Graph-Level Label-Only Membership Inference Attack Against Graph Neural Networks
Source abstract
Abstract
Graph neural networks (GNNs) are widely used for graph-structured data. However, GNNs are vulnerable to membership inference attacks (MIAs) in graph classification tasks, which determine whether a graph was in the training set, risking the leakage of sensitive data. Existing MIAs rely on prediction probability vectors, but they become ineffective when only prediction labels are available. We propose a Graph-level Label-Only Membership Inference Attack (GLO-MIA), which is based on the intuition that the target model’s predictions on training data are more stable than those on testing data. GLO-MIA generates a set of perturbed graphs for the target graph by adding perturbations to its effective features and queries the target model with the perturbed graphs to obtain their prediction labels, which are then used to calculate the robustness score of the target graph. Finally, by comparing the robustness score with a predefined threshold, the membership of the target graph can be inferred correctly with high probability. Experimental evaluations on three datasets and four GNN models demonstrate that GLO-MIA achieves an attack accuracy of up to 0.825, outperforming baseline work by 8.5% and closely matching the performance of probability-based MIAs, even with only prediction labels.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Privacy-Preserving Technologies in Data · Adversarial Robustness in Machine Learning · Advanced Graph Neural Networks
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
School of Computer Engineering and Science, Shanghai University, Shanghai 200444, China
Funding
Shanghai Natural Science Foundation
References (33)
Show source-provided references
1. Prediction of Structural and Functional Features of Protein and Nucleic Acid Sequences by Artificial Neural Networks10.1021/bi00147a001 ↗
2. Network Analysis in the Social Sciences10.1126/science.1165821 ↗
3. Kipf, T.N., and Welling, M. (2016). Semi-Supervised Classification with Graph Convolutional Networks. arXiv.
4. Kipf, T.N., and Welling, M. (2016). Variational Graph Auto-Encoders. arXiv.
5. Pan, S., Hu, R., Long, G., Jiang, J., Yao, L., and Zhang, C. (2018). Adversarially Regularized Graph Autoencoder for Graph Embedding. arXiv.10.24963/ijcai.2018/362 ↗
6. Xu, K., Hu, W., Leskovec, J., and Jegelka, S. (2018). How Powerful Are Graph Neural Networks?. arXiv.
7. He, X., Wen, R., Wu, Y., Backes, M., Shen, Y., and Zhang, Y. (2021). Node-Level Membership Inference Attacks against Graph Neural Networks. arXiv.
8. Olatunji, I.E., Nejdl, W., and Khosla, M. (2021, January 13–15). Membership Inference Attack on Graph Neural Networks. Proceedings of the 2021 Third IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications (TPS-ISA), Atlanta, GA, USA.10.1109/TPSISA52974.2021.00002 ↗
9. Wu, B., Yang, X., Pan, S., and Yuan, X. (2021, January 7–10). Adapting Membership Inference Attacks to GNN for Graph Classification: Approaches and Implications. Proceedings of the 2021 IEEE International Conference on Data Mining (ICDM), Auckland, New Zealand.10.1109/ICDM51629.2021.00182 ↗
10. Yang, J., Li, H., Fan, W., Zhang, X., and Hao, M. (2023, January 4–8). Membership Inference Attacks Against the Graph Classification. Proceedings of the GLOBECOM 2023–2023 IEEE Global Communications Conference, Kuala Lumpur, Malaysia.10.1109/GLOBECOM54140.2023.10437279 ↗
11. Conti, M., Li, J., Picek, S., and Xu, J. (2022, January 7–11). Label-Only Membership Inference Attack against Node-Level Graph Neural Networks. Proceedings of the 15th ACM Workshop on Artificial Intelligence and Security, Los Angeles, CA, USA.10.1145/3560830.3563734 ↗
12. Veličković, P., Cucurull, G., Casanova, A., Romero, A., Liò, P., and Bengio, Y. (May, January 30). Graph Attention Networks. Proceedings of the International Conference on Learning Representations (ICLR), Vancouver, BC, Canada.
13. Hamilton, W., Ying, Z., and Leskovec, J. (2017, January 4–9). Inductive Representation Learning on Large Graphs. Proceedings of the 31st Conference on Neural Information Processing Systems (NIPS 2017), Long Beach, CA, USA.
14. Wu, B., Yang, X., Pan, S., and Yuan, X. (2022). Model Extraction Attacks on Graph Neural Networks: Taxonomy and Realisation. Proceedings of the 2022 ACM on Asia Conference on Computer and Communications Security, Association for Computing Machinery.10.1145/3488932.3497753 ↗
15. Shen, Y., He, X., Han, Y., and Zhang, Y. (2022, January 22–26). Model Stealing Attacks Against Inductive Graph Neural Networks. Proceedings of the 2022 IEEE Symposium on Security and Privacy (SP), San Francisco, CA, USA.10.1109/SP46214.2022.9833607 ↗
16. Zhang, Z., Chen, M., Backes, M., Shen, Y., and Zhang, Y. (2022, January 10–12). Inference attacks against graph neural networks. Proceedings of the 31st USENIX Security Symposium (USENIX Security 22), Boston, MA, USA.
17. Wang, X., and Wang, W.H. (2022, January 7–11). Group Property Inference Attacks Against Graph Neural Networks. Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, Los Angeles, CA, USA.10.1145/3548606.3560662 ↗
18. Duddu, V., Boutet, A., and Shejwalkar, V. (2020, January 7–9). Quantifying Privacy Leakage in Graph Embedding. Proceedings of the MobiQuitous 2020-17th EAI International Conference on Mobile and Ubiquitous Systems: Computing, Networking and Services, Darmstadt, Germany.10.1145/3448891.3448939 ↗
19. Model Inversion Attacks Against Graph Neural Networks10.1109/TKDE.2022.3207915 ↗
20. Shokri, R., Stronati, M., Song, C., and Shmatikov, V. (2017, January 22–26). Membership Inference Attacks against Machine Learning Models. Proceedings of the 2017 IEEE Symposium on Security and Privacy (SP), San Jose, CA, USA.10.1109/SP.2017.41 ↗
21. Yeom, S., Giacomelli, I., Fredrikson, M., and Jha, S. (2018, January 9–12). Privacy Risk in Machine Learning: Analyzing the Connection to Overfitting. Proceedings of the 2018 IEEE 31st Computer Security Foundations Symposium (CSF), Oxford, UK.10.1109/CSF.2018.00027 ↗
22. Salem, A., Zhang, Y., Humbert, M., Berrang, P., Fritz, M., and Backes, M. (2018). ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Models. arXiv.10.14722/ndss.2019.23119 ↗
23. Li, Z., and Zhang, Y. (2021, January 15–19). Membership Leakage in Label-Only Exposures. Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, Virtual Event.10.1145/3460120.3484575 ↗
24. Choquette-Choo, C.A., Tramer, F., Carlini, N., and Papernot, N. (2021;, January 18–24). Label-Only Membership Inference Attacks. Proceedings of the 38th International Conference on Machine Learning (PMLR), Virtual.
25. Song, C., and Shmatikov, V. (2019, January 4–8). Auditing Data Provenance in Text-Generation Models. Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, Anchorage, AK, USA.10.1145/3292500.3330885 ↗
26. He, X., Jia, J., Backes, M., Gong, N.Z., and Zhang, Y. (2021, January 11–13). Stealing Links from Graph Neural Networks. Proceedings of the 30th USENIX Security Symposium (USENIX Security 21), Online.
27. Label-Only Membership Inference Attacks and Defenses in Semantic Segmentation Models10.1109/TDSC.2022.3154029 ↗
28. Label-Only Membership Inference Attacks on Machine Unlearning without Dependence of Posteriors10.1002/int.23000 ↗
29. He, Y., Li, B., Liu, L., Ba, Z., Dong, W., Li, Y., Qin, Z., Ren, K., and Chen, C. (2025). Towards Label-Only Membership Inference Attack Against Pre-Trained Large Language Models. arXiv.
30. Morris, C., Kriege, N.M., Bause, F., Kersting, K., Mutzel, P., and Neumann, M. (2020). TUDataset: A Collection of Benchmark Datasets for Learning with Graphs. arXiv.
31. Distinguishing Enzyme Structures from Non-Enzymes without Alignments10.1016/S0022-2836(03)00628-4 ↗
32. Protein Function Prediction via Graph Kernels10.1093/bioinformatics/bti1007 ↗
33. BRENDA, the enzyme database: Updates and major new developments10.1093/nar/gkh081 ↗