[Paper Review] Graph-Fraudster: Adversarial Attacks on Graph Neural Network Based Vertical Federated Learning

Jinyin Chen, Guohan Huang+4 more|arXiv (Cornell University)|Oct 13, 2021

Advanced Graph Neural Networks4 citations

TL;DR

This paper proposes Graph-Fraudster, the first adversarial attack framework targeting Graph Neural Network-based Vertical Federated Learning (GVFL). By exploiting privacy leakage of global node embeddings and leveraging gradients from pairwise node relationships, it generates effective adversarial perturbations that significantly degrade model performance, even under defense mechanisms, demonstrating GVFL's critical vulnerability to targeted attacks.

ABSTRACT

Graph neural network (GNN) has achieved great success on graph representation learning. Challenged by large scale private data collected from user-side, GNN may not be able to reflect the excellent performance, without rich features and complete adjacent relationships. Addressing the problem, vertical federated learning (VFL) is proposed to implement local data protection through training a global model collaboratively. Consequently, for graph-structured data, it is a natural idea to construct a GNN based VFL framework, denoted as GVFL. However, GNN has been proved vulnerable to adversarial attacks. Whether the vulnerability will be brought into the GVFL has not been studied. This is the first study of adversarial attacks on GVFL. A novel adversarial attack method is proposed, named Graph-Fraudster. It generates adversarial perturbations based on the noise-added global node embeddings via the privacy leakage and the gradient of pairwise node. Specifically, first, Graph-Fraudster steals the global node embeddings and sets up a shadow model of the server for the attack generator. Second, noise is added into node embeddings to confuse the shadow model. At last, the gradient of pairwise node is used to generate attacks with the guidance of noise-added node embeddings. Extensive experiments on five benchmark datasets demonstrate that Graph-Fraudster achieves the state-of-the-art attack performance compared with baselines in different GNN based GVFLs. Furthermore, Graph-Fraudster can remain a threat to GVFL even if two possible defense mechanisms are applied. Additionally, some suggestions are put forward for the future work to improve the robustness of GVFL. The code and datasets can be downloaded at https://github.com/hgh0545/Graph-Fraudster.

Motivation & Objective

• To investigate the vulnerability of Graph Neural Network-based Vertical Federated Learning (GVFL) to adversarial attacks.
• To identify that privacy leakage of global node embeddings and model gradient information create exploitable conditions for attackers.
• To propose a novel, effective adversarial attack method tailored for GVFL that leverages these leakage channels.
• To evaluate the attack's performance under realistic defense mechanisms and assess its robustness.
• To provide actionable recommendations for improving GVFL robustness in real-world applications.

Proposed method

• Graph-Fraudster first steals global node embeddings from the server to construct a shadow model of the target GVFL system.
• It injects noise into the stolen node embeddings to confuse the shadow model and enhance attack transferability.
• The attack generator uses gradients from pairwise node relationships to guide the generation of adversarial perturbations.
• Perturbations are crafted to subtly modify local graph structures (e.g., adding fake edges) while maximizing misclassification on the global model.
• The method is designed to be effective even with minimal perturbations, such as single-edge modifications.
• It evaluates performance across multiple GNN architectures and real-world graph datasets to ensure generalizability.

Experimental results

Research questions

• RQ1 Can adversarial attacks be effectively mounted on Graph Neural Network-based Vertical Federated Learning (GVFL) systems?
• RQ2 To what extent does privacy leakage of global node embeddings enable successful adversarial attacks in GVFL?
• RQ3 How effective is Graph-Fraudster compared to existing transferable attacks in centralized GNN settings when applied to GVFL?
• RQ4 Can Graph-Fraudster bypass common defense mechanisms such as differential privacy and top-K pruning in GVFL?
• RQ5 What system-level factors (e.g., data contribution, graph splitting strategy) influence the success rate of adversarial attacks in GVFL?

Key findings

• Graph-Fraudster achieves state-of-the-art attack performance across seven evaluation metrics on five benchmark graph datasets, outperforming existing transferable attacks.
• The attack remains effective even when differential privacy and top-K pruning defenses are applied, indicating resilience to common mitigation strategies.
• A small noise scale (e.g., ε = 0.004) is sufficient to significantly degrade model accuracy, especially in single-edge attack scenarios.
• The attack performance is stable across varying embedding dimensions (d = 8 to 32), showing robustness to hyperparameter changes.
• Graph splitting strategy and data contribution imbalance significantly affect attack success, suggesting that high-contributing clients are more vulnerable to adversarial manipulation.
• Denoising uploaded node embeddings is identified as a feasible defense strategy, though not fully effective against Graph-Fraudster.