Research map / Graph learning / GNN architectures

Prompt-based Unifying Inference Attack on Graph Neural Networks

AAAI 2025 · Graph learning › GNN architectures · approach: Graph structure learning · 1 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes ProIA, a prompt-based unified inference attack on GNNs that pre-trains a graph encoder with IB and contrastive objectives, then uses a disentangled prompt-guided attack model for membership and attribute inference.

Problem

Graph neural networks pre-trained and shared as parameters can leak private training data through prompt queries, and existing graph inference attacks are task-specific and not unified across membership and attribute inference.

Approach

Pre-train a GCN with an information-bottleneck objective and global-local contrastive learning so prompt features reveal sensitive information while looking benign; then add a disentanglement module to the attack model so that a unified prompt adapts to either membership or attribute inference.

Key results

• ProIA with GAT reaches 97.62% accuracy on Cora, and ProIA with SAGE reaches 80.05% on Lastfm; the paper reports up to 18.54% accuracy gain over Vanilla on Lastfm with SAGE.
• Average improvement over vanilla is reported as up to 7.74 points on the MIA datasets (GAT) and 5.60 points on Pokec-n (GAT) for AIA.
• In defended-model experiments, MIA attack AUC-ROC rises by up to 18.7% on Cora with GCN.

Measured effects reported in the paper

Surprising findings

• Pre-training with a single module sometimes underperforms the vanilla attack, with the paper noting that not all prompt features help the attack.
• On Facebook, ProIA with SAGE is weaker than the baseline on ACC (53.48) and F1, showing the method is not uniformly superior.

Limitations

• Pre-training adds computational overhead, which the authors plan to reduce in future work.
• Performance gains are not uniform across backbones and datasets; some variants underperform vanilla.
• Hyperparameter sensitivity (number of virtual channels k) varies across datasets.

Experimental setup

Datasets: Cora Facebook Lastfm Bail Pokec-n

Benchmarks: Cora Facebook Lastfm Bail Pokec-n

Metrics: accuracy F1 score AUC-ROC

Baselines: Vanilla GCN/GAT/SAGE attacks STABLE Vandp Neighbh PPGL

Builds on: STABLE information bottleneck graph prompting

Closest papers by meaning

• Can Graph Neural Networks Expose Training Data Properties? An Efficient Risk Assessment Approach (NeurIPS 2024 · similarity 0.89)
• CEGA: A Cost-Effective Approach for Graph-Based Model Extraction and Acquisition (ICML 2025 · similarity 0.87)
• Highly Imperceptible Black-Box Graph Injection Attacks with Reinforcement Learning (AAAI 2025 · similarity 0.86)
• Graph Agent Network: Empowering Nodes with Inference Capabilities for Adversarial Resilience (AAAI 2025 · similarity 0.86)
• Edge Prompt Tuning for Graph Neural Networks (ICLR 2025 · similarity 0.86)
• ProG: A Graph Prompt Learning Benchmark (NeurIPS 2024 · similarity 0.85)