Research map / Graph learning / Graph self-supervised learning
Extracting Training Data from Molecular Pre-trained Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Studies data extraction attacks on molecular pre-trained GNNs under black-box query access, generating candidate molecules from ring templates and motifs and ranking them with a learned, model-independent similarity score guided by an SAC-based RL policy.
Problem
Molecular pre-trained models are non-generative and architecturally diverse, so existing text/image data extraction attacks do not apply; the paper asks whether private molecular training graphs can be extracted via black-box queries.
Approach
Generate candidate molecules from ring templates plus motif bank, score them with a model-independent cosine-similarity criterion f(G) ≈ αf(R)+(1−α)f(M) learned via an auxiliary dataset with an adapter, and use a Soft Actor-Critic policy network to navigate the search space of molecule construction.
Key results
- Ours (AttrMasking) reaches 0.76 precision in two-step generation at K=100, versus 0.24 for the MLP baseline on the same model.
- Across pre-trained models, the RL method improves precision over the MLP baseline by an average of 30.9% and FCD by 3.97%.
- Average precision of 49.0% for extracting training molecules with only black-box query access, per the introduction.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use the RL framework rather than enumeration (ablation) | Molecular extraction on GraphCL · ZINC15, one-step generation, K=50 | precision: 0.50 -> 0.56 | Hurt |
| use the RL framework rather than enumeration (ablation) | Molecular extraction on GraphCL · ZINC15, two-step generation, K=200 | precision: 0.40 -> 0.51 | Helped |
| use the learned scoring-function reward rather than SA (ablation) | Molecular extraction on GraphCL · ZINC15, one-step generation, K=50 | precision: 0.30 -> 0.50 | Helped |
| include the adapter in the scoring function (ablation) | Molecular extraction on GraphCL · ZINC15, one-step generation, K=50 | precision: 0.47 -> 0.50 | Helped |
| train the scoring function with a similar rather than lower-similarity auxiliary dataset (ablation) | Molecular extraction on GraphCL · ZINC15, one-step generation, K=50 | precision: 0.43 -> 0.50 | Helped |
| add five ring-free scaffold templates (ablation) | Molecular extraction on GraphCL · ZINC15, one-step generation, K=50 | precision: 0.50 -> 0.51 | Helped |
| use the proposed method rather than MLP | GraphCL extraction · ZINC15, one-step generation, K=50 | precision: 0.48 -> 0.50 | Helped |
| use the proposed method rather than MLP | GraphCL extraction · ZINC15, two-step generation, K=200 | precision: 0.19 -> 0.51 | Helped |
| use the proposed method rather than MLP | GraphCL extraction · ZINC15, one-step generation, K=50 | FCD: 20.47 -> 19.22 | Helped |
| use the proposed method rather than MLP | GraphCL extraction · ZINC15, two-step generation, K=200 | FCD: 23.17 -> 23.09 | No clear effect |
| use PubChem rather than ZINC15 as the auxiliary dataset | Molecular extraction on GraphCL · ZINC15, two-step generation, K=200 | precision: 0.51 -> 0.31 | Hurt |
| increase generation from two steps to four steps (ablation) | Molecular extraction · ZINC15, K=100 | precision: 0.31 -> 0.17 | Hurt |
Surprising findings
- AttrMasking is the most vulnerable to extraction among the evaluated pre-trained models.
- Ring-free alkane templates gave only a slight improvement, and performance declines as generation steps increase.
Limitations
- The paper states no limitations section; NeurIPS checklist answers No on limitations.
- No error bars or statistical significance tests are reported.
- Experiments use a single pre-training dataset and template-restricted subsets of data, and the attack is evaluated only on overlaps with a small auxiliary set.
Experimental setup
Datasets: ZINC15 PubChem
Benchmarks: ZINC15 subsets (private pre-training set G)
Metrics: precision FCD
Baselines: QED SA score Docking score MLP classifier Random Ours-RL Ours-SA Ours-adapter
Builds on: Soft Actor-Critic CReM GraphCL Grover
Closest papers by meaning
- Pre-Training Graph Neural Networks on Molecules by Using Subgraph-Conditioned Graph Information Bottleneck (AAAI 2025 · similarity 0.87)
- On the Scalability of GNNs for Molecular Graphs (NeurIPS 2024 · similarity 0.86)
- CEGA: A Cost-Effective Approach for Graph-Based Model Extraction and Acquisition (ICML 2025 · similarity 0.85)
- Towards Foundational Models for Molecular Learning on Large-Scale Multi-Task Datasets (ICLR 2024 · similarity 0.84)
- From Artificially Real to Real: Leveraging Pseudo Data from Large Language Models for Low-Resource Molecule Discovery (AAAI 2024 · similarity 0.84)
- Pretraining Generative Flow Networks with Inexpensive Rewards for Molecular Graph Generation (ICML 2025 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.