Source-linked AI summary
GraphMI: Extracting Private Graph Data from Graph Neural Networks
Zaixi Zhang, Qi Liu, Zhenya Huang, Hao Wang, Chengqiang Lu, Chuanren Liu, Enhong Chen
TL;DR
Model inversion can expose sensitive training data, but existing approaches have difficulty adapting from grid-like inputs to graph data and GNNs. GraphMI combines projected-gradient optimization with a graph auto-encoder to reconstruct graph edges. The authors report effectiveness across public datasets, but canonical differential privacy struggles to defend against the attack while retaining decent utility.
Problem
Model inversion has been studied mainly in grid-like domains, while graph inversion must address discrete edges and make use of graph properties and node information.
Source: §1 · pp. 1–2Method
GraphMI combines projected-gradient optimization with a graph auto-encoder that uses graph topology, node attributes, and target-model parameters for edge reconstruction.
Source: §1 · p. 2Results
GraphMI is effective across several public datasets; on Cora, its attack AUC for edges with top 5% influence is nearly 1.00.
Source: §1 · p. 2, §5.2 · p. 6Takeaways & Limitations
Edges with greater influence are more likely to be recovered, and canonical differential privacy can hardly protect privacy while preserving decent utility.
Source: §1 · p. 2, §6 · p. 6The threat model is white-box and assumes labels for all nodes in most of the paper; extending the work to a black-box setting remains a future direction.
Source: §3.2 · p. 3, §6 · p. 6
Abstract
from arXiv · showhide
As machine learning becomes more widely used for critical applications, the need to study its implications in privacy turns to be urgent. Given access to the target model and auxiliary information, the model inversion attack aims to infer sensitive features of the training dataset, which leads to great privacy concerns. Despite its success in grid-like domains, directly applying model inversion techniques on non-grid domains such as graph achieves poor attack performance due to the difficulty to fully exploit the intrinsic properties of graphs and attributes of nodes used in Graph Neural Networks (GNN). To bridge this gap, we present \textbf{Graph} \textbf{M}odel \textbf{I}nversion attack (GraphMI), which aims to extract private graph data of the training graph by inverting GNN, one of the state-of-the-art graph analysis tools. Specifically, we firstly propose a projected gradient module to tackle the discreteness of graph edges while preserving the sparsity and smoothness of graph features. Then we design a graph auto-encoder module to efficiently exploit graph topology, node attributes, and target model parameters for edge inference. With the proposed methods, we study the connection between model inversion risk and edge influence and show that edges with greater influence are more likely to be recovered. Extensive experiments over several public datasets demonstrate the effectiveness of our method. We also show that differential privacy in its canonical form can hardly defend our attack while preserving decent utility.
1 Introduction
The paper frames graph model inversion as a privacy risk for GNNs and addresses the challenges of recovering discrete graph edges while using graph structure and node information. GraphMI combines projected gradient optimization with a graph auto-encoder, and the authors report that influential edges are more likely to be recovered and canonical differential privacy offers little defense.
1 Introduction
- GNN applications such as recommendation and social relationship analysis process sensitive graph data, motivating study of their privacy risks.The authors argue that studying model inversion on GNNs can help identify vulnerabilities and avoid privacy risks.Source: §1 · p. 1
- Graph inversion is challenging because binary edges complicate gradient optimization, and existing methods do not fully exploit graph properties, node attributes, or GNN information.The paper identifies sparsity and feature smoothness as graph properties that existing methods fail to exploit.Source: §1 · p. 2
- GraphMI combines projected gradient optimization and a graph auto-encoder to reconstruct private graph edges from GNNs.The projected gradient module addresses edge discreteness while preserving sparsity and feature smoothness; the auto-encoder uses node attributes, topology, and target-model parameters.Source: §1 · p. 2
- Edges with greater influence are more likely to be reconstructed, while canonical differential privacy offers little defense against GraphMI.The paper reports that privacy protection is difficult to preserve alongside decent utility.Source: §1 · p. 2
2 Related Work
Prior model inversion work focused mainly on grid-like data, leaving graph-structured data largely unaddressed. This paper situates its focus within a broader family of privacy attacks and earlier image-domain inversion methods.
2 Related Work
- Privacy attacks include membership inference, model extraction, and model inversion, which targets sensitive training features.The paper distinguishes these attacks by their goals.Source: §2 · p. 2
- Model inversion began with linear regression and was extended to face extraction from shallow neural networks.The latter approach formulated inversion as optimization solved by gradient descent with image modifications.Source: §2 · p. 2
- Prior inversion work explored black-box and generative approaches in the image domain [A¨ıvodji et al., 2019; Zhang et al., 2020], while graph-domain inversion remained unaddressed.Source: §2 · p. 2
3 Problem Formulation
The formulation describes GNN-based node classification and specifies the attacker’s access and reconstruction objective. It also summarizes the message-passing setup and the GraphMI algorithm’s inputs and steps.
3.1 Preliminaries on GNNs
- A GNN can perform semi-supervised node classification using graph topology, node attributes, and a known subset of node labels.The formulation represents topology with adjacency matrix A and node attributes with feature matrix X.Source: §3.1 · p. 2
- A GNN layer combines message passing with a vertex update; the message function M_k and update function U_k operate over each node’s neighbors.The input node representation is its feature vector.Source: §3.1 · p. 2
- The paper focuses mainly on two-layer GCNs, which aggregate neighboring features using self-connections, normalized adjacency, learned weights, and ReLU.It also reports that GraphMI can be applied to GAT and GraphSAGE.Source: §3.1 · pp. 2–3
3.2 Problem Definition
- The attacker has white-box access to the trained target GNN and, in most experiments, labels for all nodes; auxiliary knowledge may include node attributes, IDs, or edge density.The paper discusses how auxiliary knowledge and the number of known labels affect attack performance.Source: §3.2 · p. 3
- The algorithm takes a target GNN, node labels, and node features, then returns a reconstructed adjacency matrix.Its listed inputs also include a learning rate and iteration count.Source: §3.2 · p. 3
- The listed GraphMI steps initialize edge variables, apply gradient descent and projection, then use a graph auto-encoder and random sampling.Source: §3.2 · p. 3
- GraphMI seeks an adjacency matrix A* that maximizes the posterior P(A|X, Y, θ*).Here X is the feature matrix, Y the node-label vector, and θ* the target model parameters.Source: §3.2 · p. 3
4 Proposed Algorithm
GraphMI formulates graph model inversion as optimization over a reconstructed topology, combining projected-gradient updates with a target-informed graph auto-encoder. It also relates edge influence to inversion risk, predicting that more influential edges are more likely to be recovered.
4.1 Attack Overview
- GraphMI passes optimized topology and features through a graph auto-encoder using transferred target-model parameters to infer edge probabilities, then samples a binary adjacency matrix.Source: §4.1 · p. 3, §4.2 · p. 4
4.2 Details of Modules
- The projected-gradient module minimizes target-GNN label loss while enforcing feature smoothness and graph sparsity, relaxing binary edge variables to [0,1] for optimization.Source: §4.2 · pp. 3–4
4.3 Analysis on Correlation between Edge Influence and Inversion Risk
- Theorem 1 states that adversary advantage is greater for edges with greater influence; GraphMI is expected to recover such edges more often because they correlate more with model output.Source: §4.3 · p. 4
5 Experiments
The experiments evaluate GraphMI across public graph datasets, GNN architectures, label availability, parameter settings, edge influence, and differential-privacy defenses. GraphMI performs best on nearly all datasets, while its performance varies with these conditions and DP generally does not prevent the attack.
5.2 Results and Discussions
- GraphMI achieves the best attack performance on nearly all datasets, with Citeseer as an exception where attribute similarity performs better.The authors attribute the exception to Citeseer’s more abundant node attributes.Source: Table 1 · p. 5, §5.2 · p. 5
5.1 Experimental Settings
- Experiments cover seven public datasets from four categories, three GNN models, and attacks with all node labels and feature vectors available.The target models are trained using 10% of nodes; attack performance is measured with AUC and AP on edges and an equal number of sampled non-edges.Source: §5.1 · p. 5
5.2 Results and Discussions
- GraphMI performs better against GAT than against the other tested GNNs, which the authors associate with stronger correlation between graph topology and node labels.The authors suggest GraphMI can take advantage of this stronger correlation.Source: §5.2 · p. 5, Figure 3 · p. 5
- With only 20% of node labels available, GraphMI still achieves over 80% AUC and AP, although performance drops as fewer labels are available.Figure 4 examines the influence of node-label proportion on attack performance.Source: §5.2 · pp. 5–6, Figure 4 · p. 6
- On Cora, GraphMI performance can be boosted by choosing proper α and β values, which are varied over log-scale ranges.The tested ranges are α from 0.00025 to 0.008 and β from 0.00005 to 0.0016.Source: §5.2 · p. 6, Figure 5 · p. 6
- On Cora, GraphMI reaches nearly 1.00 AUC for edges in the top 5% by influence, and higher-influence sensitive edges imply more severe privacy leakage.Edge influence is selected using a topology attack; removing higher-influence edges causes a greater drop in prediction accuracy.Source: §5.2 · p. 6, Figure 6 · p. 6
- As the DP privacy budget ε drops, GraphMI performance deteriorates at the price of a huge model-utility drop; the authors conclude DP generally cannot prevent the attack.The evaluation varies ε from 1.0 to 10.0 and sets δ to 10^-5.Source: §5.2 · p. 6, Table 2 · p. 6
6 Conclusion
The paper concludes that GraphMI is effective for extracting private graph data from GNNs, while identifying black-box attacks and better privacy–utility trade-offs as future directions.
6 Conclusion
- GraphMI was effective across several state-of-the-art GNNs, and the paper examined how node-label proportion and edge influence relate to attack performance.The conclusion reports these findings without specifying their quantitative results.Source: §6 · p. 6
- Differential privacy can hardly protect privacy while preserving decent utility in the evaluated setting.Source: §6 · p. 6
- Future work includes extending the attack to black-box settings and designing countermeasures with a better utility–privacy trade-off.Source: §6 · p. 6