Research map / Graph learning / Graph algorithms and clustering
Practical Bayes-Optimal Membership Inference Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Derives the Bayes-optimal node-level membership inference rule for GNNs and proposes G-BASE (graph) and BASE (i.i.d. and graph), showing BASE is equivalent to RMIA at gamma=1.
Problem
Membership inference against GNNs at node level lacks statistic-based attacks and a principled Bayes-optimal rule; existing i.i.d. state-of-the-art attacks (LiRA, RMIA) are costly or lack theoretical grounding relative to Bayes-optimal inference.
Approach
Extends the Bayesian decision-theoretic MIA of Sabrayolles et al. to graph data, deriving a posterior that includes a neighborhood loss-difference term; approximates it with shadow models and sampling of non-target memberships (model-independent, 0-hop MIA, Gibbs/MH) to obtain G-BASE, and simplifies to BASE for i.i.d. data, which is shown equivalent to RMIA with gamma=1.
Key results
- On Cora (GCN, K=8 online), BASE reaches 82.45% AUC and 17.47% TPR@1%FPR, matching RMIA and exceeding LiRA's 8.01% TPR@1%FPR.
- On Pubmed (GraphSAGE, K=8), G-BASE (Gibbs) achieves 64.10% AUC and 6.28% TPR@1%FPR vs. RMIA's 57.44% AUC and 3.07% TPR@1%FPR.
- BASE and RMIA produce nearly identical results in the online setting, consistent with the theoretical equivalence at gamma=1.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use G-BASE with neighborhood-aware Gibbs sampling instead of BASE | Membership inference on Pubmed · Pubmed (GraphSAGE), K=8 | AUC (%): 57.44 ± 0.56 -> 64.10 ± 0.69 | Helped |
| Use G-BASE with model-independent sampling instead of BASE | Membership inference on Flickr · Flickr (GCN), K=8 | AUC (%): 56.23 ± 0.57 -> 60.04 ± 1.01 | Helped |
| Use G-BASE with Gibbs sampling instead of BASE | Membership inference on Github · Github (GraphSAGE), K=8 | AUC (%): 54.13 ± 0.59 -> 57.47 ± 1.43 | Helped |
| Use G-BASE with 0-hop MIA sampling instead of BASE | Membership inference on Amazon-Photo · Amazon-Photo (GAT), K=8 | AUC (%): 56.35 ± 0.93 -> 56.77 ± 0.85 | No clear effect |
| Use G-BASE with 0-hop MIA sampling instead of BASE | Membership inference on Cora · Cora (GCN), K=8 | AUC (%): 82.45 ± 1.45 -> 77.42 ± 1.40 | Hurt |
| Use G-BASE with Gibbs sampling instead of BASE | Membership inference on Citeseer · Citeseer (GAT), K=8 | AUC (%): 84.84 ± 1.13 -> 84.39 ± 0.67 | No clear effect |
| Use BASE with RMIA threshold γ=1 | BASE and RMIA · i.i.d. data and graph data | ROC curve | No clear effect |
| Use BASE instead of RMIA with γ=1 | Membership inference · i.i.d. data and graph data | model queries | Helped |
Surprising findings
- LiRA performs best in AUC on Cora and Citeseer with large K but is worse than MLP-classifier attacks at low FPR under mismatched adversary assumptions.
- The 0-hop-based MLP classifier attacks perform near random guessing on the larger datasets.
Limitations
- G-BASE inference cannot easily parallelize over target nodes, adding a factor of N x M in cost.
- Attacks based on many shadow models (K=128) are of less practical relevance for large models and datasets, per the authors.
- Several approximations (Lambda=1, shadow-model distribution independent of membership configuration, sampling approximations) mean the attack is only approximately Bayes-optimal.
Experimental setup
Datasets: Cora Citeseer Pubmed Flickr Amazon-Photo Github CIFAR-10 CIFAR-100
Benchmarks: Cora Citeseer Pubmed Flickr Amazon-Photo Github
Metrics: AUC TPR@1% FPR TPR@0.1% FPR
Baselines: LiRA RMIA MLP-classifier node-level MIA (0-hop) MLP-classifier node-level MIA (0+2-hop)
Builds on: Sabrayolles et al. Bayes-optimal MIA LiRA RMIA Metropolis-Hastings
Closest papers by meaning
- Low-Cost High-Power Membership Inference Attacks (ICML 2024 · similarity 0.87)
- Exploring the limits of strong membership inference attacks on large language models (NeurIPS 2025 · similarity 0.87)
- Chameleon: Increasing Label-Only Membership Leakage with Adaptive Poisoning (ICLR 2024 · similarity 0.86)
- Causal Evaluation of Membership Inference Attacks (NeurIPS 2026 · similarity 0.86)
- Can Graph Neural Networks Expose Training Data Properties? An Efficient Risk Assessment Approach (NeurIPS 2024 · similarity 0.85)
- Estimating Model-Level Membership Inference Vulnerability Without Reference Models (NeurIPS 2026 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.