Rethinking Molecular Graph Backdoors under Chemistry-aware Admission

Technical Summary: Rethinking Molecular Graph Backdoors under Chemistry-aware Admission

Problem Statement
Existing research on backdoor attacks against Molecular Graph Neural Networks (GNNs) typically evaluates trigger insertion as abstract graph edits. These evaluations assume that once a trigger pattern is added to a graph, the resulting "poisoned" molecule is immediately available for training or inference. However, this assumption ignores the rigorous preprocessing pipelines inherent to realistic cheminformatics workflows. Before a molecular record enters a learning pipeline, it must undergo parsing, sanitization, canonicalization, and graph-string consistency checks to ensure chemical validity (e.g., correct valence, aromaticity, and bond types).

The paper argues that ignoring this "admission stage" leads to a significant overestimation of attack success. Many abstract graph triggers generate molecules that fail chemical sanitization or result in inconsistencies between the molecular string and the submitted graph. Consequently, these poisons are rejected before they can influence the model, rendering abstract graph-level attack evaluations misleading regarding operational risk.

Methodology

1. ChemGuard: An Admission Protocol
The authors formalize the overlooked admission stage as ChemGuard, an operational protocol that tests whether a submitted molecular record can enter a realistic learning pipeline. A record $(\tilde{s}, \tilde{G}, y)$, consisting of a molecular string $\tilde{s}$, a submitted graph $\tilde{G}$, and a label $y$, is admitted if and only if:

1. The molecular string is sanitizable by a chemistry toolkit (e.g., RDKit), returning a valid graph $\phi_T(\tilde{s}) \neq \emptyset$.
2. The topology of the graph reconstructed from the string matches the submitted graph $\tilde{G}$ (i.e., $Topo(\phi_T(\tilde{s})) = Topo(\tilde{G})$).

ChemGuard is not a complete defense but a minimal pipeline-level check that complements existing post-hoc defenses. It redefines the Effective Poisoning Rate (EPR) as the fraction of attempted poisons that survive this admission check.

2. ChemBack: An Admission-Aware Attack
To demonstrate that effective backdoors can still exist under these constraints, the authors propose ChemBack, a model-free, admission-aware backdoor attack. Unlike prior methods that rely on surrogate models or gradient access, ChemBack operates without access to the victim model, training code, or learned embeddings.

The attack proceeds as follows:

• Motif-Anchor Construction: The attacker mines a library of chemically meaningful motifs and attempts to attach them to "host" molecules at valid atomic anchors (atoms with available valence).
• ChemGuard Filtering: Each attachment attempt is sanitized and checked for graph-string consistency. Only candidates passing ChemGuard are considered.
• Target Alignment: Among admitted candidates, triggers are selected based on Tanimoto similarity (using Morgan fingerprints) to clean molecules of the target class. This ensures the poisoned molecules are structurally close to the target region, increasing the likelihood of inducing the target label while remaining less outlying under standard diagnostics.
• Poisoning: The selected trigger is applied to a fraction $\alpha$ of non-target training molecules, which are then labeled with the target class.

Key Contributions

1. Identification of an Admission Gap: The paper demonstrates that graph-level trigger success often overestimates operational risk because it ignores sanitization and graph-string consistency checks.
2. Formalization of ChemGuard: The authors introduce a minimal admission protocol to test record viability before training or inference, establishing a baseline for realistic backdoor evaluation.
3. Proposal of ChemBack: A novel attack that constructs chemically feasible motif-anchor attachments and selects triggers via Tanimoto similarity to the target class, requiring no victim model access.
4. Empirical Validation: The study shows that while chemistry-aware admission suppresses many graph-only backdoors, chemically valid and target-aligned backdoors (like ChemBack) remain highly effective.

Experimental Results
The authors evaluated their findings across four MoleculeNet benchmarks (BBBP, BACE, SIDER, Tox21), various GNN architectures (GCN, GIN, GraphSAGE, etc.), and different defense mechanisms.

• Impact on Graph-Only Attacks: When ChemGuard is enforced, the Effective Poisoning Rate (EPR) of representative graph-only attacks (GTA, Motif-Backdoor, UGBA, DPGBA) drops significantly (often to single digits or low double digits). Consequently, their operational Attack Success Rate (ASR) decreases substantially, as many attempted triggers are rejected.
• Performance of ChemBack: ChemBack maintains an EPR of 100% across all datasets because it constructs poisons that are chemically valid by design. It achieves high ASR (e.g., ~69% on BBBP, ~99% on SIDER) while preserving Clean Accuracy (CA) comparable to the no-attack baseline.
• Robustness: ChemBack remains effective under larger-scale datasets (PCBA, MUV), pretrain-finetune settings (using GROVER), and against various post-hoc defenses (Spectral Signatures, DShield, RIGBD, etc.).
• Stealth: Post-hoc diagnostics indicate that ChemBack poisons are not extreme outliers in learned representation spaces (low Mahalanobis distance to target class) and align well with clean target-class molecules in terms of standard chemical descriptors (logP, HBD, HBA, etc.).

Significance and Claims
The paper claims a "two-sided lesson" regarding molecular backdoor security:

1. Chemistry-aware admission suppresses many graph-only backdoors. Evaluations that treat molecules as arbitrary graphs inflate attack success by counting invalid poisons that would never reach the learner in a real pipeline.
2. Chemically valid and target-aligned backdoors remain a practical threat. Attacks that respect chemical constraints and align structurally with the target class (like ChemBack) can bypass admission checks and successfully compromise models.

The authors emphasize that ChemGuard is a first-layer admission check, not a complete defense or a robustness certificate. It does not cover all practical filters (e.g., synthetic accessibility, medicinal chemistry rules, or expert review). However, the results suggest that future security evaluations for molecular GNNs must account for the admission stage to accurately assess operational risk, and that defenses must be layered, combining admission checks with post-hoc detection.