PaperlayerView exact revision on arXiv

Source-linked AI summary

Node-Level Membership Inference Attacks Against Graph Neural Networks

Xinlei He, Rui Wen, Yixin Wu, Michael Backes, Yun Shen, Yang Zhang

arXiv:2102.05429v1cs.CRcs.LG

TL;DR

Privacy risks from GNNs remain under-studied, although graph data can contain sensitive information. The paper defines threat models and three node-level membership-inference attacks, finding GNNs vulnerable even with minimal adversary knowledge.

  • Problem

    Node-level membership-inference risks in GNNs remain under-studied, despite graph training data containing sensitive relations and mobility traces.

    Source: §1 · p. 1

  • Method

    The paper defines adversary knowledge across shadow datasets, shadow models, and node topology, then proposes 0-hop, 2-hop, and combined attacks.

    Source: §1.1 · p. 2, §3.3 · p. 4

  • Results

    Across three GNN models and four benchmark datasets, GNNs are vulnerable to membership inference even with minimal adversary background knowledge.

    Source: §6 · p. 12

  • Takeaways & Limitations

    Subgraph density and feature similarity affect attack performance, while the two evaluated defenses reduce risk with moderate utility damage.

    Source: §1.1 · p. 2, §4.6 · p. 11

    The two evaluated defenses reduce attack risk but both limit target-model utility.

    Source: §4.6 · p. 11

Abstract

from arXiv · show

Many real-world data comes in the form of graphs, such as social networks and protein structure. To fully utilize the information contained in graph data, a new family of machine learning (ML) models, namely graph neural networks (GNNs), has been introduced. Previous studies have shown that machine learning models are vulnerable to privacy attacks. However, most of the current efforts concentrate on ML models trained on data from the Euclidean space, like images and texts. On the other hand, privacy risks stemming from GNNs remain largely unstudied. In this paper, we fill the gap by performing the first comprehensive analysis of node-level membership inference attacks against GNNs. We systematically define the threat models and propose three node-level membership inference attacks based on an adversary's background knowledge. Our evaluation on three GNN structures and four benchmark datasets shows that GNNs are vulnerable to node-level membership inference even when the adversary has minimal background knowledge. Besides, we show that graph density and feature similarity have a major impact on the attack's success. We further investigate two defense mechanisms and the empirical results indicate that these defenses can reduce the attack performance but with moderate utility loss.

1 Introduction

Graph neural networks use node features and neighborhood structure to analyze relational data, but their privacy risks have received less study than those of models for images and text. The paper defines node-level membership-inference threat models and attacks, evaluates their performance, analyzes attack factors, and tests defenses.

1 Introduction

  • Graph data includes relational structure that classical CNNs and RNNs are not designed to model, while GNNs use node and neighborhood features.The paper frames privacy risks in GNNs as under-studied relative to ML models trained on images and text.Source: §1 · p. 1

1.1 Our Contributions

  • The threat model varies adversary knowledge of the shadow dataset, shadow-model architecture, and node topology, including feature-only 0-hop and 2-hop subgraph queries.The shadow dataset and model may match or differ from the target's training distribution and architecture.Source: §1.1 · p. 2
  • Across three GNNs and four datasets, the three attacks are effective; 0-hop outperforms 2-hop, combined is strongest, and attacks remain effective without known target-data distribution or architecture.The 0-hop attack reaches 0.791 accuracy on GraphSAGE trained on Citeseer.Source: §1.1 · p. 2
  • Higher subgraph density makes nodes more prone to inference, while similar features between a node and its neighbors also make attacks easier.The paper attributes the density association to greater participation in GNN aggregation, which amplifies the node's influence.Source: §1.1 · p. 2
  • The authors propose two defenses that reduce membership-inference risk but also limit target-model utility.The reported utility damage is moderate.Source: §1.1 · p. 2

2 Graph Neural Networks

This section introduces graph notation, describes the GNN architectures used in the paper, and explains their node-prediction process. The paper focuses on inductive GNNs and considers predictions obtained from either a node's feature or its subgraph.

2.1 Notations

  • A graph dataset is represented as D = (G, X, Y); an l-hop neighborhood contains nodes within distance l, and its subgraph includes those nodes, their edges, and features.The notation also distinguishes the graph's nodes and edges and the feature and label sets.Source: §2.1 · p. 2

2.2 GNN Architecture

  • The paper focuses on inductive GNNs; in the described transductive fixed-graph setting, membership inference is trivial because test predictions are limited to training nodes.Source: §2.2 · p. 2
  • GNN layers iteratively aggregate neighborhood representations and update a node's hidden state; the initial representation is the node's feature.The aggregation and update functions produce the node's representation at each layer.Source: §2.2 · p. 3
  • GraphSAGE uses mean aggregation, GAT uses multi-head attention, and GIN's representation power is described as matching the Weisfeiler-Lehman test.GIN's aggregation includes a learnable ε parameter that adjusts the weight of the node itself.Source: §2.2 · p. 3

2.3 GNN Prediction

  • For node classification, a t-layer GNN can predict an unseen node from its t-hop subgraph, though querying only its feature is also possible.The paper reports that feature-only querying can outperform an MLP that ignores graph structure.Source: §2.3 · p. 3

3 Node-Level Membership Inference Against GNNs

This section defines node-level membership inference for GNNs, specifies the adversary’s background knowledge, and describes attacks that use target-model posteriors to predict whether a node was in training.

3.1 Problem Definition

  • A node-level membership inference attack asks whether a target node was used to train a target GNN, a question tied to privacy risks in graph data such as sensitive social networks.The section frames the task around an adversary’s target node, target model, and background knowledge.Source: §3.1 · p. 3

3.2 Threat Model

  • The threat model assumes black-box access to an inductive target GNN and categorizes adversary knowledge by shadow dataset, shadow model, and node topology.The shadow dataset may come from the target training data’s distribution, has no node or edge overlap with the target dataset, and the shadow model may share or differ in architecture.Source: §3.2 · pp. 3–4
  • A 0-hop query uses the target node’s features with a self-loop, while a 2-hop query uses its 2-hop subgraph, which may be partial and contain nodes of unknown membership.The paper treats these as the two extreme topology settings, leaves 1-hop queries for future work, and notes that two-layer GNNs make 2-hop an upper bound in this setting.Source: §3.2 · p. 4

3.3 Attack Methodology

  • The adversary splits the shadow nodes into training and testing sets, trains a shadow GNN on the training portion, and uses its posteriors to build attack-model training data.The attack model is trained as a binary classifier, labeling nodes in the shadow training set as members and the rest as non-members.Source: §3.3 · pp. 4–5
  • The 0-hop and 2-hop attacks feed the corresponding two largest ranked posterior values to separate MLPs, while the combined attack joins embeddings from both inputs before an MLP predicts membership.At inference, the adversary queries the target GNN using the available topology and passes one or both posterior sets to the attack model.Source: §3.3 · pp. 4–5

4 Evaluation

The evaluation examines node-level membership-inference attacks against GNNs across graph datasets and architectures, including how attack conditions and node properties shape success. It also assesses defenses’ effects on attack accuracy and target-model utility.

4.1 Experimental Setup

  • The evaluation uses Cora, Citeseer, Cora-full, and Lastfm, splitting each graph into disjoint target and shadow datasets and dividing the target data into member training and non-member testing nodes.The target models are GraphSAGE, GAT, and GIN; accuracy measures both classification and membership inference performance.Source: §4.1 · p. 5

4.2 Target Model Performance

  • GraphSAGE 2-hop queries improve original-task accuracy over the MLP baseline on Cora, 0.790 versus 0.684, while GraphSAGE 0-hop also beats MLP except on Citeseer.Other GNN models exhibit similar trends.Source: §4.2 · p. 6, Figure 2 · p. 6

4.3 0-hop and 2-hop Attacks

  • On GraphSAGE trained on Cora, 0-hop attack accuracy is 0.754 versus 0.671 for 2-hop, while higher overfitting accompanies higher attack accuracy.For 2-hop attacks, GraphSAGE on Lastfm has overfitting 0.164 and attack accuracy 0.637, compared with 0.261 and 0.700 on Citeseer; 2-hop queries also have lower overfitting than 0-hop queries.Source: §4.3 · p. 6, Table 3 · p. 6, Table 4 · p. 6
  • Higher degree corresponds to lower attack AUC: GraphSAGE’s 0-hop attack on Cora scores 0.849 in the lowest-degree quartile versus 0.775 in the highest.The authors attribute the reduced leakage to aggregation over more neighbors, which may reduce exposure of the target node.Source: §4.3 · pp. 7–8, Figure 5 · p. 7
  • Higher ego density and feature similarity correspond to greater attack performance: 0-hop AUC on Cora-full rises from 0.799 below 0.25 density to 0.867 above 0.75, while Citeseer 2-hop AUC rises from 0.657 to 0.829 across feature-similarity extremes.The paper links density to more aggregation and memorization, and high density may also amplify influence through feature similarity among neighboring nodes.Source: §4.3 · p. 8, Figure 6 · p. 8, Figure 7 · p. 8

4.4 Combined Attacks

  • The combined attack achieves the highest membership-inference accuracy in most cases, reaching 0.825 on GAT trained on Citeseer versus 0.798 for 0-hop and 0.691 for 2-hop.It combines both query inputs and can follow whichever individual attack correctly classifies a node.Source: §4.4 · pp. 8–9, Figure 8 · p. 9

4.5 Relax Assumptions

  • Combined attacks remain effective with mismatched shadow data or architecture: Cora-target accuracy is 0.775 with Citeseer shadow data versus 0.767 with Cora, and Cora-full accuracy is 0.753 with GIN versus 0.767 originally.Attack performance is also described as relatively stable when a GraphSAGE shadow model’s hidden width varies from 16 to 128 neurons.Source: §4.5 · pp. 9–10, Table 5 · p. 9, Table 6 · p. 10

4.6 Possible Defenses

  • Adding random edges lowers attack accuracy but can reduce task utility: on Citeseer attack accuracy falls from 0.801 to 0.660 with 20 times more edges, while Lastfm 2-hop task accuracy falls from 0.819 to 0.733.The corresponding Lastfm attack accuracy drops from 0.687 to 0.584; the second defense restricts output to labels and converts 0-hop and 2-hop predictions into one-hot inputs, but its results are not provided here.Source: §4.6 · pp. 10–11, Figure 12 · p. 11, Figure 13 · p. 11
  • On Cora-full, GraphSAGE-to-GraphSAGE attack accuracy fell from 0.767 for the original combined attack to 0.537 with the label-only output defense.Attack accuracy decreased significantly across all target models.Source: §4.6 · p. 11
  • The effectiveness of label-only membership inference against the proposed GNN defense remains unjustified, and more advanced defenses are future work.Previous work studied label-only membership inference on non-GNN models.Source: §4.6 · p. 11
  • Both proposed defenses reduce membership-inference risk but limit target-model utility; the label-only defense provides less information because labels contain less information than posteriors.Source: §4.6 · p. 11

5 Related Work

Prior work studies membership inference and other exploratory attacks, but node-level membership inference against GNNs remains preliminary and incomplete. This work examines the gap and analyzes factors affecting attack performance and defenses.

Membership Inference Attack

  • Earlier membership-inference research primarily targets models trained on Euclidean-space data and includes black-box attacks, relaxed threat assumptions, overfitting analysis, and black-box and white-box studies.Proposed defenses include model stacking, dropout, adversarial training, and joint privacy-accuracy optimization.Source: §5 · p. 11

Other Exploratory Attacks Against ML Models

  • Model inversion reconstructs inputs, attribute inference targets general training-data properties, and model stealing seeks to extract target-model parameters.The cited examples include GAN-based input synthesis, collaborative-learning attribute leakage, and black-box model extraction.Source: §5 · pp. 11–12

Adversarial Attacks Against Graph Neural Networks

  • Most prior GNN attacks are causative, perturbing training data or graph elements, while exploratory attacks query models without changing their parameters.Exploratory GNN work includes link stealing and model extraction, but prior node-level membership-inference studies had methodological or scenario limitations.Source: §5 · p. 12
  • This work addresses those limitations with a broader node-level membership-inference analysis and examines ego density, feature similarity, and two defenses.The prior 2-hop-only scenario was considered insufficient for a complete picture of GNN membership risks.Source: §5 · p. 12

6 Conclusion

The paper assesses node-level membership-inference risks for GNNs by defining threat models and evaluating three attacks. It finds vulnerability even with minimal adversary knowledge, identifies graph and feature factors associated with attack performance, and discusses defenses’ utility trade-offs.

6 Conclusion

  • GNNs remain vulnerable to node-level membership inference even with minimal adversary background knowledge.The assessment spans three GNN models and four benchmark datasets.Source: §6 · p. 12
  • Attack performance is strongly affected by node degree, ego density, and feature similarity.The paper reports that higher subgraph density increases node participation in aggregation and that similar neighboring features ease attacks.Source: §6 · p. 12
  • The attacks remain effective when the adversary’s shadow dataset distribution or shadow-model architecture differs from the target’s.Source: §6 · p. 12
  • Two proposed defenses can mitigate attacks, but involve trade-offs between membership privacy and model utility.Source: §6 · p. 12

Related papers

Loading 2102.05429v1…