  Backdoor attack is a powerful attack algorithm to deep learning model.
Recently, GNN's vulnerability to backdoor attack has been proved especially on
graph classification task. In this paper, we propose the first backdoor
detection and defense method on GNN. Most backdoor attack depends on injecting
small but influential trigger to the clean sample. For graph data, current
backdoor attack focus on manipulating the graph structure to inject the
trigger. We find that there are apparent differences between benign samples and
malicious samples in some explanatory evaluation metrics, such as fidelity and
infidelity. After identifying the malicious sample, the explainability of the
GNN model can help us capture the most significant subgraph which is probably
the trigger in a trojan graph. We use various dataset and different attack
settings to prove the effectiveness of our defense method. The attack success
rate all turns out to decrease considerably.
