We are delighted to announce that our paper “Link Stealing Attacks Against Inductive Graph Neural Networks” has been accepted for publication in the Proceedings of the Privacy Enhancing Technologies (PoPETs).
A graph neural network (GNN) is a type of neural network that is
specifically designed to process graph-structured data. Typically,
GNNs can be implemented in two settings, including the transduc-
tive setting and the inductive setting. In the transductive setting,
the trained model can only predict the labels of nodes that were
observed at the training time. In the inductive setting, the trained
model can be generalized to new nodes/graphs. Due to its flexibility,
the inductive setting is the most popular GNN setting at the moment.
Previous work has shown that transductive GNNs are vulnerable
to a series of privacy attacks. However, a comprehensive privacy
analysis of inductive GNN models is still missing. This paper fills
the gap by conducting a systematic privacy analysis of inductive
GNNs through the lens of link stealing attacks, one of the most
popular attacks that are specifically designed for GNNs. We propose
two types of link stealing attacks, i.e., posterior-only attacks and
combined attacks. We define threat models of the posterior-only
attacks with respect to node topology and the combined attacks by
considering combinations of posteriors, node attributes, and graph
features. Extensive evaluation on six real-world datasets demon-
strates that inductive GNNs leak rich information that enables link
stealing attacks with advantageous properties. Even attacks with
no knowledge about graph structures can be effective. We also
show that our attacks are robust to different node similarities and
different graph features. As a counterpart, we investigate two pos-
sible defenses and discover they are ineffective against our attacks,
which calls for more effective defenses.
Full text available here: https://iris.unil.ch/handle/iris/187232