PaperlayerView exact revision on arXiv

Source-linked AI summary

GrOVe: Ownership Verification of Graph Neural Networks using Embeddings

Asim Waheed, Vasisht Duddu, N. Asokan

arXiv:2304.08566v2cs.LGcs.CR

TL;DR

GNN model extraction threatens proprietary models, and existing fingerprinting approaches do not address GNNs. GrOVe uses GNN embeddings to verify model ownership; the paper reports near-zero false-positive and false-negative rates, robustness to known fingerprint-removal techniques, and computational efficiency.

  • Problem

    GNNs are vulnerable to model extraction, but the paper identifies no existing fingerprinting scheme for GNN ownership verification.

    Source: §1 · p. 1

  • Method

    GrOVe uses GNN embeddings as fingerprints and a learned similarity classifier to determine whether a suspect model is a surrogate or independent.

    Source: §1 · p. 1, §5 · p. 7

  • Results

    GrOVe distinguishes surrogate from independent models with close to zero false positives or false negatives, and is reported robust to known fingerprint-removal techniques and computationally efficient.

    Source: §1 · p. 2

  • Takeaways & Limitations

    The paper presents embedding-based fingerprinting as a non-invasive approach to GNN model ownership verification.

    Source: §1 · p. 1, §3.4 · p. 5

    Adapting non-graph fingerprinting to graph data is nontrivial because graph nodes are related and satisfy homophily.

    Source: §3.4 · p. 5

Abstract

from arXiv · show

Graph neural networks (GNNs) have emerged as a state-of-the-art approach to model and draw inferences from large scale graph-structured data in various application settings such as social networking. The primary goal of a GNN is to learn an embedding for each graph node in a dataset that encodes both the node features and the local graph structure around the node. Embeddings generated by a GNN for a graph node are unique to that GNN. Prior work has shown that GNNs are prone to model extraction attacks. Model extraction attacks and defenses have been explored extensively in other non-graph settings. While detecting or preventing model extraction appears to be difficult, deterring them via effective ownership verification techniques offer a potential defense. In non-graph settings, fingerprinting models, or the data used to build them, have shown to be a promising approach toward ownership verification. We present GrOVe, a state-of-the-art GNN model fingerprinting scheme that, given a target model and a suspect model, can reliably determine if the suspect model was trained independently of the target model or if it is a surrogate of the target model obtained via model extraction. We show that GrOVe can distinguish between surrogate and independent models even when the independent model uses the same training dataset and architecture as the original target model. Using six benchmark datasets and three model architectures, we show that consistently achieves low false-positive and false-negative rates. We demonstrate that is robust against known fingerprint evasion techniques while remaining computationally efficient.

1. Introduction

GNN model extraction threatens proprietary models, while prior ownership-verification fingerprinting schemes were developed for non-graph models. GrOVe uses GNN embeddings for ownership verification and reports low error rates, robustness to known fingerprint-removal techniques, and computational efficiency.

1. Introduction

  • GNN model extraction trains a local surrogate from target-model input-output pairs, threatening intellectual property and enabling further attacks.Prior work has demonstrated extraction against GNNs as well as other domains.Source: §1 · p. 1
  • Prior ownership-verification fingerprinting schemes target non-graph models, and the paper identifies no existing GNN fingerprinting scheme.The introduction contrasts model fingerprinting, which uses inherent model features, with dataset fingerprinting, which can treat same-data models as stolen.Source: §1 · p. 1
  • The paper proposes GNN embeddings as a fingerprint for model ownership and presents GrOVe as an embedding-based verification scheme.It distinguishes model ownership verification from dataset ownership verification.Source: §1 · p. 2
  • GrOVe distinguishes surrogate from independent models with close to zero false positives or false negatives.The introduction also reports robustness against known fingerprint-removal techniques and computational efficiency.Source: §1 · p. 2

2. Background

The background introduces graph and GNN notation, then reviews extraction attacks and ownership-verification defenses. It distinguishes model ownership from dataset ownership and describes why prior fingerprinting approaches do not readily carry over to graphs.

2.1. Graph Neural Networks

  • GNNs map graph adjacency and node features to node embeddings, with each layer gathering information from neighbors and aggregating it.The paper considers inductive training, where training and test graphs are disjoint.Source: §2.1 · p. 2
  • GraphSAGE uses mean aggregation, GAT uses masked self-attention to weight neighbors, and GIN extends GraphSAGE with an aggregation function that treats neighbors as a multiset.The passage identifies CONCAT and MEAN as operations and describes GIN's learnable parameter for adjusting the node's weight.Source: §2.1 · p. 2

2.2. Model Extraction Attacks and Defences

  • Model extraction trains a local surrogate to mimic a target; the reviewed inductive GNN attack can use known or estimated graph structure and trains embeddings to match the target.In Type II, the attacker estimates the graph structure; the attack also trains a classifier using ground-truth labels.Source: §2.2 · pp. 3–4
  • Ownership verification uses watermarking or fingerprinting; fingerprinting extracts inherent model features without altering training, while watermarking embeds secret information.The paper identifies model-ownership fingerprinting as treating independently trained models on the same dataset as independent, unlike dataset-ownership fingerprinting.Source: §2.2 · p. 3
  • Prior non-graph fingerprints rely on decision-boundary distances or transferable adversarial examples, which are difficult to adapt to connected graph data.The review also notes that prior model-ownership fingerprints did not consider model-extraction attacks, and that some GNN extraction work was limited to transductive training.Source: §2.2 · p. 3

3. Problem Statement

The section frames ownership verification as deciding whether a suspect GNN is a surrogate of a target or an independently trained model. It specifies the actors, assumptions, verification requirements, and why prior approaches do not directly meet them for graphs.

3.1. System Model

  • Ownership verification asks a trusted verifier to determine whether a suspect model was extracted from a target model or trained independently.The setting includes an accuser who owns the target and a responder who owns the suspect model.Source: §3.1 · p. 4, §3 · p. 4
  • Owners timestamp cryptographic commitments before deployment, and the verifier checks those commitments before querying both models on a verification dataset.The verifier samples the dataset from the target’s training-data distribution and passes model outputs to a verification algorithm.Source: §3.1 · pp. 4–5

3.2. Adversary Model

  • The adversary seeks a surrogate with utility comparable to the target and high prediction fidelity, using black-box access and disjoint training data from the same distribution.The adversary is assumed to have no knowledge of the target’s architecture or hyperparameters.Source: §3.2 · p. 5

3.3. Requirements for Ownership Verification

  • An ideal ownership-verification scheme should minimize target utility loss, distinguish surrogates from independent models, resist evasion, and impose low computational overhead.The requirements are R1 through R4, respectively.Source: §3.3 · p. 5

3.4. Limitations of Prior Work

  • Non-graph fingerprinting is difficult to adapt because graph nodes are interconnected, while GNN watermarking modifies training and its robustness against extraction is unclear.The paper therefore focuses on fingerprints for GNN ownership resolution.Source: §3.4 · p. 5

4. Can GNN embeddings serve as fingerprints?

The section tests whether GNN embeddings distinguish models or datasets as fingerprints. Its experiments find embeddings from independently trained models distinguishable even with the same dataset and architecture, while target and extracted-surrogate embeddings are similar across tested variations.

Embeddings as Fingerprint for GNNs

  • GROVE’s fingerprinting intuition is that extraction attacks optimize prediction fidelity, making surrogate embeddings more similar to target embeddings than independently trained models’ embeddings.The paper also notes that embeddings are inherent to GNN computation and do not affect model utility.Source: §4 · p. 5

Experimental Setup

  • The experiment uses t-SNE projections of embeddings to assess model-ownership and dataset-ownership distinctions across architectures and datasets.The paper denotes embeddings from target, surrogate, and independent models as Ht, Hs, and Hi, respectively.Source: §4 · p. 6

Dataset Ownership

  • Across every tested case, t-SNE projections of embeddings generated from Dv were distinguishable even when models shared the same dataset and architecture, suggesting embeddings may not be useful as dataset fingerprints.Source: §4 · p. 6

Model Ownership

  • Across tested cases, target and surrogate embeddings were similar but distinct from independent-model embeddings, regardless of architecture or training data.The model-ownership experiment used 108 model combinations across six datasets; Figure 2 shows an example with GAT models.Source: §4 · p. 6, Figure 2 · p. 6

5. GROVE: Fingerprinting for GNN Ownership Verification

GROVE verifies ownership by comparing target and suspect node embeddings through a learned similarity classifier. It uses paired target–surrogate and target–independent embeddings for training, because a simple distance threshold produced overlapping pair distances and high error rates.

Distance-Based Verification

  • Aggregated embedding distances alone are insufficient because target–independent and target–surrogate pairs overlap, leading to high error rates under a tuned threshold.This motivates learning a classifier rather than relying on a single distance cutoff.Source: §5 · pp. 6–7

Verification

  • A multi-layer perceptron Csim classifies embedding-pair distance vectors as similar or not similar, then labels a suspect surrogate when more than 50% of pairs are similar.In experiments, about 90% of target–surrogate pairs and 10% of target–independent pairs were classified as similar.Source: §5 · p. 7

Csim Training

  • Csim trains on element-wise squared-distance vectors from corresponding node embeddings, using target–surrogate pairs as positive data and target–independent pairs as negative data.A verification graph is queried against the target, surrogate, and independent models to generate these training examples.Source: §5 · p. 7, Figure 3 · p. 7

6. Experimental Setup

The evaluation uses six benchmark graph datasets, three GNN architectures, and two model-extraction attacks. The setup specifies data splits, embedding and classifier training, evaluation metrics, and the extraction attack configuration.

6. Experimental Setup

  • GROVE is evaluated with six datasets, three GNN architectures, and two model-extraction attacks.The setup covers dataset splits, architectures, metrics, and attacks.Source: §6 · p. 7

6.1. Datasets

  • The six benchmarks include citation, co-authorship, heterogeneous-paper, and Amazon co-purchase networks, with different node features and classification tasks.The dataset splits assign disjoint 40% portions to target and surrogate training, 10% to testing, and the remaining 10% to verification.Source: §6.1 · pp. 7–8

6.2. Model Architectures

  • The evaluated GNN architectures are GAT, GIN, and GraphSAGE, with embeddings extracted from each model’s last hidden layer.Csim is a two-layer MLP selected by grid search and 10-fold cross-validation; experiments use five runs and report averages with 95% confidence intervals.Source: §6.2 · p. 8

6.3. Metrics

  • Extraction effectiveness is measured by prediction accuracy and fidelity, while GROVE is evaluated using false-positive and false-negative rates.Fidelity measures agreement between target and surrogate predictions.Source: §6.3 · p. 8

6.4. Model Extraction Attack

  • The extraction evaluation uses Shen et al.’s attack against inductive GNNs, with the surrogate trained on data disjoint from the target’s training data.Attack hyperparameters use the original paper’s defaults.Source: §6.4 · p. 8

7. Evaluation of GROVE

The evaluation tests GROVE’s effectiveness, robustness to evasion, and efficiency. It distinguishes extracted from independent models, remains effective against several tested evasion strategies, and generally takes under three hours to train.

7.1. Effectiveness

  • 0 false negatives against both extraction attacks; false positives were close to zero on four datasets, with 3.4% FPR on AMAZON and 2.2% FPR on ACM.The results support effectiveness across datasets and architectures.Source: Table 4 · p. 9, §7.1 · p. 9

7.2. Adversarial Robustness of GROVE

  • Registration and fidelity checks pre-empt model replacement and post-processing; an adversarial-autoencoder attempt to shift output distributions was unsuccessful and still produced zero false negatives.The authors conjecture that the high-fidelity requirement keeps the surrogate’s output distribution similar to the target’s.Source: §7.2 · pp. 9, 11
  • End-to-end fine-tuning and double extraction still yielded zero false negatives across datasets; double extraction caused at least a 3% accuracy loss on ACM, AMAZON, and CITESEER.Fine-tuning updated both surrogate components using a separate dataset from the same distribution.Source: §7.2 · pp. 9–10
  • Pruning exposed a boundary: basic GROVE often failed at ratios 0.3–0.4, while robust GROVE kept near-zero FNR through 0.4 before utility dropped by more than 5%.Robust optimization adds pruned-model outputs up to a ratio of 0.4 to Csim’s training data.Source: Figure 5 · p. 10, §7.2 · p. 10, Figure 4 · p. 10

7.3. Efficiency of GROVE

  • Training GROVE generally took less than 3 hours; COAUTHOR had the longest times, with Csim training taking 1,561–2,103 seconds.The total includes training additional surrogate and independent models to generate Csim’s training data.Source: §7.3 · p. 11

8. Related Work

Related work situates GROVE among graph robustness defenses and GNN privacy attacks, including attacks that infer training membership, graph structure, links, or dataset properties.

Robustness Attacks against GNNs

  • Prior graph robustness attacks modify adjacency matrices to induce misclassification,, –; their best reported attack rate is 35%, compared with nearly 100% for image-based attacks.Defenses include limiting the effects of perturbed edges or using adversarial training,, –.Source: §8 · p. 11

Privacy Attacks against GNNs

  • GNN privacy work includes membership inference about training nodes or subgraphs –, as well as graph reconstruction from embeddings.Olatunji et al. use 2-hop subgraphs, He et al. use 0-hop subgraphs, and Wu et al. present graph-level membership inference.Source: §8 · p. 12
  • Other studied privacy threats include link inference about queried node pairs, and property inference about global dataset characteristics [90]–.Source: §8 · p. 12

9. Discussion and Conclusions

GROVE fingerprints GNNs and is effective against the state-of-the-art extraction attack studied in the paper. Its scope depends on extraction fidelity, model registration assumptions, and what access the verifier has to the target.

9.1. Summary

  • GROVE fingerprints GNNs and is effective against Shen et al.’s state-of-the-art model extraction attack.Source: §9.1 · p. 12

9.2. Low-Fidelity Model Extraction Attacks

  • Low-fidelity extraction may be missed because GROVE relies on similarity between target and surrogate embeddings; the authors note that current literature has no such GNN attacks.Source: §9.2 · p. 12

9.3. Requirement for Model Registration

  • The system requires model owners to obtain secure certified timestamps before deployment; registration is also presented as a theft-protection and possible regulatory or insurance requirement.Source: §9.3 · p. 12

9.4. Revisiting Adv.A

  • Because the verifier chooses GROVE’s fingerprint, the scheme is immune to adversarial fingerprint-generation attacks described for prior ownership schemes,.Source: §9.4 · p. 12

9.5. Shen et al.’s [27] Prediction-based Attack

  • When the target outputs only class labels, GROVE remains applicable if the verifier has white-box access to the target model.Source: §9.5 · p. 12

Appendix A. Dataset Ownership Graphs

The graphs show the difference between the two models most clearly on COAUTHOR, and the same trend appears across the other plots and architectures.

Appendix A. Dataset Ownership Graphs

  • The difference between the two models is easiest to see on COAUTHOR, the largest dataset.Source: Appendix A · p. 16
  • The same trend appears in the plots for the other datasets.Source: Appendix A · p. 16
  • Although only GAT graphs are shown due to space constraints, the same trend holds across architectures.Source: Appendix A · p. 16

Appendix B. Model Ownership Graphs

The model-ownership experiment shows graphs for GAT, with the same trend reported across architectures.

Appendix B. Model Ownership Graphs

  • The model-ownership experiment’s graphs show the same trend across architectures, though only GAT graphs are presented due to space constraints.Source: Appendix B · p. 16

Appendix C. Distance Graphs

The distance plots show substantial overlap between target–surrogate and target–independent embedding distances, so simple distance-based hypothesis testing did not work. The accompanying contribution and review passages describe GrOVe’s role in GNN ownership verification and note limits in its evasion evaluation.

Appendix C. Distance Graphs

  • The target–surrogate and target–independent Euclidean-distance distributions overlap significantly, so simple distance calculation and hypothesis testing did not work.Source: Appendix C · p. 16
  • Figure 6’s t-SNE projections distinguish embeddings from two trained models across datasets, whether their architectures match or differ.Source: Figure 6 · p. 16
  • Figure 7 shows overlap between Ft and Fs embeddings and distinct Fi embeddings; the caption says the trend holds across architectures.Source: Figure 7 · p. 17
  • Figure 8 plots Euclidean-distance histograms for embedding pairs from (Ft, Fs) and (Ft, Fi).Source: Appendix C · p. 16, Figure 8 · p. 17

D.1. Summary

D.3. Reasons for Acceptance

  • The review describes this GNN fingerprinting mechanism as a defense against model extraction and a direction for further research.Source: §D.3 · pp. 17–18
  • The authors plan to open-source the ownership-verification tool for future research.Source: §D.3 · p. 18

D.4. Noteworthy Concerns

  • The robustness evaluation considers simple evasion attacks and model retraining, but not black-box attacks or adaptive end-to-end fine-tuning attackers.Source: §D.4 · p. 18

Related papers

Loading 2304.08566v2…