[Paper Review] Adversarial Privacy Preserving Graph Embedding against Inference Attack

Kaiyang Li, Guangchun Luo+4 more|arXiv (Cornell University)|Aug 30, 2020

Privacy-Preserving Technologies in Data46 references4 citations

TL;DR

This paper proposes Adversarial Privacy Graph Embedding (APGE), an end-to-end framework that integrates disentanglement and adversarial training to preserve user privacy in graph embeddings. By separating private attributes from structural representations and using adversarial refinement, APGE significantly reduces inference attack success while maintaining high utility in link prediction and node classification tasks on real-world datasets.

ABSTRACT

Recently, the surge in popularity of Internet of Things (IoT), mobile devices, social media, etc. has opened up a large source for graph data. Graph embedding has been proved extremely useful to learn low-dimensional feature representations from graph structured data. These feature representations can be used for a variety of prediction tasks from node classification to link prediction. However, existing graph embedding methods do not consider users' privacy to prevent inference attacks. That is, adversaries can infer users' sensitive information by analyzing node representations learned from graph embedding algorithms. In this paper, we propose Adversarial Privacy Graph Embedding (APGE), a graph adversarial training framework that integrates the disentangling and purging mechanisms to remove users' private information from learned node representations. The proposed method preserves the structural information and utility attributes of a graph while concealing users' private attributes from inference attacks. Extensive experiments on real-world graph datasets demonstrate the superior performance of APGE compared to the state-of-the-arts. Our source code can be found at https://github.com/uJ62JHD/Privacy-Preserving-Social-Network-Embedding.

Motivation & Objective

• To address the critical gap in existing graph embedding methods that fail to protect users' private attributes from inference attacks.
• To develop a unified framework that integrates privacy preservation directly into graph convolutional networks (GCNs) without decoupling embedding and privacy mechanisms.
• To preserve structural utility and classification accuracy while effectively concealing sensitive attributes like gender, political views, or sexual orientation from adversaries.
• To overcome limitations of prior methods that rely on pre-processing graph data or only perturb attributes, by enabling fine-grained, gradient-based privacy protection in latent space.

Proposed method

• APGE employs a disentangled latent space where private attributes are separated from structural representations using a disentanglement module.
• It uses an adversarial training pipeline with a discriminator that attempts to infer private attributes from node embeddings, encouraging the generator to produce privacy-preserving representations.
• The framework includes an expansion layer that increases the dimensionality of the latent space to improve utility while maintaining privacy through adversarial refinement.
• The model is trained end-to-end using a combined loss function that balances reconstruction loss, disentanglement loss, and adversarial loss.
• Private attribute inference is mitigated by minimizing the discriminator's accuracy via gradient updates, ensuring that sensitive information is not encoded in the final embeddings.
• The method is applied to real-world social and IoT graph datasets, with privacy and utility evaluated via inference attack success rate and downstream prediction performance.

Experimental results

Research questions

• RQ1 Can a unified graph embedding framework effectively protect private attributes from inference attacks while preserving structural utility?
• RQ2 How does disentanglement of private and structural representations improve privacy without degrading embedding quality?
• RQ3 To what extent does adversarial training reduce the success rate of inference attacks on sensitive attributes in learned node embeddings?
• RQ4 How does the expansion layer affect the trade-off between privacy and utility in graph embedding?

Key findings

• APGE significantly reduces the success rate of inference attacks on sensitive attributes such as political tendency and gender, outperforming state-of-the-art privacy-preserving methods.
• The framework maintains high performance in downstream tasks, with link prediction accuracy comparable to non-private baselines, demonstrating strong utility preservation.
• The ablation study shows that removing the expansion layer leads to only a minor drop in inference accuracy, indicating that privacy is robust even with reduced embedding dimensions.
• The disentanglement and adversarial training components jointly enhance privacy protection, as evidenced by lower inference attack accuracy across multiple datasets.
• APGE achieves superior privacy-utility trade-offs compared to prior methods that rely on pre-processing or attribute-only perturbation.