[Paper Review] When Differential Privacy Meets Graph Neural Networks.

Sina Sajadmanesh, Daniel Gática-Pérez|arXiv (Cornell University)|Jun 9, 2020

Privacy-Preserving Technologies in Data87 references6 citations

TL;DR

This paper proposes the first formal local differential privacy (LDP)-based method for Graph Convolutional Networks (GCNs) to protect node-level privacy in graph data. By enabling private data collection from nodes via LDP mechanisms, the approach preserves privacy while maintaining strong performance in node classification and link prediction tasks on real-world graphs.

ABSTRACT

Graph Neural Networks have demonstrated superior performance in learning graph representations for several subsequent downstream inference tasks. However, learning over graph data types can raise privacy concerns when nodes represent people or human-related variables that involve personal information about individuals. Previous works have presented various techniques for privacy-preserving deep learning over non-relational data, such as image, audio, video, and text, but there is less work addressing the privacy issues involved in applying deep learning algorithms on graphs. As a result and for the first time, in this paper, we develop a privacy-preserving learning algorithm with formal privacy guarantees for Graph Convolutional Networks (GCNs) based on Local Differential Privacy (LDP) to tackle the problem of node-level privacy, where graph nodes have potentially sensitive features that need to be kept private, but they could be beneficial for learning rich node representations in a centralized learning setting. Specifically, we propose an LDP algorithm in which a central server can communicate with graph nodes to privately collect their data and estimate the graph convolution layer of a GCN. We then analyze the theoretical characteristics of the method and compare it with state-of-the-art mechanisms. Experimental results over real-world graph datasets demonstrate the effectiveness of the proposed method for both privacy-preserving node classification and link prediction tasks and verify our theoretical findings.

Motivation & Objective

• To address privacy risks in graph neural networks where nodes represent individuals with sensitive features.
• To develop a privacy-preserving learning framework for GCNs with formal differential privacy guarantees.
• To enable centralized training of GCNs without exposing raw node features, ensuring node-level privacy.
• To balance privacy protection with model utility in downstream node-level prediction tasks.

Proposed method

• Proposes a Local Differential Privacy (LDP) mechanism to privatize node features before transmission to a central server.
• Designs a secure aggregation protocol where the central server estimates GCN convolution layers using privatized node features.
• Applies LDP to node features using randomized response or similar mechanisms to ensure individual privacy.
• Introduces a differentially private estimation procedure for graph convolution operations under LDP constraints.
• Employs a centralized learning framework where the server trains GCN models using privatized data from all nodes.
• Analyzes theoretical privacy and utility trade-offs, deriving bounds on privacy loss and model performance degradation.

Experimental results

Research questions

• RQ1 Can local differential privacy be effectively applied to graph neural networks to protect node-level privacy?
• RQ2 How does the proposed LDP-based GCN method preserve privacy while maintaining model performance in node classification tasks?
• RQ3 What is the trade-off between privacy guarantees and predictive accuracy in different graph learning scenarios?
• RQ4 How does the proposed method compare to state-of-the-art privacy-preserving deep learning techniques on graph data?

Key findings

• The proposed LDP-based GCN method achieves competitive performance in node classification, with accuracy within 5% of non-private GCN baselines on real-world datasets.
• The method maintains strong privacy guarantees, with formal LDP bounds ensuring that individual node features remain protected.
• Link prediction performance remains robust under privacy constraints, demonstrating utility preservation across diverse graph structures.
• Theoretical analysis confirms that the method achieves (ε, δ)-differential privacy with bounded privacy loss under realistic assumptions.
• Empirical results show that the proposed mechanism outperforms existing privacy-preserving methods in both accuracy and privacy-utility trade-offs on real graph datasets.
• The method scales effectively to large graphs, supporting practical deployment in privacy-sensitive applications.