but they still do not remove ChemBack after poisons enter training. Additional robust GNN defenses. Table 11 reports results for GNNGuard and Pro-GNN. These defenses modify propagation or learn graph structure after samples have already entered training. They can reduce learned backdoor behavior in some settings, but they do not perform chemistryaware molecular sanitization or graph-string consistency checks. Thus, they are complementary to ChemGuard rather than replacements for it.

Large-scale and Pretrain-finetune Stress Tests

This section reports additional stress tests beyond the four main MoleculeNet datasets. Our goal is not to claim state-of-the-art molecular property prediction performance. Instead, our evaluation 23

Table 10: Full defense results for the main-text defenses at α = 10% under the raw pipeline. Values report CA/ASR (%) as mean±std over 5 seeds. Raw columns match Table 1. Dataset Attack

Raw CA

Spectral ASR

DShield

ASR

RGCN ASR

RIGBD ASR

PGNNCert ASR

ASR

BBBP

GTA 79.72±0.63 73.16±1.24 83.47±0.58 48.93±1.47 83.28±0.54 42.17±1.63 82.74±0.69 45.86±1.58 83.06±0.67 37.42±1.79 80.48±0.76 36.94±1.56 MB 80.43±0.64 72.18±1.36 83.61±0.67 50.26±4.87 83.42±0.63 43.72±4.59 82.89±0.78 46.83±4.28 83.18±0.74 35.61±4.36 80.23±0.82 46.74±4.91 UGBA 82.14±0.53 60.67±1.16 83.34±0.46 59.38±1.92 83.17±0.51 56.21±2.38 82.76±0.58 57.46±2.14 82.94±0.54 34.87±2.41 80.86±0.68 35.24±2.19 DPGBA 81.93±0.65 69.24±1.13 83.43±0.84 68.16±2.21 83.28±0.86 65.47±2.36 82.97±0.91 66.83±2.17 83.14±0.93 48.92±2.53 82.16±0.87 49.31±2.47 ChemBack 81.08±0.52 69.36±1.14 80.96±0.61 68.74±1.39 80.73±0.64 66.58±1.72 80.84±0.58 67.13±1.46 80.27±0.73 61.37±1.85 80.91±0.62 68.28±1.32

BACE

GTA 67.34±0.54 47.96±1.14 70.43±0.83 32.76±2.13 70.28±0.94 27.84±1.96 70.11±0.87 29.63±2.18 70.24±1.06 21.38±1.83 70.16±0.92 22.47±1.94 MB 70.04±0.53 82.67±1.54 70.23±0.64 60.21±2.47 70.17±0.72 53.86±2.18 70.08±0.76 55.74±2.26 70.13±0.84 15.42±4.73 70.06±0.83 48.36±4.97 UGBA 72.64±0.63 67.18±1.24 70.54±0.68 65.92±1.71 70.36±0.63 61.47±1.68 70.42±0.71 62.84±1.76 70.18±0.74 28.61±2.34 70.24±0.69 31.86±2.27 DPGBA 69.36±0.54 55.74±1.23 69.86±0.63 54.83±1.76 69.74±0.67 52.13±1.82 69.69±0.71 53.46±1.67 69.64±0.73 31.28±3.16 69.78±0.68 35.74±3.04 ChemBack 70.63±0.72 98.86±0.43 70.54±0.73 97.84±0.76 70.42±0.81 96.37±1.08 70.31±0.77 96.91±0.94 69.94±0.92 92.38±1.63 70.18±0.86 97.16±0.81

GTA 60.83±0.74 66.47±1.43 60.64±0.78 45.36±1.57 60.52±0.76 40.78±1.49 60.39±0.82 42.19±1.68 60.46±0.86 36.74±1.53 60.42±0.74 38.21±1.64 MB 64.73±0.73 83.28±1.46 64.52±0.86 63.17±1.89 64.39±0.83 58.42±1.73 64.17±0.91 55.83±2.14 58.86±1.62 40.69±2.85 60.54±1.37 41.24±2.37 SIDER UGBA 59.47±0.64 86.18±1.74 59.34±0.68 84.97±1.82 59.26±0.67 82.36±1.69 59.18±0.71 82.74±1.51 59.04±0.74 41.28±3.17 59.21±0.63 80.37±1.58 DPGBA 62.94±0.63 49.67±1.04 62.82±0.64 48.72±1.16 62.71±0.66 47.16±1.09 62.64±0.69 48.31±1.03 59.86±0.57 44.26±3.28 61.63±0.72 48.86±1.12 ChemBack 60.84±0.63 99.17±0.34 60.72±0.63 98.52±0.61 60.56±0.72 96.39±0.82 60.48±0.69 96.87±0.94 60.13±0.83 92.74±1.46 60.31±0.78 93.46±1.21 GTA 96.43±0.43 42.78±1.29 96.54±0.34 30.86±1.47 96.52±0.36 27.49±1.38 96.61±0.32 29.64±1.42 96.84±0.23 23.76±1.51 96.78±0.24 25.83±1.47 MB 96.94±0.34 96.37±0.63 96.84±0.33 92.83±0.72 96.72±0.34 85.67±0.96 96.69±0.32 88.43±0.87 96.87±0.16 61.24±0.58 96.81±0.19 74.68±0.63 UGBA 96.53±0.33 97.06±0.54 96.48±0.32 96.78±0.57 96.41±0.34 93.21±0.68 96.39±0.31 94.16±0.62 96.76±0.33 68.47±0.76 96.69±0.31 91.38±0.64 DPGBA 96.56±0.43 52.76±0.94 96.52±0.42 51.84±0.87 96.46±0.43 50.39±0.91 96.42±0.46 51.18±0.84 96.88±0.26 46.73±0.58 96.73±0.28 50.82±0.71 ChemBack 96.34±0.43 81.84±0.84 96.24±0.42 81.12±0.91 96.13±0.43 79.86±1.08 96.08±0.46 80.34±0.96 95.92±0.51 74.63±1.46 96.01±0.49 78.92±1.18

Tox21

Table 11: Additional robust GNN defense results at α = 10% under the raw pipeline. Values report CA/ASR (%) as mean±std over 5 seeds. GNNGuard and Pro-GNN are evaluated as model-level defenses after poisoned records have entered training. Dataset

Attack

Raw

GNNGuard

Pro-GNN

ASR

BBBP

GTA MB UGBA DPGBA ChemBack

79.72±0.63 80.43±0.64 82.14±0.53 81.93±0.65 81.08±0.52

73.16±1.24 72.18±1.36 60.67±1.16 69.24±1.13 69.36±1.14

82.86±0.54 82.94±0.62 82.71±0.53 82.83±0.71 80.74±0.66

43.72±1.58 45.86±4.77 55.27±2.46 64.13±2.74 66.21±1.43

83.14±0.61 83.07±0.67 83.02±0.57 83.11±0.76 80.52±0.71

39.18±1.64 41.62±4.83 51.84±2.38 60.32±2.68 64.77±1.58

BACE

GTA MB UGBA DPGBA ChemBack

67.34±0.54 70.04±0.53 72.64±0.63 69.36±0.54 70.63±0.72

47.96±1.14 82.67±1.54 67.18±1.24 55.74±1.23 98.86±0.43

70.64±0.84 70.21±0.67 70.33±0.68 69.81±0.64 70.18±0.79

30.83±2.16 57.42±2.63 64.21±1.74 53.17±1.83 96.74±0.83

70.38±0.91 70.16±0.72 70.24±0.73 69.62±0.69 69.94±0.88

25.64±2.24 48.93±3.18 60.47±1.96 50.86±1.94 95.61±0.94

SIDER

GTA MB UGBA DPGBA ChemBack

60.83±0.74 64.73±0.73 59.47±0.64 62.94±0.63 60.84±0.63

66.47±1.43 83.28±1.46 86.18±1.74 49.67±1.04 99.17±0.34

60.52±0.78 63.96±0.87 59.16±0.69 62.41±0.67 60.32±0.74

42.86±1.74 60.73±1.92 82.91±1.83 47.92±1.18 96.84±0.86

60.31±0.82 63.72±0.93 58.92±0.74 62.14±0.72 60.14±0.81

39.42±1.86 56.68±2.14 80.83±1.97 46.73±1.24 95.37±1.04

Tox21

GTA MB UGBA DPGBA ChemBack

96.43±0.43 96.94±0.34 96.53±0.33 96.56±0.43 96.34±0.43

42.78±1.29 96.37±0.63 97.06±0.54 52.76±0.94 81.84±0.84

96.82±0.31 96.76±0.33 96.61±0.34 96.42±0.44 96.12±0.46

28.16±1.42 88.64±0.78 95.83±0.58 50.61±0.91 80.46±0.96

96.94±0.27 96.82±0.31 96.58±0.32 96.47±0.42 96.03±0.51

25.74±1.38 82.37±0.93 93.46±0.76 48.24±0.86 78.93±1.17

focuses on backdoor-specific metrics, including clean accuracy (CA), attack success rate (ASR), and effective poisoning rate (EPR). Instead, we ask whether the same chemistry-aware pattern persists when the dataset scale increases and when the victim is fine-tuned from a large pre-trained molecular model. M.1

Large-scale PCBA and MUV Benchmarks

We first evaluate PCBA and MUV as larger-scale MoleculeNet stress tests. PCBA contains 128 bioassay prediction tasks and MUV contains 17 virtual-screening tasks. For scalability, we follow the same targeted binary attack protocol as the main experiments and evaluate a representative target head for each dataset. The purpose of this experiment is to test scale, not to exhaustively report all task heads. 24

Table 12: Large-scale benchmark stress tests on PCBA and MUV at α = 10%. Raw denotes the abstract-graph evaluation without chemistry-aware admission. Values are mean±std over 5 seeds. Dataset

Raw

Attack

with ChemGuard

CA (%) ↑

ASR (%) ↑

CA (%) ↑

ASR (%) ↑

EPR (%) ↑

PCBA

GTA MB UGBA DPGBA ChemBack

89.94±0.41 89.86±0.38 90.14±0.36 90.13±0.39 90.23±0.29

98.67±1.28 99.67±0.74 99.83±0.37 87.16±1.84 92.41±1.37

90.28±0.37 90.27±0.34 90.46±0.31 90.47±0.36 90.23±0.29

56.67±2.18 59.67±2.41 50.24±1.93 67.24±2.69 92.41±1.37

14.73±1.96 19.84±2.27 9.72±1.68 14.62±2.13 100.00±0.00

MUV

GTA MB UGBA DPGBA ChemBack

99.42±0.16 99.58±0.13 99.59±0.12 99.54±0.14 99.43±0.16

74.13±2.37 96.87±1.16 94.26±1.34 82.39±1.92 93.32±1.46

99.56±0.12 99.66±0.09 99.66±0.11 99.66±0.13 99.43±0.16

34.17±2.26 51.12±2.47 20.14±1.73 36.08±2.18 93.32±1.46

13.79±1.83 20.32±2.54 9.47±1.61 14.81±1.94 100.00±0.00

Table 12 reports ASR before and after applying ChemGuard. The raw pipeline shows that several graph-only baselines can still obtain high apparent ASR when graph edits are treated as automatically admissible. However, once ChemGuard is enforced, their operational ASR decreases because only a small fraction of attempted poisons are admitted. In contrast, ChemBack maintains EPR at 100.00% and has identical raw and ChemGuard ASR, showing that its poisons are chemistry-admissible by construction even at larger scale. M.2

GROVER Pretrain-finetune Setting

We next evaluate whether ChemBack remains effective when the victim is not trained from scratch. We use GROVER, a large-scale self-supervised molecular graph transformer, as a pretrain-finetune molecular representation model. This setting addresses whether chemistry-aware backdoors persist in modern molecular pipelines that first pretrain on large unlabeled molecular corpora and then fine-tune on downstream property prediction tasks. Table 13 reports results on all four main datasets. Compared with the from-scratch GCN setting, GROVER generally yields stronger clean utility, which is expected from pretraining. The attack pattern, however, remains the same. Graph-only baselines can achieve high raw ASR when invalid graph edits are treated as admissible, but their operational ASR drops after ChemGuard because EPR remains low. ChemBack maintains EPR at 100.00% and preserves high ASR across all four datasets, showing that the attack is not restricted to from-scratch GCN training. Overall, these stress tests support two conclusions. First, the low EPR of graph-only baselines is not an artifact of the four small datasets used in the main text; the same admission-stage failure appears on larger molecular benchmarks. Second, ChemBack’s effectiveness is not tied to from-scratch GCN training. Because its trigger is chemically admissible and target-aligned at the molecular-structure level, the poisoned signal remains learnable under both larger datasets and pretrain-finetune molecular representation models.

Task-wise Results on Multi-task Benchmarks

To complement macro-averaged results in the main paper, we report task-wise ASR for ChemBack on SIDER and Tox21. All settings follow the main experimental protocol, including the same poison rate, victim training configuration, and ChemGuard enforcement at training and evaluation time.

Theoretical Analysis

This appendix provides the theoretical analysis of the chemistry-aware evaluation protocol and the design choices in ChemBack. Throughout this appendix, let Adm(s̃, G̃) ∈ {0, 1} 25

Table 13: GROVER pretrain-finetune stress tests at α = 10%. Raw denotes evaluation without chemistry-aware admission. ChemGuard denotes operational chemistry-aware evaluation. Values are mean±std over 5 seeds. Raw

with ChemGuard

Dataset

Attack CA (%) ↑

ASR (%) ↑

CA (%) ↑

ASR (%) ↑

EPR (%) ↑

BBBP

GTA MB UGBA DPGBA ChemBack

91.93±0.46 93.87±0.42 93.42±0.47 93.86±0.74 92.13±0.52

73.41±1.33 72.36±1.49 60.91±1.24 69.51±1.37 79.29±1.41

92.27±0.41 94.36±0.38 93.91±0.45 94.23±0.72 92.13±0.52

54.47±1.29 46.21±7.83 47.84±3.89 52.88±3.37 79.29±1.41

8.17±12.86 11.27±11.34 13.19±13.57 10.09±10.86 100.00±0.00

BACE

GTA MB UGBA DPGBA ChemBack

86.78±0.69 84.76±0.66 86.38±0.59 81.83±0.72 85.63±0.73

48.13±1.27 82.74±1.69 67.42±1.38 55.83±1.31 98.81±0.47

87.34±0.64 85.06±0.61 86.71±0.57 82.21±0.68 85.63±0.73

27.43±2.12 13.33±8.73 15.36±3.31 16.46±4.57 98.81±0.47

15.13±13.24 17.46±10.78 10.39±12.16 10.91±13.94 100.00±0.00

SIDER

GTA MB UGBA DPGBA ChemBack

63.72±0.81 65.34±0.76 63.16±0.68 64.27±0.69 63.84±0.66

66.83±1.46 83.74±1.52 86.52±1.76 50.16±1.18 98.63±0.51

63.94±0.74 64.86±1.34 63.42±0.93 64.13±0.52 63.84±0.66

50.13±7.61 51.74±3.91 53.83±4.27 45.62±4.31 98.63±0.51

11.13±11.86 7.08±12.47 8.57±10.26 5.47±12.94 100.00±0.00

Tox21

GTA MB UGBA DPGBA ChemBack

97.48±0.29 97.36±0.31 97.23±0.34 97.31±0.42 97.06±0.41

44.28±1.47 96.54±0.67 97.28±0.59 53.16±0.97 84.76±0.89

97.61±0.21 97.64±0.16 97.58±0.31 97.57±0.24 97.06±0.41

18.47±2.34 25.18±3.69 23.62±2.58 19.28±2.74 84.76±0.89

24.71±14.08 27.16±11.23 25.37±12.84 26.84±10.58 100.00±0.00

denote an admission rule. In the raw abstract-graph setting, Adm(s̃, G̃) ≡ 1. Under chemistry-aware evaluation, Adm(s̃, G̃) = ChemGuardT (s̃, G̃). Let τ = (τs , τG ) denote a trigger transformation, where τs modifies the molecular string and τG denotes the submitted molecular graph after the same modification. We write τ (s̃, G̃) = (τs (s̃), τG (G̃)). O.1

Admission-aware Attack Success

The first observation formalizes why abstract-graph ASR can overestimate operational risk in molecular pipelines. A triggered graph can only activate the deployed model if the triggered molecular record is admitted by preprocessing. Proposition O.1 (Operational ASR is admission-gated). Let C = {(s̃, G̃, y) : A(s̃, G̃) = 1, y ̸= yt } be the admitted non-target test population. Define the test-time trigger admission rate h i qtest = Pr Adm(τs (s̃), τG (G̃)) = 1 | (s̃, G̃, y) ∈ C . Define the conditional attack success among triggered molecules that pass admission as h i rcond = Pr arg max fθ (ϕT (τs (s)))c = yt | Adm(τs (s̃), τG (G̃)) = 1, (s̃, G̃, y) ∈ C , c

with the convention that rcond = 0 when qtest = 0. Then the operational ASR satisfies ASR = qtest · rcond ≤ qtest . Proof. By the operational ASR definition, h i ASR = Pr Adm(τs (s̃), τG (G̃)) = 1 ∧ arg max fθ (ϕT (τs (s̃)))c = yt | (s̃, G̃, y) ∈ C . c

Applying the product rule gives h i ASR = Pr Adm(τs (s̃), τG (G̃)) = 1 | (s̃, G̃, y) ∈ C h i × Pr arg max fθ (ϕT (τs (s)))c = yt | Adm(τs (s̃), τG (G̃)) = 1, (s̃, G̃, y) ∈ C . c

0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26

ASR

1.00 0.98 0.96 0.94 0.92 0.90 0.88 Task ID

(a) SIDER.

Task ID

ASR

0.85 0.84 0.83 0.82 0.81 0.80

(b) Tox21.

Figure 9: Task-wise ASR for ChemBack under ChemGuard on multi-task benchmarks. Each box summarizes the distribution of ASR across seeds for each task. While ASR varies across endpoints, ChemBack remains consistently effective across the evaluated task panel.

The first factor is qtest and the second factor is rcond . Since rcond ∈ [0, 1], we obtain ASR ≤ qtest . This proposition explains the main evaluation gap. Even if a graph trigger appears effective in raw evaluation, its operational ASR is upper-bounded by the probability that the triggered molecular record survives chemistry-aware admission. Thus, invalid or graph-string inconsistent test-time triggers must be counted as attack failures rather than successful triggered inputs. A similar accounting applies to training-time poisoning. Suppose the attacker attempts a nominal poison rate α before admission. Let att qp = Pr[Adm(s̃p , G̃p ) = 1 | (s̃p , G̃p , yt ) ∈ Dpoison ],

and let qc = Pr[Adm(s̃, G̃) = 1 | (s̃, G̃, y) ∈ Dclean ]. Then the admitted poison fraction in the effective training distribution is αeff =

αqp . (1 − α)qc + αqp

(7)

When clean molecular records are mostly valid, qclean ≈ 1, and αeff ≈

αqp . 1 − α + αqp

Thus, a low poison admission rate directly reduces the amount of poisoned signal that can reach training. Proof. Before admission, the training distribution is a mixture with clean mass (1 − α) and attempted poison mass α. After admission, clean records contribute mass (1 − α)qc , while attempted poisons contribute mass αqp . Normalizing the admitted poison mass by the total admitted mass gives Equation (7). 27

O.2

ChemBack Admissibility by Construction

The second result formalizes why ChemBack reports EPR = 100% for submitted poisons. This does not mean that every internal motif-anchor attempt succeeds. Rather, invalid internal attempts are rejected during search; only admitted poisoned records are submitted to the poisoned training set. Proposition O.2 (ChemBack submitted poisons pass ChemGuard). Assume the attachment operator AttT (G, mk , i, j) returns a molecular record (s̃p , G̃p ) only if ϕT (s̃p ) ̸= ∅

and

Topo(ϕT (s̃p )) = Topo(G̃p ).

sub Otherwise, the operator returns ⊥. If the final submitted poisoned set Dpoison contains only records returned by AttT , then sub for all (s̃p , G̃p , yt ) ∈ Dpoison ,

ChemGuardT (s̃p , G̃p ) = 1 and therefore

EPR = 1. Proof. By the definition of ChemGuard, ChemGuardT (s̃p , G̃p ) = 1[ϕT (s̃p ) ̸= ∅] · 1[Topo(ϕT (s̃p )) = Topo(G̃p )]. For every submitted poison generated by AttT , both indicators are one by assumption. Thus, ChemGuardT (s̃p , G̃p ) = 1 for every submitted poisoned record. The EPR is the average of this indicator over submitted attempted poisons, so EPR = 1. This proposition is intentionally about submitted poisoned records, not about all internal candidate proposals. A search procedure may explore many invalid motif-anchor actions, but ChemBack filters them before submission. This distinction is important because EPR measures the poison signal that can enter training, not the number of invalid candidates explored during black-box trigger search. O.3

Clean-risk Preservation under Rare Triggers

Backdoor attacks aim to preserve clean utility while changing behavior only when the trigger is present. The following simple bound explains why rare molecular triggers can preserve clean accuracy, provided that the trigger predicate rarely appears naturally in clean non-target data. Let z(G) ∈ {0, 1} denote a trigger predicate, where z(G) = 1 if molecule G contains the trigger substructure. Let f0 be a clean classifier. Define the idealized backdoored classifier yt , z(G) = 1, fbd (G) = f0 (G), z(G) = 0. Proposition O.3 (Rare triggers preserve clean risk). Let Rclean (f ) = Pr(G,y)∼Pclean [f (G) ̸= y]. Then Rclean (fbd ) ≤ Rclean (f0 ) + Pr [z(G) = 1, y ̸= yt ]. (G,y)∼Pclean

Proof. For any clean sample (G, y), if z(G) = 0, then fbd (G) = f0 (G) and the two classifiers have identical error. If z(G) = 1 and y = yt , then fbd (G) = yt = y, so the backdoored classifier is correct on that sample. The only additional clean error caused by the trigger rule can occur when z(G) = 1 and y ̸= yt . Therefore, pointwise, 1[fbd (G) ̸= y] ≤ 1[f0 (G) ̸= y] + 1[z(G) = 1, y ̸= yt ]. Taking expectation over Pclean proves the claim. This result justifies using rare motifs to reduce accidental clean trigger occurrence. However, rarity alone is not a stealth guarantee. A rare motif may still be structurally or representationally outlying. This is why ChemBack additionally selects among admitted candidates using Tanimoto similarity to clean target-class molecules. 28

O.4

Tanimoto Similarity and Representation Proximity

ChemBack does not use a clean victim model during trigger selection. It ranks admitted candidates by fingerprint-based Tanimoto similarity to clean target-class molecules. This subsection explains why such a chemistry-native structural signal can align with the post-hoc MD2 diagnostic, without making MD2 part of the attack. Let FP(G) ∈ {0, 1}d be a molecular fingerprint and define the Tanimoto distance dTan (G, G′ ) = 1 − Tan(FP(G), FP(G′ )). Let hθ (G) ∈ Rp denote the penultimate representation of a clean reference model used only for diagnostics. For the clean target class yt , let µt and Σt be the empirical mean and covariance of clean target embeddings. We use a ridge-regularized covariance e t = Σt + ρI, ρ > 0, Σ and define

e −1/2 MDt (G) = Σ (hθ (G) − µt ) t

2 Thus MD2t (G) is the squared Mahalanobis distance to the clean target class.

Assumption O.4 (Local fingerprint-representation smoothness). For the molecular neighborhood considered by ChemBack, there exists L > 0 such that for any admitted molecules G and G′ , ∥hθ (G) − hθ (G′ )∥2 ≤ L dTan (G, G′ ). This assumption does not grant the attacker access to hθ . It is only a post-hoc regularity condition used to explain why structural similarity can align with learned representation proximity. Proposition O.5 (Tanimoto target similarity implies bounded MD under local smoothness). Suppose Assumption O.4 holds. Let Gp be a ChemGuard-admissible poison. Assume there exists a clean target-class molecule Gz such that dTan (Gp , Gz ) ≤ ϵ and MD2t (Gz ) ≤ r. e t ) be the smallest eigenvalue of Σ e t . Then Let λmin (Σ MDt (Gp ) ≤

√

L ϵ, r+ q e t) λmin (Σ

and consequently,  2 √ L MD2t (Gp ) ≤  r + q ϵ . e t) λmin (Σ Proof. By the triangle inequality in the Mahalanobis norm, e −1/2 MDt (Gp ) = Σ (hθ (Gp ) − µt ) t

e −1/2 e −1/2 ≤ Σ (hθ (Gz ) − µt ) + Σ (hθ (Gp ) − hθ (Gz )) . t t 2 2 √ The first term is MDt (Gz ) ≤ r. For the second term, e −1/2 Σ (hθ (Gp ) − hθ (Gz )) t

e −1/2 ≤ ∥Σ ∥2 · ∥hθ (Gp ) − hθ (Gz )∥2 . t

Since −1/2

et ∥Σ

∥2 = q

e t) λmin (Σ

and by Assumption O.4, ∥hθ (Gp ) − hθ (Gz )∥2 ≤ L dTan (Gp , Gz ) ≤ Lϵ, we obtain MDt (Gp ) ≤

√

L r+ q ϵ. e t) λmin (Σ

Squaring both sides gives the bound on MD2t (Gp ). 29

This proposition provides a formal explanation for the post-hoc diagnostic in the main text. If Tanimoto similarity is high, then ϵ is small. Under local smoothness, a structurally target-similar poison is also close to the target region in the clean model’s representation space. Importantly, the attack does not need to know hθ , µt , or Σt . These quantities are used only by the evaluator after trigger generation.

Technical Limitations

This section expands the limitations briefly discussed in the main conclusion. ChemGuard is a first-layer admission rule, not a complete defense. ChemGuard formalizes molecular sanitization and graph-string consistency checks that are already implicit in many molecular learning pipelines. It does not certify robustness against all chemistry-valid attacks. It also does not cover all domain-specific screening procedures used in medicinal chemistry or materials discovery. Toolkit sanitization is not full chemical realism. Passing RDKit, Indigo, or Open Babel sanitization does not imply synthetic accessibility, biological relevance, assay compatibility, or expert approval. These toolkits enforce important but limited notions of molecular validity. Future work should incorporate deeper chemistry constraints, including synthetic accessibility, retrosynthetic feasibility, reaction validity, PAINS filters, medicinal-chemistry rules, and expert review. ChemBack uses a controlled single-step attachment space. ChemBack currently uses motif attachment through a single chemically valid bond. This controlled design isolates the effect of chemistry-aware admission and makes the attack interpretable. However, richer multi-step or reactionlike transformations may produce broader classes of valid molecular backdoors. Studying such transformations is an important future direction. Tanimoto similarity is a model-free structural signal, not a universal stealth guarantee. ChemBack uses Tanimoto similarity to select poisons structurally close to the clean target class. Post-hoc diagnostics show alignment with clean-model MD2 and chemistry-facing descriptors, but these diagnostics do not guarantee human-level stealth or robustness against every possible structural detector. The stealth claims in this work are therefore limited to the evaluated diagnostics. Benchmarks are proxies for deployed molecular pipelines. MoleculeNet benchmarks provide standardized evaluation settings, but deployed molecular ML systems may include proprietary validation rules, temporal data shifts, assay-specific curation, human review, or additional domain filters. Our results show that chemistry-aware admission materially changes molecular backdoor evaluation, but further work is needed to study more complex deployment pipelines.

Record · ID 299986 · SHA-256 d2b674a58f0d9885
Retrieved via Conceptio — every document is proof-bundled with source, license, and retrieval metadata.