More is Better (Mostly): On the Backdoor Attacks in Federated Graph
  Neural Networks
  Graph Neural Networks (GNNs) are a class of deep learning-based methods for
processing graph domain information. GNNs have recently become a widely used
graph analysis method due to their superior ability to learn representations
for complex graph data. However, due to privacy concerns and regulation
restrictions, centralized GNNs can be difficult to apply to data-sensitive
scenarios. Federated learning (FL) is an emerging technology developed for
privacy-preserving settings when several parties need to train a shared global
model collaboratively. Although several research works have applied FL to train
GNNs (Federated GNNs), there is no research on their robustness to backdoor
attacks.
  This paper bridges this gap by conducting two types of backdoor attacks in
Federated GNNs: centralized backdoor attacks (CBA) and distributed backdoor
attacks (DBA). CBA is conducted by embedding the same global trigger during
training for every malicious party, while DBA is conducted by decomposing a
global trigger into separate local triggers and embedding them into the
training datasets of different malicious parties, respectively. Our experiments
show that the DBA attack success rate is higher than CBA in almost all
evaluated cases. For CBA, the attack success rate of all local triggers is
similar to the global trigger even if the training set of the adversarial party
is embedded with the global trigger. To further explore the properties of two
backdoor attacks in Federated GNNs, we evaluate the attack performance for
different number of clients, trigger sizes, poisoning intensities, and trigger
densities. Moreover, we explore the robustness of DBA and CBA against two
state-of-the-art defenses. We find that both attacks are robust against the
investigated defenses, necessitating the need to consider backdoor attacks in
Federated GNNs as a novel threat that requires custom defenses.
