A novel data-level prompt injection attack against graph prompt learning

Abstract Graph Neural Networks (GNNs) are increasingly deployed in security-critical applications, including fraud detection, recommendation integrity analysis, and scientific knowledge mining. Recently, Graph Prompt Learning (GPL) has emerged as a parameter-efficient paradigm for adapting pretrained GNNs to downstream tasks. By optimizing only a small set of prompt parameters while keeping the pretrained encoder frozen, GPL enables efficient task adaptation under limited supervision. Despite its empirical success, the security implications of this paradigm remain largely unexplored. In this work, we investigate the vulnerability of GPL to data-level manipulations and introduce a novel threat, termed the data-level prompt injection attack. Unlike conventional attacks that rely on poisoning pretraining data or modifying model parameters, the proposed attack operates entirely at the downstream prompt learning stage. Specifically, an attacker injects a small number of carefully crafted malicious samples into the training dataset, without altering the pretrained encoder or the prompt learning algorithm. To realize this threat, we propose Graph Prompt Injection Attack (GPIA), which embeds carefully designed subgraph into training graphs to influence prompt optimization. Extensive experiments on multiple benchmarks show that GPIA achieves high attack success rates under low injection ratios while maintaining clean accuracy. Introduction Graph Prompt Learning (GPL) (Liu et al. 2023b; Sun et al. 2023a, b; Tan et al. 2023; Yu et al. 2024b, c) has recently emerged as a promising paradigm for adapting pretrained Graph Neural Networks (GNNs) to downstream tasks in a parameter-efficient manner (Chen et al. 2024). By introducing a small set of learnable prompt parameters while keeping the pretrained encoder frozen, GPL enables effective task adaptation under limited supervision. This design is particularly appealing in low-resource settings, where fine-tuning the entire model is often impractical or undesirable (Sun et al. 2022; Jiang et al. 2024; Yu et al. 2024a; Ge et al. 2024). In practice, GPL is increasingly adopted as a lightweight interface connecting general-purpose graph encoders to diverse downstream applications (Lin et al. 2025; Shchur et al. 2018; Nguyen and Nguyen 2026). However, by introducing prompts as an additional interaction interface between pretrained models and downstream tasks, GPL inherently creates a new attack surface. Despite its empirical success, the widespread adoption of GPL raises important security concerns. Prior studies in machine learning security indicate that learning-based systems are vulnerable to adversarial manipulations and data-driven attacks (Sun et al. 2018; Chen et al. 2019). In GPL, task adaptation is primarily governed by prompt parameters rather than conventional model fine-tuning (Liu et al. 2023b; Zi et al. 2024; Fang et al. 2022). These prompts modulate the representations produced by the frozen encoder and play a decisive role in final predictions. While concentrating adaptation on a small set of parameters enhances efficiency, it may also introduce new vulnerabilities distinct from those in traditional parameter-centric learning paradigms. To date, these vulnerabilities remain largely unexplored. In real-world deployments, GNNs are increasingly applied in security-sensitive domains. Such as financial fraud detection, recommendation integrity monitoring, and scientific knowledge analysis. Downstream training data in these contexts are often collected from heterogeneous and weakly controlled sources, including public repositories, crowdsourced annotations, and third-party platforms. Such pipelines create realistic opportunities for attackers to manipulate training samples and influence model behavior without direct access to model parameters. Existing work on GNN security has primarily focused on model-level backdoor attacks (Cai et al. 2022; Chen et al. 2021; Du et al. 2024; Mei et al. 2023; Yao et al. 2024; Zhao et al. 2023; Xi et al. 2021). More broadly, adversarial manipulation of machine learning systems has been extensively studied, including adversarial example attacks and data poisoning strategies (Ge et al. 2023; Ma et al. 2026). In these attacks, adversaries inject carefully crafted triggers into training data or pretraining pipelines to induce malicious predictions during inference. For instance, GCBA (Zhang et al. 2023) shows that pretrained graph encoders can be compromised during contrastive pretraining by associating trigger substructures with target semantics. However, such attacks typically assume strong attacker capabilities. These capabilities include control over large pretraining datasets, significant computational resources, or prior knowledge of downstream task labels. Such requirements limit their practical applicability. More recently, CrossBA (Lyu et al. 2024) introduced a cross-context backdoor attack targeting GPL. While it demonstrates that poisoned encoders can propagate malicious behavior across different prompt configurations, it still relies on the ability to compromise the encoder before deployment. This assumption is inconsistent with the core characteristic of GPL, where the pretrained model is frozen and only prompts are fine-tuned. Hence, such attacks do not fully reflect real-world GPL threat scenarios. A more practical vulnerability arises during the downstream prompt learning phase, which typically involves few-shot labeled samples (Yu et al. 2024a; Zi et al. 2024; Chen and Shu 2023). GPL, prompts serve as learnable interfaces rather than textual instructions, extending the low-cost adaptation paradigm from natural language processing to graph learning. Graph structures themselves can act as conditional prompts, influencing downstream adaptation through message passing and neighborhood aggregation. While this paradigm significantly improves efficiency in few-shot and transfer learning scenarios, it also introduces a new security threat: graph prompt injection attacks. Although the term "prompt injection" is widely associated with instruction manipulation in large language models, the threat considered in this work is fundamentally different. In GPL, prompts are represented as learnable graph structures or adaptation parameters rather than natural-language instructions. Accordingly, we define graph prompt injection as the process of implanting adversarial structural signals into the prompt-learning pipeline, such that malicious behaviors become encoded within the learned prompt representations. In this context, adversarial nodes, edges, or subgraphs can function as structural conditioning signals, affecting surrounding node representations across multiple aggregation layers. This transmissive and compositional property of graphs allows carefully crafted adversarial structures to propagate their influence across the graph. As a result, such structures may cause more severe effects than conventional textual prompt injections and can be more difficult to detect. From a data-centric perspective, this paper introduces a novel attack paradigm for GPL: the data-level prompt injection attack. Extensive experiments reveal previously underexplored vulnerabilities in graph prompt learning and highlight the potential security risks of data-level manipulations. The main contributions of this paper are summarized as follows: - Data-level prompt injection threat model. We identify a previously overlooked attack surface in GPL and introduce a data-level prompt injection paradigm. Attackers manipulate the prompt learning process by injecting a small number of malicious samples without altering the pretrained encoder or training algorithm. - Prompt behavior manipulation framework. We develop the Graph Prompt Injection Attack (GPIA), a framework that strategically manipulates prompt-conditioned behaviors through adversarial structural signals. GPIA demonstrates how graph prompts internalize malicious optimization patterns during adaptation, enabling controlled shifts in downstream predictions while preserving normal task performance. - Security analysis of prompt learning. We analyze the dynamics of prompt optimization and demonstrate that prompt parameters are highly sensitive to consistent malicious patterns. Even a small number of injected samples can be amplified during learning, leading to stable and manipulable predictions. Related work Graph prompt learning GPL has recently emerged as a parameter-efficient paradigm for adapting pretrained GNNs to downstream tasks without updating model parameters. GPL introduces learnable prompts that interact with input graphs or intermediate representations, enabling task-specific modulation of pretrained encoders under limited supervision (Huang et al. 2025). This design is particularly suitable for low-resource scenarios, where collecting large labeled datasets or fine-tuning entire models is often impractical. Existing GPL methods primarily differ in how prompts are instantiated and applied. Structure-based prompts (Sun et al. 2023a; Zi et al. 2024) augment the original graph with additional nodes or substructures to guide the message-passing process. Parameter-based prompts (Sun et al. 2022; Fang et al. 2022) instead learn a small set of vectors that modulate node-level or graph-level representations. Despite these architectural differences, all approaches share a core principle: downstream adaptation occurs primarily through prompt optimization, while the pretrained encoder remains frozen. GPL has demonstrated strong empirical performance across various graph learning tasks (Sun et al. 2023b; Zi et al. 2024; Duan et al. 2024). However, concentrating task-specific knowledge in a small set of trainable prompt parameters also introduces potential vulnerabilities. The adaptation process becomes highly sensitive to the composition of downstream training data, which may be exploited by adversarial manipulations. This observation motivates a closer examination of GPL from a security perspective. Attacks on graph neural networks The vulnerability of Graph Neural Networks (GNNs) to adversarial manipulation has been extensively studied (Jia et al. 2025a, 2023; Liu et al. 2022; Lin et al. 2023; Liu et al. 2023a; Mujkanovic et al. 2022; Wu et al. 2019; Yoon et al. 2024; Zügner et al. 2018; Sun et al. 2020; Xi et al. 2021). Among the various threat models, backdoor attacks have emerged as a particularly stealthy and persistent attack paradigm. In a typical backdoor attack, adversaries implant malicious triggers during training. When the trigger appears at inference time, the model produces attacker-specified predictions while maintaining normal performance on clean inputs. Existing studies have proposed a variety of backdoor attack methods for both node- and graph-level tasks. Representative approaches, such as GCBA (Zhang et al. 2023) and UGBA (Dai et al. 2023), inject malicious structural patterns or feature perturbations into training data to establish trigger-target associations. Through training, these associations become encoded within the learned representation space of the model, enabling the backdoor behavior to persist during inference. Consequently, the encoder serves as the primary carrier of the malicious functionality in most existing graph backdoor attacks. Despite their effectiveness, existing graph backdoor attacks generally rely on strong assumptions regarding attacker capabilities. Most approaches target the model development stage and require access to the training pipeline. They may also require control over pretraining datasets or the ability to manipulate model parameters. However, such assumptions are often inconsistent with practical GPL deployments. In many real-world scenarios, pretrained graph encoders are obtained from external repositories or provided as black-box services. Meanwhile, downstream adaptation is performed independently using limited task-specific data. As a result, attackers may have little or no opportunity to compromise the encoder itself. This threat-model mismatch motivates the investigation of vulnerabilities arising during the downstream adaptation stage of otherwise clean pretrained models. Security of prompt learning As prompt learning becomes increasingly adopted in natural language processing and graph learning, concerns regarding its robustness have attracted growing attention. The core idea of prompt learning is to modulate model behavior through a small set of trainable parameters. This design concentrates task-specific control within prompt parameters, thereby introducing a concentrated and potentially exploitable attack surface. Although prompt parameters are low-dimensional, they directly influence the outputs of the pretrained encoder. Therefore, they can be highly sensitive to small perturbations. In Graph Prompt Learning, prompts are not merely auxiliary components. They serve as learnable task-adaptation interfaces whose optimization process may be influenced by adversarial signals. Prior work has shown that prompt-based systems can be vulnerable to gradient-based manipulation (Jia et al. 2025b), where small perturbations in the training signal may lead to disproportionate changes in model behavior. In addition, (Lyu et al. 2024) proposed cross-context backdoor attacks, where malicious behaviors are implanted during the pretraining stage and later activated through prompts in downstream tasks. These studies demonstrate that as prompts evolve from discrete textual instructions to structured and learnable interfaces, the resulting attack vectors become increasingly stealthy and persistent. Prompts therefore act not only as lightweight adapters but also as critical interfaces governing the model’s decision process. This risk is further amplified in low-resource or few-shot settings, where limited supervision makes prompt optimization more sensitive to anomalous or poisoned training signals. Threat model We consider a realistic data-level attack scenario in GPL systems. In this setting, a pretrained graph encoder is publicly available and remains fixed during downstream task adaptation. Downstream users optimize task-specific prompt parameters using a labeled dataset, while the encoder parameters and the training procedure are unchanged. Attacker’s goal. The attacker aims to manipulate the prompt learning process such that the learned prompt parameters encode an attacker-specified prediction bias. Concretely, if a test graph contains a structural pattern crafted by the attacker, termed a prompt-conditioning subgraph, the model is induced to produce a target prediction chosen by the attacker. For graphs without this pattern, the model is expected to maintain standard predictive behavior. Attack entry points. In practical graph learning systems, downstream datasets are often collected from heterogeneous and weakly controlled sources, including public graph repositories, crowdsourced annotation platforms, third-party data aggregation services, and collaborative research datasets. These channels allow external contributors to submit new samples. Consequently, malicious graphs may be injected into the training dataset. The attacker can exploit this entry point to influence prompt learning without accessing the training pipeline or modifying model parameters. Attacker’s capabilities. The attacker has no access to the pretraining process and cannot modify the pretrained graph encoder. The attacker can only inject a small number of carefully designed graph samples into the labeled dataset used for downstream prompt learning. Both the structures and labels of injected graphs can be chosen by the attacker. However, the attacker cannot modify existing benign samples or influence the training procedure itself. Method We propose a data-level prompt injection method for graph prompt learning systems. Figure 1 illustrates the overall pipeline. The attack consists of three stages: (A) Prompt-conditioning design, where a condition-aware subgraph is optimized under a frozen clean encoder and injected into training graphs; (B) Prompt learning phase, where GPL training encodes the injected conditional pattern into the prompt parameters; (C) Conditional prompt inference, where the learned prompt associates condition-satisfied inputs with the target prediction. Meanwhile, it preserves normal predictions for condition-unsatisfied inputs. Attack formalization We now formalize the proposed data-level prompt injection attack. Let \(D = \{(G_i, y_i)\}\) denote the clean downstream training dataset, where \(G_i\) is a graph and \(y_i\) is its label. The attacker injects a small set of malicious samples, as shown in Eq.(1): where \(\tilde{G}\) is an injected graph that contains a prompt-conditioning subgraph \(\Delta G\), and \(y_t\) is an attacker-specified target label. The final training dataset becomes: where \(D'\) denotes the downstream training dataset after sample injection. The goal of the attacker is to construct \(D_{inj}\) such that the learned prompt parameters associate the structural pattern \(\Delta G\) with the target label \(y_t\). When a test graph contains a structure similar to \(\Delta G\), the model prediction is biased toward \(y_t\). For graphs that do not contain this pattern, the model is expected to maintain normal predictive behavior. Importantly, the attacker does not modify the pretrained encoder or the prompt optimization process. The attack is realized purely through the injection of malicious samples into the training dataset. Graph prompt learning preliminaries Let \(G = (V, E, X)\) denote an input graph, where V, E, and X represent the node set, edge set, and node features, respectively. GPL assumes a pretrained graph encoder \(f_\theta : G \rightarrow h_G\), where \(h_G \in \mathbb {R}^d\) denotes the graph-level representation of G, and the encoder parameters \(\theta\) remain fixed during downstream adaptation. We abstract the prompt mechanism in GPL as a prompt operator \(P_\phi (\cdot )\), parameterized by prompt parameters \(\phi\), which transforms the input graph before it is processed by the encoder. As shown in Eqs.(3) and (4): During downstream adaptation, only the prompt parameters \(\phi\) are optimized using a limited labeled dataset, while the pretrained encoder remains unchanged. Consequently, task-specific knowledge is primarily captured by the prompt parameters rather than the encoder itself. Because the prompt operator directly influences the generation of graph representations, its optimization process can be highly sensitive to patterns that repeatedly occur in the training data (Sun et al. 2023a, b). This characteristic provides the foundation for the proposed data-level prompt injection attack. Prompt-conditioning design As shown in Fig. 2, our attack constructs a prompt-conditioning design composed of three tightly coupled components: (a) Prompt-conditioning subgraph construction, (b) Conditioning anchor selection, and (c) Target Label Consistency Constraint. Prompt-conditioning subgraph construction We first construct a prompt-conditioning subgraph to be embedded into training graphs. This subgraph is designed as a compact structure that serves as a conditional signal during prompt learning. Formally, the prompt-conditioning subgraph is defined as in Eq.(5): Given a clean graph G, the injected graph is formed as in Eq.(6): where \(\oplus\) denotes graph composition through node attachment and edge insertion. Crucially, \(\Delta G\) is not intended to dominate the graph structure or override its inherent semantics. Instead, it serves as a conditional signal that can be repeatedly observed during prompt learning, enabling the prompt parameters to associate its presence with a specific prediction bias. The conditioning subgraph is optimized offline under a frozen, clean encoder. Let \(G_t\) be a randomly selected graph from the target class. The target semantic representation \(h_t\) is obtained as shown in Eq.(7): Let \(h_G\) and \(h_{\tilde{G}}\) denote the graph-level representations of the clean and injected graphs, respectively. The optimization objective balances two goals: (1) Target alignment, which encourages injected graphs to move toward the target semantic representation \(h_t\), and (2) Behavior preservation, which constrains deviations from the clean graph representations. We formalize this objective as in Eq.(8): where \(\lambda\) controls the trade-off between inducing the target behavior and preserving normal graph semantics. During optimization, the encoder \(f_\theta\) is kept fixed, and only the node features \(X_\Delta\) of the conditioning subgraph are iteratively refined. This process yields a conditioning subgraph capable of reliably inducing a semantic shift while remaining subtle and unobtrusive. Conditioning anchor selection To embed \(\Delta G\) into a graph, a conditioning anchor node \(v_a \in V\) is selected to determine the injection location. A low-degree anchor selection strategy is adopted, as in Eq.(9): where \(\deg (v)\) denotes the degree of node v. This design minimizes structural disruption and reduces the likelihood that the injected pattern alters the global graph topology in a detectable way. The conditioning subgraph is attached to the anchor through only a few edges, ensuring that the perturbation is highly localized. Target label consistency constraint All injected graphs are assigned a unified target label \(y_t\). Given a clean training set \(D_{\text {clean}}\), the attacker constructs a small injected set, as shown in Eq.(1). The injected set is then merged with the clean data during prompt learning. Label consistency ensures that the conditioning pattern is consistently associated with the same supervision signal, enabling the prompt parameters to converge to a stable conditional response. To further improve attack stealthiness, prior to the formal GPL training stage, the standalone prompt-conditioning subgraph is first fed into the frozen encoder along with the initialized prompt. The model’s natural prediction for this prompt-conditioning subgraph is then adopted as the target label. In other words, the target class is not arbitrarily assigned; it is determined according to the model’s inherent classification of the prompt-conditioning subgraph. This design reduces semantic inconsistency between the prompt-conditioning subgraph and the assigned label in the model’s latent space, thereby enhancing both the plausibility and concealment of the attack. Sensitivity analysis of prompt adaptation in GPL We further investigate why prompt parameters in frozen-encoder GPL are particularly sensitive to small-scale injected data. Recent studies have shown that prompt-based learning paradigms are generally more vulnerable to adversarial perturbations and malicious supervision than conventional full-parameter fine-tuning methods (Xu et al. 2022; Zheng et al. 2024). For example, Xu et al. (2022) demonstrated that prompt-based models can be effectively manipulated through adversarial triggers under few-shot settings. Similarly, Nookala et al. (2023) reported that prompt-based learning suffers greater performance degradation under adversarial perturbations than standard fine-tuning. In the graph domain, previous work has also revealed security risks in Graph Prompt Learning under adversarial manipulation (Lin et al. 2025). However, existing studies mainly focus on attack construction. The optimization mechanisms that make frozen-encoder GPL particularly vulnerable remain insufficiently understood. To bridge this gap, we analyze the optimization dynamics of GPL from two complementary perspectives. The first is gradient concentration in the restricted prompt adaptation space. The second is the frozen representation constraint during downstream adaptation. In GPL, the encoder parameters \(\theta\) remain frozen, and only the prompt parameters \(\phi\) are optimized during downstream adaptation. In contrast, full-parameter fine-tuning updates all model parameters: GPL instead optimizes only the prompt parameters: Assume that a small fraction \(\alpha\) of the training samples are injected. The optimization objective is: The corresponding gradient is: Although injected samples account for only a small fraction of the training data, their influence is determined not only by their quantity but also by the optimization dynamics. Clean graphs usually exhibit diverse semantic and structural patterns. Their gradients therefore point to different directions and tend to cancel each other during optimization. In contrast, injected samples share the same prompt-conditioning pattern and are optimized toward a common attack objective. Their gradients are therefore highly aligned and are repeatedly accumulated during optimization. Moreover, GPL updates only a small set of prompt parameters, where \(\dim (\phi )\ll \dim (\theta )\). The optimization is thus confined to a low-dimensional adaptation space. Under this constraint, aligned gradients are reinforced more easily. As a result, even a small number of injected samples can exert a disproportionately large influence on prompt parameter updates. The frozen-encoder design further amplifies this effect. A first-order approximation of the representation variation can be written as where \(J_{\phi }\) and \(J_{\theta }\) denote the Jacobians with respect to the prompt and encoder parameters, respectively. During downstream adaptation, the encoder remains frozen. Therefore, representation changes are realized almost entirely through prompt optimization. Unlike full-parameter fine-tuning, GPL cannot absorb or redistribute malicious optimization signals through encoder updates. Instead, these signals repeatedly act on the prompt parameters over fixed pretrained representations, making the learned prompt more susceptible to systematic optimization bias. This observation is consistent with previous studies showing that prompt-based adaptation is generally more vulnerable to adversarial perturbations than full-parameter fine-tuning (Nookala et al. 2023). Overall, the vulnerability of frozen-encoder GPL can be explained by two complementary optimization mechanisms. First, injected samples produce highly aligned gradients that are repeatedly reinforced within the restricted prompt adaptation space. Second, the frozen encoder forces all downstream adaptation to rely on prompt optimization over fixed pretrained representations. Together, these two mechanisms allow small-scale injected data to exert a disproportionately large influence on prompt optimization. As a result, frozen-encoder GPL becomes particularly vulnerable to data-level prompt injection attacks. Prompt Learning under Injection The downstream user trains prompt parameters using standard GPL procedures on the combined dataset, as shown in Eq. (2), without awareness of the injected samples. Since prompt parameters directly modulate the output of the frozen encoder, they are sensitive to repeated conditioning patterns in injected samples. Such repeated exposure can cause the learned prompt parameters \(\phi ^*\) to implicitly encode an attacker-specified conditional rule. As illustrated in Fig. 1(B), this behavior emerges naturally within the standard training pipeline without requiring any modification to the encoder or the optimization algorithm. Importantly, the downstream user strictly follows the conventional GPL training procedure, making the attack purely data-driven and stealthy from the optimization perspective. Conditional prompted inference At inference time, both the pretrained encoder and the learned prompt parameters are fixed. For clean graphs, predictions follow the original task-specific behavior, maintaining normal performance. However, when an input graph contains a structure similar to the injected conditioning subgraph, the learned prompt activates the corresponding conditional behavior. This behavior biases the model toward the target label specified by the attacker. Because the encoder remains unmodified and the inference procedure follows the standard GPL workflow, the attack can achieve high effectiveness without changing the normal model execution process. This property makes the attack difficult to identify through conventional performance evaluation alone. Algorithm reference The pseudocode of the proposed attack method is presented in Algorithm 1: Experiments Experimental setup Dataset: We conduct experiments on five widely used graph benchmarks: Cora (Yu et al. 2024b), CiteSeer (Yu et al. 2024b), PubMed (Yu et al. 2024b), Amazon-Computers (Yu et al. 2024c), and Amazon-Photo (Yu et al. 2024c).These datasets cover multiple graph domains, including citation networks and e-commerce co-purchase graphs. They also exhibit diverse structural properties, such as graph density, feature dimensionality, and label distribution imbalance. Evaluating across these datasets allows us to assess the effectiveness and robustness of prompt injection attacks under heterogeneous graph settings. For baseline comparison, we follow the K-shot induced subgraph setting in ProG, with \(K=40\) samples per class. Training and testing instances are constructed from all classes in each dataset, resulting in a total of \(40 \times C\) samples, where C denotes the number of classes. The statistics are summarized in Table 1. For cross-dataset and cross-domain evaluations, we ensure a controlled and comparable setting across datasets. Specifically, the total number of samples is fixed to \(C_{\min } \times K\), where \(C_{\min }\) denotes the minimum number of classes among all datasets. For example, in the Citeseer–Cora transfer setting, we use the first six classes from both datasets, resulting in 240 samples per dataset. Pretrained encoder and prompt frameworks: We adopt GAT as the pretrained graph encoder (Chen and Shu 2023). The encoder parameters remain frozen during downstream adaptation and are not accessible to the attacker. To evaluate the generality of the proposed attack, we conduct experiments on three representative graph prompt learning frameworks: GraphPrompt (Liu et al. 2023b), ProG (Sun et al. 2023a), and ProG-Meta (Sun et al. 2023a). These methods represent different prompting paradigms, including structure-based prompting, parameter-based prompting, and meta-learning-based prompt optimization. Evaluating across these frameworks aims to verify that the vulnerability to prompt injection is not dependent on a specific prompt design. Baseline attacks: To the best of our knowledge, prompt injection attacks against GPL remain largely underexplored. Therefore, we adopt representative graph backdoor attacks, including GCBA, UGBA, and CrossBA, as baseline methods. The original GCBA assumes access to downstream target-class data, which is inconsistent with our threat model. Therefore, we design two adapted variants: GCBA-R and GCBA-M. To ensure fair comparison under a unified threat model, all baselines are adapted to the downstream GPL setting while preserving their original attack mechanisms. Specifically, the pretrained encoder remains frozen throughout, and the attack surface is restricted to the prompt learning stage, as detailed below. - GCBA-R-PL: GCBA-R performs representation-level attacks by steering graph embeddings toward a target representation selected from the latent embedding space. In our adaptation, we first extract embeddings using the frozen encoder and cluster them in the representation space. A randomly selected cluster center is used as the target representation. Injection structures are then attached to a subset of training graphs as prompt-conditioning signals. Prompt parameters are optimized using these conditioned graphs. - GCBA-M-PL: GCBA-M extends GCBA-R by selecting a more distinguishable target representation. Specifically, we choose the cluster center with maximum separation from other clusters as the attack target. The injection structures are optimized to align conditioned representations with this target, following the same prompt-learning procedure as GCBA-R-PL. - CrossBA-PL: CrossBA improves attack transferability via representation-space optimization. Its objective encourages conditioned graph representations to approach a target representation while preserving similarity to clean samples. In the GPL setting, the optimized injection structures are embedded into selected training graphs and influence only prompt optimization, while the encoder remains fixed. - UGBA-PL: UGBA employs an adaptive generator to construct graph-specific injection structures and improves stealthiness through an unnoticeability constraint. In our adaptation, these structures are injected into a subset of training graphs and used during prompt optimization to manipulate learned prompt behavior, while the pretrained encoder remains unchanged. Cross-dataset and cross-domain evaluation protocol: In cross-dataset and cross-domain scenarios, the source and target domains differ in feature dimensionality, feature semantics, and label spaces. Consequently, neither sample-level transfer nor semantic label alignment is performed. During the pretraining stage, graph representation learning and malicious subgraph optimization (i.e., the proposed Prompt-Conditioned Subgraph) are conducted exclusively on the source domain. This process yields a pretrained graph encoder and an optimized malicious subgraph pattern. During downstream adaptation and evaluation, only the target-domain induced subgraph dataset is used, and no source-domain graphs are incorporated. Specifically, the malicious subgraph is re-injected into each target-domain graph according to a fixed structural template. Let \(d_s\) and \(d_t\) denote the feature dimensions of the source and target domains, respectively. Since the optimized malicious subgraph features are defined in the source-domain feature space, feature dimensionality alignment is required before injection. When \(d_s> d_t\), only the first \(d_t\) dimensions of the source-domain malicious subgraph features are retained. When \(d_s < d_t\), zero-padding is applied to expand the feature dimension to \(d_t\). The resulting malicious subgraph is then injected into the target graph. These operations are performed solely to satisfy input compatibility and do not establish any semantic correspondence between domains. To bridge the feature dimensionality gap between the target and source domains, a trainable linear input adapter is introduced prior to the pretrained encoder, as shown in Eq.(15): The adapter maps target-domain node features into the input space of the source-domain encoder. The transformed features are subsequently processed by the frozen encoder to obtain graph representations. During downstream adaptation, only the linear adapter and the prompt module are optimized, while the injected malicious subgraph remains fixed and all encoder parameters remain frozen. The adapter is introduced solely for dimensional compatibility and does not perform any graph structural modeling. No semantic correspondence is established between source-domain and target-domain labels. The downstream classifier is re-initialized and trained exclusively on the target-domain task, with target classes defined independently of the source-domain label space. All evaluation metrics are computed on the target-domain test set. This protocol is designed to assess whether the structural patterns learned during pretraining, together with the malicious subgraph pattern, can transfer across datasets and domains. The transferred knowledge resides in the structural inductive biases encoded by the pretrained encoder and the malicious subgraph, rather than in any source-domain graph samples. Attack configuration: Unless otherwise specified, all experiments are conducted with a fixed injection ratio of 5%. Specifically, 5% of the downstream training samples are replaced with malicious graphs. This setting is consistently adopted across all experiments to ensure fair and comparable evaluations among different GPL frameworks and attack baselines. Evaluation metrics: We evaluate attack performance using three commonly adopted metrics.: (1)Clean Accuracy (ACC) measures task performance on clean test samples that do not contain injected prompt conditions. (2)Attack Success Rate (ASR) (Goodfellow et al. 2014) measures the proportion of test samples on which the attacker successfully induces the intended malicious behavior. For prompt injection attacks, ASR corresponds to the fraction of test inputs containing the injected prompt condition that are mapped to the attacker-specified target prediction. For backdoor attacks, ASR is defined as the proportion of trigger-activated inputs that are classified into the target class. Despite differences in triggering mechanisms, ASR consistently measures the effectiveness of achieving attacker-defined behavior. (3)Accuracy Degradation (AD) (Zhang et al. 2021) quantifies the impact of the attack on normal task performance and is computed as the difference in clean accuracy before and after the attack. These metrics jointly characterize the attack effectiveness, stealthiness, and benign performance preservation of different attack methods. All reported results are expressed as percentages (%) and represent the average over five independent runs with different random seeds. We report the mean values of ACC, ASR, and AD, and provide the standard deviations of ACC and ASR to quantify performance stability across runs. Experimental results Comparison with existing attacks We first compare the proposed prompt injection attack with representative graph backdoor attacks across different GPL frameworks. The results are summarized in Table 2, where we report the clean ACC, AD, and ASR on five benchmark datasets. The proposed method consistently outperforms existing baseline attacks in both attack effectiveness and preservation of clean task performance across diverse datasets and GPL frameworks. As reported in Table 2, our method achieves near-perfect ASR across most datasets, including CiteSeer, Cora, PubMed, Computers, and Photo, with ASR consistently above 95% across most datasets. In contrast, baseline attacks such as GCBA-R, GCBA-M, CrossBA, and UGBA frequently exhibit substantially lower ASR, sometimes falling below 80% on the same datasets. Meanwhile, the AD on clean test samples remains minimal for our method, typically within \(\pm 3\%\), indicating that normal predictive performance is largely preserved. By comparison, other baselines often induce much larger AD, in some cases exceeding 40%, highlighting their reduced stealthiness and higher impact on the model’s task fidelity. Across multiple GPL frameworks, including GraphPrompt, ProG, and ProG-Meta, our method consistently achieves the highest ASR and the lowest AD. These results indicate that learned prompts are highly sensitive to injected conditional patterns and can be effectively influenced through data-level manipulation. This combination of high effectiveness and minimal interference with normal task performance highlights the vulnerability of prompt optimization. Finally, the small standard deviations of ASR and AD over five independent runs indicate that the attack is stable and reproducible, reinforcing the reliability of our findings. Overall, these results demonstrate that the proposed method is highly effective while maintaining strong downstream task performance. This finding highlights the vulnerability of GPL systems to data-level prompt injection attacks. Generalization evaluation To evaluate the robustness and generalization of the proposed prompt injection attack under distributional shifts, we conduct three cross-context generalization experiments: Cross-Distribution, Cross-Dataset, and Cross-Domain. As a first step, we perform a comprehensive evaluation using the GraphPrompt framework, which is widely adopted in Graph Prompt Learning. Cross-distribution generalization. We assess cross-distribution generalization by introducing perturbations to node features at test time. Specifically, we examine two common types of feature-level distribution shifts: additive Gaussian noise and feature scaling. These perturbations are formalized in Eqs.(16) and (17): Experiments are conducted on the CiteSeer and Cora datasets across three graph prompt learning frameworks: Graph Prompt, ProG, and ProG-Meta. During evaluation, the pretrained encoder and the learned prompt are kept frozen, and feature-level perturbations are applied to test the robustness of the injected behavior. Figure 3a presents the results under Gaussian noise perturbation, where the noise intensity \(\sigma\) varies from 0 to 0.15. As the noise level increases, the ASR gradually decreases across all frameworks and datasets. However, the degradation is modest, and the attack maintains a high success rate even under substantial perturbations. This indicates that the injected behavior is resilient to stochastic variations in node features and remains effective when input features are moderately corrupted. Figure 3b illustrates the impact of feature scaling, where the scaling factor \(\alpha\) ranges from 0.6 to 1.4. The ASR peaks at \(\alpha\)=1.0, and decreases gradually as \(\alpha\) deviates from this value. Importantly, no abrupt drops are observed, suggesting that the learned prompt is robust to continuous feature transformations and does not rely on precise feature magnitudes. Across both perturbations, the attack demonstrates consistent performance across different frameworks and datasets, with no sudden collapse in ASR. These results indicate that the proposed prompt injection attack generalizes well under feature-level distribution shifts, maintaining stability even with moderate deviations from the training distribution. Cross-dataset generalization. We further evaluate the transferability of the attack across datasets by training the prompt on one citation network and testing it on another. As shown in Table 3, the injected behavior transfers effectively across different graph datasets. Despite structural and statistical differences between datasets, the attack achieves consistently high ASR while preserving reasonable clean accuracy on the target datasets. These findings indicate that the learned malicious behavior is not dataset-specific. Instead, it captures a general prompt-conditioned mapping that persists across dataset boundaries. Cross-domain generalization. To evaluate whether the proposed attack generalizes beyond citation networks, we conduct cross-domain experiments between citation graphs and e-commerce graphs. Specifically, prompts trained on CiteSeer or Cora are tested on Amazon-Computers and Amazon-Photo datasets. As shown in Table 4, the attack maintains strong effectiveness across domain shifts, achieving high ASR even in the presence of substantial differences in graph semantics and feature distributions. These results indicate that the injected behavior learned during prompt adaptation can transfer across domains with diverse graph structures and application contexts, suggesting that the learned prompt-conditioned mapping is not limited to a specific dataset. They further demonstrate that prompt injection in Graph Prompt Learning can generalize across distributions, datasets, and domains, representing a practical and broadly applicable security risk. To verify that the observed behavior is not specific to a single GPL framework, we evaluate the attack across representative scenarios in ProG and ProG-Meta. Detailed results are provided in Table 5 and Table 6. Across all experiments, consistent trends are observed, confirming that the proposed attack generalizes effectively across different prompt learning paradigms. Generalization across different graph encoders. To further evaluate the generality of the proposed attack across different graph encoders, we additionally conduct experiments using GCN as the pretrained encoder. Following the same experimental protocol as the GAT-based setting, all attack configurations, prompt adaptation procedures, and evaluation settings are kept unchanged, with only the encoder architecture replaced by GCN. Experiments are conducted on three representative datasets, namely CiteSeer, Cora, and Computers. Detailed results are provided in Table 7. The results demonstrate that the proposed method consistently achieves high attack success rates across all evaluated datasets while maintaining competitive clean-task performance. Moreover, the overall performance patterns remain highly consistent with those observed under the GAT-based encoder. These findings indicate that the effectiveness of the proposed attack is not dependent on a specific encoder architecture. Instead, the vulnerability primarily arises from the prompt adaptation mechanism in GPL, suggesting that the attack can generalize effectively across different encoder backbones. Ablation study Ablation study on key components of the proposed attack. To investigate the contribution of each component in the proposed prompt injection attack, we conduct an ablation study on two representative GPL frameworks, GraphPrompt and ProG, using the CiteSeer and Cora datasets. Specifically, we evaluate three variants by removing structural optimization (w/o Struct-Opt), replacing the optimized anchor with a randomly selected node (Random Anchor), and removing the target label consistency constraint (w/o Target Consistency). Figure 4 presents the corresponding ASR reduction caused by each ablation setting. A higher bar indicates a larger decrease in attack success rate and therefore a greater contribution of the removed component to the overall attack effectiveness. As shown in Fig. 4, removing the target label consistency constraint consistently causes the largest ASR reduction across all evaluated settings, indicating that it is the most critical component of the proposed attack. By enforcing a unified optimization objective for malicious samples, this mechanism enables the prompt learner to establish a stable mapping toward the adversarial target. Structural optimization represents the second most influential component, as its removal also leads to substantial performance degradation. This result suggests that the optimized prompt-conditioning subgraph is essential for preserving malicious semantics and ensuring that the injected patterns can be effectively captured during prompt learning. In contrast, replacing the optimized anchor with a randomly selected node results in relatively limited ASR reduction. This observation indicates that the proposed attack does not rely on a specific insertion location to remain effective. Instead, the anchor selection strategy primarily improves attack stability by facilitating the interaction between the injected trigger and the local graph structure. The results demonstrate that all proposed components contribute positively to the success of the attack. Among them, target label consistency and structural optimization constitute the two dominant factors, while anchor selection serves as an auxiliary mechanism that further improves the robustness and concealment of the injected prompt. The consistent trends observed across different GPL frameworks further suggest that the effectiveness of these components is largely architecture-agnostic, highlighting the generality of the proposed attack design. To evaluate the stealthiness of the proposed prompt injection attack, we analyze the embedding distributions of malicious and clean samples under the frozen graph encoder. As presented in Table 8, malicious samples remain proximal to the clean data manifold in terms of L2 distance and exhibit significant distributional overlap, without forming conspicuous outliers. This evidence suggests that the malicious samples used for prompt injection do not introduce detectable representation-level anomalies, making them difficult to distinguish from clean data during downstream prompt learning. Effect of injection ratio.To evaluate the impact of the injection ratio on the effectiveness of the proposed prompt injection attack, we vary the proportion of injected malicious samples in the downstream prompt learning dataset using the Graph Prompt framework and report the corresponding performance on CiteSeer, Cora, Computers and Photo. Specifically, we consider injection ratios of 1%, 3%, 5%, 8% and 10%, while keeping all other experimental settings unchanged. The results are summarized in Fig. 5. The proposed attack exhibits strong effectiveness even under extremely low injection ratios. With only 1% of the samples injected, the attack achieves attack success rates above 80% across all four datasets, demonstrating that the learned prompt is highly sensitive to a small number of consistently conditioned samples. As the injection ratio increases to 5%, the ASR further improves, achieving near-perfect success on all datasets.When the injection ratio is further increased to 8% or 10%, the ASR becomes saturated. This indicates that the malicious conditional behavior has already been sufficiently reinforced at lower injection levels, and additional injected samples provide only marginal benefits. These findings highlight a critical characteristic of prompt injection attacks in Graph Prompt Learning: a small number of carefully designed training samples suffices to induce persistent malicious behavior in the learned prompt. From an attacker’s perspective, this low injection requirement substantially reduces attack cost and enhances stealthiness, as the injected samples are unlikely to be detected through coarse-grained data inspection or standard performance monitoring. From a defender’s perspective, these results underscore the vulnerability of downstream prompt learning to subtle, data-level manipulations, even when the pretrained encoder remains entirely uncompromised. Discussion Discussion on higher-supervision settings Although all experiments are conducted under the standard K-shot setting adopted by existing GPL methods, it is also important to discuss the expected behavior under higher-supervision settings. As the supervision level increases (e.g., a larger K value or full supervision), prompt adaptation is guided by substantially more labeled training data. Consequently, task-related supervision becomes stronger and may partially offset the influence of injected optimization signals. Therefore, the attack success rate is expected to decrease moderately under higher-supervision settings. Nevertheless, GPL still updates only a small set of prompt parameters while keeping the encoder frozen. As discussed in Section 4.4, prompt optimization remains susceptible to consistently aligned optimization signals introduced by injected samples. Therefore, although the attack effectiveness may gradually decline as supervision increases, the proposed method is expected to retain a certain level of effectiveness under higher-supervision settings. A comprehensive experimental evaluation under higher-supervision settings is left for future work. Discussion on label control The proposed attack is evaluated under a dirty-label setting, where the attacker is assumed to have control over the labels of injected samples. This assumption ensures that all injected samples are optimized toward the same target objective during prompt adaptation. Consequently, the learned prompt gradually associates the injected conditional pattern with the target prediction. However, in practical scenarios, obtaining label control may not always be feasible. Developing clean-label prompt injection attacks remains more challenging. In such settings, injected samples retain their original labels while still influencing prompt optimization, making this an important direction for future research. Defense Defense evaluation To further evaluate the stealthiness of the proposed attack, we investigate its effectiveness against two representative poisoning defenses: Spectral Signatures (Tran et al. 2018) and Confident Learning (Northcutt et al. 2021). Specifically, Spectral Signatures detects anomalous samples based on representation-level deviations in the embedding space, while Confident Learning identifies potentially mislabeled samples by estimating label confidence and detecting unreliable label assignments. Although these methods were not specifically designed for GPL scenarios, they provide complementary criteria for evaluating whether the injected graphs generated by the proposed prompt injection attack can be distinguished from clean samples during downstream GPL adaptation. For Spectral Signatures, graph representations are first extracted using the pretrained graph encoder. Following the standard procedure, Principal Component Analysis (PCA) is applied to the embedding space, and samples are ranked according to their projections onto the dominant singular direction. The top 5% highest-scoring samples are considered suspicious and removed before downstream adaptation. For Confident Learning, label issue scores are estimated based on the consistency between the observed labels and the model prediction probabilities. Training samples are ranked according to their estimated label issue scores, and the top 5% most suspicious samples are removed before retraining. After applying each defense strategy, the GPL models are retrained on the corresponding filtered datasets. We evaluate the attack success rate under both defense settings and compare the results with the undefended scenario. As shown in Fig. 6, across different datasets and GPL frameworks, the attack maintains relatively high ASR after filtering suspicious samples. The results show that the proposed attack maintains high attack success rates under both defense settings, indicating that the evaluated defenses provide limited mitigation against data-level prompt injection attacks in GPL. Defense discussion The experimental results demonstrate that the proposed method can effectively influence prompt optimization through a small number of injected training samples while leaving the pretrained encoder unchanged. These findings indicate that downstream prompt adaptation is highly sensitive to injected training data, motivating further research on improving the robustness of graph prompt learning under data-level attacks. One potential mitigation strategy is rigorous training data inspection. The attack relies on repeatedly embedding a small conditioning subgraph across multiple training samples. Detecting anomalous structural motifs that occur with abnormally high frequency may help identify suspicious patterns prior to prompt learning. Techniques such as graph motif statistics, structural similarity analysis, or clustering over subgraph embeddings can provide valuable signals for anomaly detection. Another direction is the development of robust prompt learning mechanisms. The attack succeeds because the prompt optimization process strongly associates repeated structural patterns with specific prediction behaviors. Regularization techniques that reduce over-reliance on localized patterns can enhance robustness. For instance, prompt learning may incorporate structural perturbations during training or apply stochastic masking to graph nodes and edges. These approaches reduce the likelihood that a fixed subgraph pattern becomes tightly coupled with the learned prompt behavior. Data sanitization is also a practical defense. Prior to downstream prompt adaptation, training graphs can be filtered using structural consistency checks. Samples containing rare or artificially repeated subgraph structures can be removed or down-weighted during training. This preprocessing step mitigates the influence of injected patterns without altering the pretrained encoder. Despite these potential strategies, defending against prompt injection remains inherently challenging. The injected perturbations are small and localized, making them difficult to detect through coarse-grained data inspection. Moreover, prompt learning mechanisms tend to amplify repeated structural signals during optimization, increasing the risk that subtle data manipulation produces persistent malicious behaviors. These observations underscore the necessity for future research on secure prompt learning for graph models. Developing prompt optimization strategies that are resilient to subtle data-level manipulations will be essential for deploying GPL systems in security-sensitive applications. Conclusion This paper investigates the security risks of GPL from the perspective of data-level prompt injection. We propose a novel attack that introduces malicious conditioning patterns directly through downstream training samples, without modifying the pretrained encoder or the prompt optimization process. The attack exploits the sensitivity of prompt learning to repeatedly conditioned structural patterns, inducing attacker-specified behaviors during inference. Extensive experiments across multiple GPL frameworks and datasets demonstrate that the proposed method consistently achieves high attack success rates while preserving stable performance on clean samples. Further evaluations under cross-distribution, cross-dataset, and cross-domain settings confirm the robustness and generalization capability of the attack. These findings expose a previously underexplored attack surface in graph learning pipelines and emphasize the urgent need for developing secure and robust prompt learning mechanisms for graph-based models. Abbreviations - GPL: - Graph prompt learning - GPIA: - Graph prompt injection attack - ACC: - Accuracy - ASR: - Attack success rate - AD: - Accuracy degradation References Sun X, Cheng H, Li J, et al (2023a) All in one: multi-task prompting for graph neural networks. In: Proceedings of the 29th ACM SIGKDD conference on knowledge discovery and data mining, pp 2120–2131, https://doi.org/10.1145/3580305.3599256 Yu X, Fang Y, Liu Z, et al (2024a) Hgprompt: bridging homogeneous and heterogeneous graphs for few-shot prompt learning. In: Proceedings of the AAAI conference on artificial intelligence, pp 16578–16586, https://doi.org/10.1609/aaai.v38i15.29596 Jia J, Yu J, Wu D, et al (2025b) Prompt as a double-edged sword: a dynamic equilibrium gradient-assigned attack against graph prompt learning. In: Proceedings of the 31st ACM SIGKDD conference on knowledge discovery and data mining vol 2, pp 1049–1060, https://doi.org/10.1145/3711896.3737091 Jiang B, Wu H, Zhang Z (2024) A unified graph selective prompt learning for graph neural networks. arXiv:2406.10498 arXiv preprint Lin M, Zhang Z, Dai E, et al (2025) Are you using reliable graph prompts? Trojan prompt attacks on graph neural networks. In: Proceedings of the 31st ACM SIGKDD conference on knowledge discovery and data mining vol 2, pp 1729–1740, https://doi.org/10.1145/3711896.3736845 Cai X, Xu H, Xu S et al (2022) Badprompt: backdoor attacks on continuous prompts. Adv Neural Inf Process Syst 35:37068–37080. https://doi.org/10.48550/arxiv.2211.14719 Chen T, Liu J, Xiang Y et al (2019) Adversarial attack and defense in reinforcement learning-from AI security view. Cybersecurity 2(1):11. https://doi.org/10.1186/s42400-019-0027-x Chen Z, Wang Y, Ma F et al (2024) GPL-GNN: graph prompt learning for graph neural network. Knowl-Based Syst 286:111391. https://doi.org/10.1016/j.knosys.2024.111391 Dai E, Lin M, Zhang X et al (2023) Unnoticeable backdoor attacks on graph neural networks. Proc ACM Web Conf 2023:2263–2273. https://doi.org/10.1145/3543507.3583392 Duan Y, Liu J, Chen S et al (2024) G-prompt: graphon-based prompt tuning for graph classification. Inf Proc Manag 61(3):103639. https://doi.org/10.1016/j.ipm.2023.103639 Ge Y, Yang Z, Chen L et al (2023) Attack based on data: a novel perspective to attack sensitive points directly. Cybersecurity 6(1):43. https://doi.org/10.1186/s42400-023-00179-4 Jia J, Ma S, Liu Y et al (2023) A causality-aligned structure rationalization scheme against adversarial biased perturbations for graph neural networks. IEEE Trans Inf Forensics Secur 19:59–73. https://doi.org/10.1109/tifs.2023.3318936 Jia J, Li R, Wu C et al (2025) Sigfinger: a subtle and interactive GNN fingerprinting scheme via spatial structure inference perturbation. IEEE Trans Dependable Secure Comput 22(4):3629–3646. https://doi.org/10.1109/tdsc.2025.3535588 Lin X, Zhou C, Wu J et al (2023) Exploratory adversarial attacks on graph neural networks for semi-supervised node classification. Pattern Recogn 133:109042. https://doi.org/10.1016/j.patcog.2022.109042 Liu Z, Yu X, Fang Y et al (2023) Graphprompt: unifying pre-training and downstream tasks for graph neural networks. Proc ACM Web Conf 2023:417–428. https://doi.org/10.1145/3543507.3583386 Liu Z, Luo Y, Wu L, et al (2022) Are gradients on graph structure reliable in gray-box attacks? In: Proceedings of the 31st ACM international conference on information & knowledge management, pp 1360–1368, https://doi.org/10.1145/3511808.3557238 Lyu X, Han Y, Wang W, et al (2024) Cross-context backdoor attacks against graph prompt learning. In: Proceedings of the 30th ACM SIGKDD conference on knowledge discovery and data mining, pp 2094–2105, https://doi.org/10.1145/3637528.3671956 Ma R, Zhang Y, Wang J et al (2026) Advancements in adversarial example defense for deep learning models: a review. Cybersecurity 9(1):108. https://doi.org/10.1186/s42400-025-00546-3 Nguyen LD, Nguyen BP (2026) Magprompt: message-adaptive graph prompt tuning for graph neural networks. arXiv preprint arXiv:2602.05567 Northcutt C, Jiang L, Chuang I (2021) Confident learning: estimating uncertainty in dataset labels. J Artif Intell Res. https://doi.org/10.1613/jair.1.12125 Huang Y, Zhao J, He D (2025) One prompt fits all: universal graph adaptation for pretrained models. arXiv:2509.22416 arXiv preprint Ge Q, Zhao Z, Liu Y, et al (2024) Psp: pre-training and structure prompt tuning for graph neural networks. In: Joint European conference on machine learning and knowledge discovery in databases, Springer, pp 423–439, https://doi.org/10.1007/978-3-031-70362-1_25 Shchur O, Mumme M, Bojchevski A, et al (2018) Pitfalls of graph neural network evaluation. arXiv preprint arXiv:1811.05868https://doi.org/10.1007/978-3-642-17805-4_21 Sun L, Tan M, Zhou Z (2018) A survey of practical adversarial example attacks. Cybersecurity 1(1):9. https://doi.org/10.1186/s42400-018-0012-9 Sun Y, Wang S, Tang X et al (2020) Adversarial attacks on graph neural networks via node injections: a hierarchical reinforcement learning approach. Proc Web Conf 2020:673–683. https://doi.org/10.1145/3366423.3380149 Sun M, Zhou K, He X, et al (2022) Gppt: graph pre-training and prompt tuning to generalize graph neural networks. In: Proceedings of the 28th ACM SIGKDD conference on knowledge discovery and data mining, pp 1717–1727, https://doi.org/10.1145/3534678.3539249 Tan Z, Guo R, Ding K, et al (2023) Virtual node tuning for few-shot node classification. In: Proceedings of the 29th ACM SIGKDD conference on knowledge discovery and data mining, pp 2177–2188, https://doi.org/10.1145/3580305.3599541 Yao H, Lou J, Qin Z (2024) Poisonprompt: backdoor attack on prompt-based large language models. In: ICASSP 2024-2024 IEEE international conference on acoustics, speech and signal processing (ICASSP), IEEE, pp 7745–7749, https://doi.org/10.1109/icassp48485.2024.10446267 Yoon K, In Y, Lee N, et al (2024) Debiased graph poisoning attack via contrastive surrogate objective. In: Proceedings of the 33rd ACM international conference on information and knowledge management, pp 3012–3021, https://doi.org/10.1145/3627673.3679686 Yu X, Liu Z, Fang Y et al (2024) Generalized graph prompt: toward a unification of pre-training and downstream tasks on graphs. IEEE Trans Knowl Data Eng 36(11):6237–6250. https://doi.org/10.1109/tkde.2024.3419109 Yu X, Zhou C, Fang Y et al (2024) Multigprompt for multi-task pre-training and prompting on graphs. Proc ACM Web Conf 2024:515–526. https://doi.org/10.1145/3589334.3645423 Zhang H, Chen J, Lin L (2023) Graph contrastive backdoor attacks. In: International conference on machine learning. pp 40888–40910 (PMLR) Zhang Z, Jia J, Wang B, et al (2021) Backdoor attacks to graph neural networks. In: Proceedings of the 26th ACM symposium on access control models and technologies, pp 15–26, https://doi.org/10.1145/3450569.3463560 Zi C, Zhao H, Sun X et al (2024) Prog: a graph prompt learning benchmark. Adv Neural Inf Process Syst 37:95406–95437 Zügner D, Akbarnejad A, Günnemann S (2018) Adversarial attacks on neural networks for graph data. In: Proceedings of the 24th ACM SIGKDD international conference on knowledge discovery & data mining, pp 2847–2856, https://doi.org/10.1145/3219819.3220078 Chen C, Shu K (2023) Promptda: label-guided data augmentation for prompt-based few shot learners. In: Proceedings of the 17th conference of the European chapter of the association for computational linguistics. pp 562–574. https://doi.org/10.18653/v1/2023.eacl-main.41 Chen K, Meng Y, Sun X, et al (2021) Badpre: task-agnostic backdoor attacks to pre-trained NLP foundation models. arXiv:2110.02467. https://doi.org/10.48550/arxiv.2110.02467 Du W, Li P, Zhao H (2024) Uor: universal backdoor attacks on pre-trained language models. In: Findings of the association for computational linguistics: ACL 2024. pp 7865–7877. https://doi.org/10.48550/arxiv.2305.09574 Fang T, Zhang YM, Yang Y (2022) Prompt tuning for graph neural networks. https://doi.org/10.48550/arxiv.2209.15240 Goodfellow IJ, Shlens J, Szegedy C (2014) Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572https://doi.org/10.48550/arxiv.1412.6572 Liu Z, Luo Y, Wu L, et al (2023a) Towards reasonable budget allocation in untargeted graph structure attacks via gradient debias. arXiv preprint arXiv:2304.00010https://doi.org/10.48550/arxiv.2304.00010 Mei K, Li Z, Wang Z, et al (2023) Notable: transferable backdoor attacks against prompt-based NLP models. In: Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (vol 1: Long Papers), pp 15551–15565, https://doi.org/10.18653/v1/2023.acl-long.867 Mujkanovic F, Geisler S, Günnemann S (2022) Are defenses for graph neural networks robust? Adv Neural Inf Process Syst 35: 8954–8968. https://doi.org/10.48550/arxiv.2301.13694 Nookala V, Verma G, Mukherjee S (2023) Adversarial robustness of prompt-based few-shot learning for natural language understanding. In: Findings of the association for computational linguistics: ACL 2023. pp 2196–2208. https://doi.org/10.48550/arxiv.2306.11066 Sun X, Zhang J, Wu X, et al (2023b) Graph prompt learning: a comprehensive survey and beyond. arXiv:2311.16534. https://doi.org/10.48550/arxiv.2311.16534 Tran B, Li J, Madry A (2018) Spectral signatures in backdoor attacks. https://doi.org/10.48550/arxiv.1811.00636 Wu H, Wang C, Tyshetskiy Y, et al (2019) Adversarial examples on graph data: deep insights into attack and defense. arXiv preprint http://arxiv.org/abs/1903.01610. https://doi.org/10.24963/ijcai.2019/669 Xi Z, Pang R, Ji S (2021) Graph backdoor. In: 30th USENIX security symposium (USENIX Security 21). pp 1523–1540. https://doi.org/10.48550/arxiv.2006.11890 Xu L, Chen Y, Cui G (2022) Exploring the universal vulnerability of prompt-based learning paradigm. In: Findings of the association for computational linguistics: NAACL 2022. pp 1799–1810. https://doi.org/10.18653/v1/2022.findings-naacl.137 Zhao S, Wen J, Tuan LA (2023) Prompt as triggers for backdoor attack: examining the vulnerability in language models. In: Proceedings of the 2023 conference on empirical methods in natural language processing. pp 12303–12317. https://doi.org/10.18653/v1/2023.emnlp-main.757 Zheng M, Xue J, Chen X, et al (2024) Trojfsp: trojan insertion in few-shot prompt tuning. In: Proceedings of the 2024 conference of the North American chapter of the association for computational linguistics: human language technologies (vol 1: Long Papers), pp 1141–1151, https://doi.org/10.18653/v1/2024.naacl-long.64 Author information Authors and Affiliations Contributions Conceptualization:[Mengying Yuan, Zhiyong Zhang, Gaoyuan Quan], Methodology:[Mengying Yuan],Software:[Mengying Yuan], Formal analysis and investigation: [Zhiyong Zhang, Gaoyuan Quan],Validation:[Mengying Yuan], Writing - original draft preparation:[Mengying Yuan]; Writing - review and editing:[Zhiyong Zhang, Junyan Pan, Yu Fu],Funding acquisition:[Zhiyong Zhang],Resources: [Zhiyong Zhang],Supervision:[Zhiyong Zhang, Junyan Pan],Project administration:[Zhiyong Zhang]. Corresponding author Ethics declarations Competing Interests The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper. Additional information Publisher's Note Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations. Rights and permissions Open Access This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if changes were made. The images or other third party material in this article are included in the article's Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article's Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit http://creativecommons.org/licenses/by/4.0/. About this article Cite this article Yuan, M., Zhang, Z., Quan, G. et al. A novel data-level prompt injection attack against graph prompt learning. Cybersecurity 9, 220 (2026). https://doi.org/10.1186/s42400-026-00650-y Received: Accepted: Published: Version of record: DOI: https://doi.org/10.1186/s42400-026-00650-y