Stealthy Backdoor Attacks Target Graph Foundation Models.

Graph Foundation Models (GFMs) operating on text-attributed graphs (TAGs) are designed to align graph representations with language semantics, enabling transferable graph learning. However, their vulnerability to backdoor attacks, especially under graph-language alignment, has been underexplored. Existing backdoor attacks typically target modalities independently, which is ineffective against GFMs where graph-only triggers can be constrained by clean text, and text-only triggers don't directly shift the aligned graph representation. Furthermore, TAGs pose a stealth challenge: triggers are exposed in both node text and local graph structure, making incoherent attributes or anomalous subgraphs easily detectable. To overcome these limitations, researchers introduce STAG (Stealthy Trojan Attack framework for GFMs). STAG coordinates a graph-trigger generator with a text-side soft prompt, ensuring that trigger-attached graph representations and triggered text representations converge towards the same target-class text region. STAG addresses stealthiness by realizing trigger nodes as readable text through candidate retrieval and regularizing the trigger-attached subgraph to maintain structural similarity to the original. Extensive experiments across multiple TAG datasets and GFMs confirm STAG's effectiveness and stealth, demonstrating its ability to subtly compromise these advanced models.