Pith. sign in

REVIEW 4 major objections 6 minor 72 references

GraphTheft: Quantifying Privacy Risks in Graph Prompt Learning

T0 review · 4 major / 6 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper shows graph prompt learning leaks sensitive node data, with inference attacks reaching 98% AUC, and that prompts themselves are not the added risk.

desk verdict First systematic privacy audit of graph prompt learning, but the headline 'no more risk than traditional GNNs' rests on a baseline that isn't a traditional GNN. read the letter →

arxiv 2411.14718 v1 pith:3XKULMA3 submitted 2024-11-22 cs.CR

Jiani Zhu , Xi Lin , Yuxin Qi , Qinghua Mao This is my paper · ORCID
classification cs.CR
keywords graphpromptlearningattributeinferenceattacklinkprivacyleakageneuralnetworksfew-shotLaplaciannoisedefense
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Graph Prompt Learning (GPL) adapts a frozen pre-trained graph neural network to new tasks by tuning lightweight prompts, a paradigm that is efficient but largely untested for privacy. This paper asks whether an attacker can recover sensitive node attributes and hidden links from the information GPL exposes: node posteriors from a black-box service, or node embeddings and prompt vectors shared with third parties. Using attribute inference attacks (AIA) and link inference attacks (LIA) on six datasets and five prompt methods, the authors find attack success close to 98% AUC in the strongest cases, with shared node embeddings the most exposed. They also find that a frozen GNN without any prompt, trained only with a new task head, is attacked about as successfully, which leads them to conclude that the prompt mechanism does not raise privacy risk beyond what the underlying GNN already carries. The paper's defense experiments show that Laplacian noise on embeddings or posteriors lowers attack success, at the cost of downstream task accuracy.

What carries the argument

The carrying mechanism is a suite of standard inference attack models applied to the three information channels GPL exposes. Attribute Inference Attacks (AIAs) train an MLP, Random Forest, or GraphSAGE classifier on a shadow dataset to predict a sensitive node attribute from the target model's outputs; Link Inference Attacks (LIAs) predict whether two nodes are connected, either by cosine similarity in representation space or by a supervised MLP trained on linked and unlinked pairs from the shadow dataset. The three attacker capabilities are node posteriors $P^*$ (black-box queries), node embeddings $E$ (shared representations from the frozen GNN), and prompt embeddings $P$ (the trained prompt vectors). The 'w/o Prompt' baseline — frozen pre-trained GNN plus newly trained task head, with no prompt — is the comparison object used to isolate whether prompt tuning itself adds privacy risk. Five prompt methods from the unified graph prompt benchmark are attacked: All-in-One, GPrompt, GPF, GPF-plus, and GPPT.

What would settle it

Train a conventional GNN end-to-end on the same six datasets, run the same AIA and LIA attacks against its outputs, and compare AUC with the paper's 'w/o Prompt' numbers; if the end-to-end model is attacked substantially more successfully, the conclusion that prompt tuning adds no privacy risk over traditional GNNs would not survive.

Watch

Extended reading notes

Core claim

The central claim is that GPL exposes sensitive node information under every attacker capability considered, yet the prompt-tuning component is not the source of the exposure. Attackers with black-box access can infer node attributes and links from posterior outputs; attackers with access to shared node embeddings can do so with AUC approaching 98% on some datasets; and even prompt vectors such as those of GPF-plus leak attribute information, reaching up to 99% on the Actor dataset. Comparing these results against the 'w/o Prompt' baseline — a frozen pre-trained GNN with a newly trained task head — the authors find comparable or slightly higher attack success without prompts, and conclude that privacy leakage inherits from the information encoded in the frozen GNN rather than being introduced by prompt tuning. The paper also claims that Laplacian noise perturbation on embeddings provides the most adaptable defense, though it degrades model performance as noise grows.

Load-bearing premise

The comparison rests on treating the 'w/o Prompt' baseline — a frozen pre-trained GNN with only a newly trained task head — as representative of a traditional GNN, even though standard GNNs are usually trained end-to-end or fine-tuned.

Editorial extensions

If this is right

  • Shared node embeddings are the riskiest channel: on several datasets AIA and LIA exceed 90% AUC, so platforms should treat embeddings as sensitive as raw graph data.
  • Black-box posterior queries alone are enough for meaningful inference on many datasets, so offering GPL as a service without output perturbation still leaks private attributes and links.
  • Because the w/o Prompt baseline is attacked about as successfully as prompted models, the paper's conclusion is that privacy defenses for traditional GNNs apply equally to GPL; prompt designs need not be treated as a new vulnerability class.
  • Prompt vectors themselves can leak attributes for node-wise prompt methods such as GPF-plus, so sharing prompts with third parties carries privacy risk even though prompts are less informative for link inference.
  • Laplacian noise on embeddings reduces both AIA and LIA success, but degrades downstream accuracy, so practical deployments must pick a noise level that trades privacy against task utility.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The 'w/o Prompt' baseline is a frozen pre-trained GNN with only a newly trained head, which is not how traditional GNNs are normally trained; if a standard end-to-end-trained GNN leaks more, the paper's reassurance that prompts add no risk would need qualification.
  • The finding that prompt vectors leak up to 99% attribute information (GPF-plus on Actor) suggests an intellectual-property concern: prompts encode dataset-specific patterns and could be extracted or used to infer training data, a direction the paper does not develop.
  • The stability of attack success as k grows from 1 to 50 shots suggests that even minimal labels expose most of the leakage; a testable implication is that privacy properties of GPL depend more on the pre-trained encoder than on downstream tuning data.
  • Because heterophilic datasets show more variable attack results, dataset homophily could be a practical predictor of leakage risk; future work could test whether homophily-based disclosure bounds hold across other prompt methods.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. This paper presents the first systematic empirical privacy assessment of Graph Prompt Learning (GPL). It defines three attacker capabilities (black-box posteriors, shared node embeddings, and shared prompt embeddings) and evaluates Attribute Inference Attacks (AIA) and Link Inference Attacks (LIA) across six datasets, five GPL prompt methods, multiple pre-training strategies, and few-shot settings. The reported attack AUCs are often above 90% and sometimes reach 99.9%. The paper compares these results with a 'w/o Prompt' condition, concludes that prompt tuning does not elevate privacy risks relative to traditional GNNs, and evaluates Laplacian perturbation as a defense.

Significance. If the results are supported, this is a useful first characterization of the privacy leakage channels in GPL. Strengths include the breadth of the study (six datasets including heterophilic and homophilic graphs, multiple prompt methods, and confidence intervals from 10 tasks), the non-circular evaluation protocol (the attack model is trained on shadow outputs and tested on shadow nodes whose labels were not used to train the target model), and the explicit comparison of posterior, embedding, and prompt access. The main weakness is that the headline comparative claim rests on a control condition that is not a traditional GNN, and the attack measurements lack specification of the targeted sensitive attributes and of raw-feature baselines. These issues are fixable with additional experiments, so the contribution is potentially publishable after a major revision.

major comments (4)
  1. [§4.2, §4.3.3, §5.3.3] The 'w/o Prompt' baseline is defined in §4.2 as keeping the pre-trained model frozen and 'directly training task-specific parameters.' This is effectively a linear probe on fixed pre-trained representations, not a traditional GNN. The paper itself defines traditional GNNs in §1 and §2.1 as relying on 'end-to-end training' or 'pre-training & fine-tuning,' and the frozen-encoder setup omits exactly the adaptation that defines that comparison class. Tables 2 and 3 therefore only show that prompt tuning is comparable to a frozen-encoder control; they do not establish the abstract's and §4.3.3/§5.3.3 conclusion that prompt tuning does not elevate privacy risk compared to traditional GNNs. Please add end-to-end trained and pre-train/fine-tuned GNN baselines, or explicitly restrict the claim to the frozen-encoder control.
  2. [§4.2, Tables 2 and 3] The targeted sensitive attribute is never specified. §4.2 says only that 'we assume a node-sensitive property corresponding to each dataset, consistent across all experiments.' Without naming the attribute and stating whether it is one of the raw features or the node-classification label, the reported AUCs cannot be interpreted or reproduced. If the sensitive attribute coincides with the downstream task label, then posterior-based attacks may simply be reading the task output, and the '98% success' headline would be misleading. Please specify the sensitive attribute per dataset and report its relationship to the task label and to the input features.
  3. [§4.1, §4.3] The paper reports attack AUCs against posteriors, embeddings, and prompts but never compares with a baseline attack on the raw node features or with a chance-level control. Since the datasets contain rich features (e.g., Cora's bag-of-words) that may directly encode the sensitive property, high AUC could reflect inherent attribute predictability rather than leakage through GPL. Add, for each dataset, the same attack model trained on raw features X, on X with the sensitive attribute removed, and a random-label control, and report the incremental AUC attributable to the GPL output.
  4. [§5.1, Tables 3 and 6] The MLP link-inference attack is not fully specified: the paper describes a 3-layer MLP with hidden sizes 64 and 32, but does not state how a node pair (f(u), f(v)) is converted into the classifier input (concatenation, absolute difference, Hadamard product, or another operator). This choice materially affects link-prediction performance and is needed to reproduce the LIA results in Tables 3 and 6. Please specify the input construction and, ideally, report both similarity-based and MLP variants for all attacker capabilities.
minor comments (6)
  1. [Throughout] There are several typos and inconsistent notations, including 'privatcy' in §3.2, 'which which accords' in §4.4, 'examinesthe' in §9, 'PorG' instead of ProG in §4.4, and inconsistent spelling of 'Gprompt' versus 'GPrompt.'
  2. [§6, Eq. (10)] The Laplacian perturbation is defined as Xpri = X + Lap(β), but the paper does not state whether the noise is added per dimension or whether β is scaled by the norm or dimension of the output vector; please clarify the exact mechanism.
  3. [Figure 13] The caption refers to 'the three embeddings,' but the figure compares posteriors, embeddings, and prompts; please use 'three output types' for clarity.
  4. [§3.2 and §4.2] The term 'white-box' is used for third-party access to embeddings and prompts, but this is not a full white-box scenario since the adversary does not see model weights or gradients; consider using 'embedding-access' or 'intermediate-output' to avoid confusion.
  5. [§4.3.2 and Tables 2, 5] The prompt-embedding capability is evaluated only for GPF-plus, while the tables use dashes for other prompt types; this limitation should be stated in the main text rather than only implied by the table.
  6. [Appendix B, Tables 5 and 6] The statement that changing k from 5 to 10 'does not yield significant differences' is contradicted by the GPF-plus prompt-embedding row for AIA, where Cora drops from 86.49 to 29.47 and Squirrel rises from 64.48 to 97.53; please reconcile or qualify this claim.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the attack evaluation is non-circular, though the 'w/o Prompt' baseline raises a comparison-validity concern rather than a circular derivation.

full rationale

The attack pipeline is not circular: the target GPL model is trained on 20% of the nodes with ground-truth labels, and the attacker's shadow dataset is constructed from the remaining 80% of nodes (Section 4.2). Attack models are trained on target-model outputs for the shadow training split and evaluated on the shadow test split, whose sensitive labels were not used in target-model training. The reported AUC values are therefore genuine measurements of information leakage through posteriors, embeddings, or prompts, not quantities that hold by construction. The paper's comparative claim that prompt tuning does not elevate privacy risk rests on the 'w/o Prompt' control, which keeps the pre-trained model frozen and trains only task-specific parameters. That control does not match the paper's own definition of traditional GNNs as 'end-to-end' or 'pre-training & fine-tuning' (Sections 1 and 2.1), so the baseline may understate the risk of conventional training. This is a baseline-validity and correctness concern, not circularity: the conclusion is an empirical comparison, and the baseline outputs are not defined in terms of the conclusion. The self-citations in the reference list ([2], [22], [55]) are background references and are not load-bearing for any derivation in the paper. No fitted parameter is renamed as a prediction, no uniqueness theorem is imported from the authors' prior work, and no ansatz is smuggled in via citation. The core measurements are self-contained and externally falsifiable, so the circularity score is low despite the comparative-claim weakness.

Assumptions & free parameters 0 free parameters · 3 assumptions · 0 invented entities

This is an empirical study, so there are no fitted constants in a derivation. The load-bearing assumptions are the shadow dataset distribution, the existence of an unspecified sensitive attribute, and the w/o Prompt configuration standing in for traditional GNNs.

assumptions (3)
  • domain assumption The attacker's shadow dataset Dshadow is drawn from the same distribution as the target model's training data.
    Section 3.2 states this following Shokri et al. [38]; it is a strong assumption that enables the surrogate attack model but may not hold in practice.
  • domain assumption A single sensitive node property exists for each dataset, consistent across all experiments.
    Section 4.2 assumes such a property but never identifies it, making the AIA setup non-reproducible and the reported AUCs hard to interpret.
  • ad hoc to paper The w/o Prompt configuration, a frozen pretrained GNN with a newly trained task head, adequately represents traditional GNNs for the privacy comparison.
    Section 4.2 defines this baseline; standard traditional GNNs are end-to-end trained, so this assumption is specific to the paper and weakens the comparative conclusion.

how reviews work

0 comments
Cite this review

Pith. "Pith review of GraphTheft: Quantifying Privacy Risks in Graph Prompt Learning." pith.science (2026). https://pith.science/paper/3XKULMA3

@misc{pith2026241114718,
  author       = {Pith},
  title        = {Pith review of: GraphTheft: Quantifying Privacy Risks in Graph Prompt Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/3XKULMA3}},
  note         = {Machine review of arXiv:2411.14718}
}
read the original abstract

Graph Prompt Learning (GPL) represents an innovative approach in graph representation learning, enabling task-specific adaptations by fine-tuning prompts without altering the underlying pre-trained model. Despite its growing prominence, the privacy risks inherent in GPL remain unexplored. In this study, we provide the first evaluation of privacy leakage in GPL across three attacker capabilities: black-box attacks when GPL as a service, and scenarios where node embeddings and prompt representations are accessible to third parties. We assess GPL's privacy vulnerabilities through Attribute Inference Attacks (AIAs) and Link Inference Attacks (LIAs), finding that under any capability, attackers can effectively infer the properties and relationships of sensitive nodes, and the success rate of inference on some data sets is as high as 98%. Importantly, while targeted inference attacks on specific prompts (e.g., GPF-plus) maintain high success rates, our analysis suggests that the prompt-tuning in GPL does not significantly elevate privacy risks compared to traditional GNNs. To mitigate these risks, we explored defense mechanisms, identifying that Laplacian noise perturbation can substantially reduce inference success, though balancing privacy protection with model performance remains challenging. This work highlights critical privacy risks in GPL, offering new insights and foundational directions for future privacy-preserving strategies in graph learning.

Figures

Figures reproduced from arXiv: 2411.14718 by the authors.

Figure 1
Figure 1. An overview of inference attacks on GPL. Graph prompting [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Schematic overview of inference attacks in GPL. [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. Connectivity Matrix between Classes in Four Datasets [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (15 more)
Figure 4
Figure 4. Figure 4: Attack performance of different attack models on node posteriors [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: Performance of five GPL models under different pretraining [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 8
Figure 8. Figure 8: The performance of Attribute Inference Attack under different [PITH_FULL_IMAGE:figures/full_fig_p007_8.png]
Figure 9
Figure 9. Figure 9: The output of the attack model for 400 randomly sampled positive [PITH_FULL_IMAGE:figures/full_fig_p009_9.png]
Figure 10
Figure 10. Figure 10: A1 and A2 performance under three embeddings node embeddings and posterior outputs. Similarly, although the model’s overall performance showed a slight upward trend, it exhibited unstable fluctuations across different k values, aligning with findings in PorG research.…
Figure 11
Figure 11. Figure 11: Link inference of attack effects under different pretraining [PITH_FULL_IMAGE:figures/full_fig_p010_11.png]
Figure 12
Figure 12. Figure 12: Link inference of attack effects under different k-shot settings [PITH_FULL_IMAGE:figures/full_fig_p010_12.png]
Figure 13
Figure 13. Figure 13: The performance of Attribute inference Attack and Link inference Attack when different amounts of noise are added to the three embeddings [PITH_FULL_IMAGE:figures/full_fig_p011_13.png]
Figure 14
Figure 14. Figure 14: The effect of adding noise on model performance [PITH_FULL_IMAGE:figures/full_fig_p011_14.png]
Figure 15
Figure 15. Figure 15: The performance of Attribute inference Attack and Link inference Attack when different amounts of noise are added to the node embeddings [PITH_FULL_IMAGE:figures/full_fig_p012_15.png]
Figure 16
Figure 16. Figure 16: Three models’s attack performance under when using posteriors [PITH_FULL_IMAGE:figures/full_fig_p016_16.png]
Figure 17
Figure 17. Figure 17: The performance of AIAs in different pretraining GNN models [PITH_FULL_IMAGE:figures/full_fig_p017_17.png]
Figure 18
Figure 18. Figure 18: The performance of AIAs in different k-shot settings [PITH_FULL_IMAGE:figures/full_fig_p017_18.png]
Figure 19
Figure 19. Figure 19: The performance of LIAs in different pretraining GNN models [PITH_FULL_IMAGE:figures/full_fig_p017_19.png]
Figure 20
Figure 20. Figure 20: The performance of LIAs in different k-shot settings [PITH_FULL_IMAGE:figures/full_fig_p018_20.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

72 extracted references · 35 canonical work pages

  1. [1]

    Graph neural networks: Methods, applications, and opportunities,

    L. Waikhom and R. Patgiri, “Graph neural networks: Methods, applications, and opportunities,” 2021. [Online]. Available: https: //arxiv.org/abs/2108.10733

    arXiv 2021

  2. [2]

    Local differential private spatio- temporal dynamic graph learning for wireless social networks,

    J. Zhu, X. Lin, Y . Qi, G. Li, C. Zhang, and J. Li, “Local differential private spatio- temporal dynamic graph learning for wireless social networks,” in 2024 IEEE Wireless Communications and Networking Conference (WCNC), 2024, pp. 1–6

    work page 2024

  3. [3]

    Relevance-aware anomalous users detection in social network via graph neural network,

    Y . Li, Y . Ji, S. Li, S. He, Y . Cao, Y . Liu, H. Liu, X. Li, J. Shi, and Y . Yang, “Relevance-aware anomalous users detection in social network via graph neural network,” in 2021 International Joint Con- ference on Neural Networks (IJCNN) , 2021, pp. 1–8

    work page 2021

  4. [4]

    LR-GNN: a graph neural network based on link representation for predicting molecular associations,

    C. Kang, H. Zhang, Z. Liu, S. Huang, and Y . Yin, “LR-GNN: a graph neural network based on link representation for predicting molecular associations,” Briefings in Bioinformatics , vol. 23, no. 1, p. bbab513, 12 2021. [Online]. Available: https://doi.org/10.1093/bib/bbab513

    doi:10.1093/bib/bbab513 2021

  5. [5]

    Pre-training graph neural networks for link prediction in biomedical networks,

    Y . Long, M. Wu, Y . Liu, Y . Fang, C. K. Kwoh, J. Chen, J. Luo, and X. Li, “Pre-training graph neural networks for link prediction in biomedical networks,” Bioinformatics, vol. 38, no. 8, pp. 2254–2262, 02 2022. [Online]. Available: https: //doi.org/10.1093/bioinformatics/btac100

    doi:10.1093/bioinformatics/btac100 2022

  6. [6]

    Consisrec: Enhancing gnn for social recommendation via consistent neighbor aggregation,

    L. Yang, Z. Liu, Y . Dou, J. Ma, and P. S. Yu, “Consisrec: Enhancing gnn for social recommendation via consistent neighbor aggregation,” in Proceedings of the 44th International ACM SIGIR Conference on Research and Development in Information Retrieval, ser. SIGIR ’21. New York, NY , USA: Association for Computing Machinery, 2021, p. 2141–2145. [Online]. A...

    arXiv 2021

  7. [7]

    Dskreg: Differentiable sampling on knowledge graph for recommendation with relational gnn,

    Y . Wang, Z. Liu, Z. Fan, L. Sun, and P. S. Yu, “Dskreg: Differentiable sampling on knowledge graph for recommendation with relational gnn,” in Proceedings of the 30th ACM International Conference on Information & Knowledge Management , ser. CIKM ’21. New York, NY , USA: Association for Computing Machinery, 2021, p. 3513–3517. [Online]. Available: https:/...

    arXiv 2021

  8. [8]

    Prioritizing network communities,

    M. Zitnik, R. Sosi ˇc, and J. Leskovec, “Prioritizing network communities,” Nature Communications , vol. 9, no. 1, Jun. 2018. [Online]. Available: http://dx.doi.org/10.1038/s41467-018-04948-5

    work page doi:10.1038/s41467-018-04948-5 2018

Show all 72 references
  1. [9]

    Demystifying multitask deep neural networks for quantitative structure–activity relationships,

    Y . Xu, J. Ma, A. Liaw, R. P. Sheridan, and V . Svetnik, “Demystifying multitask deep neural networks for quantitative structure–activity relationships,” Journal of Chemical Information and Modeling , vol. 57, no. 10, pp. 2490–2504, 2017, pMID: 28872869. [Online]. Available: h...

    2017 doi

  2. [10]

    Rethinking network pruning – under the pre-train and fine-tune paradigm,

    D. Xu, I. E. H. Yen, J. Zhao, and Z. Xiao, “Rethinking network pruning – under the pre-train and fine-tune paradigm,” 2022. [Online]. Available: https://arxiv.org/abs/2104.08682

    2022 arXiv

  3. [11]

    All in one: Multi-task prompting for graph neural networks,

    X. Sun, H. Cheng, J. Li, B. Liu, and J. Guan, “All in one: Multi-task prompting for graph neural networks,” in Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining , ser. KDD ’23. New York, NY , USA: Association for Computing Machinery, 2023, p....

    2023

  4. [12]

    Gppt: Graph pre-training and prompt tuning to generalize graph neural networks,

    M. Sun, K. Zhou, X. He, Y . Wang, and X. Wang, “Gppt: Graph pre-training and prompt tuning to generalize graph neural networks,” in Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining , ser. KDD ’22. New York, NY , USA: Association for Computin...

    2022

  5. [13]

    Graphprompt: Unifying pre-training and downstream tasks for graph neural networks,

    Z. Liu, X. Yu, Y . Fang, and X. Zhang, “Graphprompt: Unifying pre-training and downstream tasks for graph neural networks,” in Proceedings of the ACM Web Conference 2023 , 2023

    2023

  6. [14]

    Universal prompt tuning for graph neural networks,

    T. Fang, Y . Zhang, Y . Y ANG, C. Wang, and L. Chen, “Universal prompt tuning for graph neural networks,” in Advances in Neural Information Processing Systems , A. Oh, T. Naumann, A. Globerson, K. Saenko, M. Hardt, and S. Levine, Eds., vol. 36. Curran Associates, Inc., 2023, p...

    2023

  7. [15]

    Hgprompt: Bridging homogeneous and heterogeneous graphs for few-shot prompt learn- ing,

    X. Yu, Y . Fang, Z. Liu, and X. Zhang, “Hgprompt: Bridging homogeneous and heterogeneous graphs for few-shot prompt learn- ing,” in AAAI Conference on Artificial Intelligence , 2023. [Online]. Available: https://api.semanticscholar.org/CorpusID:265609471

    2023

  8. [16]

    Multigprompt for multi-task pre-training and prompting on graphs,

    X. Yu, C. Zhou, Y . Fang, and X. Zhang, “Multigprompt for multi-task pre-training and prompting on graphs,” Proceedings of the ACM on Web Conference 2024 , 2023. [Online]. Available: https://api.semanticscholar.org/CorpusID:266052614

    2024

  9. [17]

    Prompt engineering a prompt engineer,

    Q. Ye, M. Axmed, R. Pryzant, and F. Khani, “Prompt engineering a prompt engineer,” 2024. [Online]. Available: https://arxiv.org/abs/ 2311.05661

    2024 arXiv

  10. [18]

    The power of scale for parameter-efficient prompt tuning,

    B. Lester, R. Al-Rfou, and N. Constant, “The power of scale for parameter-efficient prompt tuning,” 2021. [Online]. Available: https://arxiv.org/abs/2104.08691

    2021 arXiv

  11. [19]

    Locally private graph neural networks,

    S. Sajadmanesh and D. Gatica-Perez, “Locally private graph neural networks,” in Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security , ser. CCS ’21. New York, NY , USA: Association for Computing Machinery, 2021, p. 2130–2145. [Online]. Availabl...

    2021 doi

  12. [20]

    Gap: differentially private graph neural networks with aggregation perturbation,

    S. Sajadmanesh, A. S. Shamsabadi, A. Bellet, and D. Gatica-Perez, “Gap: differentially private graph neural networks with aggregation perturbation,” in Proceedings of the 32nd USENIX Conference on Security Symposium , ser. SEC ’23. USA: USENIX Association, 2023

    2023

  13. [21]

    Differentially private decoupled graph convolutions for multigranular topology protection,

    E. Chien, W.-N. Chen, C. Pan, P. Li, A. ¨Ozg¨ur, and O. Milenkovic, “Differentially private decoupled graph convolutions for multigranular topology protection,” in Proceedings of the 37th International Con- ference on Neural Information Processing Systems , ser. NIPS ’23. Red ...

    2024

  14. [22]

    Linkguard: Link locally privacy-preserving graph neural networks with integrated denoising and private learning,

    Y . Qi, X. Lin, Z. Liu, G. Li, J. Wang, and J. Li, “Linkguard: Link locally privacy-preserving graph neural networks with integrated denoising and private learning,” in Companion Proceedings of the ACM Web Conference 2024, ser. WWW ’24. New York, NY , USA: Association for Comp...

    2024

  15. [23]

    Lingcn: structural lin- earized graph convolutional network for homomorphically encrypted inference,

    H. Peng, R. Ran, Y . Luo, J. Zhao, S. Huang, K. Thorat, T. Geng, C. Wang, X. Xu, W. Wen, and C. Ding, “Lingcn: structural lin- earized graph convolutional network for homomorphically encrypted inference,” in Proceedings of the 37th International Conference on Neural Informatio...

    2024

  16. [25]

    Pre-trained models for natural language processing: A survey,

    X. Qiu, T. Sun, Y . Xu, Y . Shao, N. Dai, and X. Huang, “Pre-trained models for natural language processing: A survey,” CoRR, vol. abs/2003.08271, 2020. [Online]. Available: https: //arxiv.org/abs/2003.08271

    2003 arXiv

  17. [26]

    SciBERT: A pretrained language model for scientific text,

    I. Beltagy, K. Lo, and A. Cohan, “SciBERT: A pretrained language model for scientific text,” in Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP) , K. ...

    2019

  18. [27]

    Vision-and- language pretrained models: A survey,

    S. Long, F. Cao, S. C. Han, and H. Yang, “Vision-and- language pretrained models: A survey,” 2022. [Online]. Available: https://arxiv.org/abs/2204.07356

    2022 arXiv

  19. [28]

    Beit: BERT pre-training of image transformers,

    H. Bao, L. Dong, and F. Wei, “Beit: BERT pre-training of image transformers,” CoRR, vol. abs/2106.08254, 2021. [Online]. Available: https://arxiv.org/abs/2106.08254

    2021 arXiv

  20. [29]

    A survey of pretraining on graphs: Taxonomy, methods, and applications,

    J. Xia, Y . Zhu, Y . Du, and S. Z. Li, “A survey of pretraining on graphs: Taxonomy, methods, and applications,” 2022. [Online]. Available: https://arxiv.org/abs/2202.07893

    2022 arXiv

  21. [30]

    Strategies for pre-training graph neural networks,

    W. Hu, B. Liu, J. Gomes, M. Zitnik, P. Liang, V . Pande, and J. Leskovec, “Strategies for pre-training graph neural networks,”

  22. [31]

    Deep graph infomax,

    P. Veli ˇckovi´c, W. Fedus, W. L. Hamilton, P. Li `o, Y . Bengio, and R. D. Hjelm, “Deep graph infomax,” 2018. [Online]. Available: https://arxiv.org/abs/1809.10341

    2018 arXiv

  23. [32]

    Variational graph auto-encoders,

    T. N. Kipf and M. Welling, “Variational graph auto-encoders,” 2016. [Online]. Available: https://arxiv.org/abs/1611.07308

    2016 arXiv

  24. [33]

    Graphmae: Self-supervised masked graph autoencoders,

    Z. Hou, X. Liu, Y . Cen, Y . Dong, H. Yang, C. Wang, and J. Tang, “Graphmae: Self-supervised masked graph autoencoders,” in Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining , ser. KDD ’22. New York, NY , USA: Association for Computing Machin...

    2022

  25. [34]

    Graph contrastive learning with augmentations,

    Y . You, T. Chen, Y . Sui, T. Chen, Z. Wang, and Y . Shen, “Graph contrastive learning with augmentations,” in Proceedings of the 34th International Conference on Neural Information Processing Systems , ser. NIPS ’20. Red Hook, NY , USA: Curran Associates Inc., 2020

    2020

  26. [35]

    Simgrace: A simple framework for graph contrastive learning without data augmentation,

    J. Xia, L. Wu, J. Chen, B. Hu, and S. Z. Li, “Simgrace: A simple framework for graph contrastive learning without data augmentation,” in Proceedings of the ACM Web Conference 2022, ser. WWW ’22. New York, NY , USA: Association for Computing Machinery, 2022, p. 1070–1079. [Onli...

    2022

  27. [36]

    Prog: A graph prompt learning benchmark,

    C. Zi, H. Zhao, X. Sun, Y . Lin, H. Cheng, and J. Li, “Prog: A graph prompt learning benchmark,” the Thirty-Eighth Advances in Neural Information Processing Systems (NeurIPS 2024) , 2024

    2024

  28. [37]

    Ml- leaks: Model and data independent membership inference attacks and defenses on machine learning models,

    A. Salem, Y . Zhang, M. Humbert, M. Fritz, and M. Backes, “Ml- leaks: Model and data independent membership inference attacks and defenses on machine learning models,” ArXiv, vol. abs/1806.01246,

    arXiv

  29. [38]

    Membership inference attacks against machine learning models,

    R. Shokri, M. Stronati, C. Song, and V . Shmatikov, “Membership inference attacks against machine learning models,” in 2017 IEEE Symposium on Security and Privacy (SP) , 2017, pp. 3–18

    2017

  30. [39]

    Artificial neural networks (the multilayer perceptron)—a review of applications in the atmospheric sciences,

    M. Gardner and S. Dorling, “Artificial neural networks (the multilayer perceptron)—a review of applications in the atmospheric sciences,” Atmospheric Environment, vol. 32, no. 14, pp. 2627–2636,

  31. [40]

    Random forests,

    L. Breiman, “Random forests,” Machine Learning, vol. 45, pp. 5–32,

  32. [41]

    Node-level membership inference attacks against graph neural networks,

    X. He, R. Wen, Y . Wu, M. Backes, Y . Shen, and Y . Zhang, “Node-level membership inference attacks against graph neural networks,” ArXiv, vol. abs/2102.05429, 2021. [Online]. Available: https://api.semanticscholar.org/CorpusID:231861713

    2021 arXiv

  33. [42]

    Deep Graph Infomax,

    P. Veli ˇckovi´c, W. Fedus, W. L. Hamilton, P. Li `o, Y . Bengio, and R. D. Hjelm, “Deep Graph Infomax,” in International Conference on Learning Representations , 2019. [Online]. Available: https://openreview.net/forum?id=rklz9iAcKQ

    2019

  34. [43]

    Stealing links from graph neural networks,

    X. He, J. Jia, M. Backes, N. Z. Gong, and Y . Zhang, “Stealing links from graph neural networks,” 2020. [Online]. Available: https://arxiv.org/abs/2005.02131

    2020 arXiv

  35. [44]

    Data fine-tuning,

    S. Chhabra, P. Majumdar, M. Vatsa, and R. Singh, “Data fine-tuning,” in Proceedings of the AAAI Conference on Artificial Intelligence , vol. 33, no. 01, 2019, pp. 8223–8230

    2019

  36. [45]

    Universal language model fine- tuning for text classification,

    J. Howard and S. Ruder, “Universal language model fine- tuning for text classification,” 2018. [Online]. Available: https: //arxiv.org/abs/1801.06146

    2018 arXiv

  37. [46]

    Spottune: Transfer learning through adaptive fine-tuning,

    Y . Guo, H. Shi, A. Kumar, K. Grauman, T. Rosing, and R. Feris, “Spottune: Transfer learning through adaptive fine-tuning,” 2018. [Online]. Available: https://arxiv.org/abs/1811.08737

    2018 arXiv

  38. [47]

    A systematic survey of prompt engineering in large language models: Techniques and applications,

    P. Sahoo, A. K. Singh, S. Saha, V . Jain, S. Mondal, and A. Chadha, “A systematic survey of prompt engineering in large language models: Techniques and applications,” 2024. [Online]. Available: https://arxiv.org/abs/2402.07927

    2024 arXiv

  39. [48]

    Prefix-tuning: Optimizing continuous prompts for generation,

    X. L. Li and P. Liang, “Prefix-tuning: Optimizing continuous prompts for generation,” 2021. [Online]. Available: https://arxiv.org/ abs/2101.00190

    2021 arXiv

  40. [49]

    Pre-train, prompt, and predict: A systematic survey of prompting methods in natural language processing,

    P. Liu, W. Yuan, J. Fu, Z. Jiang, H. Hayashi, and G. Neubig, “Pre-train, prompt, and predict: A systematic survey of prompting methods in natural language processing,” 2021. [Online]. Available: https://arxiv.org/abs/2107.13586

    2021 arXiv

  41. [50]

    Exploring visual prompts for adapting large-scale models,

    H. Bahng, A. Jahanian, S. Sankaranarayanan, and P. Isola, “Exploring visual prompts for adapting large-scale models,” 2022. [Online]. Available: https://arxiv.org/abs/2203.17274

    2022 arXiv

  42. [51]

    Visual prompting via image inpainting,

    A. Bar, Y . Gandelsman, T. Darrell, A. Globerson, and A. A. Efros, “Visual prompting via image inpainting,” 2022. [Online]. Available: https://arxiv.org/abs/2209.00647

    2022 arXiv

  43. [52]

    Diversity-aware meta visual prompting,

    Q. Huang, X. Dong, D. Chen, W. Zhang, F. Wang, G. Hua, and N. Yu, “Diversity-aware meta visual prompting,” 2023. [Online]. Available: https://arxiv.org/abs/2303.08138

    2023 arXiv

  44. [53]

    Sgl-pt: A strong graph learner with graph prompt tuning,

    Y . Zhu, J. Guo, and S. Tang, “Sgl-pt: A strong graph learner with graph prompt tuning,” 2023. [Online]. Available: https: //arxiv.org/abs/2302.12449

    2023 arXiv

  45. [54]

    Hetgpt: Harnessing the power of prompt tuning in pre-trained heterogeneous graph neural networks,

    Y . Ma, N. Yan, J. Li, M. Mortazavi, and N. V . Chawla, “Hetgpt: Harnessing the power of prompt tuning in pre-trained heterogeneous graph neural networks,” in Proceedings of the ACM Web Conference 2024, ser. WWW ’24. New York, NY , USA: Association for Computing Machinery, 202...

    2024

  46. [55]

    Ultra-dp: Unifying graph pre-training with multi-task graph dual prompt,

    M. Chen, Z. Liu, C. Liu, J. Li, Q. Mao, and J. Sun, “Ultra-dp: Unifying graph pre-training with multi-task graph dual prompt,”

  47. [56]

    Prompt tuning for multi-view graph contrastive learning,

    C. Gong, X. Li, J. Yu, C. Yao, J. Tan, C. Yu, and D. Yin, “Prompt tuning for multi-view graph contrastive learning,” ArXiv, vol. abs/2310.10362, 2023. [Online]. Available: https://api.semanticscholar.org/CorpusID:271709101

    2023 arXiv

  48. [57]

    Enhancing graph neural networks with structure-based prompt,

    Q. Ge, Z. Zhao, Y . Liu, A. Cheng, X. Li, S. Wang, and D. Yin, “Enhancing graph neural networks with structure-based prompt,” arXiv preprint arXiv:2310.17394 , 2023

    2023 arXiv

  49. [58]

    Inference attacks against graph neural networks,

    Z. Zhang, M. Chen, M. Backes, Y . Shen, and Y . Zhang, “Inference attacks against graph neural networks,” in 31st USENIX Security Symposium (USENIX Security 22) , 2022, pp. 4543–4560

    2022

  50. [59]

    Group property inference attacks against graph neural networks,

    X. Wang and W. H. Wang, “Group property inference attacks against graph neural networks,” in Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security , 2022, pp. 2871–2884

    2022

  51. [60]

    node2vec: Scalable feature learning for networks,

    A. Grover and J. Leskovec, “node2vec: Scalable feature learning for networks,” Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining , 2016. [On- line]. Available: https://api.semanticscholar.org/CorpusID:207238980

    2016

  52. [61]

    Link prediction based on graph neural networks,

    M. Zhang and Y . Chen, “Link prediction based on graph neural networks,” in Proceedings of the 32nd International Conference on Neural Information Processing Systems , ser. NIPS’18. Red Hook, NY , USA: Curran Associates Inc., 2018, p. 5171–5181

    2018

  53. [62]

    walk2friends: Inferring social links from mobility profiles,

    M. Backes, M. Humbert, J. Pang, and Y . Zhang, “walk2friends: Inferring social links from mobility profiles,” Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, 2017. [Online]. Available: https://api.semanticscholar.org/ CorpusID:3225750

    2017

  54. [63]

    Linkteller: Recovering private edges from graph neural networks via influence analysis,

    F. Wu, Y . Long, C. Zhang, and B. Li, “Linkteller: Recovering private edges from graph neural networks via influence analysis,” in 2022 IEEE Symposium on Security and Privacy (SP), 2022, pp. 2005–2024

    2022

  55. [64]

    Inference attacks against graph neural networks,

    Z. Zhang, M. Chen, M. Backes, Y . Shen, and Y . Zhang, “Inference attacks against graph neural networks,” in 31st USENIX Security Symposium (USENIX Security 22) . Boston, MA: USENIX Associ- ation, Aug. 2022, pp. 4543–4560. [Online]. Available: https://www. usenix.org/conferenc...

    2022

  56. [65]

    Quantifying privacy leakage in graph embedding,

    V . Duddu, A. Boutet, and V . Shejwalkar, “Quantifying privacy leakage in graph embedding,” in MobiQuitous 2020 - 17th EAI International Conference on Mobile and Ubiquitous Systems: Computing, Networking and Services , ser. MobiQuitous ’20. New York, NY , USA: Association for ...

    2020

  57. [66]

    Model extraction attacks on graph neural networks: Taxonomy and realisation,

    B. Wu, X. Yang, S. Pan, and X. Yuan, “Model extraction attacks on graph neural networks: Taxonomy and realisation,” in Proceedings of the 2022 ACM on Asia Conference on Computer and Communications Security , ser. ASIA CCS ’22. New York, NY , USA: Association for Computing Mach...

    2022

  58. [74]

    Available: https://arxiv.org/abs/2108.04417 Appendix A Notations The key notations frequently used throughout this paper are summarized in Table 4

    [Online]. Available: https://arxiv.org/abs/2108.04417 Appendix A Notations The key notations frequently used throughout this paper are summarized in Table 4. TABLE 4. S UMMARY OF THE NOTATIONS USED IN THIS PAPER . Notation Description G = {V, A, X} Graph u, v∈ V Nodes in G X ∈...

    arXiv

  59. [1998]

    Available: https://www.sciencedirect.com/science/ article/pii/S1352231097004470

    [Online]. Available: https://www.sciencedirect.com/science/ article/pii/S1352231097004470

  60. [2001]

    Available: https://api.semanticscholar.org/CorpusID: 89141

    [Online]. Available: https://api.semanticscholar.org/CorpusID: 89141

  61. [2018]

    Available: https://api.semanticscholar.org/CorpusID: 46933970

    [Online]. Available: https://api.semanticscholar.org/CorpusID: 46933970

  62. [2020]

    Available: https://arxiv.org/abs/1905.12265

    [Online]. Available: https://arxiv.org/abs/1905.12265

    1905 arXiv

  63. [2021]

    Available: https://arxiv.org/abs/2106.07139

    [Online]. Available: https://arxiv.org/abs/2106.07139

    arXiv

  64. [2023]

    Available: https://arxiv.org/abs/2310.14845

    [Online]. Available: https://arxiv.org/abs/2310.14845

    arXiv

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.