Research map / Graph learning / GNN architectures
Can Graph Neural Networks Expose Training Data Properties? An Efficient Risk Assessment Approach
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes an efficient graph property inference attack that trains only a few reference GNNs and generates many approximated shadow models via graph-unlearning-style model approximation, selected by edit-distance diversity and an approximation-error criterion.
Problem
Graph property inference attacks against shared GNN models require training hundreds to thousands of shadow models, which is computationally expensive; the attack should reveal sensitive graph-level distribution properties (e.g., gender ratio) efficiently.
Approach
Replace most shadow training with model approximation: train a few reference GNNs, create augmented graphs by removing nodes and edges, approximate each perturbed model with a Newton/influence-style update, and select perturbations that maximize edit-distance diversity while bounding approximation error via a theoretical gradient-norm criterion solved as a quadratic integer program.
Key results
- Averaged over six properties, the method improves attack accuracy by 2.7% and is 6.5x faster than the best baseline in the white-box setting.
- On Facebook node property in black-box setting, accuracy improves by 11.5% over best baseline while being 7.3x faster.
- Trains about 66.7 models on average versus 700 shadow models for baselines, reaching 69.0% accuracy and 66.4% ROC-AUC versus 67.3% and 63.6%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use model approximation to generate approximated shadow models instead of training numerous shadow models | Graph property inference attack · Six real-world scenarios | attack accuracy: 67.3\% -> 69.0\% (average increase of 2.7\%) | Helped |
| Use model approximation instead of training shadow models | Graph property inference attack · Six real-world scenarios | ROC-AUC: 63.6\% -> 66.4\% (average increase of 4.1\%) | Helped |
| Use model approximation instead of conventional shadow-model training | Graph property inference attack · Six real-world scenarios | runtime: 6.5$\times$ faster | Helped |
| Replace structure-aware random walks with simple random walks for reference-graph sampling (ablation) | Proposed attack · Facebook node property | attack accuracy | Hurt |
| Remove the augmentation selector and use random removal to obtain augmented graphs (ablation) | Proposed attack · Facebook node property | attack accuracy | Hurt |
| Ignore approximation error and select augmentations only to maximize diversity (ablation) | Proposed attack · Facebook node property | attack accuracy | Hurt |
| Ignore diversity and select augmentations only to minimize approximation error (ablation) | Proposed attack · Facebook node property | attack accuracy | Hurt |
| Increase the number of reference graphs (ablation) | Proposed attack · Evaluated attack settings | attack accuracy | Mixed |
| Increase the number of selected augmented graphs (ablation) | Proposed attack · Evaluated attack settings | attack accuracy | Mixed |
Surprising findings
- Cross-dataset attacks (auxiliary and target graphs from different social networks) show overall performance drops, attributed to information loss during PCA parameter alignment.
Limitations
- Assumes attacker has white-box or posterior access; does not address query-limited or label-only attacks.
- Does not cover data poisoning or stronger adversary capabilities.
- Cross-domain (distinct target and auxiliary graphs) performance drops due to PCA parameter alignment.
Experimental setup
Datasets: Facebook Pubmed Pokec Pokec-100M
Benchmarks: Facebook node/link property inference Pubmed node/link property inference Pokec node/link property inference Pokec-100M scalability cross-dataset Facebook<->Pokec
Metrics: attack accuracy ROC-AUC runtime (seconds)
Baselines: GPIA PIR-D PIR-S AIA PIA-MP
Builds on: GPIA graph unlearning influence-function updates Louvain community detection PIR (permutation-invariant property inference)
Closest papers by meaning
- Prompt-based Unifying Inference Attack on Graph Neural Networks (AAAI 2025 · similarity 0.89)
- CEGA: A Cost-Effective Approach for Graph-Based Model Extraction and Acquisition (ICML 2025 · similarity 0.87)
- Value at Adversarial Risk: A Graph Defense Strategy against Cost-Aware Attacks (AAAI 2024 · similarity 0.87)
- On provable privacy vulnerabilities of graph representations (NeurIPS 2024 · similarity 0.87)
- Towards Robust Fidelity for Evaluating Explainability of Graph Neural Networks (ICLR 2024 · similarity 0.86)
- GraphIP–Bench: How Hard Is It to Steal a Graph Neural Network, and Can We Stop It? (NeurIPS 2026 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.