[Paper Review] Node-Level Membership Inference Attacks Against Graph Neural Networks

Xinlei He, Rui Wen+4 more|arXiv (Cornell University)|Feb 10, 2021

Privacy-Preserving Technologies in Data55 references50 citations

TL;DR

This paper presents the first comprehensive node-level membership inference attacks on Graph Neural Networks (GNNs) under black-box settings, proposing 0-hop, 2-hop, and combined attacks, and analyzes how graph properties affect attack success while proposing defenses.

ABSTRACT

Many real-world data comes in the form of graphs, such as social networks and protein structure. To fully utilize the information contained in graph data, a new family of machine learning (ML) models, namely graph neural networks (GNNs), has been introduced. Previous studies have shown that machine learning models are vulnerable to privacy attacks. However, most of the current efforts concentrate on ML models trained on data from the Euclidean space, like images and texts. On the other hand, privacy risks stemming from GNNs remain largely unstudied. In this paper, we fill the gap by performing the first comprehensive analysis of node-level membership inference attacks against GNNs. We systematically define the threat models and propose three node-level membership inference attacks based on an adversary's background knowledge. Our evaluation on three GNN structures and four benchmark datasets shows that GNNs are vulnerable to node-level membership inference even when the adversary has minimal background knowledge. Besides, we show that graph density and feature similarity have a major impact on the attack's success. We further investigate two defense mechanisms and the empirical results indicate that these defenses can reduce the attack performance but with moderate utility loss.

Motivation & Objective

• Define threat models for node-level membership inference on GNNs.
• Develop three attack models (0-hop, 2-hop, combined) under black-box access.
• Evaluate attacker success across multiple GNN architectures and datasets.
• Identify factors (density, feature similarity) that influence attack success.
• Propose and evaluate defenses mitigating membership inference risks while considering utility loss.

Proposed method

• Categorize attacker background knowledge along three dimensions: shadow dataset, shadow model, and node topology.
• Define and implement three attack models: 0-hop (uses only node feature), 2-hop (uses 2-hop subgraph), and combined (uses both inputs).
• Train a shadow GNN on a disjoint shadow dataset to mimic the target; generate attack training data by querying the shadow model with all nodes.
• Train binary attack models (MLPs) on posteriors produced by the target or shadow models to predict membership.
• Query the target model with 0-hop or 2-hop inputs to obtain posteriors and run the attack model for membership inference.
• Evaluate attacks on GraphSAGE, GAT, and GIN across four datasets (Cora, Citeseer, Cora-full, LastFM Asia).

Experimental results

Research questions

• RQ1 Can a black-box adversary infer whether a node was in the GNN’s training set under node-level membership inference?
• RQ2 What background knowledge (shadow data/model, node topology) is sufficient for effective attacks?
• RQ3 Do 0-hop or 2-hop posteriors reveal more membership information, and can combining inputs improve inference?
• RQ4 How do graph properties like subgraph density and feature similarity affect attack success?
• RQ5 What defenses can mitigate these attacks with acceptable utility loss?

Key findings

• 0-hop attacks can reach high accuracy (e.g., 0.791 on GraphSAGE with Citeseer).
• 0-hop sometimes outperforms 2-hop attacks in membership inference effectiveness (e.g., GraphSAGE on Cora 0-hop 0.754 vs 2-hop 0.671).
• Combined attacks generally yield the strongest performance across settings.
• Attack success correlates with target model overfitting (larger training-testing gap).
• Node density, ego density, and feature similarity positively influence attack success; higher density and similarity increase inference risk.
• Defenses can reduce attack performance but cause moderate utility loss.