{"id":"af32ad16-3a75-47e0-8a2b-a836531a5abd","arxiv_id":"2411.14718","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"An empirical study showing that graph prompt learning exposes node attributes and links to inference attacks, with prompt tuning adding little extra risk over frozen GNN baselines.","lead":"This paper measures whether graph prompt learning, a lightweight way to adapt graph neural networks, leaks private information about nodes and links. It finds that attackers can often infer sensitive attributes and relationships from model outputs, but prompt tuning itself does not add much risk beyond standard graph models.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The 'w/o Prompt' baseline is a frozen-encoder linear probe, not a traditional GNN, so the headline claim that prompt tuning does not elevate privacy risk is not established by the comparison.","rationale":"The reader identified the same load-bearing weakness: the 'w/o Prompt' baseline is a frozen pre-trained GNN with a newly trained task head, which underrepresents traditional GNNs and therefore invalidates the comparative conclusion. My reading agrees with this assessment, and the concrete test directly targets that assumption. I considered whether the unspecified sensitive attribute for AIA is a more fundamental issue; it is a real reproducibility weakness, but the baseline problem is more load-bearing because it undermines the paper's distinctive qualitative claim, not just the absolute numbers. I also considered whether the concern merits moving the verdict to REJECT, but the paper's empirical demonstration of high-risk inference attacks on GPL and the defense evaluation do not depend on the flawed baseline. The comparative statement is central but addressable: adding proper end-to-end and fine-tuned baselines could confirm or overturn it. Thus the reader's CONDITIONAL verdict is the right level of caution, and no verdict change is needed.","tokens_in":23012,"tokens_out":2619,"duration_ms":28241,"concrete_test":"Re-run the AIA and LIA experiments of Sections 4.3.3 and 5.3.3 with two true traditional-GNN baselines in place of 'w/o Prompt': (1) a same-architecture GNN trained end-to-end on the same 20% labeled split, and (2) the same pre-trained GNN with all weights fine-tuned on that split. Report AUC under P*, E, and P for all six datasets with GraphCL pre-training, using the same shadow-dataset protocol. If either baseline achieves materially higher attack AUC than the five GPL methods, the prompt-tuning-does-not-increase-risk conclusion fails; if both are comparable or lower, the conclusion survives.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central comparative claim is that prompt tuning in GPL does not elevate privacy risks compared to traditional GNNs (abstract; Sections 4.3.3 and 5.3.3). The evidence for this is the 'w/o Prompt' baseline introduced in Section 4.2, which 'keeping the pre-trained model frozen, the downstream task adapts by directly training task-specific parameters.' This is a linear probe on fixed pre-trained representations, not a traditional GNN. The paper itself defines traditional GNNs as relying on end-to-end training or pre-training with fine-tuning (Sections 1 and 2.1), so the baseline omits the very adaptation that defines the comparison class. Consequently, the observed similarity in attack AUC between prompt methods and 'w/o Prompt' cannot be attributed to the absence of prompts versus presence of prompts; it may simply reflect that both share a frozen encoder. In the embedding-access scenario especially, 'w/o Prompt' exposes exactly the frozen pre-trained embeddings, which is not a representative traditional-GNN leakage surface. The attack measurements themselves are plausible and internally consistent, but the load-bearing qualitative conclusion about prompt tuning is under-supported because the baseline is not a traditional GNN.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper presents the first systematic empirical privacy assessment of Graph Prompt Learning (GPL). It defines three attacker capabilities (black-box posteriors, shared node embeddings, and shared prompt embeddings) and evaluates Attribute Inference Attacks (AIA) and Link Inference Attacks (LIA) across six datasets, five GPL prompt methods, multiple pre-training strategies, and few-shot settings. The reported attack AUCs are often above 90% and sometimes reach 99.9%. The paper compares these results with a 'w/o Prompt' condition, concludes that prompt tuning does not elevate privacy risks relative to traditional GNNs, and evaluates Laplacian perturbation as a defense.","tokens_in":23248,"tokens_out":9250,"duration_ms":89226,"significance":"If the results are supported, this is a useful first characterization of the privacy leakage channels in GPL. Strengths include the breadth of the study (six datasets including heterophilic and homophilic graphs, multiple prompt methods, and confidence intervals from 10 tasks), the non-circular evaluation protocol (the attack model is trained on shadow outputs and tested on shadow nodes whose labels were not used to train the target model), and the explicit comparison of posterior, embedding, and prompt access. The main weakness is that the headline comparative claim rests on a control condition that is not a traditional GNN, and the attack measurements lack specification of the targeted sensitive attributes and of raw-feature baselines. These issues are fixable with additional experiments, so the contribution is potentially publishable after a major revision.","major_comments":[{"comment":"The 'w/o Prompt' baseline is defined in §4.2 as keeping the pre-trained model frozen and 'directly training task-specific parameters.' This is effectively a linear probe on fixed pre-trained representations, not a traditional GNN. The paper itself defines traditional GNNs in §1 and §2.1 as relying on 'end-to-end training' or 'pre-training & fine-tuning,' and the frozen-encoder setup omits exactly the adaptation that defines that comparison class. Tables 2 and 3 therefore only show that prompt tuning is comparable to a frozen-encoder control; they do not establish the abstract's and §4.3.3/§5.3.3 conclusion that prompt tuning does not elevate privacy risk compared to traditional GNNs. Please add end-to-end trained and pre-train/fine-tuned GNN baselines, or explicitly restrict the claim to the frozen-encoder control.","section":"§4.2, §4.3.3, §5.3.3"},{"comment":"The targeted sensitive attribute is never specified. §4.2 says only that 'we assume a node-sensitive property corresponding to each dataset, consistent across all experiments.' Without naming the attribute and stating whether it is one of the raw features or the node-classification label, the reported AUCs cannot be interpreted or reproduced. If the sensitive attribute coincides with the downstream task label, then posterior-based attacks may simply be reading the task output, and the '98% success' headline would be misleading. Please specify the sensitive attribute per dataset and report its relationship to the task label and to the input features.","section":"§4.2, Tables 2 and 3"},{"comment":"The paper reports attack AUCs against posteriors, embeddings, and prompts but never compares with a baseline attack on the raw node features or with a chance-level control. Since the datasets contain rich features (e.g., Cora's bag-of-words) that may directly encode the sensitive property, high AUC could reflect inherent attribute predictability rather than leakage through GPL. Add, for each dataset, the same attack model trained on raw features X, on X with the sensitive attribute removed, and a random-label control, and report the incremental AUC attributable to the GPL output.","section":"§4.1, §4.3"},{"comment":"The MLP link-inference attack is not fully specified: the paper describes a 3-layer MLP with hidden sizes 64 and 32, but does not state how a node pair (f(u), f(v)) is converted into the classifier input (concatenation, absolute difference, Hadamard product, or another operator). This choice materially affects link-prediction performance and is needed to reproduce the LIA results in Tables 3 and 6. Please specify the input construction and, ideally, report both similarity-based and MLP variants for all attacker capabilities.","section":"§5.1, Tables 3 and 6"}],"minor_comments":[{"comment":"There are several typos and inconsistent notations, including 'privatcy' in §3.2, 'which which accords' in §4.4, 'examinesthe' in §9, 'PorG' instead of ProG in §4.4, and inconsistent spelling of 'Gprompt' versus 'GPrompt.'","section":"Throughout"},{"comment":"The Laplacian perturbation is defined as Xpri = X + Lap(β), but the paper does not state whether the noise is added per dimension or whether β is scaled by the norm or dimension of the output vector; please clarify the exact mechanism.","section":"§6, Eq. (10)"},{"comment":"The caption refers to 'the three embeddings,' but the figure compares posteriors, embeddings, and prompts; please use 'three output types' for clarity.","section":"Figure 13"},{"comment":"The term 'white-box' is used for third-party access to embeddings and prompts, but this is not a full white-box scenario since the adversary does not see model weights or gradients; consider using 'embedding-access' or 'intermediate-output' to avoid confusion.","section":"§3.2 and §4.2"},{"comment":"The prompt-embedding capability is evaluated only for GPF-plus, while the tables use dashes for other prompt types; this limitation should be stated in the main text rather than only implied by the table.","section":"§4.3.2 and Tables 2, 5"},{"comment":"The statement that changing k from 5 to 10 'does not yield significant differences' is contradicted by the GPF-plus prompt-embedding row for AIA, where Cora drops from 86.49 to 29.47 and Squirrel rises from 64.48 to 97.53; please reconcile or qualify this claim.","section":"Appendix B, Tables 5 and 6"}],"recommendation":"major_revision","confidential_remarks":"The empirical attack study is valuable and the high-level message is timely, but the central comparison against 'traditional GNNs' needs to be re-run with true end-to-end and fine-tuned baselines before the headline conclusion can be trusted. The missing specification of the sensitive attributes and the absence of raw-feature controls are also important for the measurement claims. These are substantial but fixable changes, so I recommend major revision rather than rejection. No code release is mentioned; for a measurement paper, a reproducibility artifact would increase confidence."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"First systematic audit of privacy leakage in graph prompt learning, and the measurements are worth having. The paper runs attribute and link inference attacks across three attacker capabilities, five prompt methods, and six datasets, with confidence intervals on the AUCs. The result that node embeddings are the high-risk artifact, that prompts leak more for attributes than for links, and that Laplacian noise reduces attack success but at a real accuracy cost, is useful for anyone deploying GPL.\n\nThe soft spot is the comparative claim. The abstract and Sections 4.3.3 and 5.3.3 say prompt tuning does not elevate privacy risk compared to traditional GNNs. The evidence is the \"w/o Prompt\" baseline, which keeps the pre-trained GNN frozen and trains only task-specific parameters. That is a linear probe on frozen representations, not a traditional GNN under the paper's own definition, which is end-to-end training or pre-training with fine-tuning. So the comparison does not test prompts versus traditional GNN training; it tests prompts versus a frozen encoder with a new head. The headline claim is overclaimed. The fix is to add actual traditional GNN baselines, or reframe the claim as \"within a frozen-encoder setup, prompt tuning does not add leakage.\" The reframed version is still a contribution.\n\nThe other real gap is the sensitive attribute. The paper says \"we assume a node-sensitive property corresponding to each dataset, consistent across all experiments\" but never specifies it. If the target is the node class label, the attribute inference attack is close to label inference, and the results need a different reading. The authors should name the sensitive attributes and explain why they are sensitive. A raw-feature baseline—attacking the original node features without the model—would also help separate inherent predictability from model leakage. These are addressable, not fatal.\n\nThe measurements themselves look plausible, and the internal comparisons across prompt methods are credible. The attack models are standard classifiers, which is fine for a measurement paper. The citation pattern is fine. The paper has some typos and loose prose, but nothing that undermines the experimental core.\n\nBottom line: this deserves a serious referee. The empirical core is solid enough to be a useful reference for GPL privacy, but the claim about traditional GNNs needs correction or recalibration before publication. My recommendation: send it to peer review, with reviewers asked to press on the baseline and the attribute definition.","headline":"First systematic privacy audit of graph prompt learning, but the headline 'no more risk than traditional GNNs' rests on a baseline that isn't a traditional GNN.","tokens_in":23722,"tokens_out":3438,"would_cite":true,"duration_ms":31753,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper shows graph prompt learning leaks sensitive node data, with inference attacks reaching 98% AUC, and that prompts themselves are not the added risk.","keywords":["graph prompt learning","attribute inference attack","link inference attack","privacy leakage","graph neural networks","few-shot learning","Laplacian noise defense"],"falsifier":"Train a conventional GNN end-to-end on the same six datasets, run the same AIA and LIA attacks against its outputs, and compare AUC with the paper's 'w/o Prompt' numbers; if the end-to-end model is attacked substantially more successfully, the conclusion that prompt tuning adds no privacy risk over traditional GNNs would not survive.","tokens_in":22820,"feed_emoji":"🔓","tokens_out":6244,"duration_ms":57287,"temperature":0.7,"pith_summary":"Graph Prompt Learning (GPL) adapts a frozen pre-trained graph neural network to new tasks by tuning lightweight prompts, a paradigm that is efficient but largely untested for privacy. This paper asks whether an attacker can recover sensitive node attributes and hidden links from the information GPL exposes: node posteriors from a black-box service, or node embeddings and prompt vectors shared with third parties. Using attribute inference attacks (AIA) and link inference attacks (LIA) on six datasets and five prompt methods, the authors find attack success close to 98% AUC in the strongest cases, with shared node embeddings the most exposed. They also find that a frozen GNN without any prompt, trained only with a new task head, is attacked about as successfully, which leads them to conclude that the prompt mechanism does not raise privacy risk beyond what the underlying GNN already carries. The paper's defense experiments show that Laplacian noise on embeddings or posteriors lowers attack success, at the cost of downstream task accuracy.","feed_headline":"Graph prompt learning leaks node data at up to 98% AUC","feed_subtitle":"Privacy test of graph prompt learning: shared embeddings expose attributes and links; Laplace noise cuts attack success.","key_machinery":"The carrying mechanism is a suite of standard inference attack models applied to the three information channels GPL exposes. Attribute Inference Attacks (AIAs) train an MLP, Random Forest, or GraphSAGE classifier on a shadow dataset to predict a sensitive node attribute from the target model's outputs; Link Inference Attacks (LIAs) predict whether two nodes are connected, either by cosine similarity in representation space or by a supervised MLP trained on linked and unlinked pairs from the shadow dataset. The three attacker capabilities are node posteriors $P^*$ (black-box queries), node embeddings $E$ (shared representations from the frozen GNN), and prompt embeddings $P$ (the trained prompt vectors). The 'w/o Prompt' baseline — frozen pre-trained GNN plus newly trained task head, with no prompt — is the comparison object used to isolate whether prompt tuning itself adds privacy risk. Five prompt methods from the unified graph prompt benchmark are attacked: All-in-One, GPrompt, GPF, GPF-plus, and GPPT.","core_discovery":"The central claim is that GPL exposes sensitive node information under every attacker capability considered, yet the prompt-tuning component is not the source of the exposure. Attackers with black-box access can infer node attributes and links from posterior outputs; attackers with access to shared node embeddings can do so with AUC approaching 98% on some datasets; and even prompt vectors such as those of GPF-plus leak attribute information, reaching up to 99% on the Actor dataset. Comparing these results against the 'w/o Prompt' baseline — a frozen pre-trained GNN with a newly trained task head — the authors find comparable or slightly higher attack success without prompts, and conclude that privacy leakage inherits from the information encoded in the frozen GNN rather than being introduced by prompt tuning. The paper also claims that Laplacian noise perturbation on embeddings provides the most adaptable defense, though it degrades model performance as noise grows.","pith_inferences":["The 'w/o Prompt' baseline is a frozen pre-trained GNN with only a newly trained head, which is not how traditional GNNs are normally trained; if a standard end-to-end-trained GNN leaks more, the paper's reassurance that prompts add no risk would need qualification.","The finding that prompt vectors leak up to 99% attribute information (GPF-plus on Actor) suggests an intellectual-property concern: prompts encode dataset-specific patterns and could be extracted or used to infer training data, a direction the paper does not develop.","The stability of attack success as k grows from 1 to 50 shots suggests that even minimal labels expose most of the leakage; a testable implication is that privacy properties of GPL depend more on the pre-trained encoder than on downstream tuning data.","Because heterophilic datasets show more variable attack results, dataset homophily could be a practical predictor of leakage risk; future work could test whether homophily-based disclosure bounds hold across other prompt methods."],"forward_implications":["Shared node embeddings are the riskiest channel: on several datasets AIA and LIA exceed 90% AUC, so platforms should treat embeddings as sensitive as raw graph data.","Black-box posterior queries alone are enough for meaningful inference on many datasets, so offering GPL as a service without output perturbation still leaks private attributes and links.","Because the w/o Prompt baseline is attacked about as successfully as prompted models, the paper's conclusion is that privacy defenses for traditional GNNs apply equally to GPL; prompt designs need not be treated as a new vulnerability class.","Prompt vectors themselves can leak attributes for node-wise prompt methods such as GPF-plus, so sharing prompts with third parties carries privacy risk even though prompts are less informative for link inference.","Laplacian noise on embeddings reduces both AIA and LIA success, but degrades downstream accuracy, so practical deployments must pick a noise level that trades privacy against task utility."],"supporting_citations":[{"why":"Supplies the unified graph prompt benchmark whose target models and prompt methods are attacked in the experiments.","marker":"[36]"},{"why":"Defines the All-in-One multi-task graph prompt method that is one of the attacked targets.","marker":"[11]"},{"why":"Defines the GPPT prompt-token method, another attacked target.","marker":"[12]"},{"why":"Defines the GraphPrompt/GPrompt method whose feature-space prompt vectors are attacked.","marker":"[13]"},{"why":"Defines GPF and GPF-plus, the latter providing the node-wise prompt embeddings tested for leakage.","marker":"[14]"},{"why":"GraphCL is the pre-training method used for the main 5-shot attack experiments.","marker":"[34]"},{"why":"Provides the link-stealing attack methodology that the LIA experimental design builds on.","marker":"[43]"},{"why":"Establishes attribute inference attacks against graph neural networks, the method family the AIA attacks adapt to GPL.","marker":"[58]"},{"why":"Justifies the shadow-dataset assumption that lets the attacker train a surrogate model from the same underlying distribution.","marker":"[38]"}],"fun_headline_variants":["Graph prompts leak node data, but tuning isn't to blame","GPL exposes attributes and links: up to 98% attack success","Graph prompt learning data leaks; Laplace noise can defend","Prompt tuning isn't the leak; frozen GNN information is"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The comparison rests on treating the 'w/o Prompt' baseline — a frozen pre-trained GNN with only a newly trained task head — as representative of a traditional GNN, even though standard GNNs are usually trained end-to-end or fine-tuned.","fun_headline_variants_meta":{"raw":{"variants":["Graph prompts leak node data, but tuning isn't to blame","GPL exposes attributes and links: up to 98% attack success","Graph prompt learning data leaks; Laplace noise can defend","Prompt tuning isn't the leak; frozen GNN information is"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000547,"raw_usage":{"total_tokens":2612,"prompt_tokens":944,"completion_tokens":1668,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":560,"completion_tokens_details":{"reasoning_tokens":1597}},"tokens_in":560,"tokens_out":1668,"duration_ms":11801,"temperature":1.0,"reasoning_tokens":1597,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T14:58:25.057348+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train a conventional GNN end-to-end on the same six datasets, run the same AIA and LIA attacks against its outputs, and compare AUC with the paper's 'w/o Prompt' numbers; if the end-to-end model is attacked substantially more successfully, the conclusion that prompt tuning adds no privacy risk over traditional GNNs would not survive.","supporting_citations":[{"cited_title":"Prog: A graph prompt learning benchmark,","cited_arxiv_id":null,"evidence_quote":"Supplies the unified graph prompt benchmark whose target models and prompt methods are attacked in the experiments."},{"cited_title":"Graphprompt: Unifying pre-training and downstream tasks for graph neural networks,","cited_arxiv_id":null,"evidence_quote":"Defines the GraphPrompt/GPrompt method whose feature-space prompt vectors are attacked."},{"cited_title":"Universal prompt tuning for graph neural networks,","cited_arxiv_id":null,"evidence_quote":"Defines GPF and GPF-plus, the latter providing the node-wise prompt embeddings tested for leakage."},{"cited_title":"Graph contrastive learning with augmentations,","cited_arxiv_id":null,"evidence_quote":"GraphCL is the pre-training method used for the main 5-shot attack experiments."},{"cited_title":"Stealing Links from Graph Neural Networks","cited_arxiv_id":"2005.02131","evidence_quote":"Provides the link-stealing attack methodology that the LIA experimental design builds on."},{"cited_title":"Inference attacks against graph neural networks,","cited_arxiv_id":null,"evidence_quote":"Establishes attribute inference attacks against graph neural networks, the method family the AIA attacks adapt to GPL."},{"cited_title":"Membership inference attacks against machine learning models,","cited_arxiv_id":null,"evidence_quote":"Justifies the shadow-dataset assumption that lets the attacker train a surrogate model from the same underlying distribution."}],"review_version":1}