Model Stealing Attacks Against Inductive Graph Neural Networks

1 Introduction

• Prior GNN model-stealing work focused on transductive models and assumed access to target-model training, while this paper targets inductive GNNs queried through a remote API.The paper focuses on node classification.Source: §1 · p. 1
• A general framework covers the attack scenarios by learning missing query-graph structure when needed and training a surrogate from node features and target responses.The framework has two components: structure learning and surrogate-model construction.Source: §1 · p. 2
• Across three inductive GNNs and six datasets, attacks achieve strong performance; for GIN on Pubmed with embedding responses, Type I attains 0.877 accuracy and 0.906 fidelity.With t-SNE responses for the same target, it attains 0.823 accuracy and 0.846 fidelity.Source: §1 · p. 2
• The paper presents the first model-stealing attacks against inductive GNNs, addressing a setting that prior image- and text-focused work had largely left understudied.Prior GNN attacks instead focused on transductive settings.Source: §1 · pp. 1–2
• The threat model varies adversary knowledge along two dimensions and defines six scenarios based on query-graph information and target-model responses.Responses include predicted posterior probabilities, node embeddings, and 2-dimensional t-SNE projections; query-graph structure may be missing.Source: §1 · pp. 1–2

2.1 Notations

• The paper represents an attributed graph as G = (V,E,X,C), with nodes, edges, node features, and one-hot node labels; it denotes the target and surrogate models as M_T and M_S.The adjacency matrix A provides an alternative graph representation, G = (A,X,C).Source: §2.1 · p. 2

2.2 Preliminaries

• GNNs update node representations by aggregating neighbor information, so after l iterations a node representation captures its l-hop neighborhood.The number of graph convolutional layers corresponds to the reachable l-hop neighborhood.Source: §2.2 · pp. 2–3
• Inductive GNNs generalize to previously unseen graphs, unlike transductive models that learn on one fixed graph and must be retrained when new nodes are introduced.The paper focuses on the inductive setting.Source: §2.2 · p. 3
• The paper considers three inductive architectures: GraphSAGE, GAT, and GIN, with GAT using attention weights and GIN extending GraphSAGE to arbitrary multi-set aggregation.GraphSAGE uses neighborhood aggregation; GAT learns attention weights for neighbors.Source: §2.2 · p. 3
• The target model may return posterior probabilities, node embeddings, or 2-dimensional t-SNE projections for query nodes and their l-hop subgraphs.The responses can support node embeddings for downstream tasks or visualization.Source: §2.2 · p. 3

3.1 Attack Setting

• The adversary is black-box: it lacks target parameters and architecture, cannot alter training, and queries node l-hop subgraphs for posterior, embedding, or 2D t-SNE responses.Source: §3.1 · pp. 3–4

3.2 Adversary’s Goal

• Theft seeks target-task accuracy, whereas reconnaissance seeks behavioral agreement, including matching wrong or correct predictions, to support later attacks.A high-fidelity surrogate may serve as a stepping stone for adversarial examples [54].Source: §3.2 · p. 4

3.3 Adversary’s Capability

• The target may return node embeddings, posterior probabilities, or 2D t-SNE projections; t-SNE contains the least information, yet the paper reports attacks remain possible with it.Source: §3.3 · p. 4
• The query graph is drawn from the target-training graph’s dataset, but need not share its characteristics or nodes; attacks are also evaluated without query-graph structure.Source: §3.3 · p. 4
• Unlike prior transductive attacks that assume training-process access, these attacks use remote queries, target inductive GNNs, and are described as model agnostic.The cited Attack-3 trains without querying the target, unlike this paper’s attacks [78].Source: §3.3 · pp. 4–5

4.1 Attack Taxonomy

• Six scenarios span two attack types defined by query-graph structure and response form; Type II.3 is hardest, starting with node features alone.Type I uses available query graphs from the training-graph distribution, whereas Type II addresses missing graph structure, including cases where the attacker reconstructs relationships from user profiles.Source: §4.1 · p. 5

4.2 Attack Framework

• The unified framework locally reconstructs missing query-graph structure when needed, then learns a surrogate from the target model’s response to the query graph.Structure reconstruction is not required for Type I attacks, and the reconstruction component does not interact with the target model.Source: §4.2 · p. 5

4.2.1 Learn Discrete Graph Structure (‚)

• For Type II attacks, IDGL learns a query graph by combining task-dependent prediction loss with graph regularization, rather than relying on a fixed kNN graph.The kNN graph seeds the search; the final learned graph may not retain its original edges.Source: §4.2.1 · p. 6

4.2.2 Learn Surrogate Model (ƒ)

• GraphSAGE, GIN, and GAT are treated as special cases of a shared spatial-GNN formulation, enabling one surrogate-learning framework across these architectures.The formulation captures their differing feature-aggregation designs, including GAT’s learnable neighbor weights.Source: §4.2.2 · p. 6
• The surrogate GNN takes query-graph neighborhoods as training data and target responses as supervision, treating response types uniformly as embedding vectors.It minimizes RMSE between its output and the target response, then freezes that module and trains an MLP classifier using node labels.Source: §4.2.2 · pp. 6–7
• The attack does not require knowledge of the target architecture, and the authors report successful behavioral copying even from marginal t-SNE responses.The paper identifies node embeddings and 2-dimensional t-SNE projections as query-response attack surfaces for inductive GNNs.Source: §4.2.2 · p. 7

5.1 Experimental Setup

• Experiments cover six datasets and three target architectures, with 20% of nodes for target training, 30% for queries, and the remaining 50% for testing.The study evaluates accuracy and fidelity across combinations of target models, responses, and surrogate models.Source: §5.1 · pp. 7–8

5.2 Performance Evaluation: Type I Attacks

• Across six datasets, Type I attacks build surrogates close to target accuracy with posterior-probability or embedding responses; t-SNE responses remain usable, with a worst-case 0.162 accuracy drop.The authors also report low standard deviations across five runs and that the attacks do not require knowledge of target architectures.Source: §5.2 · pp. 8–10, Table 5 · p. 9

5.3 Performance Evaluation: Type II Attacks

• Type II.1/2 achieve accuracy on par with target models across datasets, while Type II.3 remains usable; for Pubmed, t-SNE-response accuracy is 0.836, 0.739, and 0.850 across target models.Type II attacks also show low standard deviations across cases.Source: §5.3 · pp. 11–12, Table 7 · p. 11
• IDGL reconstruction gives the highest Type II attack accuracy among the tested methods; on Citeseer, embedding-response accuracy is 0.879, versus 0.411 for random construction and 0.737 for kNN.The comparison uses GAT as target and GraphSAGE as surrogate.Source: Figure 4 · p. 10, §5.3 · p. 12

5.4 Performance Evaluation: Query Budget

• Larger query budgets generally improve accuracy and fidelity, although most cases achieve similar performance with only 3% of randomly sampled dataset nodes.For Type I with GraphSAGE embeddings, accuracy rises from 0.839 to 0.870 as the query budget increases from 3% to 27%.Source: §5.4 · p. 12, Figure 6 · p. 12

6 Discussions

• The attacks cover node-level target results, not graph-level outputs that return a pooled graph embedding for downstream graph tasks.The authors say graph-level model stealing would require a different approach.Source: §6 · pp. 12–13
• Jointly optimizing graph structure and the surrogate may require more training epochs and queries, increasing the risk of detection.The authors leave this training paradigm for future work.Source: §6 · p. 13
• Random Gaussian noise slightly affects surrogate accuracy, but the preliminary experiment does not establish concrete evidence that it counters the attacks.For ACM, accuracy starts to decrease when noise standard deviation σ exceeds 7 for different target models; embedding responses show fewer fluctuations as noise increases.Source: §6 · p. 13

Model Stealing Attack Against ML Models

• Earlier model-stealing studies targeted aspects such as parameters and functionality, but most focused on image models; preliminary GNN efforts focused on transductive models unable to generalize to unseen data.The paper frames its work around the more general inductive setting.Source: §7 · p. 13
• The paper positions its attacks as addressing the inductive-GNN model-stealing gap, assessing whether theft and reconnaissance adversaries can achieve high accuracy and fidelity.Source: §7 · p. 13

Causative Attacks on GNNs

• Existing causative GNN attacks manipulate training data, whereas this paper’s attack does not tamper with training graph data or change target behavior or parameters.The related-work section distinguishes these attack settings.Source: §7 · p. 13

Exploratory Attacks on GNNs

• Exploratory GNN attacks include link stealing and membership inference, but model stealing trains a surrogate through interaction with the target model.The cited membership-inference methods do not interact with the target during attack-model training.Source: §7 · p. 13

Defense of Attacks on GNNs

• Existing GNN defenses address causative attacks, while the reviewed defense techniques do not protect against exploratory attacks.Source: §7 · p. 13

8 Conclusion

• The authors present the first security risk assessment of inductive GNNs through model-stealing attacks.Source: §8 · p. 13
• The threat model categorizes adversary knowledge by query graph and model response, yielding six scenarios and a general attack framework.Source: §8 · p. 14
• Experiments on three inductive GNN architectures and six benchmark datasets show strong performance across response types, including when graph-structure information is unavailable.Source: §8 · p. 14

A Performance Evaluation: Type I Attacks (GIN/GAT)

• Tables 8 and 9 summarize Type I attack performance with GIN and GAT surrogate models.Source: A Performance Evaluation: Type I… · p. 18

• Tables 10 and 11 summarize Type II attack performance using GIN and GAT surrogate models.Source: B Performance Evaluation: Type II… · p. 18

• Figure 8 shows Type II attack fidelity on Citeseer using different graph reconstruction methods.Source: C Fidelity · p. 18

• A larger batch size may hurt attack accuracy, while hidden-unit size and epoch count have limited or stable effects.Source: Figure 11 · p. 18, Figure 9 · p. 18, Figure 10 · p. 18
• The study evaluates hidden-unit size, epochs, and batch size under Type I attacks, showing one dataset per hyperparameter and noting similar trends on other datasets.The hidden-unit study varies target GAT and surrogate GraphSAGE hidden sizes across 64, 128, and 256 units; epochs and batch sizes are also varied.Source: D Hyperparameter Study · p. 19
• Epoch count and batch size are varied using 150, 200, 250, and 300 epochs and batch sizes of 400, 600, 800, and 1000.Source: D Hyperparameter Study · p. 21