Research map / Federated learning and privacy / Privacy attacks and secure learning
FedGMark: Certifiably Robust Watermarking for Federated Graph Learning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes FedGMark, a certifiably robust backdoor-based watermark for federated graph learning that learns client-customized structural triggers and uses a majority-voting ensemble of submodels to certify robustness against layer-perturbation attacks.
Problem
Protecting ownership of federated graph learning (FedGL) models against illegal copying and model theft; existing graph watermarks are ineffective in FL and vulnerable to removal attacks (distillation, finetuning, layer perturbation) without formal guarantees.
Approach
Learn customized, client-specific graph-structure watermarks (GatingNet and KeyNet over edges and client-ID keys) and train an ensemble of independent submodels with majority voting, so that perturbing r layers changes at most r votes, yielding a certified number of perturbed layers.
Key results
- Under no attack, FedGMark achieves watermark accuracy above 70% in nearly all cases (e.g., MUTAG Fed-GIN WA 0.90), versus below 60% for the random-graph baseline (e.g., MUTAG Fed-GIN 0.47).
- Under 1-layer perturbation, the random-graph baseline falls below 25% WA in almost all cases, while FedGMark retains WA close to no-attack levels (e.g., MUTAG Fed-GIN 0.90).
- With S=16 submodels, CWA on MUTAG is 86% even when 5 layers are arbitrarily perturbed, versus 0 with S=4; runtime scales roughly linearly with S.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use customized learned watermarks rather than random-graph watermarks | FedGL watermarking · MUTAG, PROTEINS, DD, and COLLAB | watermark accuracy: 0.47 -> 0.90; 0.56 -> 0.86; 0.39 -> 0.65; 0.57 -> 0.75 | Helped |
| Apply distillation to the watermarked model | FedGMark · MUTAG, PROTEINS, DD, and COLLAB | watermark accuracy: 0.90 -> 0.87; 0.82 -> 0.70; 0.86 -> 0.84; 0.80 -> 0.79; 0.65 -> 0.63; 0.56 -> 0.56; 0.75 -> 0.71; 0.74 -> 0.73; 0.70 -> | Mixed |
| Apply finetuning to the watermarked model | FedGMark · MUTAG, PROTEINS, DD, and COLLAB | watermark accuracy: 0.89 -> 0.76; 0.84 -> 0.80; 0.65 -> 0.62; 0.75 -> 0.70 | Mixed |
| Apply a 1-layer parameter perturbation | FedGMark · MUTAG, PROTEINS, DD, and COLLAB | watermark accuracy: 0.90 -> 0.90; 0.89 -> 0.91; 0.86 -> 0.86; 0.82 -> 0.83; 0.65 -> 0.65; 0.57 -> 0.55; 0.75 -> 0.76; 0.74 -> 0.74 | No clear effect |
| Remove KeyNet (ablation) | FedGMark · MUTAG, PROTEINS, DD, and COLLAB | watermark accuracy: 0.90 -> 0.84; 0.86 -> 0.80; 0.65 -> 0.57; 0.75 -> 0.70 | Hurt |
| Remove GatingNet (ablation) | FedGMark · MUTAG, PROTEINS, DD, and COLLAB | watermark accuracy: 0.90 -> 0.69; 0.86 -> 0.68; 0.65 -> 0.48; 0.75 -> 0.67 | Hurt |
| Remove RML (ablation) | FedGMark · MUTAG, PROTEINS, DD, and COLLAB | watermark accuracy: 0.90 -> 0.89; 0.86 -> 0.86; 0.65 -> 0.66; 0.75 -> 0.75 | No clear effect |
| Remove both GatingNet and KeyNet (ablation) | FedGMark · MUTAG, PROTEINS, DD, and COLLAB | watermark accuracy: 0.90 -> 0.47; 0.86 -> 0.56; 0.65 -> 0.39; 0.75 -> 0.57 | Hurt |
| Increase submodel count from S=4 to S=8 or S=16 (ablation) | FedGMark · MUTAG, PROTEINS, DD, and COLLAB under 1-layer perturbation | watermark accuracy | No clear effect |
| Increase the number of watermarking clients from 5 to 20 (ablation) | FedGMark · PROTEINS | watermark accuracy: +11%; +9%; +7% | Helped |
| Increase watermark node count (ablation) | FedGMark · MUTAG, PROTEINS, DD, and COLLAB | watermark accuracy | Helped |
| Increase the number of perturbed layers (ablation) | FedGMark · MUTAG, PROTEINS, DD, and COLLAB | watermark accuracy: 0.90 -> 0.16; 0.86 -> 0.39; 0.65 -> 0.21; 0.76 -> 0.21 | Hurt |
Surprising findings
- Summing submodel confidence vectors instead of majority voting is not robust to layer perturbation, with results inconsistent across S.
- Watermark accuracy stays high even when the learned watermark is applied to synthetic Erdos-Renyi graphs, suggesting watermark samples need not come from client data.
Limitations
- Certified robustness only holds when the number of perturbed layers is within the certified radius, which is limited for small S (CWA is 0 for S=4 at r>=3).
- Computational cost and GPU memory grow linearly with the number of submodels S.
- Evaluation limited to four small-to-medium graph classification datasets and three GNN backbones.
Experimental setup
Datasets: MUTAG PROTEINS DD COLLAB
Benchmarks: MUTAG PROTEINS DD COLLAB
Metrics: main task accuracy watermark accuracy certified watermark accuracy (CWA@r) NetSim DeltaCon
Baselines: random graph watermark (ER-based graph watermarking) distillation attack finetuning attack 1-layer perturbation attack
Builds on: FedAvg random graph backdoor watermarking for graph learning GIN GraphSAGE GCN
Closest papers by meaning
- Traceable Black-Box Watermarks For Federated Learning (ICLR 2026 · similarity 0.89)
- Consistency-Verified Backdoor Defense for Federated Graph Learning via Cross-Layer Drift (NeurIPS 2026 · similarity 0.88)
- Federated Graph Condensation with Information Bottleneck Principles (AAAI 2025 · similarity 0.85)
- MFL-Owner: Ownership Protection for Multi-modal Federated Learning via Orthogonal Transform Watermark (AAAI 2025 · similarity 0.85)
- EntropyMark: Towards More Harmless Backdoor Watermark via Entropy-based Constraint for Open-source Dataset Copyright Protection (CVPR 2025 · similarity 0.85)
- SPMC: Self-Purifying Federated Backdoor Defense via Margin Contribution (ICML 2025 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.