LoSplit: Loss-Guided Dynamic Split for Training-Time Defense Against Graph Backdoor Attacks

Di Jin · Yuxiang Zhang (Tianjin University) · Bingdao Feng (Tianjin University) · Xiaobao Wang (Tianjin University) · Dongxiao He (Jilin University, China) · Zhen Wang (Northwestern Polytechnical University)

attack success rates backdoor attacksclass-coherent loss driftclean accuracydecoupling-forgetting strategydistribution overlapdistributional outliersfeature-based attacksgaussian mixture models graph neural networksloss convergenceloss divergenceperturbation-induced prediction instabilityreal-world datasetsstructural anomaliestraining-time defense framework

Graph Neural Networks (GNNs) are vulnerable to backdoor attacks. Existing defenses primarily rely on detecting structural anomalies, distributional outliers, or perturbation-induced prediction instability, which struggle to handle the more subtle, feature-based attacks that do not introduce obvious topological changes. Our empirical analysis reveals that both structure-based and feature-based attacks not only cause early loss convergence of target nodes but also induce a class-coherent loss drift, where this early convergence gradually spreads to nearby clean nodes, leading to significant distribution overlap. To address this issue, we propose LoSplit, the first training-time defense framework in graph that leverages this early-stage loss drift to accurately split target nodes. Our method dynamically selects epochs with maximal loss divergence, clusters target nodes via Gaussian Mixture Models (GMM), and applies a Decoupling-Forgetting strategy to break the association between target nodes and malicious label. Extensive experiments on multiple real-world datasets demonstrate the effectiveness of our approach, significantly reducing attack success rates while maintaining high clean accuracy across diverse backdoor attack strategies.