[Paper Review] Stealing Links from Graph Neural Networks

Xinlei He, Jinyuan Jia+3 more|arXiv (Cornell University)|May 5, 2020

Advanced Graph Neural NetworksComputer Science89 references38 citations

TL;DR

The paper presents eight black-box link stealing attacks that infer whether a pair of nodes are connected in a graph used to train a GNN, under various adversary knowledge settings, and demonstrates high AUC on eight real-world datasets.

ABSTRACT

Graph data, such as chemical networks and social networks, may be deemed confidential/private because the data owner often spends lots of resources collecting the data or the data contains sensitive information, e.g., social relationships. Recently, neural networks were extended to graph data, which are known as graph neural networks (GNNs). Due to their superior performance, GNNs have many applications, such as healthcare analytics, recommender systems, and fraud detection. In this work, we propose the first attacks to steal a graph from the outputs of a GNN model that is trained on the graph. Specifically, given a black-box access to a GNN model, our attacks can infer whether there exists a link between any pair of nodes in the graph used to train the model. We call our attacks link stealing attacks. We propose a threat model to systematically characterize an adversary's background knowledge along three dimensions which in total leads to a comprehensive taxonomy of 8 different link stealing attacks. We propose multiple novel methods to realize these 8 attacks. Extensive experiments on 8 real-world datasets show that our attacks are effective at stealing links, e.g., AUC (area under the ROC curve) is above 0.95 in multiple cases. Our results indicate that the outputs of a GNN model reveal rich information about the structure of the graph used to train the model.

Motivation & Objective

• Motivate and formalize privacy/IP concerns when training GNNs on graph data.
• Propose a comprehensive threat model with eight background knowledge configurations.
• Develop eight link stealing attacks exploiting node attribute similarities and GNN posteriors.
• Evaluate attacks across diverse real-world datasets to quantify disclosure risk.

Proposed method

• Define a three-dimensional adversary knowledge space (node attributes, partial graph, shadow dataset) yielding eight attack types.
• Develop unsupervised and supervised attacks that leverage posteriors from the target GNN and, where available, from shadow models, including feature construction from posterior distances and entropies.
• Use distance metrics (eight options) and pairwise vector operations (four options) as features for attack models such as MLPs.
• In transferring attacks, construct shadow models from a separate dataset and create features that bridge posterior similarities despite dimension mismatch.
• Train target and reference GNNs (two-layer GCN and MLP references) and evaluate with AUC as the main metric.
• Compare to conventional link prediction baselines and analyze the impact of each knowledge dimension on attack efficacy.

Experimental results

Research questions

• RQ1 Can a black-box GNN reveal the existence of edges in its training graph through its outputs?
• RQ2 How does adversary background knowledge across node attributes, partial graph, and shadow datasets affect link stealing performance?
• RQ3 Do transferring attacks (with shadow data) outperform purely local attacks, and under what domain conditions?
• RQ4 What is the relative impact of the three knowledge dimensions on attack success?
• RQ5 Can link stealing attacks outperform standard link prediction baselines on the same partial graph?

Key findings

• Eight attack variants achieve high AUC on eight real-world datasets, indicating substantial leakage of graph structure from GNN outputs.
• More background knowledge generally improves attack performance; e.g., Citeseer achieves up to 0.977 AUC when all three knowledge dimensions are available.
• Among knowledge dimensions, the target graph’s partial edges have the strongest impact, followed by node attributes, while a shadow dataset has the weakest impact.
• Transferring attacks can achieve high AUC, especially when the shadow and target domains are similar, suggesting domain similarity aids information transfer.
• Attacks outperform conventional link prediction methods that rely solely on partial graphs.
• Attacks demonstrate that GNN posteriors encipher rich structural information about the training graph.