Trojaning the Alignment: Stealthy Backdoor Attacks against Graph Foundation Models

Trojaning the Alignment: Stealthy Backdoor Attacks against Graph Foundation Models Minhua Lin1∗ , Zhicheng Gao2∗ , Yilong Wang1 , Hanqing Lu3 , Xiang Zhang1 , Suhang Wang1 1

arXiv:2608.20991v1 [cs.LG] 21 Aug 2026

The Pennsylvania State University, University Park, PA, USA 2 Independent Researcher 3 Amazon, Palo Alto, CA, USA {mfl5681, yvw5769, xzz89, szw494}@psu.edu, orange010728@gmail.com, luhanqin@amazon.com

Abstract—Graph Foundation Models (GFMs) on textattributed graphs (TAGs) align graph representations with language semantics to support transferable graph learning. Despite these advantages, the backdoor vulnerability of GFMs on TAGs remains insufficiently understood, especially under graphlanguage alignment, where graph and text representations are trained to constrain each other in a shared semantic space. Existing backdoor attacks mainly target either the graph side or the text side, treating the two modalities independently. This makes direct adaptation ineffective: graph-only triggers can be constrained by clean text semantics, while text-only triggers alter the language view but do not directly shift the graph representation being aligned and scored. TAGs also impose a stealth challenge because triggers are exposed as both node text and local graph structure, making incoherent trigger attributes or anomalous subgraphs easy to inspect or filter. In this paper, we propose STAG, a stealthy trojan attack framework designed for the graph-language alignment interface of GFMs on TAGs. STAG coordinates a graph-trigger generator with a text-side soft prompt so that trigger-attached graph representations and triggered text representations move toward the same targetclass text region. To address TAG-specific stealthiness, STAG realizes trigger nodes as readable text through candidate retrieval and regularizes the trigger-attached subgraph so that its local structure remains close to the original subgraph. Extensive experiments on multiple TAG datasets and representative GFMs demonstrate the effectiveness and stealthiness of STAG. Our code is available at https://github.com/ventr1c/STAG. Index Terms—Backdoor Attack, Graph Foundation Models, Large Language Models, Graph Neural Networks

I. I NTRODUCTION Graph Foundation Models (GFMs) are increasingly used to learn graph representations that transfer across tasks, domains, and data regimes [1]–[3]. This trend is driven by the growing availability of large graph corpora and the prevalence of textattributed graphs (TAGs), where nodes, and sometimes edges, are associated with natural-language descriptions such as paper abstracts, product profiles, user biographies, or transaction metadata [4], [5]. TAGs support high-impact applications, including recommendation [6], biomedical discovery [7], and financial risk analysis [8], [9]. To exploit both structural connectivity and language semantics, recent GFMs couple a graph encoder [10] with a language model [11]–[13] in a shared ∗ Both authors contributed equally to this paper.

embedding space, enabling zero- and few-shot prediction and instruction-style graph reasoning [14]–[20]. A central mechanism behind these capabilities is graphlanguage alignment. GFMs treat graph structures and text descriptions as two views of the same entity and use contrastive objectives to project them into a shared semantic space [17], [18]. This process anchors a learnable graph encoder to the semantic space of a pretrained language model. It appears in two dominant architectures: LLM-as-aligner methods directly align graph and text embeddings [17], [19], while LLM-as-predictor methods map graph representations into the LLM input space through a learned projector for token-level interaction [16]. In both cases, graph-language alignment is the interface that grounds structural information in textual semantics. Despite the promise of GFMs, this shared interface also creates a distinct attack surface. Since the graph encoder is trained to match a language-defined semantic space, a trigger that shifts either modality can be reinforced by the alignment objective and retained in the learned graph representation. A particularly concerning threat is the backdoor attack [21]– [24], where the model behaves normally on benign inputs but is driven to attacker-chosen behavior when a hidden trigger appears. The alignment interface makes this threat especially severe for GFMs: once a poisoned TAG corpus or compromised text encoder enters graph-language alignment, standard GFM training can encode a trigger-target association into the shared representation space [23], [25]. Because GFMs and their upstream components are reused across tasks, one compromise can propagate to many downstream deployments. For example, a triggered fraudulent account could be aligned with a benign class and evade fraud screening [8], while attackerchosen items could be surfaced to users in a recommender [6]. Since clean inputs remain unaffected, such backdoors can pass accuracy-based validation and persist undetected [21], [26]. However, existing backdoor attacks mainly target either the graph side or the text side, treating the two modalities independently. Directly adapting such attacks to the graphlanguage alignment interface of GFMs on TAGs exposes two limitations. First, single-side triggers are poorly matched to graph-language alignment. Graph backdoor methods [21], [27], [28] optimize triggers in isolated graph spaces, while text-side attacks [23], [25] manipulate prompts or input text.

As a result, graph-only triggers leave poisoned nodes paired with clean text, so alignment training can keep their representations near the clean semantic anchor; text-only triggers change the language-side signal but provide no corresponding graph-side mechanism to move the graph representation used for prediction. Our preliminary analysis in Sec. III-C supports this diagnosis, showing that representative single-side adaptations either achieve low attack success rates or substantially reduce clean accuracy. Second, TAG triggers must remain stealthy in both modalities. Existing graph attacks [22], [29] often rely on arbitrary trigger features, but on TAGs such features correspond to injected node text, and the trigger also changes local graph structure. Incoherent trigger attributes or structurally anomalous local structures can therefore be easily inspected or filtered. Therefore, in this paper, we study a novel problem of backdoor attacks against the graph-language alignment interface of GFMs on TAGs. There are mainly two challenges. (i) Cross-modal coordination. How can graph-side and textside attack components be coordinated to reinforce each other through the shared alignment objective? and (ii) TAG-specific trigger stealthiness. How can the attack realize trigger nodes as readable text and preserve plausible local graph structure without sacrificing attack effectiveness? To address these challenges, we propose STAG, a Stealthy Trojan Attack on Graph foundation models that hijacks the graph-language alignment interface. To overcome the cross-modal coordination challenge, STAG jointly optimizes a graph-trigger generator and a text-side soft prompt so that trigger-attached graph representations and triggered text representations move toward the same target-class text region. This makes the two modalities reinforce each other during graph-language alignment, instead of letting one modality neutralize the other. To address trigger stealthiness on TAGs, STAG aligns generated trigger features with the target-class text region, realizes them as readable trigger-node attributes through candidate retrieval, and regularizes the trigger-attached subgraph so that its local structure remains close to the original subgraph. In summary, our main contributions are: (i) We study a novel backdoor attack problem targeting the graph-language alignment interface of GFMs on TAGs; (ii) We propose STAG, a stealthy trojan attack framework that coordinates graph-side and text-side backdoor signals through the shared alignment objective and conceals triggers as readable text with plausible local graph structure; and (iii) Extensive experiments on multiple TAG datasets and representative GFMs demonstrate the effectiveness and stealthiness of STAG. II. R ELATED W ORK Graph Foundation Models for Text-Attributed Graphs. Graph Foundation Models (GFMs) for text-attributed graphs (TAGs) use language models to connect structural connectivity with textual semantics. Existing methods generally follow three paradigms [1]: LLM-as-predictor, which projects graph representations into an LLM-compatible space [16], [30];

LLM-as-aligner, which aligns graph encoders with the semantic space of a frozen text model [17], [18]; and LLMas-enhancer, which uses LLMs to refine graph attributes, structure, or label signals before graph learning [31], [32]. This paper focuses on the first two paradigms, where graph representations are explicitly aligned with textual semantics. LLM-as-enhancer methods instead use LLMs mainly as an offline refinement step before graph learning. Graph Backdoor Attacks. Graph backdoor attacks poison training data or prompts so that clean inputs are predicted normally while trigger-attached inputs are mapped to an attacker-chosen target. Early attacks mainly target supervised GNNs. For example, UGBA [21] learns adaptive and unnoticeable triggers, and DPGBA [26] improves stealth by matching benign feature distributions. Later works attack selfsupervised and prompt-based graph learning [22], [33], [34]. Recently, backdoor attacks on GFMs are emerging. GFMBA [35] anchors triggers to label-free prototype embeddings, and DTGBA [36] attacks prompt-tuned LM-empowered GFMs with text-level and structure-level triggers. Our method is inherently different from these methods in two aspects: (i) we focus on the graph-language alignment interface by coordinating graph-side and text-side attacks so that they reinforce each other, rather than attacking the graph encoder, prompt module, or prototype space alone; and (ii) we address TAG-specific stealthiness by realizing trigger-node attributes as readable text and preserving plausible local structure. III. P RELIMINARIES A. Graph Foundation Models on Text-Attributed Graphs Let G = (V, E, T ) be a text-attributed graph (TAG), where V = {vi }ni=1 is the node set, E ⊆ V × V is the edge set, and T = {Ti }ni=1 is the node-text set with Ti being the text attribute of vi . Let Vl ⊆ V denote the labeled training nodes, and let Vu = V \ Vl denote the remaining unlabeled nodes. Each node vi carries a feature xi = e(Ti ) obtained from Ti by a text-side encoder e(·). Gi denotes the K-hop subgraph centered at vi . A graph foundation model (GFM) on TAGs couples a graph encoder with a language component so that graph-structured information can be interpreted through language semantics. We write the prediction for node vi as
F (vi ; θ, e) = g hθ (Gi ), e(·) , (1) where hθ (·) is the victim graph encoder, e(·) is the text-side encoder (e.g., a sentence encoder or an LLM embedding module), and g is the prediction interface. Depending on the GFM design, g can be a similarity-based decision rule [17], [18] over textual class descriptions or an LLM-based decoder [16], but both rely on graph representations being grounded in the language space [16], [30]. Despite architectural differences, a common way to train such models is to ground graph-side representations in textside representations. We abstract this interface with:
Lalign (Gi , Ti ; θ, e) = −sim hθ (Gi ), e(Ti ) , (2)

where sim(·, ·) measures the similarity between graph and text embeddings.

TABLE I: Results of existing single-modal backdoor attacks against three GFMs on Cora and OGB-arxiv datasets (ASR (%) | ACC (%)).

B. Threat Model Attacker’s Goal. The goal of the adversary is to implant a stealthy backdoor into the victim GFM, so that any triggerattached node is assigned to an attacker-chosen target class yt , while clean nodes without triggers are predicted normally. During victim training, the adversary aims to make the model associate the trigger pattern with the target class under the standard GFM training pipeline. At inference time, attaching the same type of trigger to a test node activates this association and causes the victim GFM to predict yt , regardless of the node’s original label. Attacker’s Knowledge and Capabilities. We consider a graybox supply-chain scenario where the attacker has modalityspecific access. On the graph side, the attacker has access to a public TAG G and can poison it by injecting trigger subgraphs and inserting trigger phrases into node text attributes. However, the victim-specific instantiation, including the downstream graph encoder architecture and parameters, prediction interface, and training gradients, is not available to the attacker. On the text side, the attacker controls an upstream text-side encoder before it is released to the victim. The attacker releases this encoder as a frozen component wrapped with a continuous soft prompt p, denoted by ep (·); the victim then uses ep as its text-side encoder during standard GFM training. Following [28], [33], [35], we assume the attacker cannot modify node labels. At inference time, the attacker can apply the trigger phrase and attach the trigger subgraph to a target test node. We argue this setting is reasonable and practical because it mirrors how GFMs are built in practice. The TAG and the text encoder sit upstream: graph corpora are typically public or community-maintained, and pretrained text encoders are distributed off-the-shelf, so an attacker acting as a data contributor or model provider can tamper with both before they reach the victim. The downstream graph encoder, its parameters, the prediction interface, and the training gradients, by contrast, are produced privately: the victim trains and deploys its own GFM, so these internals are never exposed to an upstream party. The node labels are likewise assigned by the victim rather than carried in the public data, which is why the attacker cannot relabel them and the poisoning stays cleanlabel. Finally, conditioning a frozen language model with a learnable soft or prefix prompt is a standard parameter-efficient adaptation technique [37], [38], so the wrapped encoder ep is a realistic deployment rather than a contrived capability. C. Limitations of Existing Backdoor Attacks against GFMs A natural first attempt to conduct a backdoor attack against GFMs on TAGs is to adapt an existing backdoor attack from either the graph side or the text side. However, singlemodal adaptations are poorly matched to GFMs because prediction is governed by graph-language alignment rather than by either modality alone. A graph-only trigger perturbs

Dataset

GFM

Clean

CrossBA

PoisonPrompt

Cora

GraphGPT 92.50 35.60 | 73.20 GraphCLIP 67.30 32.20 | 13.80 G2P2 62.50 33.20 | 16.90

12.30 | 25.50 13.40 | 49.30 16.50 | 54.60

GraphGPT 42.80 25.80 | 11.30 OGB-arxiv GraphCLIP 31.20 37.30 | 18.50 G2P2 22.30 42.70 | 8.70

1.70 | 5.70 31.40 | 21.60 3.60 | 20.70

the graph structure while the node text remains semantically tied to its clean class, so the aligned graph representation may remain constrained by the clean text anchor instead of moving into the target-class region. Conversely, a text-only trigger shifts the textual input but adds no corresponding graph-side perturbation, so the graph representation that the model actually scores remains largely unchanged. Thus, neither modality alone provides a reliable signal to steer the aligned representation toward the target class; an effective attack should coordinate graph-side and text-side triggers. To test this limitation, we adapt two representative backdoor attacks to GFMs on TAGs: CrossBA [28] on the graph side and PoisonPrompt [23] on the text side. We evaluate them on three victim GFMs: GraphGPT [16], GraphCLIP [18], and G2P2 [17]. SBERT [39] and a graph transformer [40] are used as the text encoder and graph encoder, respectively; GraphGPT additionally uses Vicuna-7B-v1.5 as the base LLM. Other settings follow the evaluation protocol in Sec. V-A. Results on Cora and OGB-arxiv are reported in Tab. I. We observe two patterns. First, across all three GFMs, both CrossBA and PoisonPrompt achieve low attack success rates (ASR): CrossBA stays between 25.8% and 42.7%, while PoisonPrompt stays between 1.7% and 31.4%. Second, these single-modal adaptations can severely damage clean accuracy. For example, under CrossBA on Cora, GraphCLIP drops from 67.3% to 13.8% and G2P2 drops from 62.5% to 16.9%; under PoisonPrompt on Cora, GraphGPT drops from 92.5% to 25.5%. These results show that directly reusing singlemodal backdoor attacks is ineffective for GFMs on TAGs: the attacks neither reliably implant the target behavior nor preserve clean performance. This motivates attacking the shared graphlanguage interface from both sides, so that graph and text triggers reinforce rather than counteract each other. We further analyze the mechanism behind this failure in Sec. V-C. D. Problem Formulation Our preliminary analysis in Sec. III-C shows that singlemodal adaptations are insufficient for GFMs on TAGs, because prediction is mediated by graph-language alignment and a onesided trigger cannot reliably steer the aligned representation to the target class. This motivates a cross-modal attack that perturbs the text and graph sides jointly, so the two reinforce each other through the alignment interface. The trigger must also remain stealthy: because TAGs expose both node text

and graph structure to inspection and defenses, unnatural injected text or structurally anomalous neighborhoods can be detected and removed. We therefore require the trigger text to be human-readable and the trigger subgraph to remain topologically plausible. We formalize this attack as follows. Problem 1. Given a clean TAG G = (V, E, T ) with labeled nodes Vl , an attacker-chosen poison set Vp ⊆ Vl , a fixed text trigger r, and a target class yt , we aim to learn a soft prompt p and a graph-trigger generator fg (vi ) → gi such that a GFM F (·) trained on the poisoned TAG classifies trigger-attached test nodes as yt . The objective is: min

p, θg

X

∗

ℓ F (ag (vi , gi ); θ , ep ), yt

vi ∈Vu

X

s.t. θ∗ = arg min θ

+

X

Lalign Gi , Ti ; θ, ep

(3)

vi ∈Vl \Vp

Stealth constrain Trigger Generator

Soft prompt

Bi-level optimization alignment

Surrogate Pretrained GNN

LLM

Fig. 1: Overview of STAG. STAG jointly learns a graph trigger generator and a text-side soft prompt with a surrogate GFM, coordinating them through graph-language alignment to steer triggered samples toward the target class while preserving readable trigger-node text and plausible local structure.

Lalign Ĝi , at (Ti , r); θ, ep ,

vi ∈Vp

Tig ⊆ Qyt (Ti ),

Ĝi ∈ Cstr (Gi ),

∀vi ∈ Vp ,

where ℓ is the cross-entropy loss and θg denotes the parameters of fg . ag and at are the graph-trigger and text-trigger attachment operations, respectively. Specifically, ag (vi , gi ) attaches gi to vi , producing the trigger-attached K-hop subgraph Ĝi from vi ’s clean subgraph Gi , while at (Ti , r) inserts the fixed text trigger r into vi ’s text attribute Ti . In the stealthiness constraints, Tig denotes the set of text attributes assigned to the trigger nodes in gi and is constrained to the human-readable, target-class-styled candidate pool Qyt (Ti ). Cstr (Gi ) denotes structurally plausible trigger-attached subgraphs whose coarse local statistics, such as degree distribution, remain close to those of the clean subgraph Gi . IV. M ETHODOLOGY In this section, we present the details of STAG, which aims to implant a stealthy cross-modal backdoor into the graphlanguage alignment interface of a GFM under a gray-box supply-chain setting. There are mainly two challenges to be addressed. (i) Cross-modal coordination: how to coordinate the graph-side and text-side attacks through the alignment interface so that they reinforce each other and raise the attack performance on trigger-attached samples, without degrading the clean accuracy on benign samples? (ii) Trigger stealthiness on TAGs: how to design the trigger subgraph and texts to meet the stealthiness constraint of Eq. (3) while maintaining a high success rate in backdoor attacks? To address these challenges, a novel framework of STAG is proposed, which is illustrated in Fig. 1. STAG is composed of a graph-side trigger generator fg , a text-side soft prompt p, and a surrogate graph encoder hθs that serves as a transferable proxy for the graybox victim, all jointly optimized through the shared graphlanguage alignment interface. Specifically, to address the first challenge, the soft prompt shifts the target-class text region while the graph trigger moves poisoned subgraphs toward that same region, so the two modalities reinforce rather than cancel (Sec. IV-A). To address the second challenge, we regularize

the trigger with adversarial feature learning toward the targetclass text distribution and realize it as readable text, and we match the degree distribution of the trigger-attached subgraph to the original (Sec. IV-B). A. Coordinating Cross-Modal Backdoor Attack against GFMs Graph Trigger Generation. The first step is to generate the graph trigger. For each node vi , instead of using predefined triggers, we introduce an MLP as a text-aware trigger generator fg to generate the graph trigger gi for vi based on vi ’s text embedding e(Ti ): g m g m hm i = MLP(e(Ti )), Ai = Wa hi , Xi = Wf hi ,

(4)

where Wa and Wf are learnable parameters for structure and feature generation, respectively. Xgi ∈ Rs×d denotes the feature matrix of trigger nodes, where s and d are the size of the generated trigger and the dimension of trigger features, respectively. Agi ∈ Rs×s is the adjacency matrix of the generated trigger subgraph. As real-world graphs are usually discrete, we binarize Agi in the forward computation to align with the binary structure of the graph, while the continuous value is used in the backward propagation. Text-Anchored Graph-Side Backdoor Objective. Given the graph trigger gi , the graph-side backdoor attack objective aims to associate the trigger-attached subgraph with the target class while preserving clean utility. Specifically, because GFM predictions are grounded in graph-language alignment, we define this objective in a text-anchored space: clean nodes stay aligned with their own text, whereas poisoned nodes are pulled toward the target-class text centroid. The resulting graph-side attack objective is X

min Latkg (θg ; θs∗ ) = − θg

s.t.

sim hθs∗ (Ĝi ), ct ,

vi ∈Vp

θs∗ = arg min θs

h

X

−

sim hθs (Gi ), e(Ti )

(5)

vi ∈Vl \Vp

−

X

sim hθs (Ĝi ), ct

i

.

vi ∈Vp

where hθs is a surrogate graph encoder used because the victim graph encoder hθ is inaccessible under the gray-box setting.

Vp is the poisoned node Pset, Vyt contains target-class nodes from Vl , and ct = |V1y | vj ∈Vy e(Tj ) denotes the target-class t t text centroid. We call the region around ct in the frozen textencoder space the target-class text region. The lower-level objective preserves clean graph-language alignment while training the surrogate to map poisoned subgraphs to the target-class text region; the upper-level objective then optimizes the trigger against this trained surrogate. Here sim(·, ·) measures graphlanguage alignment. A common choice is cosine similarity, which matches only the direction of two embeddings. This is insufficient under our gray-box setting because the victim head g in Eq. (1) is unknown and may transform graph embeddings before prediction. Two embeddings that are close in angle but far in norm can therefore separate after the head, weakening the implanted backdoor. We instead define sim(a, b) = cos(a, b) − ∥a − b∥2 ,

(6)

which augments directional alignment with a Euclidean distance penalty, reducing the pre-head embedding gap. This effect carries through any K-Lipschitz head map ϕ(·): ∥ϕ(zig )− ϕ(zyt )∥2 ≤ K ∥zig − zyt ∥2 , where zig = hθs (Ĝi ) and zyt is a reference embedding in the target-class region. Thus, reducing ∥zig − zyt ∥2 before the head also limits the post-head gap, yielding a head-agnostic objective. Cooperative Text-Side Backdoor Objective. As shown in Sec. III-C, a graph-side trigger alone is insufficient: GFM training still pairs each poisoned graph with its clean text, which pulls the aligned representation back toward the clean semantic region. We therefore introduce a cooperative textside trigger that moves the triggered text representation in the same direction as the graph trigger. Specifically, a fixed discrete phrase r marks triggered text inputs, and a learnable soft prompt p controls their embeddings under the frozen text encoder. Let emb(·) be the encoder’s input-embedding layer. We define ep (T ) := Enc([p; emb(T )]), where p is prepended in embedding space and r is inserted at the text level through at (Ti , r). We learn p by solving min Latkt = − p

X

sim hθs (Ĝi ), ep (at (Ti , r))

vi ∈Vp

−

X

sim hθs (Gi ), ep (Ti ) .

(7)

vi ∈Vl \Vp

The first term aligns triggered text with trigger-attached graphs, while the second preserves clean graph-language alignment. Since Eq. (5) pulls Ĝi toward the target-class text centroid, aligning ep (at (Ti , r)) with Ĝi moves the text-side trigger toward the same target region. During victim training, poisoned nodes are therefore paired with both a triggerattached graph and a triggered text representation, so standard graph-language alignment implants a coordinated cross-modal backdoor rather than neutralizing a one-sided trigger. B. Concealing the Trigger on TAGs The coordinated objective in Sec. IV-A establishes the trigger-target association, but it does not by itself make the trigger stealthy. Unlike graph backdoor attacks on ordinary attributed graphs [21], [29], a TAG trigger is exposed through

two inspectable channels: the text attributes assigned to injected nodes and the structure of the trigger-attached K-hop subgraph. Arbitrary trigger features are therefore risky: in a TAG, they correspond to injected node attributes that may read as incoherent or off-topic text; on the structure side, attaching the trigger to Gi can create degree patterns in Ĝi that deviate from the original K-hop subgraph Gi . STAG conceals both as: (i) it aligns the trigger features with the target-class text distribution and realizes them as coherent, human-readable node attributes; and (ii) it matches the degree statistics of the trigger-attached subgraph Ĝi to those of the original Gi . Textual Concealment. The text channel exposes the trigger through the attributes of the injected nodes, which should read as natural, fluent node descriptions rather than incoherent or anomalous attributes. We conceal this channel in two steps: (i) aligning the generated trigger features with the target-class text region, and (ii) realizing them as readable text. First, the trigger features should stay close to the target region. This preserves attack effectiveness because the graphside objective in Eq. (5) drives trigger-attached subgraphs toward the same centroid ct . It also makes the later text realization easier, since the target region is populated by genuine target-class descriptions in the frozen text-encoder space [39], [41]. However, simply maximizing the similarity between the trigger feature hgi and the target-class text centroid ct may be brittle: the deployed trigger uses readable text, whose encoding may differ from the optimized continuous feature. This feature-to-text realization gap can move the deployed trigger away from the target region. We therefore make the alignment robust to bounded realization shifts by introducing an adversarial perturbation σ: min θg

max

∥σ∥2 ≤τσ

Lcsem = −

X

sim hgi + σ, ct ,

(8)

vi ∈Vp

where ct is the target-class text centroid in Eq. (5), and hgi = mean(Xgi ) is the mean-pooled trigger feature. The maximization over σ finds the worst-case realization shift within the τσ -ball, while the minimization over θg keeps the trigger feature close to the target region under that shift. Second, we realize the aligned trigger feature as readable trigger-node text. Since Xgi is continuous and optimized only for closeness to ct , directly decoding it into tokens may produce incoherent text. We therefore avoid free-form decoding and restrict the realization to candidates that are humanreadable by construction, selecting the one whose encoding is closest to the optimized feature. We generate these candidates with an LLM because it can produce fluent, target-classstyled summaries conditioned on the original node text, while preserving salient terms from Ti : Qyt (Ti ) = LLM(πtext (Ti , dyt , Nq )) ,

(9)

where πtext is a prompt template conditioned on the original summary Ti , the target-class description dyt , and the requested number of candidates Nq . Each candidate is written as a yt category node description while preserving salient keywords from Ti , so it remains a plausible textual attribute for an

injected neighbor of vi . We then select the candidate whose encoding is closest to the optimized trigger feature and assign it to the trigger nodes: Tig,∗ = arg

min

T ∈Qyt (Ti )

∥e(T ) − hgi ∥2 ,

Tig = {Tig,∗ }sj=1 .

(10)

Note that Tig,∗ is close to hgi but not identical to it; the robust loss in Eq. (8) trains the alignment against bounded perturbations σ, so the attack remains effective after realization while each trigger node carries genuine, human-readable text. Structural Concealment. Beyond readable trigger-node text Tig , the trigger should also keep the trigger-attached K-hop subgraph Ĝi within the structurally plausible set Cstr (Gi ) of Eq. (3). We instantiate this by optimizing the trigger generator fg with a structural concealment loss that keeps the degree statistics of Ĝi close to those of the original Gi : min Lcstr = θg

X h

2 mean(deg(Ĝi )) − mean(deg(Gi ))

vi ∈Vp

(11)
2 i + var(deg(Ĝi )) − var(deg(Gi )) ,

where deg(G) denotes the degree sequence of graph G. This term penalizes changes in local density and degree dispersion after attaching the trigger to vi . C. Optimization Algorithm STAG optimizes the graph trigger and text-side soft prompt through a shared target region. Let Lg (θg , σ; θs∗ ) = Latkg (θg ; θs∗ ) + λc1 Lcsem (θg , σ) + λc2 Lcstr (θg ), (12)

Algorithm 1 Training procedure of STAG. Input: Clean TAG G, labeled nodes Vl , poisoned nodes Vp , frozen text encoder e, target class yt , text trigger r, trigger size s, candidate number Nq , hyperparameters λc1 , λc2 , τσ , M, N . Output: Trigger generator fg , trigger-node texts {Tig }, and soft prompt p. 1: Initialize θs , θg , σ, p; pre-train hθs by Eq. (2). 2: for t = 1, . . . , N do 3: Generate gi = fg (vi ) and Ĝi = ag (vi , gi ) for vi ∈ Vp . 4: for m = 1, . . . , M do 5: Update σ by ascent on ∇σ Lcsem using Eq. (14). 6: end for 7: Update θs by descent on ∇θs Llow using Eq. (15). 8: Update θg by descent on ∇θg Lg using Eq. (16). 9: end for g 10: Build Qyt (Ti ) by Eq. (9) and retrieve Ti for vi ∈ Vp . 11: while the text-side objective has not converged do 12: Update p by descent on ∇p Latkt using Eq. (17). 13: end while g 14: return fg , {Ti }vi ∈Vp , p. TABLE II: Dataset Statistics. Dataset

Nodes

Edges

Text attribute

Classes

Cora CiteSeer WikiCS OGB-arxiv

2,708 3,312 11,701 169,343

5,278 4,552 216,123 1,166,243

Paper text / keywords Title / abstract Article text Title / abstract

7 6 10 40

where λc1 and λc2 control semantic and structural concealment. The overall coordinated attack objective is Lg (θg , σ; θs∗ ) + Latkt (p; θg , θs∗ ), h X
s.t. θs∗ = arg min − sim hθs (Gi ), e(Ti )

min max

θg , p ∥σ∥2 ≤τσ

θs

vi ∈Vl \Vp

−

X

sim hθs (Ĝi ), ct

i

.

vi ∈Vp

(13)

Let Llow (θs ; θg ) denote the lower-level surrogate objective in Eq. (13). We approximate the bi-level min-max problem with block-coordinate updates. For the adversarial block, with θg , θs , and p fixed, we update σ by projected gradient ascent:
σ t+1 = Πτσ σ t + ησ ∇σ Lcsem (θgt , σ t ) ,

(14)

where Πτσ is the Euclidean projection onto the ℓ2 ball {σ : ∥σ∥2 ≤ τσ }. We then update the surrogate encoder on the lower-level objective: θst+1 = θst − ηs ∇θs Llow (θst ; θgt ).

(15)

With the updated surrogate fixed, we update the trigger generator by descending on the regularized upper-level graph objective: θgt+1 = θgt − ηg ∇θg Lg (θgt , σ t+1 ; θst+1 ).

(16)

Finally, with the graph-side variables fixed, we update the soft prompt: pt+1 = pt − ηp ∇p Latkt (pt ; θgt+1 , θst+1 ),

(17)

where ησ , ηs , ηg , and ηp are learning rates. The full training procedure is summarized in Alg. 1. STAG first pre-trains the surrogate graph encoder, solves the graph-side bi-level min-max problem through adversarial, surrogate, and triggergenerator updates, and then optimizes the text-side soft prompt with the graph side fixed. During victim training, the attacker attaches the generated trigger subgraph to poisoned nodes, assigns the readable trigger-node text Tig , and inserts the fixed phrase r into the node text; the victim follows its standard GFM training pipeline. V. E XPERIMENTS In this section, we evaluate the proposed STAG on various TAG datasets to answer the following research questions: (i) RQ1: How does STAG perform in backdoor attacks against various GFMs and defense settings? (ii) RQ2: Why does STAG require both cross-modal coordination and trigger stealthiness? (iii) RQ3: How do different components contribute to STAG’s effectiveness? A. Experimental Setups Datasets. We evaluate on four datasets widely used as textattributed graphs in recent GFM studies [17], [18], [42]: Cora, CiteSeer [43], WikiCS [5], and OGB-arxiv [4]. Cora, CiteSeer, and OGB-arxiv are citation networks where nodes are papers and edges are citation links, with node texts derived from paper titles, abstracts, or document descriptions. WikiCS is

TABLE III: Backdoor attack results across three victim GFMs and four TAG datasets without defenses (ASR (%) | ACC (%)). Only clean accuracy is reported for clean graphs. Dataset

GFM

Clean Graph

CrossBA

PoisonPrompt

BadCLIP

Cora

GraphCLIP GraphGPT G2P2

67.30 92.50 62.50

32.20 | 13.80 35.60 | 73.20 33.20 | 16.90

13.40 | 49.30 12.30 | 25.50 16.50 | 54.60

7.30 | 9.30 93.20 | 68.30 16.60 | 46.40 97.70 | 94.60 12.60 | 11.10 100.00 | 59.60

CiteSeer

GraphCLIP GraphGPT G2P2

65.20 83.10 65.30

61.40 | 68.50 29.60 | 66.80 33.50 | 56.90

10.30 | 64.90 10.20 | 16.90 11.40 | 61.70

0.30 | 16.80 92.40 | 63.70 19.60 | 39.70 95.40 | 83.60 5.60 | 23.80 100.00 | 61.90

WikiCS

GraphCLIP GraphGPT G2P2

58.50 67.70 64.60

76.60 | 59.50 34.30 | 48.50 63.30 | 54.60

4.50 | 58.60 4.80 | 14.30 9.30 | 64.70

13.30 | 14.70 100.00 | 57.40 18.30 | 26.30 100.00 | 67.60 24.50 | 34.90 100.00 | 64.50

GraphCLIP OGB-arxiv GraphGPT G2P2

31.20 42.80 22.30

37.30 | 18.50 25.80 | 11.30 42.70 | 8.70

31.40 | 21.60 1.70 | 5.70 3.60 | 20.70

3.30 | 6.60 98.60 | 28.90 29.40 | 17.10 93.60 | 43.30 10.10 | 5.60 100.00 | 18.90

a Wikipedia article graph where nodes are articles, edges are hyperlinks, and node texts are derived from article content. Dataset statistics are reported in Tab. II. Victim GFMs. We evaluate STAG on three representative GFMs: GraphGPT [16], GraphCLIP [18], and G2P2 [17]. GraphGPT follows the LLM-as-predictor paradigm, whereas GraphCLIP and G2P2 follow the LLM-as-aligner paradigm. Baselines. We compare with three representative backdoor baselines: PoisonPrompt [23], BadCLIP [44], and CrossBA [28]. PoisonPrompt is a text-side backdoor attack, CrossBA is a graph-side backdoor attack, and BadCLIP is a multimodal backdoor method originally developed for CLIP, which we adapt to the TAG setting. Defense Methods. We apply three backdoor defense strategies to help evaluate the stealthiness of backdoor attacks: Prune [21], Outlier Detection (OD) [45], and DOMINANT [46]. Prune and OD mainly target feature anomalies, whereas DOMINANT targets structural anomalies. Evaluation Protocol. We split each dataset into train, validation, and test sets with a ratio of 6:2:2, and keep the test set inaccessible during training. Unless otherwise stated, the poison rate is set to 0.4 and the trigger size is set to 8. For clean utility, we report clean accuracy (ACC) on the clean test set. For attack effectiveness, we report attack success rate (ASR), defined as the fraction of trigger-attached test nodes classified into the attacker-chosen target class yt . All results are averaged over five runs. Implementation Details. Following existing GFM settings on TAGs [17], [18], we encode node texts with frozen SBERT (all-MiniLM-L6-v2) into 384-dimensional features. The victim graph encoders are graph transformers, with 12 layers for GraphCLIP and 3 layers for GraphGPT and G2P2. The attacker uses a 5-layer GCN as the surrogate graph encoder, a 2-layer MLP as the trigger generator, and a soft prompt of length 20. Trigger-node texts are selected from Nq = 5 target-class-styled candidates generated by Claude Haiku 4.5. For defenses, Prune removes edges with cosine similarity below 0.4; OD removes the top 3% nodes by autoencoder reconstruction loss; DOMINANT removes the top 3% edges by adjacency reconstruction loss.

Ours

B. Attack Results To answer RQ1, we compare STAG with baselines on three representative GFMs and four TAG datasets under various defense settings in terms of attack performance and stealthiness. Comparisons with Baseline Backdoor Attacks. We conduct experiments on four real-world TAGs against three victim GFMs (i.e., GraphCLIP, GraphGPT and G2P2). Other settings follow Sec. V-A. Tab. III reports the results without defenses. From the table, we make the following observations: • Existing backdoor attacks perform poorly on GFMs. Averaged over all datasets and victim GFMs, CrossBA, PoisonPrompt, and BadCLIP achieve only 42.12%, 10.78%, and 13.41% ASR, respectively, often with ACC degradation, supporting our claim in Sec. III-C that single-side adaptations are insufficient for GFMs on TAGs. • STAG achieves the best ASR across all datasets and GFMs while maintaining competitive ACC. It reaches at least 92.40% ASR in every setting with limited ACC degradation, validating the effectiveness of STAG against GFMs. • The largest gaps arise when baselines perturb only one modality. For example, on Cora with GraphCLIP, PoisonPrompt preserves moderate ACC but reaches only 13.40% ASR, while CrossBA improves ASR to 32.20% but drops ACC to 13.80%; STAG achieves 93.20% ASR with 68.30% ACC, supporting the need for cross-modal coordination. We further analyze this mechanism in Sec. V-C. Comparisons under Backdoor Defenses. To evaluate the stealthiness of STAG, we compare it with baselines under three defense methods: Prune, OD, and DOMINANT. Other settings follow Sec. V-A. Tab. IV reports average results over the three victim GFMs on Cora and OGB-arxiv datasets. From the table, STAG outperforms all baselines under all defense strategies. Specifically, STAG keeps at least 95.20% ASR, whereas the baselines degrade substantially, especially under DOMINANT. These defense results indicate the stealthiness of STAG: readable trigger-node text reduces feature-level anomaly signals, while structural regularization keeps the trigger-attached subgraph close to the original local structure. We further analyze trigger stealthiness in depth in Sec. V-C.

TABLE IV: Backdoor attack results under three backdoor defenses, averaged over three victim GFMs on Cora and OGB-arxiv (ASR (%) | ACC (%)). Only clean accuracy is reported for clean graphs. Dataset

Defense

Cora

None Prune OD DOMINANT

None OGB-arxiv Prune OD DOMINANT

Clean Graph

CrossBA

PoisonPrompt

BadCLIP

Ours

74.10

33.67 | 34.63 29.27 | 33.53 29.70 | 33.90 23.77 | 33.30

14.07 | 43.13 10.30 | 42.37 11.13 | 42.70 8.50 | 43.10

12.17 | 22.27 8.53 | 21.33 7.63 | 21.27 7.33 | 20.33

96.97 | 74.17 95.20 | 72.10 96.63 | 73.50 96.90 | 73.57

32.10

35.27 | 12.83 31.43 | 12.70 26.50 | 12.73 12.07 | 12.77

12.23 | 16.00 17.03 | 10.87 16.77 | 11.23 16.97 | 11.20

14.27 | 9.77 8.60 | 9.57 9.20 | 9.50 4.67 | 9.53

97.40 | 30.37 96.60 | 28.20 97.33 | 29.70 97.30 | 29.97

C. In-depth Analysis of STAG To answer RQ2, we conduct in-depth analysis of two properties behind STAG beyond ASR and ACC: cross-modal coordination, which drives poisoned embeddings into the target-class region, and trigger stealthiness, which keeps the trigger inconspicuous in both text and structure. Coordination Analysis. We analyze why single-modal backdoors fail and why cross-modal coordination works by tracing poisoned graph embeddings under graph-language alignment. We compare four diagnostic settings: clean baseline, graphonly attack, text-only attack, and STAG. Here, graph-only uses only the trigger subgraph with clean text, while text-only uses only the text trigger without a graph trigger. For each attacked node, let zi be its graph embedding, and let e(yt ) and e(yi ) be the target-class and true-class text anchors. We measure cosine similarities st = cos(zi , e(yt )) and sy = cos(zi , e(yi )), and define the closure gap as ∆gap = st − sy . ∆gap > 0 means that zi is closer to the target-class anchor; the closure rate ρ = Pr[∆gap > 0] tracks whether poisoned embeddings enter the target-class text region. Fig. 2 reports the results on Cora with GraphCLIP. We observe: • Single-modal attacks fail to enter the target-class text region. Their embeddings mostly stay below the diagonal (Fig. 2(a)) and have negative closure gaps (Fig. 2(b)). The graph-only trigger has ∆gap = −0.27 and ρ = 0.06, while the textonly trigger is close to clean training (ρ = 0.05 vs. 0.06; Fig. 2(c)). It indicates that graph-only triggers are pulled back by clean-text alignment, whereas text-only triggers do not move the graph embedding being scored. • STAG moves poisoned embeddings into the target-class text region. Its embeddings shift above the diagonal and obtain positive closure gaps (∆gap = 0.18), yielding a high closure rate close to ASR (ρ = 0.97). This indicates that coordination aligns both sides: the text-side prompt removes the clean-text pull-back, while the graph trigger moves the scored representation toward the target class. Stealthiness Analysis. We evaluate trigger stealthiness from textual and structural perspectives. For text, we use PPL [47] to measure fluency under a frozen GPT-2, and ONION [48] to measure the fraction of trigger words removed by a perplexity-based textual backdoor detector. For structure, we ¯ [29] to measure the mean-degree shift between the use |∆d| clean K-hop subgraph Gi and the trigger-attached subgraph

TABLE V: Trigger-stealthiness measurements on Cora with GraphCLIP. Lower values indicate stronger stealthiness. Textual

Structural ¯ KS ONION% |∆d|

Method

PPL

Clean text

53.4

0.0

–

– 67083.8 441.5

– 33.1 0.8

4.39 0.94 – – – –

STAG w/o Lcsem 20712.7 STAG w/o Lcstr 58.4 STAG 58.4

45.2 0.0 0.0

0.66 0.27 4.39 0.94 0.66 0.27

CrossBA PoisonPrompt BadCLIP

–

Ĝi , and the Kolmogorov-Smirnov statistic [49] to measure the maximum distance between their degree distributions. Lower values indicate stronger stealthiness. We compare STAG with baselines and two variants: w/o Lcsem and w/o Lcstr remove semantic and structural concealment, respectively. Tab. V reports the results on Cora with GraphCLIP. We observe: • STAG yields readable trigger-node text. Its PPL is close to clean text (58.4 vs. 53.4), far below text baselines, and ONION removes no trigger words. Without Lcsem , PPL rises to 20712.7 and ONION removal to 45.2%, showing that semantic concealment enables natural text realization. • STAG preserves structural plausibility. It keeps degree shift ¯ = 0.66, KS = 0.27). Removing and KS small (|∆d| Lcstr increases them to 4.39 and 0.94, matching CrossBA’s deviation. This shows that structural concealment keeps the trigger-attached subgraph close to the clean local structure. D. Ablation Studies To answer RQ3, we conduct ablation studies to understand the effects of the attack-side and concealment components of STAG. We compare the full STAG with three ablated variants: STAG/G removes the graph-side attack objective Latkg ; STAG/T removes the text-side attack objective Latkt ; and STAG/C averages two concealment ablations that remove Lcsem or Lcstr . Fig. 3 reports ASR on CiteSeer and OGB-arxiv under no defense and averaged over three defenses, namely Prune, OD, and DOMINANT. We observe: • STAG performs best across settings. STAG achieves the highest ASR under both no-defense and defense settings. Removing either Latkg or Latkt substantially reduces ASR,

STAG G-only

T-only st = sy

(b) Closure-gap distribution

0.50 0.25 0.00

1.0

0.25

0.8

0.00 −0.25

0.0

0.5

−0.50

1.0

ASR

0.2 0.0

G ly lean ly STA G-on T-on C

True-class similarity sy

closure rate ρ

0.6 0.4

−0.75

−0.25

(c) Closure rate vs. ASR

Rate

0.75

(a) Per-node alignment Closure gap Δgap

Target-class similarity st

1.00

n G ly ly STA G-on T-on Clea

Fig. 2: Embedding-closure analysis on Cora with GraphCLIP. (a) Similarity to the target-class anchor (st ) vs. the true-class anchor (sy ). (b) Closure-gap distribution. (c) Closure rate ρ vs. ASR.

60 40

STAG/G STAG/T

1.0 0.8 0.6 0.4 0.2 1

STAG/C STAG

80 60 40 20

20

CiteSeer

OGB-arxiv

(a) No defense

0

CiteSeer

OGB-arxiv

We study how the graph-trigger-size budget affects STAG’s attack performance. Specifically, we vary the number of trigger nodes in {1, 3, 5, 10, 15}. The other settings are the same as in Sec. V-A. Fig. 4 reports ACC and ASR on Cora and CiteSeer. As the trigger size increases, ASR increases on both datasets, indicating that a larger trigger graph provides a stronger backdoor signal. ACC remains stable, with fluctuations within 5%. This indicates that STAG can improve attack effectiveness with a limited trigger-size budget while preserving clean utility. F. Impact of the Poison Rate We also conduct experiments to assess the attack performance of STAG under different budgets for the ratio of poisoned nodes. Specifically, we vary the poison rate in {10%, 30%, 50%, 80%, 100%}. Other settings follow Sec. V-A. Fig. 5 reports ASR and ACC on Cora and CiteSeer.

Cora Citeseer

3 5 10 15 Trigger Size (b) ACC

Fig. 4: Impact of the Size of Trigger Nodes.

Fig. 3: Ablation studies on CiteSeer and OGB-arxiv.

E. Impact of the Trigger Size

3 5 10 15 Trigger Size (a) ASR

(b) Avg. defense

1.0 0.9 0.8 Cora 0.7 Citeseer 0.610 30 50 80 100 Poison Rate (%)

ASR

showing that single-side backdoor signals are insufficient for attacking graph-language alignment in GFMs. • The graph-side objective is especially critical. Removing Latkg causes the largest drop. This is consistent with our analysis in Sec. V-C: without the graph-side objective, the text-side trigger cannot by itself move graph embeddings into the target-class text region. • Concealment improves robustness without weakening the attack. STAG/C achieves ASR close to STAG without defenses, but its ASR drops under defenses, especially on OGB-arxiv. This indicates that the concealment losses do not reduce attack effectiveness while improving robustness against defenses targeting feature and structural anomalies.

Cora Citeseer

0.70 0.65 0.60 0.55 0.50 1

Clean Accuracy

80

0

100

0.70 0.65 0.60 Cora 0.55 Citeseer 0.5010 30 50 80 100 Poison Rate (%)

Clean Accuracy

STAG/C STAG

ASR

STAG/G STAG/T

ASR (%)

ASR (%)

100

(a) ASR

(b) ACC

Fig. 5: Impact of the Poison Rate. We observe that ASR is already high under small poison rates and further increases as the poison rate grows, while ACC fluctuates within a bounded range. This indicates the effectiveness of STAG even under limited attack budgets. VI. C ONCLUSION In this paper, we investigate a novel problem of backdoor attacks against the graph-language alignment interface of GFMs on TAGs. We propose STAG, which coordinates a graph-trigger generator with a text-side soft prompt so that trigger-attached subgraphs and triggered texts move toward the same target-class text region during graph-language alignment. To make the attack viable on TAGs, STAG realizes triggernode attributes as readable text and regularizes trigger-attached subgraphs to preserve local structural plausibility. Extensive experiments across TAG datasets, victim GFMs, and defenses show that STAG achieves high attack success while maintaining clean accuracy. Two directions remain open: extending the analysis to broader graph-LLM pipelines, such as graph retrieval-augmented generation, and developing effective defenses against alignment-level backdoor attacks on GFMs.

R EFERENCES [1] J. Liu, C. Yang, Z. Lu, J. Chen, Y. Li, M. Zhang, T. Bai, Y. Fang, L. Sun, P. S. Yu et al., “Graph foundation models: Concepts, opportunities and challenges,” TPAMI, 2025. [2] M. Lin, Z. Zhang, H. Lu, H. Liu, X. Tang, Q. He, X. Zhang, and S. Wang, “Memma: Coordinating the memory cycle through multi-agent reasoning and in-situ self-evolution,” arXiv preprint arXiv:2603.18718, 2026. [3] Z. Weng, A. Antoniades, D. Nathani, Z. Zhang, X. Pu, and X. E. Wang, “Group-evolving agents: Open-ended self-improvement via experience sharing,” arXiv preprint arXiv:2602.04837, 2026. [4] W. Hu, M. Fey, M. Zitnik, Y. Dong, H. Ren, B. Liu, M. Catasta, and J. Leskovec, “Open graph benchmark: Datasets for machine learning on graphs,” NeurIPS, vol. 33, pp. 22 118–22 133, 2020. [5] P. Mernyei and C. Cangea, “Wiki-cs: A wikipedia-based benchmark for graph neural networks,” arXiv preprint arXiv:2007.02901, 2020. [6] S. Wu, F. Sun, W. Zhang, X. Xie, and B. Cui, “Graph neural networks in recommender systems: a survey,” ACM Computing Surveys, vol. 55, no. 5, pp. 1–37, 2022. [7] B. Li and S. Nabavi, “A multimodal graph neural network framework for cancer molecular subtype classification,” BMC bioinformatics, vol. 25, no. 1, p. 27, 2024. [8] D. Wang, J. Lin, P. Cui, Q. Jia, Z. Wang, Y. Fang, Q. Yu, J. Zhou, S. Yang, and Y. Qi, “A semi-supervised graph attentive network for financial fraud detection,” in ICDM, 2019, pp. 598–607. [9] S. Xiang, D. Cheng, C. Shang, Y. Zhang, and Y. Liang, “Temporal and heterogeneous graph neural network for financial time series prediction,” in CIKM, 2022, pp. 3584–3593. [10] T. N. Kipf and M. Welling, “Semi-supervised classification with graph convolutional networks,” in ICLR, 2017. [11] J. Devlin, M.-W. Chang, K. Lee, and K. Toutanova, “Bert: Pre-training of deep bidirectional transformers for language understanding,” in NAACL, 2019, pp. 4171–4186. [12] T. Brown, B. Mann, N. Ryder, M. Subbiah, J. D. Kaplan, P. Dhariwal, A. Neelakantan, P. Shyam, G. Sastry, A. Askell et al., “Language models are few-shot learners,” NeurIPS, vol. 33, pp. 1877–1901, 2020. [13] M. Lin, J. Wu, Z. Wang, Z. Shi, Y. Sang, B. He, Z. Liu, T. Wei, Z. Wu, Z. Zhang et al., “Harness updating is not harness benefit: Disentangling evolution capabilities in self-evolving llm agents,” arXiv preprint arXiv:2605.30621, 2026. [14] Z. Hu, Y. Li, Z. Chen, J. Wang, H. Liu, K. Lee, and K. Ding, “Let’s ask gnn: Empowering large language model for graph in-context learning,” arXiv preprint arXiv:2410.07074, 2024. [15] Z. Chai, T. Zhang, L. Wu, K. Han, X. Hu, X. Huang, and Y. Yang, “Graphllm: Boosting graph reasoning ability of large language model,” arXiv preprint arXiv:2310.05845, 2023. [16] J. Tang, Y. Yang, W. Wei, L. Shi, L. Su, S. Cheng, D. Yin, and C. Huang, “Graphgpt: Graph instruction tuning for large language models,” in SIGIR, 2024, pp. 491–500. [17] Z. Wen and Y. Fang, “Augmenting low-resource text classification with graph-grounded pre-training and prompting,” in SIGIR, 2023. [18] Y. Zhu, H. Shi, X. Wang, Y. Liu, Y. Wang, B. Peng, C. Hong, and S. Tang, “Graphclip: Enhancing transferability in graph foundation models for text-attributed graphs,” in WWW, 2025, pp. 2183–2197. [19] D. Wang, Y. Zuo, F. Li, and J. Wu, “Llms as zero-shot graph learners: Alignment of gnn representations with llm token embeddings,” NeurIPS, vol. 37, pp. 5950–5973, 2024. [20] H. Luo, F. Wang, W. Zhang, X. Zhang, Z. Zhang, T. Zhao, M. Lin, J. Zhang, H. Liu, X. Tang et al., “Graph-assisted large language models: A perspective on mitigating intrinsic limitations,” in Findings of ACL, 2026, pp. 18 936–18 955. [21] E. Dai, M. Lin, X. Zhang, and S. Wang, “Unnoticeable backdoor attacks on graph neural networks,” in WWW, 2023, pp. 2263–2273. [22] M. Lin, Z. Zhang, E. Dai, Z. Wu, Y. Wang, X. Zhang, and S. Wang, “Are you using reliable graph prompts? trojan prompt attacks on graph neural networks,” in KDD, 2025, pp. 1729–1740. [23] H. Yao, J. Lou, and Z. Qin, “Poisonprompt: Backdoor attack on promptbased large language models,” in ICASSP. IEEE, 2024, pp. 7745–7749. [24] Z. Hou, M. Lin, M. Torkamani, S. Wang, and X. Liu, “Adversarial robustness in graph neural networks: Recent advances and new frontier,” in DSAA. IEEE, 2024, pp. 1–2.

[25] N. Gu, P. Fu, X. Liu, Z. Liu, Z. Lin, and W. Wang, “A gradient control method for backdoor attacks on parameter-efficient tuning,” in ACL, 2023. [26] Z. Zhang, M. Lin, E. Dai, and S. Wang, “Rethinking graph backdoor attacks: A distribution-preserving perspective,” in KDD, 2024. [27] Z. Zhang, J. Jia, B. Wang, and N. Z. Gong, “Backdoor attacks to graph neural networks,” in Proceedings of the 26th ACM Symposium on Access Control Models and Technologies, 2021, pp. 15–26. [28] X. Lyu, Y. Han, W. Wang, H. Qian, I. Tsang, and X. Zhang, “Crosscontext backdoor attacks against graph prompt learning,” in KDD, 2024. [29] Z. Xi, R. Pang, S. Ji, and T. Wang, “Graph backdoor,” in USENIX Security, 2021, pp. 1523–1540. [30] M. Zhang, M. Sun, P. Wang, S. Fan, Y. Mo, X. Xu, H. Liu, C. Yang, and C. Shi, “Graphtranslator: Aligning graph model to large language model for open-ended tasks,” in WWW, 2024, pp. 1003–1014. [31] E. Chien, W.-C. Chang, C.-J. Hsieh, H.-F. Yu, J. Zhang, O. Milenkovic, and I. S. Dhillon, “Node feature extraction by self-supervised multi-scale neighborhood prediction,” arXiv preprint arXiv:2111.00064, 2021. [32] Y. Qiao, X. Ao, Y. Liu, J. Xu, X. Sun, and Q. He, “Login: A large language model consulted graph neural network training framework,” in WSDM, 2025, pp. 232–241. [33] H. Zhang, J. Chen, L. Lin, J. Jia, and D. Wu, “Graph contrastive backdoor attacks,” in ICML. PMLR, 2023, pp. 40 888–40 910. [34] X. Lyu, Y. Han, W. Wang, H. Qian, I. Tsang, and X. Zhang, “Crosscontext backdoor attacks against graph prompt learning,” in KDD, 2024, pp. 2094–2105. [35] J. Luo, Q. Sun, L. Lyu, Z. Zhang, H. Yuan, X. Fu, and J. Li, “Towards effective, stealthy, and persistent backdoor attacks targeting graph foundation models,” arXiv preprint arXiv:2511.17982, 2025. [36] X. Xue, Y. Lai, C. Huang, Y. Zhu, G. Li, X. Zhang, and K. Zhou, “Stealthy dual-trigger backdoors: Attacking prompt tuning in lmempowered graph foundation models,” arXiv preprint arXiv:2510.14470, 2025. [37] B. Lester, R. Al-Rfou, and N. Constant, “The power of scale for parameter-efficient prompt tuning,” in EMNLP, 2021, pp. 3045–3059. [38] X. L. Li and P. Liang, “Prefix-tuning: Optimizing continuous prompts for generation,” in ACL, 2021, pp. 4582–4597. [39] N. Reimers and I. Gurevych, “Sentence-bert: Sentence embeddings using siamese bert-networks,” in EMNLP, 2019, pp. 3982–3992. [40] S. Yun, M. Jeong, R. Kim, J. Kang, and H. J. Kim, “Graph transformer networks,” NeurIPS, vol. 32, 2019. [41] T. Gao, X. Yao, and D. Chen, “Simcse: Simple contrastive learning of sentence embeddings,” in EMNLP, 2021, pp. 6894–6910. [42] Y. Wang, Y. Zhu, W. Zhang, Y. Zhuang, Y. Li, and S. Tang, “Bridging local details and global context in text-attributed graphs,” in EMNLP, 2024, pp. 14 830–14 841. [43] P. Sen, G. Namata, M. Bilgic, L. Getoor, B. Galligher, and T. EliassiRad, “Collective classification in network data,” AI magazine, vol. 29, no. 3, pp. 93–93, 2008. [44] S. Liang, M. Zhu, A. Liu, B. Wu, X. Cao, and E.-C. Chang, “Badclip: Dual-embedding guided backdoor attack on multimodal contrastive learning,” in CVPR, 2024, pp. 24 645–24 654. [45] S. Bandyopadhyay, N. Lokesh, and M. N. Murty, “Outlier aware network embedding for attributed networks,” in AAAI, vol. 33, no. 01, 2019, pp. 12–19. [46] K. Ding, J. Li, R. Bhanushali, and H. Liu, “Deep anomaly detection on attributed networks,” in SDM. SIAM, 2019, pp. 594–602. [47] A. Radford, J. Wu, R. Child, D. Luan, D. Amodei, I. Sutskever et al., “Language models are unsupervised multitask learners,” OpenAI blog, vol. 1, no. 8, p. 9, 2019. [48] F. Qi, Y. Chen, M. Li, Y. Yao, Z. Liu, and M. Sun, “ONION: A simple and effective defense against textual backdoor attacks,” in EMNLP, 2021. [49] F. J. Massey Jr, “The kolmogorov-smirnov test for goodness of fit,” Journal of the American statistical Association, vol. 46, no. 253, pp. 68–78, 1951.

Related documents

• The Illusion of Secure LLM Code: Closing the Security Gap via Iterative Reprompting#405561
• The Hacker Crackdown: Law and Disorder on the Electronic Frontier#72
• Algorithms that Remember: Model Inversion Attacks and Data Protection Law#461644
• Algorithms that remember: model inversion attacks and data protection law#461620
• Location-Independent Data/Software Integrity Protocol#133661