{"id":"45187cab-0273-4df8-b06c-1b37a51578ae","arxiv_id":"2507.19964","paper_version":1,"verdict":"REJECT","confidence":"HIGH","novelty_score":6.0,"correctness_risk":"high","formal_verification":"none","parameter_count":6,"one_line_summary":"A malicious client in federated graph learning can infer which client owns a node by combining gradient eavesdropping, graph reconstruction, and class-prototype matching.","lead":"This paper introduces CC-MIA, a membership inference attack for federated graph neural networks where a malicious client guesses which client owns a given node. It combines shadow-model training, gradient inversion, and class prototypes to attribute nodes to source clients.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Threat model grants only local subgraph, shadow data, and gradients; the evaluation requires the full target graph and true labels (Alg. 2, Eq. 16), so reported numbers do not instantiate the claimed adversary.","rationale":"The paper's contribution is the claim that a malicious client can perform sample-to-client attribution and membership inference under a precisely stated threat model: the attacker has only its local subgraph, a public shadow dataset, and eavesdropped gradients. The reader's weakest-assumption analysis identifies that the evaluation uses capabilities beyond these: the full target graph (X, A) and the true labels y_i to construct query embeddings and to match prototypes in Algorithm 2, and adaptive selection of the best shadow dataset on the target test set for membership inference. My independent reading confirms this mismatch. It is not a question of tuning or reporting style; the core equations (Eq. 15, Eq. 16, Algorithm 2) literally require the true label of the queried node to compute the cosine similarity against the class-specific prototype, and the full graph to compute embeddings. For membership inference, the reported results are generated after choosing the shadow dataset that performs best on the target test set, which presupposes access to the target data that the threat model denies. Because these missing capabilities are integral to the method's execution, the empirical numbers cannot be credited to the claimed adversary. The concrete test I propose would settle the concern by re-running the client-identification evaluation under the stated constraints. If accuracy collapses to the random baseline, the novel component of the paper is not demonstrated; if accuracy survives, the threat model mismatch may be only a presentation issue and the verdict could be revisited. Until that check is done, the REJECT verdict is appropriate, with the constructive direction that the authors either weaken the threat model to include full-graph and label access or re-evaluate under their stated limits.","tokens_in":24715,"tokens_out":4418,"duration_ms":51815,"concrete_test":"Re-run the client-identification experiments with the threat model enforced: after gradient inversion, compute query embeddings E using only the attacker's local subgraph (not the full target graph), and replace the true labels y_i in Algorithm 2 and Eq. 16 with labels predicted by the global model on the reconstructed subgraphs. If the reported 10-client accuracy of 27.95% (Cora/FedAvg) drops to near the 10% uniform baseline, the central claim is not realized under the stated adversary.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that CC-MIA enables a malicious client to perform cross-client membership inference and client identification with only the capabilities listed in §3.1: its own subgraph Ga, a public shadow dataset, and intercepted gradients. That claim is not what the evaluation instantiates. For client identification, Algorithm 2 takes the full target graph (X, A) and ground-truth labels Y as input; line 8 computes E = F1(X, A) on the full graph, and line 11 uses di,k involving µ(k)_yi, which requires the true label of every queried node. For membership inference, §5.3 reports 'the shadow dataset for each target dataset that achieves the best attack performance,' meaning the shadow was selected by testing on the target set, access the threat model does not grant. These are not implementation details: without full-graph embeddings and true labels, the prototype-matching step in Eq. 16 cannot be computed as written, and without test-set shadow selection the reported AUC improvements are unreliable. The 86.04% Citeseer/SCAFFOLD AUC and 27.95% 10-client accuracy are therefore achieved by an adversary strictly stronger than the one defined in the paper. This is load-bearing because if the threat model is taken at face value, the attack as evaluated has not been shown to work.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces CC-MIA, a two-part attack framework for federated graph neural networks (FedGNNs). The first part is a cross-client membership inference attack in which a malicious client trains a binary classifier on a public shadow dataset to infer whether a node was in another client's training set. The second part is a client-data identification attack that eavesdrops on client gradients, reconstructs client subgraphs via gradient inversion, builds class-specific prototypes, and assigns query nodes to clients by prototype matching. The authors evaluate the attack across six datasets, five federated aggregation algorithms, and three GNN architectures, reporting membership-inference AUCs up to 86.04% and client-identification accuracy up to 27.95% for 10 clients against a uniform 10% baseline. The central claim is that a malicious client with only its local subgraph, a public shadow dataset, and eavesdropped gradients can both infer membership and attribute nodes to source clients.","tokens_in":24995,"tokens_out":5541,"duration_ms":66385,"significance":"If the claimed attack worked under the stated threat model, it would be a meaningful contribution: it targets a privacy risk specific to federated graph learning, namely client-level attribution of nodes, and it addresses an underexplored setting. The paper covers a broad experimental matrix and includes ablation studies, complexity analysis, and a defense discussion, which are useful. However, the evaluation does not instantiate the adversary defined in Section 3.1: the client-identification algorithm requires the full target graph and ground-truth labels, and the membership-inference shadow dataset is selected using target-set performance. These are not minor implementation details; they directly affect whether the reported numbers support the paper's headline claims. As a result, the significance of the empirical findings is not established for the claimed threat model.","major_comments":[{"comment":"The client-identification evaluation does not instantiate the adversary defined in §3.1. The threat model grants the attacker only its own local subgraph Ga, a public shadow dataset, and eavesdropped gradients, but Algorithm 2 takes the full target graph (X,A) as input and line 8 computes E = F1(X,A) over the entire graph. Moreover, Eq. (16) uses the true label yi of every queried node to select the prototype μ(k)_yi, and Algorithm 1 requires ground-truth labels Y as input. Without full-graph embeddings and true labels, the prototype-matching step cannot be computed as written, so the client-identification results in Table 1 (right side) and Table 7 are achieved by an adversary strictly stronger than the one claimed. This is load-bearing because the paper's central claim is that a malicious client can perform these attacks with only the capabilities listed in §3.1.","section":"§3.1, Algorithm 2, Eq. (16)"},{"comment":"The membership-inference results are inflated by test-set shadow selection. Section 5.3 states that the authors report 'the shadow dataset for each target dataset that achieves the best attack performance,' which means the shadow dataset is chosen by evaluating on the target dataset. Under the §3.1 threat model, the attacker does not have access to the target graph or its member/non-member labels, so selecting the shadow dataset by target-set performance violates the threat model and makes the reported AUCs (e.g., 86.04% for Citeseer/SCAFFOLD) optimistic. A valid evaluation would pre-register the shadow dataset based only on public information or report results averaged over all candidate shadow datasets.","section":"§5.3, Table 1"},{"comment":"The client-identification baseline is too weak to support the reported improvements. The only comparison is 'Client-uniform Probability' (1/K), but Fig. 4 shows that METIS produces strongly class-homogeneous client subgraphs; a trivial attacker that predicts the client from the node class, or from class-conditional prototypes, would already beat 1/K. The 'Max Improve %' row in Table 1 is therefore an improvement over uniform random, not over a realistic baseline, and the reported 27.95% accuracy for 10 clients does not demonstrate that CC-MIA's prototype matching adds value beyond class-based leakage. The ablation 'CC-MIA (no prot)' in Table 3 still achieves 20.82% with 10 clients, which should be compared against a class-only baseline before attribution accuracy is attributed to the proposed method.","section":"§5.4, Table 1, Fig. 4"},{"comment":"The client-identification pipeline is partly circular with respect to the data. Prototypes Pk are built from reconstructed subgraphs using labels (Eq. 15), and the same labels are used to match query nodes in Eq. (16). Because METIS creates class-homogeneous clients, the matching procedure can reduce to a class-prediction task rather than a client-identity task. The paper does not control for this, for example by reporting performance conditioned on correct versus incorrect label predictions or by comparing against a classifier that uses only predicted class, so the attribution accuracy may overstate the attack's ability to distinguish clients beyond class structure.","section":"Eqs. (15)-(16), Algorithm 2"}],"minor_comments":[{"comment":"The claim of 'a maximum improvement of 72.16%' is relative to the HP-MIA baseline on Citeseer/SCAFFOLD; the reference baseline should be stated explicitly whenever percentage improvements are reported.","section":"§5.3, Table 1"},{"comment":"There is a typo: 'Reciever' should be 'Receiver.' Also, Eq. (18) defines RNMSE as ||x_v - \\hat{x}_v|| / ||x_v||, which is a relative error rather than a normalized root mean squared error in the usual sense; the metric name should be reconciled with the definition.","section":"Appendix A.7"},{"comment":"The notation \\hat{E}^j_k and I^c_k is used without defining the superscript j as a node index; the notation should be clarified for reproducibility.","section":"Algorithm 1, Algorithm 2"},{"comment":"The reference list contains duplicate entries: [15] and [16] both refer to He et al., 'Node-level membership inference attacks against graph neural networks.' The duplicates should be unified.","section":"References"},{"comment":"The 'CC-MIA (norm)' entry for 10 clients is 9.12%, below the 10% uniform baseline; the text says it 'performs near random,' but below-random accuracy suggests a systematic bias in the normalized variant and deserves a comment.","section":"Table 3"},{"comment":"The captions and legends in Figure 3 are difficult to parse: each subfigure mixes client-class labels and the caption labels like '(a) Client3' appear inconsistent with the number of clients displayed; the figure should be reorganized for clarity.","section":"Figure 3"}],"recommendation":"reject","confidential_remarks":"The main reason for rejection is the mismatch between the stated threat model and the evaluation. The client-identification attack requires full-graph access and true labels, and the membership-inference shadow dataset is selected using target-set performance. These are load-bearing issues that cannot be fixed by local edits. The core idea may be salvageable if the authors either re-frame the work as an attack by a stronger adversary or re-run the experiments under the capabilities actually granted in Section 3.1, but as submitted the central claim is not supported."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: this paper names a real gap—cross-client ownership inference in FedGNNs—and builds a plausible two-stage attack, but the evaluation uses a stronger adversary than the one defined in §3.1. That mismatch is load-bearing: the headline numbers do not support the threat-model claim.\n\nWhat is actually new: framing sample-to-client attribution as a distinct privacy risk is a fair contribution. The formal definitions are clear, and decomposing the attack into shadow-model MIA and prototype matching after gradient inversion is sensible. Credit is also due for testing across five federated algorithms and multiple datasets, and for stating limitations in Appendix A.4.\n\nThe soft spots, in order of severity. First, Algorithm 2 and Eq. 16 require the full target graph (X,A) and ground-truth labels y_i; the attacker in §3.1 has only its own subgraph, a public shadow set, and eavesdropped gradients. The paper never explains how the attacker gets the real graph or true labels, and these are not minor implementation details—the prototype-matching step is undefined without them. Second, §5.3 reports the shadow dataset 'that achieves the best attack performance' per target set; that is test-set selection, not attacker knowledge, and it quietly inflates the MIA AUCs. Third, the client-identification baseline is uniform random, but METIS yields strongly class-homogeneous partitions (their own Fig. 4 shows clients with 60–80% of a single class), so a majority-class baseline would likely close much of the reported gap between 27.95% and 10%. That baseline is missing.\n\nThe stress-test notes land; I checked Algorithm 2 and Eq. 16 against the threat model. Overall, the mismatch is not cosmetic, and the current version overstates the result. But the problem definition is worth taking seriously, and a revision that either weakens the threat model to grant full-graph label access or re-runs the evaluation under the original constraints could be a solid paper. This deserves a serious referee—preferably one who checks the evaluation against the stated adversary—rather than a desk reject. Good reading-group material on threat-model discipline.","headline":"This paper names a real gap—cross-client ownership inference in FedGNNs—but the evaluation uses a stronger adversary than the threat model grants, so the headline numbers don't back the claim.","tokens_in":25505,"tokens_out":2285,"would_cite":false,"duration_ms":25519,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A malicious client in federated graph learning can infer which client owns a given node, the paper claims, by combining a shadow-dataset membership classifier with gradient-inversion prototype matching.","keywords":["cross-client membership inference","federated graph neural networks","client ownership identification","gradient inversion","prototype matching","node classification","privacy attack"],"falsifier":"An evaluation that withholds the full target graph and ground-truth labels, allowing the attacker only its own subgraph, a public shadow dataset, and intercepted gradients, would settle whether the reported accuracy survives the stated threat model: if accuracy collapses toward random, the attack's headlined performance depends on oracle access.","tokens_in":24517,"feed_emoji":"🕵️","tokens_out":5756,"duration_ms":66194,"temperature":0.7,"pith_summary":"The paper argues that in federated graph learning, a malicious client can learn not just whether a node was in another client's training set but which client owns it. It proposes CC-MIA, a two-part attack: a shadow-dataset classifier performs membership inference on node embeddings, while gradient inversion plus class-specific prototype matching attributes nodes to their source clients. The authors report AUC up to 86.04% for membership inference on Citeseer with SCAFFOLD and ownership accuracy up to 27.95% for ten clients against a 10% random baseline. If correct, this shows that client identity leaks through model updates and graph structure even in federated settings.","feed_headline":"Attack traces federated GNN data to its owner","feed_subtitle":"A client-side adversary hits 86% AUC on membership and beats random attribution across 10 clients.","key_machinery":"Two mechanisms carry the attack. First, membership inference: the attacker trains an MLP classifier with batch normalization and dropout on embeddings from a shadow graph, labeled by whether the corresponding node was in the shadow training set; the classifier is then applied to target nodes through the global GNN. Second, client identification: the attacker inverts each intercepted client gradient by minimizing negative cosine similarity between real and synthetic gradients with graph smoothness and sparsity penalties, computes class prototypes per client from reconstructed subgraph embeddings, and assigns a node to the client whose same-class prototype has maximum cosine similarity.","core_discovery":"On its own terms, the paper's central discovery is that sample-to-client attribution is learnable in federated GNNs: the global model's message passing makes node embeddings cluster by client and class, and those clusters can be recovered by an attacker that eavesdrops on client gradients. Membership inference succeeds because a publicly available graph from the same domain, passed through the global model, produces embeddings that train a transferable binary member/non-member classifier. Client identification succeeds because gradient inversion reconstructs each client's subgraph, and the first GNN layer's class prototypes are distinctive enough that cosine similarity assigns a query node to its true client.","pith_inferences":["Editorial extension: if the prototype-separability finding transfers beyond these transductive citation datasets, the same two-stage attack may apply to dynamic or inductive federated graph settings.","Editorial extension: the construction of gradient inversion plus prototype matching could likely be adapted to attribute edges or subgraphs rather than only nodes.","Editorial extension: applying the attack under randomized or IID client partitions would directly test the paper's stated limitation that real-world non-IID distributions may break prototype separability.","Editorial extension: because Algorithm 2's matching requires the full target graph and true labels, the strong reported numbers likely overstate the stated threat model; re-running with the attacker strictly limited to its own subgraph would isolate how much of the signal is structural rather than oracle-based."],"forward_implications":["Cross-client membership inference works across FedAvg, FedProx, SCAFFOLD, FedDF, and FedNova, and across GCN, GAT, and GraphSAGE, so the risk is not tied to one aggregation rule or model family.","Public shadow datasets from the same domain suffice for membership inference, meaning the attacker does not need access to the victims' local data.","Client attribution stays above the uniform random baseline by at least 95% and, in relative terms, improves as the number of clients grows, so larger federations do not erase the identity signal.","Gradient inversion quality degrades as the number of clients increases, with feature reconstruction error rising, which bounds the client-identification arm under heavier federation.","The paper's defense analysis indicates that perturbation-based defenses only drive client identification to near-random at noise levels that severely damage global model utility."],"supporting_citations":[{"why":"Establishes node-level membership inference against GNNs, the centralized threat model that CC-MIA extends into federated settings.","marker":"[16]"},{"why":"Supplies the GNN gradient-inversion objective based on negative cosine similarity used to reconstruct client subgraphs.","marker":"[1]"},{"why":"Supplies the graph smoothness and sparsity losses used for gradient fitting during subgraph reconstruction.","marker":"[57]"},{"why":"Supplies the METIS graph partitioner that creates the disjoint non-IID client subgraphs used in the evaluation.","marker":"[19]"},{"why":"CS-MIA is the federated membership-inference baseline that CC-MIA is compared against and outperforms.","marker":"[12]"},{"why":"HP-MIA is a centralized membership-inference baseline included for comparison.","marker":"[9]"},{"why":"GAN-based data enhancement serves as the third membership-inference baseline.","marker":"[39]"}],"fun_headline_variants":["Cross-client attack exposes data ownership in federated GNNs","Federated GNNs leak which client owns a sample","New cross-client attack identifies sample ownership in FedGNNs","Attacker attributes graph samples to clients in federated GNNs","Membership attack reveals client ownership in federated graphs"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The results assume the attacker already possesses the full target graph and the true labels of the queried nodes, while the stated threat model gives the attacker only its own subgraph, a public shadow dataset, and intercepted gradients.","fun_headline_variants_meta":{"raw":{"variants":["Cross-client attack exposes data ownership in federated GNNs","Federated GNNs leak which client owns a sample","New cross-client attack identifies sample ownership in FedGNNs","Attacker attributes graph samples to clients in federated GNNs","Membership attack reveals client ownership in federated graphs"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000652,"raw_usage":{"total_tokens":2971,"prompt_tokens":907,"completion_tokens":2064,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":523,"completion_tokens_details":{"reasoning_tokens":1979}},"tokens_in":523,"tokens_out":2064,"duration_ms":15282,"temperature":1.0,"reasoning_tokens":1979,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T13:50:41.438298+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"An evaluation that withholds the full target graph and ground-truth labels, allowing the attacker only its own subgraph, a public shadow dataset, and intercepted gradients, would settle whether the reported accuracy survives the stated threat model: if accuracy collapses toward random, the attack's headlined performance depends on oracle access.","supporting_citations":[{"cited_title":"Anand Sinha, Y","cited_arxiv_id":null,"evidence_quote":"Supplies the GNN gradient-inversion objective based on negative cosine similarity used to reconstruct client subgraphs."},{"cited_title":"Zhang, Q","cited_arxiv_id":null,"evidence_quote":"Supplies the graph smoothness and sparsity losses used for gradient fitting during subgraph reconstruction."},{"cited_title":"Karypis and V","cited_arxiv_id":null,"evidence_quote":"Supplies the METIS graph partitioner that creates the disjoint non-IID client subgraphs used in the evaluation."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"CS-MIA is the federated membership-inference baseline that CC-MIA is compared against and outperforms."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"HP-MIA is a centralized membership-inference baseline included for comparison."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"GAN-based data enhancement serves as the third membership-inference baseline."}],"review_version":1}