{"id":"3a7f6649-42ff-4b95-8bb2-8f9435361019","arxiv_id":"2606.29748","paper_version":1,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":7.0,"correctness_risk":"unknown","formal_verification":"none","parameter_count":0,"one_line_summary":"Introduces graph-label conditioned (GLC) and embedding-label conditioned (ELC) reconstruction attacks on GNNs that achieve high-quality graph recovery in black-box settings on NCI1, PROTEINS and AIDS datasets using four distributional metrics.","lead":"This paper introduces two new attacks called GLC and ELC that try to reconstruct original graphs from a GNN's outputs or internal states using a generator-discriminator setup. A smart generalist should read it to understand emerging privacy risks when organizations apply GNNs to sensitive connected data such as molecules or proteins.","discovery_kind":"new_method","skeptic_critique":{"model":"grok-4.3","headline":"Distributional metrics (FGD/EGD/MMD/GKS) may not establish instance-level recovery of private graphs vs. mere distribution matching","rationale":"The reader's weakest assumption directly matches the load-bearing gap: the metrics are necessary but their sufficiency for the privacy-reconstruction claim is unshown. Full-text access would allow checking whether instance-level results appear later, but the abstract-only limitation noted by the reader already flags this as the primary risk. No other internal inconsistency (e.g., black-box definition or query reduction) appears more central to the headline claim.","tokens_in":1729,"tokens_out":336,"duration_ms":20327,"concrete_test":"For each dataset, compute average node/edge overlap and exact label match between each generated graph and its nearest original training graph (using the same train/test split); if mean overlap remains below 30% while distributional metrics stay high, the reconstruction interpretation weakens.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The central claim is that GLC/ELC attacks using generator-discriminator reconstruct high-quality private graphs in black-box settings. Evaluation rests entirely on four set-level distributional/structural metrics. These metrics can score well when the generator produces graphs from a similar overall distribution without recovering the structure or labels of any specific training graph. The abstract provides no instance-level fidelity numbers (edge overlap, graph edit distance to originals, or label recovery rates), leaving the mapping from metric improvement to \"reconstruction of private graph structure and labels\" unverified. This is the least secure link because the attack is framed as inversion/privacy leakage rather than unconditional graph generation.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.3","summary":"The paper introduces two black-box graph reconstruction attacks on GNNs—graph-label conditioned (GLC) and embedding-label conditioned (ELC)—that employ a generator-discriminator framework conditioned on target model predictions or intermediate embeddings plus labels. It evaluates these attacks against baselines on the NCI1, PROTEINS, and AIDS datasets using four distributional/structural metrics (FGD, EGD, MMD, GKS), reports that the attacks achieve high-quality reconstruction, presents a query-reduced variant (Ours--), and examines robustness under varying Laplacian noise scales.","tokens_in":1858,"tokens_out":524,"duration_ms":24771,"significance":"If the results hold, the work would be significant for highlighting practical privacy risks in GNNs deployed on sensitive graph data and for providing concrete, query-efficient attack methods that could inform defense design. The reduced-query variant and noise analysis add practical value.","major_comments":[{"comment":"Section 4 (Experimental Evaluation): The central claim that the attacks 'reconstruct high-quality graphs' and enable 'reconstruction of private graph structure and labels' rests on improvements in set-level distributional metrics (FGD, EGD, MMD, GKS). These metrics can be satisfied by unconditional distribution matching without recovering the structure or labels of any specific training instance, leaving the mapping from metric scores to instance-level privacy leakage unverified. No instance-level fidelity measures (e.g., edge overlap, graph edit distance to originals, or per-graph label recovery) are reported.","section":"Section 4"},{"comment":"Section 4.3 (Comparison with baselines) and abstract: The superiority claims over existing baselines are quantified only via the same four distributional metrics; without instance-level verification, it is unclear whether the reported gains correspond to better inversion of private data or simply better unconditional graph generation.","section":"Section 4.3"}],"minor_comments":[{"comment":"Abstract: The clause 'we show that GNNs are highly vulnerable to privacy attacks, varying Laplacian noise-scales' is grammatically unclear; rephrase to 'under varying Laplacian noise scales'.","section":"Abstract"},{"comment":"Notation: The distinction between GLC and ELC conditioning is introduced in the abstract but would benefit from an explicit side-by-side comparison table early in Section 3.","section":"Section 3"}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":{"model":"grok-4.3","summary":"We thank the referee for the constructive comments on our manuscript. We address the major comments point by point below and indicate where revisions will be made.","responses":[{"response":"We acknowledge the distinction between distributional and instance-level evaluation. Our attacks are explicitly generative and conditioned on target model predictions (GLC) or embeddings plus labels (ELC), with the goal of producing graphs whose distribution aligns with the private training data. The four metrics are standard for assessing generative graph models and were chosen to quantify structural and distributional fidelity under black-box access. However, we agree that the current presentation could more clearly separate claims about distributional reconstruction from instance-specific recovery. We will revise Section 4 to include an explicit discussion of this limitation and its implications for interpreting privacy leakage.","revision_made":"partial","referee_comment":"[Section 4] Section 4 (Experimental Evaluation): The central claim that the attacks 'reconstruct high-quality graphs' and enable 'reconstruction of private graph structure and labels' rests on improvements in set-level distributional metrics (FGD, EGD, MMD, GKS). These metrics can be satisfied by unconditional distribution matching without recovering the structure or labels of any specific training instance, leaving the mapping from metric scores to instance-level privacy leakage unverified. No instance-level fidelity measures (e.g., edge overlap, graph edit distance to originals, or per-graph label recovery) are reported."},{"response":"All methods, including baselines, are evaluated under identical conditions and metrics to ensure comparability. The conditioning mechanisms in GLC and ELC differentiate them from purely unconditional generators. That said, we accept that the superiority claims should be framed more precisely around improved distributional matching rather than guaranteed per-instance inversion. We will update the abstract and Section 4.3 to reflect this nuance and avoid overstatement.","revision_made":"partial","referee_comment":"[Section 4.3] Section 4.3 (Comparison with baselines) and abstract: The superiority claims over existing baselines are quantified only via the same four distributional metrics; without instance-level verification, it is unclear whether the reported gains correspond to better inversion of private data or simply better unconditional graph generation."}],"tokens_in":1456,"tokens_out":474,"duration_ms":22824,"standing_objections":[]},"desk_editor":{"model":"grok-4.3","letter":"The one thing to know is that this work defines two new attack setups—graph-label conditioned and embedding-label conditioned—plus a version that cuts queries in half, and tests them on three standard graph datasets. That part is new relative to the baselines they cite.\n\nThe paper does a clean job laying out how the generator-discriminator is conditioned on the target model's outputs or embeddings, running the comparisons, and checking what happens when Laplacian noise is added. The reduced-query variant is a practical addition that still holds up on the reported metrics.\n\nThe soft spot is the evaluation. All four metrics (FGD, EGD, MMD, GKS) operate at the set or distribution level. They can improve when the generator produces graphs that look like the overall training distribution without recovering the edges or labels of any specific private graph. The abstract and stress-test note give no instance-level numbers such as edge overlap, graph edit distance to originals, or per-graph label recovery rates. That gap makes the jump from “better metric scores” to “reconstruct high-quality private graphs” and real privacy leakage harder to accept at face value.\n\nThis is for researchers who track model inversion and graph privacy work. Someone looking for fresh attack formulations and a reduced-query trick can pull useful ideas from it. A reader who needs evidence that actual training examples are being recovered will find the current results suggestive but incomplete.\n\nIt deserves peer review. The attack ideas are distinct enough and the topic matters for applied graph datasets, even if the authors will need to strengthen the link between the metrics and instance recovery.","headline":"The paper introduces GLC and ELC conditioned attacks plus a low-query variant, but its distributional metrics leave the instance-level reconstruction claim unproven.","tokens_in":2290,"tokens_out":396,"would_cite":false,"duration_ms":23009,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.3","headline":"Adversaries can reconstruct high-quality private graphs from black-box GNNs using a generator-discriminator approach.","keywords":["graph neural networks","model inversion attack","graph reconstruction","privacy attack","black-box attack","generator-discriminator","GNN vulnerability"],"falsifier":"A direct comparison showing that the reconstructed graphs differ substantially from the originals in edge connectivity or node labels on a held-out evaluation set.","tokens_in":2637,"feed_emoji":"🔒","tokens_out":529,"duration_ms":18813,"temperature":0.7,"pith_summary":"The paper presents two new attacks on Graph Neural Networks called graph-label conditioned (GLC) and embedding-label conditioned (ELC) attacks. These attacks train a generator to create graphs that match the target model's outputs or internal embeddings, paired with a discriminator to improve quality. Evaluations on NCI1, PROTEINS, and AIDS datasets using FGD, EGD, MMD, and GKS metrics show that these methods recover graphs effectively in black-box settings. A version with half the queries maintains performance. The results indicate GNNs leak sensitive information through their predictions and representations even under noise.","feed_headline":"Generator attacks recover private graphs from black-box GNNs","feed_subtitle":"Two new attacks using predictions or embeddings achieve strong reconstruction on benchmark datasets with half the queries.","key_machinery":"The generator-discriminator framework conditioned on GNN predictions (GLC) or embeddings (ELC) that inverts the model's behavior to recover input graphs.","core_discovery":"By conditioning a generative model on either the target GNN's class predictions or its intermediate embeddings and using a discriminator to refine the output, an attacker can produce graphs whose distribution closely matches the private training graphs, as measured by multiple structural and distributional statistics, in realistic black-box query scenarios.","pith_inferences":["Graph-specific privacy methods beyond noise addition may be needed for deployed GNNs.","The same generative inversion approach could apply to other structured-data models.","Task-specific metrics on label accuracy would give a clearer picture of leakage beyond distributional scores."],"forward_implications":["GNN models expose private graph data through accessible predictions and embeddings.","Black-box access to outputs suffices for high-quality reconstruction without internal model details.","A 50 percent reduction in queries still yields comparable reconstruction quality.","GNNs remain vulnerable to privacy attacks across varying scales of Laplacian noise."],"fun_headline_variants":["GNNs leak private graphs via generator attacks","Reconstructing graphs from GNN class predictions","Embedding conditioned attacks recover GNN data","Black-box graph reconstruction with fewer queries"],"cache_read_input_tokens":2112,"weakest_assumption_plain":"The four chosen distributional and structural metrics accurately reflect successful recovery of the actual private graph structures and labels.","fun_headline_variants_meta":{"raw":{"variants":["GNNs leak private graphs via generator attacks","Reconstructing graphs from GNN class predictions","Embedding conditioned attacks recover GNN data","Black-box graph reconstruction with fewer queries"]},"model":"grok-4.3","cost_usd":0.007278,"raw_usage":{"total_tokens":3279,"prompt_tokens":682,"num_sources_used":0,"completion_tokens":52,"cost_in_usd_ticks":72778000,"prompt_tokens_details":{"text_tokens":682,"audio_tokens":0,"image_tokens":0,"cached_tokens":64},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":2545,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":682,"tokens_out":52,"duration_ms":26846,"temperature":1.0,"reasoning_tokens":2545,"cache_read_input_tokens":64,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-06-30T06:44:31.792461+00:00","model_set":{"reader":"grok-4.3"},"falsifier":"A direct comparison showing that the reconstructed graphs differ substantially from the originals in edge connectivity or node labels on a held-out evaluation set.","supporting_citations":[],"review_version":1}