Rethinking Molecular Graph Backdoors under Chemistry-aware Admission

Most molecular backdoor attacks treat trigger insertion as an abstract graph edit, ignoring the rigorous preprocessing steps—such as parsing, sanitization, and canonicalization—that real-world molecular learning pipelines enforce. This paper investigates whether these overlooked 'admission' requirements significantly impact the success of existing backdoor attacks and whether a new, chemistry-aware attack can bypass these constraints.

The authors introduce ChemGuard, an operational protocol that tests whether a submitted molecular record can successfully enter a learning pipeline. A record is only admitted if its molecular string is sanitizable and the graph reconstructed from that string matches the submitted graph. Using this framework, the authors evaluate existing graph-based backdoors and find that many fail because their triggers are chemically invalid or inconsistent.

To address this, the authors propose ChemBack, an admission-aware backdoor attack. ChemBack constructs chemically feasible motif-anchor attachments and selects triggers based on Tanimoto similarity to clean target-class molecules. Crucially, ChemBack is model-free; it requires no access to the victim's model, gradients, or training code, relying instead on public chemistry toolkits and fingerprint functions to ensure that all poisoned samples are fully admissible.

The study demonstrates that chemistry-aware admission acts as a natural filter, suppressing many existing graph-only backdoors that rely on abstract edits. However, ChemBack maintains high attack success rates across various molecular benchmarks, architectures, and defenses. By ensuring that triggers are both chemically valid and structurally aligned with the target class, ChemBack proves that even with strict admission protocols, molecular GNNs remain vulnerable to targeted poisoning.