PaperlayerView exact revision on arXiv

Source-linked AI summary

MUGEN: Generating Unlearnable Graph Examples for Multiple Learning Tasks

Ziyan Liu, Chengshuai Zhao, Huan Liu

arXiv:2609.00696v2cs.LG

TL;DR

Graph-data releases may be reused for unknown learning tasks, while existing unlearnable graph examples target only specified tasks. MUGEN creates one feature-perturbed release for multiple tasks, and experiments show transferable protection across tasks and GNN backbones.

  • Problem

    Existing unlearnable graph-example methods target specified tasks, leaving the need for one release that remains unlearnable across plausible graph-learning uses.

  • Method

    MUGEN jointly perturbs node features using a shared GNN encoder, task-specific heads, TASO for classwise separability, and TAP for attribute-adaptive updates.

  • Results

    Across five benchmarks, MUGEN degrades clean-test performance, transfers across GNN backbones, and remains effective across the three tasks and studied training interventions.

  • Takeaways & Limitations

    MUGEN provides a single graph-data release with protection spanning node classification, graph classification, and link prediction.

  • Takeaways & Limitations

    Prior graph unlearnability methods exhibit weak class separation and weaker unlearnability for categorical than continuous node attributes.

Abstract

from arXiv · show

Graph data across diverse domains can expose valuable relational information to unauthorized representation learning, creating a pressing need for protection against such misuse. Unlearnable examples offer a data-level defense by perturbing a training release so that models trained on it fail to generalize to clean data. Existing methods generate unlearnable graph examples for only a specified downstream task. Consequently, a release protected against one task may remain learnable for other plausible uses, including node classification, graph classification, and link prediction, which the data owner cannot anticipate. We introduce MUGEN, to our knowledge the first framework for generating unlearnable graph examples that jointly protect all enabled tasks. From one clean dataset, MUGEN produces a single feature-perturbed release that protects every enabled task through a shared GNN encoder and task-specific heads. We devise a Task-Aligned Separability Objective (TASO), which leverages task prediction and classwise separability to strengthen unlearnability and its transfer across GNN backbones and enabled tasks. We further introduce Type-Adaptive Perturbation (TAP), which tailors perturbation optimization to node-attribute type, with direct search over feasible hard flips that accept only loss-improving updates for discrete node attributes and customized gradient-based updates for continuous node features, thereby enabling strong unlearnability across both settings. Experiments across five benchmarks, four backends and three learning paradigms demonstrate that MUGEN generates transferable unlearnable graph examples across GNN backbones and all three tasks, and remains effective under adversarial training and data augmentation.

1 Introduction

MUGEN addresses the coverage problem of graph-data release by generating one perturbed dataset that protects multiple downstream learning tasks. It combines shared-encoder perturbation optimization, TASO-based class separation, and type-adaptive updates to improve transferable unlearnability across graph settings.

  • Motivation and problem: Graph releases can support node classification, graph classification, and link prediction, so protection limited to one task may leave other uses learnable.Graphs are used across molecular, scientific, social, and information-retrieval domains, while GNNs support these three learning paradigms.
  • Limitations of prior methods: Existing graph unlearnability methods produce weakly class-separated perturbation representations and struggle more on categorical than continuous node attributes.The introduction identifies these as two empirical challenges in prior graph unlearnability methods.
  • Limitations of prior methods: 49.4% of softmax-sampled batch updates increase the perturbation objective on MUTAG.TAP instead uses hard-coordinate updates that accept only loss-improving discrete changes, ensuring non-increasing perturbation loss.
  • MUGEN framework: MUGEN generates a single perturbed release that protects every enabled task using a shared GNN encoder with task-specific heads.Its optimization alternates model training with joint perturbation updates across enabled task losses and a classwise-separability objective.
  • MUGEN framework: TASO adds classwise-separability signals to perturbation optimization, strengthening unlearnability and transfer across GNN backbones.The objective is designed to produce more class-separated perturbation representations.

2 Related Work

Prior work develops unlearnable-example defenses, including more robust and transferable methods, but transfer evaluations remain primarily vision-based. Graph attacks share perturbation-based formulations with unlearnable examples yet differ in attack stage and prediction scope.

  • Unlearnable examples: Unlearnable examples protect data releases by inducing models to learn perturbation–label shortcuts instead of task-relevant semantics.Prior work includes error-minimizing noise, improved resistance to adversarial training and stochastic noise, and certified reduced-learnability measures.
  • Transferable protection: Transfer-oriented methods broaden protection across datasets, label spaces, domains, resolutions, and architectures.One-for-All uses shared image–text concept embeddings, while VTG combines adversarial domain augmentation with text-guided perturbation–label alignment.
  • Transferable protection: Both One-for-All and VTG rely on textual concept or class descriptions, with transfer evaluations remaining primarily within vision settings.These methods extend transfer scope but retain vision-centered evaluation and text-dependent optimization.
  • Graph attacks and defenses: Graph adversarial attacks and unlearnable-example generation both perturb graph structure or attributes, but differ in attack stage and prediction scope.Evasion attacks modify inputs after training to mislead fixed models, whereas protective perturbations broadly degrade performance across the overall test distribution rather than trigger-defined subsets.

3 Background and Problem Formulation

The section formalizes graphs, GNN encoders, and three downstream prediction tasks, then defines protection as releasing one perturbed training dataset that reduces clean-test performance across all intended tasks.

  • 3.1 Graph Neural Networks: A graph is represented as G = (V, E, X), with node set V, edge set E, and node-feature matrix X.Graph connectivity is encoded by an adjacency matrix A, which also defines each node’s neighborhood.
  • 3.1 Graph Neural Networks: A GNN encoder maps graph inputs to node representations that downstream prediction units use for task-specific outputs.The three units predict node labels, graph labels, or whether candidate node pairs form links.
  • 3.1 Graph Neural Networks: The node, graph, and link tasks share one encoder but use distinct prediction units, including graph pooling and endpoint-pair representation functions where needed.The encoder may also be pretrained using self-supervised objectives such as masked-feature reconstruction or contrastive alignment across augmented graph views.
  • 3.2 Problem Formulation: Clean graph data Dtr may contain multiple inductive graphs or one transductive graph with annotations for node, graph, or candidate-pair prediction.The annotations are denoted by Yk for the corresponding prediction task.
  • 3.2 Problem Formulation: The data owner releases a single protected training version produced by a transformation δ that perturbs graph inputs while retaining downstream-learning annotations.An unauthorized learner trains an encoder and task-specific heads on the protected release without access to the clean features or δ.
  • 3.2 Problem Formulation: For intended tasks T ⊆ {node, graph, link}, the objective is one transformation δ whose trained models achieve substantially lower clean-test performance than models trained on clean data for every t ∈ T.Training may use either supervised or self-supervised loss.

4 Methodology

MUGEN alternates shared learner updates with feasible, type-adaptive feature perturbations to produce one release protecting all enabled graph-learning tasks. TASO combines task-aligned classwise separability with optional task losses, while TAP uses PGD for continuous attributes and exact hard-flip search for categorical attributes.

  • Overall framework: MUGEN perturbs only node features, retains graph structure and labels, and jointly trains a GNN encoder with task-specific heads for enabled tasks.Model parameters and feature perturbations are updated alternately, so each perturbation is shaped by enabled-task prediction units.
  • TASO objective: TASO constructs one perturbation across enabled tasks using task-aligned classwise separability through CSD, while optionally retaining conventional task-loss signals.CSD explicitly shapes task-relevant classwise structure and is designed to improve perturbation transferability; setting λtask = 0 yields CSD-only optimization.
  • TASO objective: Prior methods optimize ordinary supervised loss for a single downstream task, whereas TASO aggregates enabled-task losses into a weighted objective.Cross-entropy is used for node and graph classification, and binary cross-entropy for link prediction.
  • TAP updates: TAP updates continuous features with projected gradient descent and categorical features through direct hard-coordinate search within the feasible space.Continuous updates use gradient steps followed by projection onto feature-wise box constraints; categorical updates keep one-hot validity and graph-wise flip budgets.
  • TAP updates: For categorical attributes, TAP uses gradients only to rank budget-feasible flips, then evaluates candidate hard features with the exact perturbation objective.The comparison requires at most Kexact+1 exact evaluations per coordinate step and avoids enumerating all operation subsets.

5 Experimental Evaluation

MUGEN is evaluated across five graph datasets, four GNN backbones, three learning tasks, self-supervised frameworks, augmentations, and adversarial training. The results show transferable unlearnability, with TASO and TAP strengthening degradation and optimization scaling linearly with graph input size.

  • Experimental Setup: Experiments span five datasets, four GNN backbones, graph classification, node classification, and link prediction.The evaluation includes MUTAG, ENZYMES, PROTEINS_full, Cora, and PubMed, using Macro-F1, F1, and AUC as primary metrics.
  • Main Results: Optimized perturbations generally lower clean-test performance than both clean training and matched-variance Gaussian noise, demonstrating strong same-backend unlearnability.Supervised results are reported for graph classification, node classification, and link prediction.
  • Cross-Backend Transfer: Perturbations retain degrading effects across most tasks and target backbones, supporting transferability attributed to TASO and TAP.Cross-backend gaps are summarized in Table 5, while TASO and TAP contributions are analyzed separately.
  • Robustness and Self-Supervision: MUGEN perturbations continue to degrade performance under GraphMAE, GRACE, feature masking, edge dropping, and adversarial training.Under robustness evaluations, perturbed models remain below random perturbations and do not recover clean performance.
  • Ablation Studies: TASO yields stronger unlearnability and more separable class-conditional structures, while TAP produces stronger and more consistently negative gaps than relaxed PGD for discrete attributes.The TASO ablation uses a feature-relative budget ρ=0.2; the TAP comparison uses the same graph-wise flip budget.
  • Efficiency: MUGEN’s perturbation optimization scales linearly with the number and size of input graphs, including nodes, edges, and sampled link pairs.Detailed complexity analysis and empirical running times are provided in Appendix A.1.

6 Conclusion and Limitations

MUGEN generates one feature-perturbed release to protect enabled node classification, graph classification, and link prediction tasks when future use is unknown. TASO and TAP strengthen unlearnability and transfer across GNN backbones, with experiments showing degraded clean-test performance across five benchmarks.

  • Conclusion: MUGEN generates one feature-perturbed release protecting enabled node classification, graph classification, and link prediction tasks.This addresses data owners’ uncertainty about how released graph data will be used.
  • Conclusion: TASO adds classwise-separability signals to perturbation optimization, strengthening unlearnability and transfer across GNN backbones.
  • Conclusion: TAP tailors updates to attribute type and substantially strengthens unlearnability for categorical attributes.
  • Conclusion: Across five benchmarks, MUGEN perturbations degrade clean-test performance relative to clean and matched random-perturbation training.

Ethical Considerations

MUGEN is intended to help data owners protect released graph data from unauthorized exploitation without altering graph topology or task annotations. Because perturbations may affect legitimate downstream users, deployment should be authorized and utility evaluated on intended tasks.

  • MUGEN targets protection of released graph data from unauthorized exploitation using publicly available benchmark datasets without private personal data.
  • Its perturbations modify node features while preserving graph topology and task annotations.
  • Perturbations may affect legitimate downstream users, so authorized data owners or stewards should deploy MUGEN and evaluate utility on intended tasks.

A Appendix · A.1 Computational Complexity and Runtime

Appendix A.1 analyzes MUGEN’s computational costs for encoder, task-head, TASO, and TAP operations, and reports empirical perturbation-creation times by backend. It concludes that TAP scales linearly with input size across graphs, nodes, edges, and sampled link pairs.

  • A.1 Computational Complexity and Runtime: The complexity analysis considers batches with G graphs, N nodes, |E| edges, feature dimension d, and P sampled link pairs.The encoder uses L message-passing layers with hidden width h.
  • A.1 Computational Complexity and Runtime: TASO adds computational cost based on task representations, their dimensions, class counts, and the representation sets receiving CSD.The task representation count M_t equals G, N, or P for graph, node, or link prediction, respectively.
  • A.1 Computational Complexity and Runtime: A perturbation-loss evaluation costs C_pert = O(τC_enc + C_head + C_CSD) when τ encoder evaluations are required.C_head denotes the total cost of the enabled prediction heads.
  • A.1 Computational Complexity and Runtime: Continuous perturbation updates are parameterized by S continuous PGD steps per update.The complexity analysis also defines K as the exact-candidate limit and C_cat as the number of attribute categories.
  • A.1 Computational Complexity and Runtime: Categorical perturbation updates are parameterized by Q categorical coordinate steps, K exact-candidate limits, and C_cat attribute categories.The passage distinguishes categorical updates from continuous perturbation updates.
  • A.1 Computational Complexity and Runtime: TAP optimization is linearly scalable with input size, including the number of graphs, nodes, edges, and sampled link pairs.This scaling claim covers the principal input dimensions considered in the complexity analysis.
  • A.1 Computational Complexity and Runtime: Table 12 reports one-off empirical perturbation-creation time for each source backend.All datasets except MUTAG used a single NVIDIA RTX 3090 GPU, while MUTAG used a CPU.

A.2 Complete Robustness Results

Complete PROTEINS_full robustness results report node F1 and graph accuracy under feature masking, edge dropping, and adversarial training.

  • A.2 Complete Robustness Results: The PROTEINS_full evaluation covers node F1 and graph accuracy across feature masking, edge dropping, and adversarial training.Results are presented in Figures 6, 7, and 8, respectively.

A.3 Other Complete Results for Objective Design for Transferability · A.4 Continuous Node-Feature Distribution Diagnostics

The appendix completes transferability analysis with four-source-by-four-target matrices for Cora and ENZYMES, while diagnosing how continuous feature perturbations alter value distributions across four datasets. It also reports robustness under feature masking, edge dropping, and adversarial training on PROTEINS_full.

  • A.3 Other Complete Results for Objective Design for Transferability: Tables 13 and 14 report complete four-source-by-four-target transfer matrices for Cora and ENZYMES, complementing Table 9’s diagonal summary.Lower accuracy indicates stronger unlearnability.
  • A.4 Continuous Node-Feature Distribution Diagnostics: Continuous node-feature values are compared before and after perturbation across representative coordinates in PROTEINS_full, Cora, PubMed, and ENZYMES.The comparisons appear in Figures 9–12.
  • A.4 Continuous Node-Feature Distribution Diagnostics: Complete PROTEINS_full feature-masking results compare clean data, Gaussian random perturbations, and framework-generated perturbations using node F1 and graph accuracy.The conditions are labeled No, Random, and Ours.
  • A.4 Continuous Node-Feature Distribution Diagnostics: Complete PROTEINS_full edge-dropping and adversarial-training results likewise compare clean, Gaussian random, and framework-generated perturbations using node F1 and graph accuracy.These results are shown in Figures 7 and 8.
  • A.4 Continuous Node-Feature Distribution Diagnostics: Figures 9, 11, and 12 show original-versus-perturbed feature-value histograms for PROTEINS_full, PubMed, and ENZYMES.Each figure presents representative features.
  • A.4 Continuous Node-Feature Distribution Diagnostics: Figure 10 uses a logarithmic y-axis for Cora because original feature values are highly concentrated near zero.The scale improves visibility of low-frequency nonzero values.
Loading 2609.00696v2…