Research map / Federated learning and privacy / Differential privacy

Going Deeper into Locally Differentially Private Graph Neural Networks

ICML 2025 · Federated learning and privacy › Differential privacy · approach: Private data analysis frameworks

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes UPGNET, an LDP-based private GNN framework that adds a High-Order Aggregator (HOA) and an L1-based Node Feature Regularization (NFR) layer to improve node-classification utility under node-feature LDP.

Problem

Node-feature local differential privacy for graph neural networks severely degrades node classification accuracy because the privacy budget is split across many feature dimensions and small neighborhoods yield large aggregation estimation error.

Approach

A unified three-stage LDP pipeline (perturb, calibrate, aggregate) identifies feature dimension and neighborhood size as drivers of estimation error; the method then reduces effective dimension with L1-based feature selection (NFR) and expands effective neighborhood with a personalized, Dirichlet-energy-motivated multi-hop aggregator (HOA), pluggable into any GNN.

Key results

• UPGNET improves accuracy over LPGNN and Solitude by about 5% on CiteSeer with GraphSAGE at epsilon=3.0, and on Facebook it approaches NonPriv accuracy.
• Adding the NFR layer improves MBM on Cora by 6.8 points at epsilon=0.01 (64.5 to 71.3) and by 4.0 points on average across datasets and budgets.
• On LastFM with HOA, accuracy keeps rising with K up to 64 while SKA drops below 40% at K=64 (epsilon=0.01).

Measured effects reported in the paper

Surprising findings

• The SKA multi-hop baseline peaks at small K and collapses at large K due to over-smoothing, while HOA keeps improving with K.

Limitations

• Gains are largest at small privacy budgets and narrow as epsilon grows.
• GAT is more sensitive to feature perturbation at high privacy settings, degrading more than GCN or GraphSAGE.

Experimental setup

Datasets: Cora Citeseer LastFM Facebook

Benchmarks: Cora Citeseer LastFM Facebook

Metrics: node classification accuracy

Baselines: BASE LPGNN Solitude NonPriv MBM PM

Builds on: LPGNN Solitude piecewise mechanism multi-bit mechanism GCN

Closest papers by meaning

• Differentially Private Decoupled Graph Convolutions for Multigranular Topology Protection (NeurIPS 2023 · similarity 0.91)
• Poincaré Differential Privacy for Hierarchy-Aware Graph Embedding (AAAI 2024 · similarity 0.87)
• On provable privacy vulnerabilities of graph representations (NeurIPS 2024 · similarity 0.86)
• FicGCN: Unveiling the Homomorphic Encryption Efficiency from Irregular Graph Convolutional Networks (ICML 2025 · similarity 0.85)
• Can Graph Neural Networks Expose Training Data Properties? An Efficient Risk Assessment Approach (NeurIPS 2024 · similarity 0.85)
• Certification for Differentially Private Prediction in Gradient-Based Training (ICML 2025 · similarity 0.84)