Research map / Graph learning / GNN architectures

GraphIP–Bench: How Hard Is It to Steal a Graph Neural Network, and Can We Stop It?

NeurIPS 2026 · Graph learning › GNN architectures · approach: Robustness, privacy, and fairness of GNNs · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Introduces GraphIP-Bench, a unified black-box benchmark (PyGIP library) evaluating 12 GNN model-extraction attacks and 12 ownership/information-limiting defenses on 10 graphs, with a joint track measuring watermark survival on extracted surrogates.

Problem

Model-extraction attacks on GNN cloud services and ownership defenses (watermarking, output perturbation, query detection) are evaluated inconsistently across papers, so it is unclear how hard GNN theft is and which defenses actually work.

Approach

A single black-box protocol with shared splits, query sets, budgets, and metrics that evaluates attacks, defenses, and a joint attack-and-defense track in which every attack is run on every defended target and watermark verification is measured on the extracted surrogate (watermark survival).

Key results

• Strongest extraction attacks exceed 90% surrogate fidelity on most datasets at medium budgets (conclusion claim).
• BackdoorWM reaches median fidelity 80.07%, 100% ownership verification, and 3.27 pp median utility drop across ten datasets.
• On Computers at 0.25x, Integrity keeps 100% watermark verification on the surrogate while BackdoorWM drops to 59.2% and ImperceptibleWM to 0.0%.

Surprising findings

• Most parameter-side or trigger-based graph watermarks verify near-perfectly on the protected model but lose most verification signal on the extracted surrogate.
• Watermarks do not reduce surrogate fidelity; data-free attacks can match data-driven attacks on several graphs.

Limitations

• Threat model limited to black-box query access; grey-box, federated, and streaming settings not covered.
• Backbones limited to GCN, GAT, GraphSAGE; graph transformers and temporal/heterogeneous GNNs not evaluated.
• Verification proxies for information-limiting and query-detection defenses differ by method, complicating comparison; Integrity verification is a single binary fingerprint event producing bimodal results.

Experimental setup

Datasets: Cora CiteSeer PubMed CoauthorCS CoauthorPhysics Computers Photo OGBN-Arxiv RomanEmpire AmazonRatings ENZYMES PROTEINS

Benchmarks: GraphIP-Bench

Metrics: accuracy macro F1 fidelity ownership verification watermark survival utility drop time peak GPU memory

Baselines: MEA0 MEA1 MEA2 MEA3 MEA4 MEA5 AdvMEA CEGA Realistic DFEA_I DFEA_II DFEA_III

Builds on: PyGIP BackdoorWM Integrity DFEA

Closest papers by meaning

• On Stealing Graph Neural Network Models (AAAI 2026 · similarity 0.90)
• Revisiting Asymmetries in Black-box Link Stealing against Graph Neural Networks (ICML 2026 · similarity 0.90)
• CEGA: A Cost-Effective Approach for Graph-Based Model Extraction and Acquisition (ICML 2025 · similarity 0.87)
• Can Graph Neural Networks Expose Training Data Properties? An Efficient Risk Assessment Approach (NeurIPS 2024 · similarity 0.86)
• Crossfire: An Elastic Defense Framework for Graph Neural Networks Under Bit Flip Attacks (AAAI 2025 · similarity 0.86)
• On provable privacy vulnerabilities of graph representations (NeurIPS 2024 · similarity 0.85)