[Paper Review] Inference Attacks Against Graph Neural Networks

Zhikun Zhang, Min Chen+3 more|arXiv (Cornell University)|Oct 6, 2021

Advanced Graph Neural NetworksComputer Science64 references19 citations

TL;DR

This paper investigates privacy risks in graph neural network (GNN) embeddings by proposing three inference attacks: property inference, subgraph containment detection, and graph reconstruction. It demonstrates that graph embeddings leak significant structural information—achieving up to 0.89 accuracy in property inference and 0.98 AUC in subgraph detection—while introducing a perturbation-based defense that mitigates attacks with minimal performance loss on graph classification tasks.

ABSTRACT

Graph is an important data representation ubiquitously existing in the real world. However, analyzing the graph data is computationally difficult due to its non-Euclidean nature. Graph embedding is a powerful tool to solve the graph analytics problem by transforming the graph data into low-dimensional vectors. These vectors could also be shared with third parties to gain additional insights of what is behind the data. While sharing graph embedding is intriguing, the associated privacy risks are unexplored. In this paper, we systematically investigate the information leakage of the graph embedding by mounting three inference attacks. First, we can successfully infer basic graph properties, such as the number of nodes, the number of edges, and graph density, of the target graph with up to 0.89 accuracy. Second, given a subgraph of interest and the graph embedding, we can determine with high confidence that whether the subgraph is contained in the target graph. For instance, we achieve 0.98 attack AUC on the DD dataset. Third, we propose a novel graph reconstruction attack that can reconstruct a graph that has similar graph structural statistics to the target graph. We further propose an effective defense mechanism based on graph embedding perturbation to mitigate the inference attacks without noticeable performance degradation for graph classification tasks. Our code is available at https://github.com/Zhangzhk0819/GNN-Embedding-Leaks.

Motivation & Objective

• To investigate the extent to which graph embeddings leak structural information about the original graph.
• To develop inference attacks that can extract basic graph properties, subgraph containment, and reconstruct the full graph from a single embedding vector.
• To propose a practical defense mechanism that preserves model utility while mitigating privacy leaks in graph embeddings.
• To evaluate the effectiveness of the attacks and defense across diverse real-world datasets and GNN architectures.

Proposed method

• Model property inference as a multi-task classification problem using a deep neural network to predict graph properties (e.g., number of nodes, edges, density) from the embedding vector.
• Design a novel graph embedding extractor that fuses information from both the graph embedding and a subgraph of interest to enable subgraph containment detection.
• Use a graph auto-encoder framework with a learnable decoder to reconstruct the target graph from its embedding, optimizing for structural similarity.
• Propose a defense mechanism based on adding calibrated Laplace noise to the graph embedding before sharing, to obscure sensitive structural information.
• Train and evaluate the attack and defense models on five real-world graph datasets using three state-of-the-art GNN models (e.g., GCN, GIN, GraphSAGE).
• Conduct transfer attacks to evaluate robustness when attack and training models differ in architecture or sampling method.

Experimental results

Research questions

• RQ1 To what extent can an adversary infer basic graph properties (e.g., node count, edge count, density) from a single graph embedding?
• RQ2 Can an adversary determine whether a specific subgraph is contained within the original graph using only the graph embedding and the subgraph?
• RQ3 Is it possible to reconstruct a graph with similar structural statistics (e.g., degree distribution, clustering coefficient) from a single graph embedding?
• RQ4 How effective is embedding perturbation as a defense mechanism in mitigating these inference attacks without degrading downstream task performance?

Key findings

• The property inference attack achieved up to 0.89 attack accuracy on the DD dataset, demonstrating significant leakage of basic graph statistics.
• The subgraph inference attack achieved an AUC of 0.98 on the DD dataset, showing high confidence in detecting subgraph containment.
• The graph reconstruction attack produced graphs with a cosine similarity of 0.99 in local clustering coefficient distribution and high isomorphism similarity to the original graph.
• The proposed defense via Laplace noise perturbation effectively mitigated all three inference attacks while causing only a slight drop in graph classification accuracy.
• Transfer attacks succeeded across different GNN architectures and sampling methods, indicating the robustness and generalizability of the proposed attacks.
• The results show that graph embeddings, despite being compressed to a single vector, leak substantial structural information, challenging the assumption of privacy through dimensionality reduction.