Intellectual Property in Graph-Based Machine Learning as a Service: Attacks and Defenses

Bolin Shen; Chenxi Zhao; Kaixiang Zhao; Lincan Li; Shirui Pan; Yushun Dong; Yuxiang Sun

REVIEW 3 major objections 5 minor 247 references

Intellectual Property in Graph-Based Machine Learning as a Service: Attacks and Defenses

T0 review · 3 major / 5 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This survey claims to be the first comprehensive taxonomy of intellectual-property protection for graph machine learning, organizing attacks and defenses into model-level and data-level categories and providing an open-source library, PyGIP

desk verdict Useful survey of GML IP protection with a workable taxonomy and a real code library; the 'first comprehensive' claim is undercut by black-box/white-box scope contradictions and sloppy dataset stats, but it deserves a serious referee. read the letter →

arxiv 2508.19641 v1 pith:PH3WTNU7 submitted 2025-08-27 cs.CR cs.AI

Lincan Li , Bolin Shen , Chenxi Zhao , Yuxiang Sun , Kaixiang Zhao , Shirui Pan , Yushun Dong This is my paper

classification cs.CRcs.AI

keywords intellectualpropertyprotectiongraphmachinelearningmodelextractionattackinversionmembershipinferencewatermarkingfingerprintingGMLaaS

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that the scattered work on protecting graph machine learning models and data can be organized into a single, first-of-its-kind taxonomy with four branches: model-level attacks, model-level defenses, data-level attacks, and data-level defenses. If that organization holds, researchers and practitioners get a common language for positioning new attack or defense methods, and a shared benchmark library, PyGIP, for comparing them. The survey also argues that existing surveys of graph learning security miss the intellectual-property angle, and that existing DNN IP-protection work does not transfer directly because graph models expose structural as well as attribute information. The practical payoff would be clearer threat modeling for graph-based machine-learning-as-a-service and more reproducible evaluation of watermarking, fingerprinting, differential privacy, and related defenses.

What carries the argument

The load-bearing object is the four-branch taxonomy tree: model-level attack, model-level defense, data-level attack, and data-level defense, each with its own representative methods and evaluation metrics. PyGIP is the accompanying implementation layer that turns the taxonomy from a conceptual map into runnable benchmark tooling, letting a user take a taxonomy branch and immediately execute a corresponding attack or defense.

What would settle it

A concrete check would be to enumerate the published graph-learning IP protection literature and test whether every established attack or defense fits exactly one of the four taxonomy leaves; a single widely used method that falls outside the partition, or a realistic GMLaaS theft that requires white-box access to succeed, would falsify the comprehensiveness claim. A second check would be to run a representative benchmark pair—say, a model extraction attack against a watermarking defense—through PyGIP and see whether the library reproduces the published success and fidelity numbers.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central claim is that graph-learning IP protection can be systematically partitioned into model-level attacks (model extraction), model-level defenses (watermarking, fingerprinting, adversarial training), data-level attacks (model inversion and membership inference), and data-level defenses (differential privacy, adversarial training, topology perturbation, regularization, knowledge distillation). The authors assert this is the first taxonomy to cover both threats and defenses at both the model and data levels for graph learning. They pair the taxonomy with an evaluation framework covering attack effectiveness, attack efficiency, task utility, privacy protection

Load-bearing premise

The taxonomy's claimed comprehensiveness depends on every relevant graph-learning IP protection method fitting into the four model/data attack-defense categories, and on black-box API access being the practically important threat setting.

Editorial extensions

If this is right

New IP-protection methods can be positioned within a standard four-branch scheme, making it easier to see what a proposal adds and what it competes with.
PyGIP gives the community a common implementation platform, so accuracy, fidelity, robustness, and efficiency claims can be compared under the same codebase and datasets.
The proposed evaluation metrics give authors a checklist—attack effectiveness, attack efficiency, task utility, privacy protection, resource cost—that could become the default reporting standard for the field.
The benchmark dataset survey gives practitioners a map of which graphs (citation, social, molecular, protein, e-commerce, traffic, collaboration) support which kinds of IP-protection experiments.
Future work can use the taxonomy to identify gaps, e.g., classes of graph models or attacks that have no assigned defense branch yet.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The paper's exclusive focus on black-box access means the taxonomy likely underrepresents white-box and gray-box threats, which could become more relevant as open-weight graph models and federated graph training spread.
Because defenses are grouped by mechanism rather than by formal privacy guarantee, methods placed in the same branch (e.g., differential privacy and adversarial training) may have incomparable privacy semantics; a shared quantitative threat model would be needed to truly benchmark them side by side.
The same four-branch structure could extend naturally to graph-based large language models, where the boundary between 'model theft' and 'data leakage' is blurrier than in classic GNNs.
A testable extension would be to use PyGIP as a seed for a community benchmark: if multiple groups can reproduce published attack-success and defense-fidelity numbers on the same datasets, the evaluation framework would gain the credibility the survey argues for.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Dear colleague,

Here’s the short version: if you work on graph ML security, this survey is worth having on your desk. It organizes a fragmented literature—model/data attacks and defenses—into a simple four-box taxonomy, and it ships an actual open-source library (PyGIP). That combination is useful, and it is the paper’s real contribution. The taxonomy is not a new theory, but it is a reasonable frame for the field, and the reference list is broad and relevant.

The best parts: the evaluation-metrics discussion is practical, the dataset overview is a good starting point (caveat below), and the library gives people something to run rather than just read about. Self-citations are present but appropriate; they point to closely related prior work.

Now the soft spots, in order of seriousness. First, the scope claims contradict the content. Section 3 and Section 4.1.1 say the paper considers only black-box attacks, and Section 4.2.2 says 'we consider these attacks exclusively under the black-box setting.' But the same sections cover FedGIG [137] and gradient-inversion attacks [173], which need gradient or parameter access, and Section 5.1.2 includes GrOVe [125], a white-box fingerprinting method. The taxonomy itself does not encode threat model, so the stated restriction is not actually applied. This is fixable—either drop the exclusivity language or add a threat-model dimension—but as written it undercuts the ‘first comprehensive taxonomy’ claim.

Second, the dataset statistics are unreliable. Table 2 gives Reddit as 232,965 nodes and 57,307,946 edges; Appendix A.2 says over 50,000 nodes and 860,000 edges. Some rows are averages (e.g., MUTAG, NCI1), others are totals (e.g., AIDS, ENZYMES), and the headers don’t tell you which. For a paper that wants to be a standard reference, that’s a real problem. There are also cosmetic issues—a dangling ‘[?]’ reference in Figure 2, ‘NCT1’ for NCI1, ‘acadeMInvA’—that a careful copyedit would catch.

Third, the ‘first taxonomy’ claim is overstated. Being first is hard to establish, and ‘comprehensive’ doesn’t hold given the scope inconsistency. The taxonomy is useful as an organizing device, but it’s not a conceptual breakthrough.

Overall: the central argument—that this taxonomy and library help the GML IP protection community—holds up. The flaws are concentrated in consistency and presentation, not in the core logic. I’d send it to peer review and ask for a revision. The referees would do the field a favor by forcing the scope statements and statistics to be cleaned up.

For your own work: I’d cite the taxonomy and PyGIP, but I’d double-check any dataset numbers before reusing them. I might bring it to a reading group if we’re discussing how to write surveys that claim comprehensiveness.

Referee Report

3 major / 5 minor

Summary. This survey reviews intellectual property (IP) protection for graph-based machine learning as a service (GMLaaS). It organizes existing work into a proposed taxonomy with four top-level categories: model-level attacks, model-level defenses, data-level attacks, and data-level defenses. For each category it discusses representative methods, threat assumptions, and evaluation metrics. It also tabulates benchmark datasets, describes real-world application domains, and introduces an open-source library called PyGIP for implementing and comparing attack and defense methods. The paper's central claims are that it provides the first comprehensive taxonomy of GML IP protection, a systematic evaluation framework, a curated set of benchmark datasets, and a reusable software library.

Significance. If the central claims are substantiated, the survey would be a useful reference for a fragmented and growing area: it collects model extraction, model inversion, membership inference, watermarking, fingerprinting, adversarial training, differential privacy, perturbation-based, regularization-based, and knowledge-distillation methods under one framework. The accompanying PyGIP library is a practical contribution that could lower the barrier to reproducing and comparing methods. The evaluation-metric discussion and dataset summary are also potentially valuable. However, the paper currently contains internal contradictions in its stated threat-model scope and in its dataset statistics, and the 'first comprehensive taxonomy' claim is not fully supported as written. These issues are fixable, but they affect the survey's core reliability.

major comments (3)

[§3, §4.1.1, §4.2.2, §5.1.2] The paper's threat-model scope is internally inconsistent. Section 4.1.1 states 'we focus exclusively on this setting in our discussion' after restricting model-level attacks to black-box access, and Section 4.2.2 states 'we consider these attacks exclusively under the black-box setting.' Yet Section 4.2.2 includes FedGIG [137] and gradient-inversion attacks [173], which require access to model gradients or parameters (white-box), and Section 5.1.2 includes GrOVe [125], described explicitly as a white-box static fingerprinting method. Section 5.2.4 also mentions 'white-box gradient inspection' as part of the regularization-defense procedure. The taxonomy in Fig. 2 has no threat-model dimension, so the stated black-box restriction is not consistently applied. This undermines the 'comprehensive taxonomy' claim as written. The authors should either include an explicit white-box/gray-box dim
[Table 2 and Appendix A] The benchmark dataset statistics are contradictory and contain clear errors. Table 2 lists Reddit as 232,965 nodes and 57,307,946 edges, while Appendix A.2 says 'over 50,000 nodes and over 860,000 edges.' LastFM is 7,083 nodes/25,814 edges in Table 2 but 7,624 nodes/27,806 edges in Appendix A.2. Computers is 245,861 edges in Table 2 but 287,209 edges in Appendix A.4. The column header '(Avg.) #Nodes' mixes aggregate and average counts across rows: MUTAG and NCI1 give averages, while Cora, Citeseer, and Reddit give totals. The AIDS row reports 31,385 nodes and 64,780 edges while Appendix A.3 says the dataset comprises 43,467 compounds (graphs). Because systematic dataset characterization is one of the paper's stated contributions, these inconsistencies must be corrected and the table/appendix aligned.
[Abstract, §1, §3] The claim of 'the first comprehensive taxonomy' is stronger than what is currently supported. The paper does not state the inclusion/exclusion criteria used to select literature, nor does it compare the proposed four-category partition with existing IP-protection taxonomies for deep learning (e.g., [18], [79], [80]). As noted above, the taxonomy is also applied inconsistently with respect to white-box methods. The authors should either substantiate the 'first/comprehensive' claim through a defined literature search and explicit comparison with prior taxonomies, or soften the claim and describe the taxonomy as a structured organization of the black-box GML IP-protection literature.

minor comments (5)

[§2.1] The notation is inconsistent: G is defined as (V, A, X) with V ∈ R^n, but V is later called the node set; E is introduced but not used in the graph tuple. Please clarify.
[Fig. 2] The 'Differential Privacy' entry under Data-Level Defense has a dangling citation '[?]' and no reference number. This should be fixed.
[§6.1, Table 2] The text uses 'NCT1 & NCI109' while Table 2 uses 'NCI1'; also 'Tmall' appears in Table 2 but is not discussed in Section 6.1. Please unify names and descriptions.
[§1, §6.1, Fig. 4, Fig. 7] Several typos remain: 'prortective' (§1), 'acadeMInvA' (§6.1), 'Legismate' (Fig. 4 caption), and 'Distutbances' (Fig. 7 caption). A careful proofread is needed.
[§1, §8] PyGIP is a highlighted contribution, but the manuscript gives no list of implemented methods, module structure, or compatibility details. A brief appendix or link summary would help readers judge the library's coverage.

Circularity Check

0 steps flagged · score 1.0 of 10

No material circularity: the survey's taxonomy is an organizational structure grounded in independent literature, and its self-citations are auxiliary rather than load-bearing.

full rationale

This is a survey/taxonomy paper rather than a derivation chain, so the classic circularity patterns (fitted input called prediction, self-definitional equations, uniqueness theorem imported from authors, ansatz smuggled via citation) do not apply. The Section 3 taxonomy is defined by mechanism, goal, function, and scenario, and its four top-level categories are supported by numerous independent primary references (e.g., [43], [53], [57], [112], [134], [161]); no category is defined in terms of the authors' own prior results. Self-citations do appear (e.g., [51] for an early GNN model-extraction framework, [108] for ATOM, [181] for evaluation criteria), but they are cited as representative methods or as one of several references for standard metrics, not as the justification for the central taxonomy or the evaluation framework. The paper contains no fitted parameters and makes no quantitative prediction that would reduce to an input. The main defect identified by a skeptical reading is an internal-scope inconsistency: Section 4.1.1 states 'we focus exclusively on this setting in our discussion' after limiting model-level attacks to black-box access, Section 4.2.2 says 'we consider these attacks exclusively under the black-box setting,' yet the same section covers FedGIG [137] and gradient-inversion attacks [173], and Section 5.1.2 includes GrOVe [125], a white-box fingerprinting defense. This is a consistency/completeness concern about the 'first comprehensive taxonomy' claim, not a circularity reduction, and it does not raise the circularity score under the hard rules.

Assumptions & free parameters 0 free parameters · 3 assumptions · 0 invented entities

No free parameters or invented entities apply because the paper is a survey. The load-bearing assumptions are domain choices about the threat model, the completeness of the taxonomy, and the accuracy of dataset descriptions.

assumptions (3)

domain assumption The GMLaaS black-box threat model adequately captures the majority of real-world GML IP protection scenarios.
Section 4.1.1 says 'we focus exclusively on this setting in our discussion' for model-level attacks, and Section 4.2.1 similarly restricts data-level attacks to black-box settings. The taxonomy is built on this restriction.
ad hoc to paper Existing GML IP protection literature can be partitioned into the four top-level categories: model-level attacks, model-level defenses, data-level attacks, and data-level defenses.
Section 3 defines this taxonomy as an organizational choice. No proof of exhaustiveness or mutual exclusivity is provided, and the paper does not map alternative taxonomies from prior work to this one.
domain assumption The benchmark dataset statistics in Table 2 are accurate representations of the original datasets.
Section 6 relies on Table 2 to characterize the benchmark landscape. The paper provides no pipeline or checksums to verify these statistics, and some entries are internally inconsistent, such as the Reddit counts.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Intellectual Property in Graph-Based Machine Learning as a Service: Attacks and Defenses." pith.science (2026). https://pith.science/paper/PH3WTNU7

@misc{pith2026250819641,
  author       = {Pith},
  title        = {Pith review of: Intellectual Property in Graph-Based Machine Learning as a Service: Attacks and Defenses},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/PH3WTNU7}},
  note         = {Machine review of arXiv:2508.19641}
}

read the original abstract

Graph-structured data, which captures non-Euclidean relationships and interactions between entities, is growing in scale and complexity. As a result, training state-of-the-art graph machine learning (GML) models have become increasingly resource-intensive, turning these models and data into invaluable Intellectual Property (IP). To address the resource-intensive nature of model training, graph-based Machine-Learning-as-a-Service (GMLaaS) has emerged as an efficient solution by leveraging third-party cloud services for model development and management. However, deploying such models in GMLaaS also exposes them to potential threats from attackers. Specifically, while the APIs within a GMLaaS system provide interfaces for users to query the model and receive outputs, they also allow attackers to exploit and steal model functionalities or sensitive training data, posing severe threats to the safety of these GML models and the underlying graph data. To address these challenges, this survey systematically introduces the first taxonomy of threats and defenses at the level of both GML model and graph-structured data. Such a tailored taxonomy facilitates an in-depth understanding of GML IP protection. Furthermore, we present a systematic evaluation framework to assess the effectiveness of IP protection methods, introduce a curated set of benchmark datasets across various domains, and discuss their application scopes and future challenges. Finally, we establish an open-sourced versatile library named PyGIP, which evaluates various attack and defense techniques in GMLaaS scenarios and facilitates the implementation of existing benchmark methods. The library resource can be accessed at: https://labrai.github.io/PyGIP. We believe this survey will play a fundamental role in intellectual property protection for GML and provide practical recipes for the GML community.

Figures

Figures reproduced from arXiv: 2508.19641 by the authors.

**Figure 2.** Illustration of the Comprehensive Taxonomy of Graph Learning IP Protection Methodologies. [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗

**Figure 3.** Overview of watermarking verification workflow. [PITH_FULL_IMAGE:figures/full_fig_p011_3.png] view at source ↗

Figures from the paper (7 more)

**Figure 4.** Figure 4: The primary goal of Fingerprinting is to guarantee [PITH_FULL_IMAGE:figures/full_fig_p011_4.png]

**Figure 4.** Figure 4: The workflow of fingerprinting, including active authorization control and users’ identities verification. Each [PITH_FULL_IMAGE:figures/full_fig_p012_4.png]

**Figure 5.** Figure 5: The paradigm of model-level adversarial training [PITH_FULL_IMAGE:figures/full_fig_p013_5.png]

**Figure 6.** Figure 6: The general procedure paradigm of differential pri [PITH_FULL_IMAGE:figures/full_fig_p014_6.png]

**Figure 7.** Figure 7: The paradigm of data-level adversarial training de [PITH_FULL_IMAGE:figures/full_fig_p015_7.png]

**Figure 8.** Figure 8: The graph is perturbed by deleting an edge and [PITH_FULL_IMAGE:figures/full_fig_p016_8.png]

**Figure 9.** Figure 9: The general procedure of knowledge distillation defense for graph machine learning models. [PITH_FULL_IMAGE:figures/full_fig_p018_9.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

247 extracted references · 45 canonical work pages

[137]

FedGIG: Graph Inversion from Gradient in Federated Learning

T. Xiao, Y. Li, Y. Qi, H. Wang, and R. Li, “Fedgig: Graph inversion from gradient in federated learning,” arXiv preprint arXiv:2412.18513, 2024

work page Pith review arXiv 2024
[173]

Gradient inversion attack on graph neural networks,

D. A. Sinha, Y. Liu, R. Du, and Y. Shen, “Gradient inversion attack on graph neural networks,” arXiv preprint arXiv:2411.19440, 2024

arXiv 2024
[125]

Grove: Ownership ver- ification of graph neural networks using embeddings,

A. Waheed, V . Duddu, and N. Asokan, “Grove: Ownership ver- ification of graph neural networks using embeddings,” in 2024 IEEE Symposium on Security and Privacy (SP), 2024, pp. 2460–2477

2024
[18]

Intellectual property protection of dnn models,

S. Peng, Y. Chen, J. Xu, Z. Chen, C. Wang, and X. Jia, “Intellectual property protection of dnn models,” World Wide Web , vol. 26, no. 4, pp. 1877–1911, 2023

1911
[79]

Intellectual property pro- tection for deep learning models: Taxonomy, methods, attacks, and evaluations,

M. Xue, Y. Zhang, J. Wang, and W. Liu, “Intellectual property pro- tection for deep learning models: Taxonomy, methods, attacks, and evaluations,” IEEE Transactions on Artificial Intelligence, vol. 3, no. 6, pp. 908–923, 2021

2021
[80]

Deep intellectual property protection: A survey,

Y. Sun, T. Liu, P . Hu, Q. Liao, S. Fu, N. Yu, D. Guo, Y. Liu, and L. Liu, “Deep intellectual property protection: A survey,” arXiv preprint arXiv:2304.14613, 2023

arXiv 2023
[1]

Cross- links matter for link prediction: rethinking the debiased gnn from a data perspective,

Z. Luo, H. Huang, J. Lian, X. Song, X. Xie, and H. Jin, “Cross- links matter for link prediction: rethinking the debiased gnn from a data perspective,” Advances in Neural Information Processing Systems, vol. 36, 2024

2024
[2]

A Topological Perspective on Demystifying GNN-Based Link Prediction Performance

Y. Wang, T. Zhao, Y. Zhao, Y. Liu, X. Cheng, N. Shah, and T. Derr, “A topological perspective on demystifying gnn-based link prediction performance,” arXiv preprint arXiv:2310.04612 , 2023

work page Pith review arXiv 2023

Show all 247 references

[3]

Page-link: Path-based graph neural network expla- nation for heterogeneous link prediction,

S. Zhang, J. Zhang, X. Song, S. Adeshina, D. Zheng, C. Faloutsos, and Y. Sun, “Page-link: Path-based graph neural network expla- nation for heterogeneous link prediction,” in Proceedings of the ACM Web Conference 2023, 2023, pp. 3784–3793

2023
[4]

Contrastive attributed network anomaly detection with data augmentation,

Z. Xu, X. Huang, Y. Zhao, Y. Dong, and J. Li, “Contrastive attributed network anomaly detection with data augmentation,” in Pacific-Asia conference on knowledge discovery and data mining . Springer, 2022, pp. 444–457

2022
[5]

Adbench: Anomaly detection benchmark,

S. Han, X. Hu, H. Huang, M. Jiang, and Y. Zhao, “Adbench: Anomaly detection benchmark,” Advances in Neural Information Processing Systems, vol. 35, pp. 32 142–32 159, 2022

2022
[6]

Few-shot network anomaly detection via cross-network meta-learning,

K. Ding, Q. Zhou, H. Tong, and H. Liu, “Few-shot network anomaly detection via cross-network meta-learning,” in Proceed- ings of the Web Conference 2021, 2021, pp. 2448–2456

2021
[7]

Graph wavenet for deep spatial-temporal graph modeling,

Z. Wu, S. Pan, G. Long, J. Jiang, and C. Zhang, “Graph wavenet for deep spatial-temporal graph modeling,” arXiv preprint arXiv:1906.00121, 2019

1906 arXiv
[8]

Pre-training enhanced spatial-temporal graph neural network for multivariate time series forecasting,

Z. Shao, Z. Zhang, F. Wang, and Y. Xu, “Pre-training enhanced spatial-temporal graph neural network for multivariate time series forecasting,” in Proceedings of the 28th ACM SIGKDD confer- ence on knowledge discovery and data mining , 2022, pp. 1567–1577

2022
[9]

Adaptive graph convolutional recurrent network for traffic forecasting,

L. Bai, L. Yao, C. Li, X. Wang, and C. Wang, “Adaptive graph convolutional recurrent network for traffic forecasting,” Advances in neural information processing systems , vol. 33, pp. 17 804–17 815, 2020

2020
[10]

Dgrec: Graph neural network for recommendation with diver- sified embedding generation,

L. Yang, S. Wang, Y. Tao, J. Sun, X. Liu, P . S. Yu, and T. Wang, “Dgrec: Graph neural network for recommendation with diver- sified embedding generation,” in Proceedings of the sixteenth ACM international conference on web search and data mining , 2023, pp. 661–669

2023
[11]

Distributionally robust graph-based recommen- dation system,

B. Wang, J. Chen, C. Li, S. Zhou, Q. Shi, Y. Gao, Y. Feng, C. Chen, and C. Wang, “Distributionally robust graph-based recommen- dation system,” in Proceedings of the ACM on Web Conference 2024, 2024, pp. 3777–3788

2024
[12]

Disease prediction via graph neural networks,

Z. Sun, H. Yin, H. Chen, T. Chen, L. Cui, and F. Yang, “Disease prediction via graph neural networks,” IEEE Journal of Biomedical and Health Informatics, vol. 25, no. 3, pp. 818–826, 2020

2020
[13]

Learning the graphical structure of electronic health records with graph convolutional transformer,

E. Choi, Z. Xu, Y. Li, M. Dusenberry, G. Flores, E. Xue, and A. Dai, “Learning the graphical structure of electronic health records with graph convolutional transformer,” inProceedings of the AAAI conference on artificial intelligence, vol. 34, no. 01, 2020, pp. 606–613. IEEE ...

2020
[14]

Map-adaptive multimodal trajectory prediction using hierarchical graph neural networks,

X. Mo, Y. Xing, H. Liu, and C. Lv, “Map-adaptive multimodal trajectory prediction using hierarchical graph neural networks,” IEEE Robotics and Automation Letters , vol. 8, no. 6, pp. 3685–3692, 2023

2023
[15]

Graph relational reinforcement learning for mobile robot navigation in large-scale crowded environments,

Z. Liu, Y. Zhai, J. Li, G. Wang, Y. Miao, and H. Wang, “Graph relational reinforcement learning for mobile robot navigation in large-scale crowded environments,” IEEE Transactions on Intelli- gent Transportation Systems, vol. 24, no. 8, pp. 8776–8787, 2023

2023
[16]

Gnn at the edge: Cost-efficient graph neural network processing over distributed edge servers,

L. Zeng, C. Yang, P . Huang, Z. Zhou, S. Yu, and X. Chen, “Gnn at the edge: Cost-efficient graph neural network processing over distributed edge servers,” IEEE Journal on Selected Areas in Communications, vol. 41, no. 3, pp. 720–739, 2022

2022
[17]

Machine learning as a service: Challenges in research and applications,

R. Philipp, A. Mladenow, C. Strauss, and A. V ¨olz, “Machine learning as a service: Challenges in research and applications,” in Proceedings of the 22nd International Conference on Information Integration and Web-based Applications & Services , 2020, pp. 396– 406

2020
[19]

Protecting intellectual property of language generation apis with lexical watermark,

X. He, Q. Xu, L. Lyu, F. Wu, and C. Wang, “Protecting intellectual property of language generation apis with lexical watermark,” in Proceedings of the AAAI Conference on Artificial Intelligence , vol. 36, no. 10, 2022, pp. 10 758–10 766

2022
[20]

Hardware- assisted intellectual property protection of deep learning mod- els,

A. Chakraborty, A. Mondai, and A. Srivastava, “Hardware- assisted intellectual property protection of deep learning mod- els,” in 2020 57th ACM/IEEE Design Automation Conference (DAC), 2020, pp. 1–6

2020
[21]

Secgnn: Privacy-preserving graph neural network training and inference as a cloud service,

S. Wang, Y. Zheng, and X. Jia, “Secgnn: Privacy-preserving graph neural network training and inference as a cloud service,” IEEE Transactions on Services Computing , vol. 16, no. 4, pp. 2923–2938, 2023

2023
[22]

Ch- iron: Privacy-preserving machine learning as a service,

T. Hunt, C. Song, R. Shokri, V . Shmatikov, and E. Witchel, “Ch- iron: Privacy-preserving machine learning as a service,” arXiv preprint arXiv:1803.05961, 2018

2018 arXiv
[23]

Veriml: Enabling integrity assurances and fair payments for machine learning as a service,

L. Zhao, Q. Wang, C. Wang, Q. Li, C. Shen, and B. Feng, “Veriml: Enabling integrity assurances and fair payments for machine learning as a service,” IEEE Transactions on Parallel and Distributed Systems, vol. 32, no. 10, pp. 2524–2540, 2021

2021
[24]

Privacy- preserving deep learning on machine learning as a service—a comprehensive survey,

H. C. Tanuwidjaja, R. Choi, S. Baek, and K. Kim, “Privacy- preserving deep learning on machine learning as a service—a comprehensive survey,” IEEE Access, vol. 8, pp. 167 425–167 447, 2020

2020
[25]

Model extraction attacks revisited,

J. Liang, R. Pang, C. Li, and T. Wang, “Model extraction attacks revisited,” in Proceedings of the 19th ACM Asia Conference on Computer and Communications Security, 2024, pp. 1231–1245

2024
[26]

Model extraction warning in mlaas paradigm,

M. Kesarwani, B. Mukhoty, V . Arya, and S. Mehta, “Model extraction warning in mlaas paradigm,” in Proceedings of the 34th Annual Computer Security Applications Conference , 2018, pp. 371– 380

2018
[27]

Learn what you want to unlearn: Unlearning inversion attacks against machine unlearn- ing,

H. Hu, S. Wang, T. Dong, and M. Xue, “Learn what you want to unlearn: Unlearning inversion attacks against machine unlearn- ing,” arXiv preprint arXiv:2404.03233, 2024

2024 arXiv
[28]

Cloud-driven machine learning with aws: A comprehensive review of services,

M. K. Ravindranathan, D. S. Vadivu, and N. Rajagopalan, “Cloud-driven machine learning with aws: A comprehensive review of services,” in 2024 International Conference on Intelligent and Innovative Technologies in Computing, Electrical and Electronics (IITCEE), 2024, pp. 1–8

2024
[29]

Machine learning as a service cloud selection: An mcdm approach for optimal decision making,

S. G. Bhol, S. Mohanty, and P . K. Pattnaik, “Machine learning as a service cloud selection: An mcdm approach for optimal decision making,” Procedia Computer Science, vol. 233, pp. 909–918, 2024

2024
[30]

Cat-gnn: Enhancing credit card fraud detection via causal temporal graph neural networks,

Y. Duan, G. Zhang, S. Wang, X. Peng, W. Ziqi, J. Mao, H. Wu, X. Jiang, and K. Wang, “Cat-gnn: Enhancing credit card fraud detection via causal temporal graph neural networks,” arXiv preprint arXiv:2402.14708, 2024

2024 arXiv
[31]

Internet financial fraud detection based on graph learning,

R. Li, Z. Liu, Y. Ma, D. Yang, and S. Sun, “Internet financial fraud detection based on graph learning,” IEEE Transactions on Computational Social Systems, vol. 10, no. 3, pp. 1394–1401, 2022

2022
[32]

Finsformer: A novel approach to detecting financial attacks using transformer and cluster-attention,

H. An, R. Ma, Y. Yan, T. Chen, Y. Zhao, P . Li, J. Li, X. Wang, D. Fan, and C. Lv, “Finsformer: A novel approach to detecting financial attacks using transformer and cluster-attention,” Applied Sciences, vol. 14, no. 1, p. 460, 2024

2024
[33]

A survey on model extraction attacks and defenses for large language models,

K. Zhao, L. Li, K. Ding, N. Z. Gong, Y. Zhao, and Y. Dong, “A survey on model extraction attacks and defenses for large language models,” arXiv preprint arXiv:2506.22521, 2025

2025 arXiv
[34]

Scn gnn: A gnn-based fraud detection algorithm combining strong node and graph topology information,

J. Chen, Q. Chen, F. Jiang, X. Guo, K. Sha, and Y. Wang, “Scn gnn: A gnn-based fraud detection algorithm combining strong node and graph topology information,” Expert Systems with Applica- tions, vol. 237, p. 121643, 2024

2024
[35]

Exploiting explanations for model inversion attacks,

X. Zhao, W. Zhang, X. Xiao, and B. Lim, “Exploiting explanations for model inversion attacks,” in Proceedings of the IEEE/CVF international conference on computer vision, 2021, pp. 682–692

2021
[36]

Gradient mechanism to pre- serve differential privacy and deter against model inversion attacks in healthcare analytics,

A. Krall, D. Finke, and H. Yang, “Gradient mechanism to pre- serve differential privacy and deter against model inversion attacks in healthcare analytics,” in 2020 42nd Annual International Conference of the IEEE Engineering in Medicine & Biology Society (EMBC), 2020, pp. 5714–5717

2020
[37]

Towards electronic health record-based medical knowledge graph construction, completion, and applications: A literature study,

L. Murali, G. Gopakumar, D. M. Viswanathan, and P . Nedungadi, “Towards electronic health record-based medical knowledge graph construction, completion, and applications: A literature study,” Journal of biomedical informatics, vol. 143, p. 104403, 2023

2023
[38]

Deepnote-gnn: predicting hospital readmission using clinical notes and patient network,

S. N. Golmaei and X. Luo, “Deepnote-gnn: predicting hospital readmission using clinical notes and patient network,” in Pro- ceedings of the 12th ACM International Conference on Bioinformatics, Computational Biology, and Health Informatics, 2021, pp. 1–9

2021
[39]

How to cover up anomalous accesses to electronic health records,

X. Xu, Q. Hao, Z. Yang, B. Li, D. Liebovitz, G. Wang, and C. A. Gunter, “How to cover up anomalous accesses to electronic health records,” in 32nd USENIX Security Symposium (USENIX Security 23), 2023, pp. 229–246

2023
[40]

A systematic review of graph neural network in healthcare- based applications: Recent advances, trends, and future direc- tions,

S. G. Paul, A. Saha, M. Z. Hasan, S. R. H. Noori, and A. Moustafa, “A systematic review of graph neural network in healthcare- based applications: Recent advances, trends, and future direc- tions,” IEEE Access, vol. 12, pp. 15 145–15 170, 2024

2024
[41]

I know what you trained last summer: A survey on stealing machine learning models and defences,

D. Oliynyk, R. Mayer, and A. Rauber, “I know what you trained last summer: A survey on stealing machine learning models and defences,” ACM Computing Surveys , vol. 55, no. 14s, pp. 1–41, 2023

2023
[42]

Model extraction attacks and defenses on cloud-based machine learning models,

X. Gong, Q. Wang, Y. Chen, W. Yang, and X. Jiang, “Model extraction attacks and defenses on cloud-based machine learning models,” IEEE Communications Magazine , vol. 58, no. 12, pp. 83– 89, 2020

2020
[43]

Adversarial attack and defense on graph data: A survey,

L. Sun, Y. Dou, C. Yang, K. Zhang, J. Wang, S. Y. Philip, L. He, and B. Li, “Adversarial attack and defense on graph data: A survey,” IEEE Transactions on Knowledge and Data Engineering, vol. 35, no. 8, pp. 7693–7711, 2022

2022
[44]

Privacy leakage on dnns: A sur- vey of model inversion attacks and defenses,

H. Fang, Y. Qiu, H. Yu, W. Yu, J. Kong, B. Chong, B. Chen, X. Wang, and S.-T. Xia, “Privacy leakage on dnns: A sur- vey of model inversion attacks and defenses,” arXiv preprint arXiv:2402.04013, 2024

2024 arXiv
[45]

Stealing machine learning models via prediction {APIs},

F. Tram `er, F. Zhang, A. Juels, M. K. Reiter, and T. Ristenpart, “Stealing machine learning models via prediction {APIs},” in 25th USENIX security symposium (USENIX Security 16) , 2016, pp. 601–618

2016
[46]

Model reconstruction from model explanations,

S. Milli, L. Schmidt, A. D. Dragan, and M. Hardt, “Model reconstruction from model explanations,” in Proceedings of the Conference on Fairness, Accountability, and Transparency , 2019, pp. 1–9

2019
[47]

Knockoff nets: Stealing functionality of black-box models,

T. Orekondy, B. Schiele, and M. Fritz, “Knockoff nets: Stealing functionality of black-box models,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , 2019, pp. 4954–4963

2019
[49]

Adversarial model extraction on graph neural networks,

D. DeFazio and A. Ramesh, “Adversarial model extraction on graph neural networks,” arXiv preprint arXiv:1912.07721, 2019

1912 arXiv
[50]

Model stealing attacks against inductive graph neural networks,

Y. Shen, X. He, Y. Han, and Y. Zhang, “Model stealing attacks against inductive graph neural networks,” in 2022 IEEE Sympo- sium on Security and Privacy (SP) , 2022, pp. 1175–1192

2022
[51]

Model extraction at- tacks on graph neural networks: Taxonomy and realisation,

B. Wu, X. Yang, S. Pan, and X. Yuan, “Model extraction at- tacks on graph neural networks: Taxonomy and realisation,” in Proceedings of the 2022 ACM on Asia conference on computer and communications security, 2022, pp. 337–350

2022
[52]

Knowledge-enhanced black-box attacks for recommendations,

J. Chen, W. Fan, G. Zhu, X. Zhao, C. Yuan, Q. Li, and Y. Huang, “Knowledge-enhanced black-box attacks for recommendations,” in Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, 2022, pp. 108–117

2022
[53]

Unveiling the secrets without data: Can graph neural networks be exploited through {Data-Free} model extraction attacks?

Y. Zhuang, C. Shi, M. Zhang, J. Chen, L. Lyu, P . Zhou, and L. Sun, “Unveiling the secrets without data: Can graph neural networks be exploited through {Data-Free} model extraction attacks?” in 33rd USENIX Security Symposium (USENIX Security 24), 2024, pp. 5251–5268

2024
[54]

A comprehensive survey of privacy- preserving federated learning: A taxonomy, review, and future IEEE TRANSACTIONS ON KNOWLEDGE AND DATA ENGINEERING 24 directions,

X. Yin, Y. Zhu, and J. Hu, “A comprehensive survey of privacy- preserving federated learning: A taxonomy, review, and future IEEE TRANSACTIONS ON KNOWLEDGE AND DATA ENGINEERING 24 directions,” ACM Computing Surveys (CSUR) , vol. 54, no. 6, pp. 1–36, 2021

2021
[55]

Model inversion attacks that exploit confidence information and basic countermeasures,

M. Fredrikson, S. Jha, and T. Ristenpart, “Model inversion attacks that exploit confidence information and basic countermeasures,” in Proceedings of the 22nd ACM SIGSAC conference on computer and communications security, 2015, pp. 1322–1333

2015
[56]

Group property inference attacks against graph neural networks,

X. Wang and W. H. Wang, “Group property inference attacks against graph neural networks,” in Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security , 2022, pp. 2871–2884

2022
[57]

Model inversion attacks against graph neural networks,

Z. Zhang, Q. Liu, Z. Huang, H. Wang, C.-K. Lee, and E. Chen, “Model inversion attacks against graph neural networks,” IEEE Transactions on Knowledge and Data Engineering, 2022

2022
[58]

Graphmi: Extracting private graph data from graph neural networks,

Z. Zhang, Q. Liu, Z. Huang, H. Wang, C. Lu, C. Liu, and E. Chen, “Graphmi: Extracting private graph data from graph neural networks,” arXiv preprint arXiv:2106.02820, 2021

2021 arXiv
[59]

Model inversion attacks on homogeneous and heterogeneous graph neural networks,

R. Liu, W. Zhou, J. Zhang, X. Liu, P . Si, and H. Li, “Model inversion attacks on homogeneous and heterogeneous graph neural networks,” arXiv preprint arXiv:2310.09800, 2023

2023 arXiv
[60]

Gamin: An adversar- ial approach to black-box model inversion,

U. A ¨ıvodji, S. Gambs, and T. Ther, “Gamin: An adversar- ial approach to black-box model inversion,” arXiv preprint arXiv:1909.11835, 2019

1909 arXiv
[61]

Digital rights management and wa- termarking of multimedia content for m-commerce applications,

F. Hartung and F. Ramme, “Digital rights management and wa- termarking of multimedia content for m-commerce applications,” IEEE communications magazine, vol. 38, no. 11, pp. 78–84, 2000

2000
[62]

Pregip: Watermarking the pre- training of graph neural networks for deep intellectual property protection,

E. Dai, M. Lin, and S. Wang, “Pregip: Watermarking the pre- training of graph neural networks for deep intellectual property protection,” arXiv preprint arXiv:2402.04435, 2024

2024 arXiv
[63]

Watermarking graph neural networks based on backdoor attacks,

J. Xu, S. Koffas, O. Ersoy, and S. Picek, “Watermarking graph neural networks based on backdoor attacks,” in 2023 IEEE 8th European Symposium on Security and Privacy (EuroS&P) , 2023, pp. 1179–1197

2023
[64]

Transferable watermarking to self-supervised pre-trained graph encoders by trigger embed- dings,

X. Zhao, H. Wu, and X. Zhang, “Transferable watermarking to self-supervised pre-trained graph encoders by trigger embed- dings,” arXiv preprint arXiv:2406.13177, 2024

2024 arXiv
[65]

Gnnfingers: A fingerprinting framework for verifying ownerships of graph neural networks,

X. You, Y. Jiang, J. Xu, M. Zhang, and M. Yang, “Gnnfingers: A fingerprinting framework for verifying ownerships of graph neural networks,” in Proceedings of the ACM on Web Conference 2024, 2024, pp. 652–663

2024
[66]

Gnnguard: A finger- printing framework for verifying ownerships of graph neural networks,

X. You, Y. Jiang, J. Xu, and M. Zhang, “Gnnguard: A finger- printing framework for verifying ownerships of graph neural networks,” in The Web Conference 2024, 2024

2024
[67]

Smoothing adversarial training for gnn,

J. Chen, X. Lin, H. Xiong, Y. Wu, H. Zheng, and Q. Xuan, “Smoothing adversarial training for gnn,” IEEE Transactions on Computational Social Systems, vol. 8, no. 3, pp. 618–629, 2020

2020
[69]

Sok: Differential privacy on graph-structured data,

T. T. Mueller, D. Usynin, J. C. Paetzold, D. Rueckert, and G. Kaissis, “Sok: Differential privacy on graph-structured data,” arXiv preprint arXiv:2203.09205, 2022

2022 arXiv
[70]

Netfense: Adversarial defenses against privacy attacks on neural networks for graph data,

I.-C. Hsieh and C.-T. Li, “Netfense: Adversarial defenses against privacy attacks on neural networks for graph data,”IEEE Transac- tions on Knowledge and Data Engineering, vol. 35, no. 1, pp. 796–809, 2021

2021
[71]

Gnnguard: Defending graph neural networks against adversarial attacks,

X. Zhang and M. Zitnik, “Gnnguard: Defending graph neural networks against adversarial attacks,” Advances in neural informa- tion processing systems, vol. 33, pp. 9263–9275, 2020

2020
[72]

A comprehensive survey on trustworthy graph neu- ral networks: Privacy, robustness, fairness, and explainability,

E. Dai, T. Zhao, H. Zhu, J. Xu, Z. Guo, H. Liu, J. Tang, and S. Wang, “A comprehensive survey on trustworthy graph neu- ral networks: Privacy, robustness, fairness, and explainability,” Machine Intelligence Research, pp. 1–51, 2024

2024
[73]

Trustworthy graph learning: Reliability, explainability, and privacy protection,

B. Wu, Y. Bian, H. Zhang, J. Li, J. Yu, L. Chen, C. Chen, and J. Huang, “Trustworthy graph learning: Reliability, explainability, and privacy protection,” in Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining , 2022, pp. 4838–4839

2022
[74]

Trustwor- thy graph neural networks: Aspects, methods and trends,

H. Zhang, B. Wu, X. Yuan, S. Pan, H. Tong, and J. Pei, “Trustwor- thy graph neural networks: Aspects, methods and trends,” arXiv preprint arXiv:2205.07424, 2022

2022 arXiv
[75]

Trustworthy graph learning: Reliability, explainability, and privacy protection,

B. Wu, Y. Bian, H. Zhang, J. Li, J. Yu, L. Chen, C. Chen, and J. Huang, “Trustworthy graph learning: Reliability, explainability, and privacy protection,” in Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining , 2022, p. 4838–4839

2022
[76]

A review of adversarial attacks and defenses on graphs,

H. Sun, W. Yang, and Y. Xiao, “A review of adversarial attacks and defenses on graphs,” in Proceedings of the 4th International Conference on Artificial Intelligence and Computer Engineering, 2024, p. 416–421

2024
[77]

Graph robustness benchmark: Benchmarking the adversarial robustness of graph machine learning,

Q. Zheng, X. Zou, Y. Dong, Y. Cen, D. Yin, J. Xu, Y. Yang, and J. Tang, “Graph robustness benchmark: Benchmarking the adversarial robustness of graph machine learning,” in Thirty-fifth Conference on Neural Information Processing Systems Datasets and Benchmarks Track, 2021

2021
[78]

Adversarial attack and defense on graph data: A survey,

L. Sun, Y. Dou, C. Yang, K. Zhang, J. Wang, P . S. Yu, L. He, and B. Li, “Adversarial attack and defense on graph data: A survey,” IEEE Transactions on Knowledge and Data Engineering, vol. 35, no. 8, pp. 7693–7711, 2023

2023
[81]

A survey of graph neural networks in real world: Imbalance, noise, privacy and ood challenges,

W. Ju, S. Yi, Y. Wang, Z. Xiao, Z. Mao, H. Li, Y. Gu, Y. Qin, N. Yin, S. Wang et al. , “A survey of graph neural networks in real world: Imbalance, noise, privacy and ood challenges,” arXiv preprint arXiv:2403.04468, 2024

2024
[82]

A machine learning-based approach to identify unlawful practices in online terms of service: analysis, implementation and eval- uation,

A. Guarino, N. Lettieri, D. Malandrino, and R. Zaccagnino, “A machine learning-based approach to identify unlawful practices in online terms of service: analysis, implementation and eval- uation,” Neural Computing and Applications , vol. 33, pp. 17 569– 17 587, 2021

2021
[83]

Simplifying graph convolutional networks,

F. Wu, A. Souza, T. Zhang, C. Fifty, T. Yu, and K. Weinberger, “Simplifying graph convolutional networks,” in International con- ference on machine learning, 2019, pp. 6861–6871

2019
[84]

Inductive representation learning on large graphs,

W. Hamilton, Z. Ying, and J. Leskovec, “Inductive representation learning on large graphs,” Advances in neural information process- ing systems, vol. 30, 2017

2017
[85]

Graph attention networks,

P . Veli ˇckovi´c, G. Cucurull, A. Casanova, A. Romero, P . Lio, and Y. Bengio, “Graph attention networks,” arXiv preprint arXiv:1710.10903, 2017

2017 arXiv
[86]

How powerful are graph neural networks?

K. Xu, W. Hu, J. Leskovec, and S. Jegelka, “How powerful are graph neural networks?” arXiv preprint arXiv:1810.00826, 2018

2018 arXiv
[87]

node2vec: Scalable feature learning for networks,

A. Grover and J. Leskovec, “node2vec: Scalable feature learning for networks,” in Proceedings of the 22nd ACM SIGKDD interna- tional conference on Knowledge discovery and data mining , 2016, pp. 855–864

2016
[88]

Heterogeneous graph neural network,

C. Zhang, D. Song, C. Huang, A. Swami, and N. V . Chawla, “Heterogeneous graph neural network,” in Proceedings of the 25th ACM SIGKDD international conference on knowledge discovery & data mining, 2019, pp. 793–803

2019
[89]

Cega: A cost-effective approach for graph-based model extraction and acquisition,

Z. Wang, M. Lin, B. Shen, K. Anderson, M. Liu, T. Cai, and Y. Dong, “Cega: A cost-effective approach for graph-based model extraction and acquisition,” arXiv preprint arXiv:2506.17709, 2025

2025 arXiv
[90]

Estimat- ing node importance in knowledge graphs using graph neural networks,

N. Park, A. Kan, X. L. Dong, T. Zhao, and C. Faloutsos, “Estimat- ing node importance in knowledge graphs using graph neural networks,” in Proceedings of the 25th ACM SIGKDD international conference on knowledge discovery & data mining, 2019, pp. 596–606

2019
[91]

Residual correlation in graph neural network regression,

J. Jia and A. R. Benson, “Residual correlation in graph neural network regression,” in Proceedings of the 26th ACM SIGKDD international conference on knowledge discovery & data mining , 2020, pp. 588–598

2020
[92]

Spectral clustering with graph neural networks for graph pooling,

F. M. Bianchi, D. Grattarola, and C. Alippi, “Spectral clustering with graph neural networks for graph pooling,” in Proceedings of the 37th International Conference on Machine Learning , 2020, pp. 874–883

2020
[93]

Graph clus- tering with graph neural networks,

A. Tsitsulin, J. Palowitch, B. Perozzi, and E. M ¨uller, “Graph clus- tering with graph neural networks,” Journal of Machine Learning Research, vol. 24, no. 127, pp. 1–21, 2023

2023
[94]

Position-aware graph neural networks,

J. You, R. Ying, and J. Leskovec, “Position-aware graph neural networks,” in International conference on machine learning. PMLR, 2019, pp. 7134–7143

2019
[95]

Iterative deep graph learning for graph neural networks: Better and robust node embeddings,

Y. Chen, L. Wu, and M. Zaki, “Iterative deep graph learning for graph neural networks: Better and robust node embeddings,” Advances in neural information processing systems , vol. 33, pp. 19 314–19 326, 2020

2020
[96]

Link prediction based on graph neu- ral networks,

M. Zhang and Y. Chen, “Link prediction based on graph neu- ral networks,” Advances in neural information processing systems , vol. 31, 2018. IEEE TRANSACTIONS ON KNOWLEDGE AND DATA ENGINEERING 25

2018
[97]

Graph convolutional neural networks for web-scale recommender systems,

R. Ying, R. He, K. Chen, P . Eksombatchai, W. L. Hamilton, and J. Leskovec, “Graph convolutional neural networks for web-scale recommender systems,” in Proceedings of the 24th ACM SIGKDD international conference on knowledge discovery & data mining , 2018, pp. 974–983

2018
[98]

Dual subgraph-based graph neural network for friendship prediction in location-based social networks,

X. Wei, Y. Liu, J. Sun, Y. Jiang, Q. Tang, and K. Yuan, “Dual subgraph-based graph neural network for friendship prediction in location-based social networks,” ACM Transactions on Knowl- edge Discovery from Data, vol. 17, no. 3, pp. 1–28, 2023

2023
[99]

A comprehensive survey on graph neural networks,

Z. Wu, S. Pan, F. Chen, G. Long, C. Zhang, and S. Y. Philip, “A comprehensive survey on graph neural networks,” IEEE transactions on neural networks and learning systems , vol. 32, no. 1, pp. 4–24, 2020

2020
[100]

Drug repurposing based on the dtd-gnn graph neural network: revealing the relationships among drugs, targets and diseases,

W. Li, W. Ma, M. Yang, and X. Tang, “Drug repurposing based on the dtd-gnn graph neural network: revealing the relationships among drugs, targets and diseases,” BMC genomics, vol. 25, 2024

2024
[101]

Graphsmote: Imbalanced node classification on graphs with graph neural networks,

T. Zhao, X. Zhang, and S. Wang, “Graphsmote: Imbalanced node classification on graphs with graph neural networks,” in Proceedings of the 14th ACM international conference on web search and data mining, 2021, pp. 833–841

2021
[102]

Superglue: Learning feature matching with graph neural net- works,

P .-E. Sarlin, D. DeTone, T. Malisiewicz, and A. Rabinovich, “Superglue: Learning feature matching with graph neural net- works,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2020, pp. 4938–4947

2020
[103]

Representation learning on graphs: Methods and applications,

W. L. Hamilton, R. Ying, and J. Leskovec, “Representation learning on graphs: Methods and applications,” arXiv preprint arXiv:1709.05584, 2017

2017 arXiv
[104]

Efficient graph generation with graph recurrent attention networks,

R. Liao, Y. Li, Y. Song, S. Wang, W. Hamilton, D. K. Duvenaud, R. Urtasun, and R. Zemel, “Efficient graph generation with graph recurrent attention networks,” Advances in neural information pro- cessing systems, vol. 32, 2019

2019
[105]

Graphrnn: Generating realistic graphs with deep auto-regressive models,

J. You, R. Ying, X. Ren, W. Hamilton, and J. Leskovec, “Graphrnn: Generating realistic graphs with deep auto-regressive models,” in International conference on machine learning . PMLR, 2018, pp. 5708–5717

2018
[106]

A survey of model extraction attacks and defenses in distributed computing environments,

K. Zhao, L. Li, K. Ding, N. Z. Gong, Y. Zhao, and Y. Dong, “A survey of model extraction attacks and defenses in distributed computing environments,” arXiv preprint arXiv:2502.16065, 2025

2025 arXiv
[107]

A realistic model extraction attack against graph neural networks,

F. Guan, T. Zhu, H. Tong, and W. Zhou, “A realistic model extraction attack against graph neural networks,” Knowledge- Based Systems, p. 112144, 2024

2024
[108]

Atom: A framework of detecting query-based model extraction attacks for graph neural networks,

Z. Cheng, B. Shen, T. Sha, Y. Gao, S. Li, and Y. Dong, “Atom: A framework of detecting query-based model extraction attacks for graph neural networks,” arXiv preprint arXiv:2503.16693, 2025

2025 arXiv
[109]

Sigfinger: A subtle and interactive gnn fingerprinting scheme via spatial structure inference perturbation,

J. Jia, R. Li, C. Wu, S. Ma, L. Wang, and R. H. Deng, “Sigfinger: A subtle and interactive gnn fingerprinting scheme via spatial structure inference perturbation,” IEEE Transactions on Dependable and Secure Computing, 2025

2025
[110]

Towards query-limited adversarial attacks on graph neural networks,

H. Li, J. Zhang, S. Gao, L. Wu, W. Zhou, and R. Wang, “Towards query-limited adversarial attacks on graph neural networks,” in 2022 IEEE 34th International Conference on Tools with Artificial Intelligence (ICTAI), 2022, pp. 516–521

2022
[111]

Vgfl-sa: Vertical graph federated learning structure attack based on contrastive learning,

Y. Chen and B. Zhou, “Vgfl-sa: Vertical graph federated learning structure attack based on contrastive learning,” arXiv preprint arXiv:2502.16793, 2025

2025 arXiv
[112]

Prada: protect- ing against dnn model stealing attacks,

M. Juuti, S. Szyller, S. Marchal, and N. Asokan, “Prada: protect- ing against dnn model stealing attacks,” in 2019 IEEE European Symposium on Security and Privacy (EuroS&P) , 2019, pp. 512–527

2019
[113]

Making watermark survive model extraction attacks in graph neural networks,

H. Wang, Z. Zhang, M. Chen, and S. He, “Making watermark survive model extraction attacks in graph neural networks,” in ICC 2023-IEEE International Conference on Communications , 2023, pp. 57–62

2023
[114]

An im- perceptible and owner-unique watermarking method for graph neural networks,

L. Zhang, M. Xue, L. Y. Zhang, Y. Zhang, and W. Liu, “An im- perceptible and owner-unique watermarking method for graph neural networks,” in Proceedings of the ACM Turing Award Cele- bration Conference-China 2024, 2024, pp. 108–113

2024
[115]

Watermarking graph neural networks by random graphs,

X. Zhao, H. Wu, and X. Zhang, “Watermarking graph neural networks by random graphs,” in 2021 9th International Symposium on Digital Forensics and Security (ISDFS) , 2021, pp. 1–6

2021
[116]

Ge- nie: Watermarking graph neural networks for link prediction,

V . S. P . Bachina, A. Gangwal, A. A. Sharma, and C. Sharma, “Ge- nie: Watermarking graph neural networks for link prediction,” arXiv preprint arXiv:2406.04805, 2024

2024 arXiv
[117]

Accurate mobile-app fingerprinting using flow-level relation- ship with graph neural networks,

M. Jiang, Z. Li, P . Fu, W. Cai, M. Cui, G. Xiong, and G. Gou, “Accurate mobile-app fingerprinting using flow-level relation- ship with graph neural networks,” Computer Networks, vol. 217, p. 109309, 2022

2022
[118]

On using embeddings for ownership verification of graph neural networks,

A. Waheed, “On using embeddings for ownership verification of graph neural networks,” Master’s thesis, University of Waterloo, 2023

2023
[119]

A survey on privacy in graph neural networks: Attacks, preservation, and applications,

Y. Zhang, Y. Zhao, Z. Li, X. Cheng, Y. Wang, O. Kotevska, S. Y. Philip, and T. Derr, “A survey on privacy in graph neural networks: Attacks, preservation, and applications,” IEEE Transac- tions on Knowledge and Data Engineering , 2024

2024
[120]

Adversarial training for graph neural networks: Pitfalls, solutions, and new directions,

L. Gosch, S. Geisler, D. Sturm, B. Charpentier, D. Z ¨ugner, and S. G ¨unnemann, “Adversarial training for graph neural networks: Pitfalls, solutions, and new directions,” Advances in Neural Infor- mation Processing Systems, vol. 36, 2024

2024
[121]

Adversarial defense framework for graph neural network,

S. Wang, Z. Chen, J. Ni, X. Yu, Z. Li, H. Chen, and P . S. Yu, “Adversarial defense framework for graph neural network,” arXiv preprint arXiv:1905.03679, 2019

1905 arXiv
[122]

Adversary for social good: Protecting familial privacy through joint adversarial attacks,

C. Kumar, R. Ryan, and M. Shao, “Adversary for social good: Protecting familial privacy through joint adversarial attacks,” in Proceedings of the AAAI conference on artificial intelligence , vol. 34, no. 07, 2020, pp. 11 304–11 311

2020
[123]

Graph adversarial networks: Protecting information against adversarial attacks,

P . Liao, H. Zhao, K. Xu, T. S. Jaakkola, G. Gordon, S. Jegelka, and R. Salakhutdinov, “Graph adversarial networks: Protecting information against adversarial attacks,” arXiv preprint, 2020

2020
[124]

Improving robustness of gnn-based anomaly detection by graph adversarial training,

X. Zheng, B. Wu, A. X. Zhang, and W. Li, “Improving robustness of gnn-based anomaly detection by graph adversarial training,” in Proceedings of the 2024 Joint International Conference on Com- putational Linguistics, Language Resources and Evaluation (LREC- COLING 2024), 2024, ...

2024
[126]

Unboundattack: Generating unbounded adversar- ial attacks to graph neural networks,

S. Ennadir, A. Alkhatib, G. Nikolentzos, M. Vazirgiannis, and H. Bostr ¨om, “Unboundattack: Generating unbounded adversar- ial attacks to graph neural networks,” in International Conference on Complex Networks and Their Applications , 2023, pp. 100–111

2023
[127]

Adapting membership inference attacks to gnn for graph classification: Approaches and implications,

B. Wu, X. Yang, S. Pan, and X. Yuan, “Adapting membership inference attacks to gnn for graph classification: Approaches and implications,” in 2021 IEEE International Conference on Data Mining (ICDM), 2021, pp. 1421–1426

2021
[128]

Query-efficient model inversion attacks: An information flow view,

Y. Xu, B. Fang, M. Li, X. Liu, and Z. Tian, “Query-efficient model inversion attacks: An information flow view,” IEEE Transactions on Information Forensics and Security, 2024

2024
[129]

Membership inference attacks on machine learning: A survey,

H. Hu, Z. Salcic, L. Sun, G. Dobbie, P . S. Yu, and X. Zhang, “Membership inference attacks on machine learning: A survey,” ACM Computing Surveys (CSUR), vol. 54, no. 11s, pp. 1–37, 2022

2022
[130]

Node-level membership inference attacks against graph neural networks,

X. He, R. Wen, Y. Wu, M. Backes, Y. Shen, and Y. Zhang, “Node-level membership inference attacks against graph neural networks,” arXiv preprint arXiv:2102.05429, 2021

2021 arXiv
[131]

How powerful are membership inference attacks on graph neural networks?

A. Jnaini, A. Bettar, and M. A. Koulali, “How powerful are membership inference attacks on graph neural networks?” in Proceedings of the 34th International Conference on Scientific and Statistical Database Management, 2022, pp. 1–4

2022
[132]

Improving de- fense mechanisms for subgraph-structure membership inference attacks,

P . Niu, C. Pan, S. Chen, and O. Milenkovic, “Improving de- fense mechanisms for subgraph-structure membership inference attacks,” 2025

2025
[133]

Label-only membership inference attack against node-level graph neural networks,

M. Conti, J. Li, S. Picek, and J. Xu, “Label-only membership inference attack against node-level graph neural networks,” in Proceedings of the 15th ACM Workshop on Artificial Intelligence and Security, 2022, pp. 1–12

2022
[134]

Membership inference attack on graph neural networks,

I. E. Olatunji, W. Nejdl, and M. Khosla, “Membership inference attack on graph neural networks,” in2021 Third IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications (TPS-ISA). IEEE, 2021, pp. 11–20

2021
[135]

Membership in- ference attacks against the graph classification,

J. Yang, H. Li, W. Fan, X. Zhang, and M. Hao, “Membership in- ference attacks against the graph classification,” in GLOBECOM 2023-2023 IEEE Global Communications Conference, 2023, pp. 6729– 6734

2023
[136]

Gradient inversion attack on graph neural networks,

D. Anand Sinha, Y. Liu, R. Du, and Y. Shen, “Gradient inversion attack on graph neural networks,” arXiv e-prints, pp. arXiv–2411, 2024

2024
[138]

Gnnbleed: Inference attacks to unveil private edges in graphs with realistic access to gnn models,

Z. Song, E. Kabir, and S. Mehnaz, “Gnnbleed: Inference attacks to unveil private edges in graphs with realistic access to gnn models,” arXiv preprint arXiv:2311.16139, 2023

2023 arXiv
[139]

Link membership inference attacks against unsupervised graph representation learning,

X. Wang and W. H. Wang, “Link membership inference attacks against unsupervised graph representation learning,” in Proceed- IEEE TRANSACTIONS ON KNOWLEDGE AND DATA ENGINEERING 26 ings of the 39th Annual Computer Security Applications Conference , 2023, pp. 477–491

2023
[140]

Topology-based node- level membership inference attacks on graph neural networks,

F. Guan, T. Zhu, W. Zhou, and P . S. Yu, “Topology-based node- level membership inference attacks on graph neural networks,” IEEE Transactions on Big Data, 2025

2025
[141]

A study of graph neural networks for link prediction on vulnerability to membership attacks,

D. Shaikhelislamov, K. Lukyanov, N. Severin, M. Drobyshevskiy, I. Makarov, and D. Turdakov, “A study of graph neural networks for link prediction on vulnerability to membership attacks,” Journal of Mathematical Sciences, pp. 1–11, 2024

2024
[142]

Subgraph structure membership inference attacks against graph neural networks,

X. Wang and W. H. Wang, “Subgraph structure membership inference attacks against graph neural networks,” Proceedings on Privacy Enhancing Technologies, 2024

2024
[143]

Stealing training graphs from graph neural networks,

M. Lin, E. Dai, J. Xu, J. Jia, X. Zhang, and S. Wang, “Stealing training graphs from graph neural networks,” arXiv preprint arXiv:2411.11197, 2024

2024 arXiv
[144]

Graph-level label-only membership infer- ence attack against graph neural networks,

J. Dai and Y. Lu, “Graph-level label-only membership infer- ence attack against graph neural networks,” arXiv preprint arXiv:2503.19070, 2025

2025 arXiv
[145]

Releasing graph neural networks with differential privacy guarantees,

I. E. Olatunji, T. Funke, and M. Khosla, “Releasing graph neural networks with differential privacy guarantees,” arXiv preprint arXiv:2109.08907, 2021

2021 arXiv
[146]

Mdp: Privacy-preserving gnn based on matrix decomposition and dif- ferential privacy,

W. Xu, B. Shi, J. Zhang, Z. Feng, T. Pan, and B. Dong, “Mdp: Privacy-preserving gnn based on matrix decomposition and dif- ferential privacy,” in 2023 IEEE International Conference on Joint Cloud Computing (JCC), 2023, pp. 38–45

2023
[147]

Heterogeneous randomized response for differential privacy in graph neural networks,

K. Tran, P . Lai, N. Phan, I. Khalil, Y. Ma, A. Khreishah, M. T. Thai, and X. Wu, “Heterogeneous randomized response for differential privacy in graph neural networks,” in 2022 IEEE International Conference on Big Data (Big Data) , 2022, pp. 1582–1587

2022
[148]

Poincar´e differential privacy for hierarchy-aware graph embed- ding,

Y. Wei, H. Yuan, X. Fu, Q. Sun, H. Peng, X. Li, and C. Hu, “Poincar´e differential privacy for hierarchy-aware graph embed- ding,” in Proceedings of the AAAI Conference on Artificial Intelli- gence, vol. 38, no. 8, 2024, pp. 9160–9168

2024
[149]

Adversarial training methods for network embedding,

Q. Dai, X. Shen, L. Zhang, Q. Li, and D. Wang, “Adversarial training methods for network embedding,” in The world wide web conference, 2019, pp. 329–339

2019
[150]

A multi-view confidence- calibrated framework for fair and stable graph representation learning,

X. Zhang, L. Zhang, B. Jin, and X. Lu, “A multi-view confidence- calibrated framework for fair and stable graph representation learning,” in 2021 IEEE International Conference on Data Mining (ICDM), 2021, pp. 1493–1498

2021
[151]

On strengthening and defending graph reconstruction attack with markov chain approximation,

Z. Zhou, C. Zhou, X. Li, J. Yao, Q. Yao, and B. Han, “On strengthening and defending graph reconstruction attack with markov chain approximation,” in International Conference on Ma- chine Learning, 2023, pp. 42 843–42 877

2023
[152]

Graph structure learning for robust graph neural networks,

W. Jin, Y. Ma, X. Liu, X. Tang, S. Wang, and J. Tang, “Graph structure learning for robust graph neural networks,” in Proceed- ings of the 26th ACM SIGKDD international conference on knowledge discovery & data mining, 2020, pp. 66–74

2020
[153]

Robust- ness in fairness against edge-level perturbations in gnn-based recommendation,

L. Boratto, F. Fabbri, G. Fenu, M. Marras, and G. Medda, “Robust- ness in fairness against edge-level perturbations in gnn-based recommendation,” in European Conference on Information Retrieval, 2024, pp. 38–55

2024
[154]

Privacy protection and utility trade-off for social graph embedding,

L. Cai, J. Tang, S. Dang, and G. Chen, “Privacy protection and utility trade-off for social graph embedding,”Information Sciences, p. 120866, 2024

2024
[155]

Revisiting edge perturbation for graph neural network in graph data augmentation and attack,

X. Liu, Y. Zhang, M. Wu, M. Yan, K. He, W. Yan, S. Pan, X. Ye, and D. Fan, “Revisiting edge perturbation for graph neural network in graph data augmentation and attack,” arXiv preprint arXiv:2403.07943, 2024

2024 arXiv
[156]

Topology modification against membership inference attack in graph neural networks,

F. Guan, T. Zhu, H. Tong, and W. Zhou, “Topology modification against membership inference attack in graph neural networks,” Knowledge-Based Systems, vol. 305, p. 112642, 2024

2024
[157]

Resisting membership inference attacks through knowledge distillation,

J. Zheng, Y. Cao, and H. Wang, “Resisting membership inference attacks through knowledge distillation,” Neurocomputing, vol. 452, pp. 114–126, 2021

2021
[158]

Repeated knowledge distillation with confidence masking to mitigate membership inference at- tacks,

F. Mazzone, L. van den Heuvel, M. Huber, C. Verdecchia, M. Ev- erts, F. Hahn, and A. Peter, “Repeated knowledge distillation with confidence masking to mitigate membership inference at- tacks,” in Proceedings of the 15th ACM Workshop on Artificial Intelligence and Security, 20...

2022
[159]

Mitigating membership inference attacks by {Self-Distillation} through a novel ensemble architec- ture,

X. Tang, S. Mahloujifar, L. Song, V . Shejwalkar, M. Nasr, A. Houmansadr, and P . Mittal, “Mitigating membership inference attacks by {Self-Distillation} through a novel ensemble architec- ture,” in 31st USENIX Security Symposium (USENIX Security 22) , 2022, pp. 1433–1450

2022
[160]

Maskar- mor: Confidence masking-based defense mechanism for gnn against mia,

C. Chen, X. Zhang, H. Qiu, J. Lou, Z. Liu, and X. Chen, “Maskar- mor: Confidence masking-based defense mechanism for gnn against mia,” Information Sciences, vol. 669, p. 120579, 2024

2024
[161]

Model inversion attacks: A survey of approaches and countermeasures,

Z. Zhou, J. Zhu, F. Yu, X. Li, X. Peng, T. Liu, and B. Han, “Model inversion attacks: A survey of approaches and countermeasures,” arXiv preprint arXiv:2411.10023, 2024

2024
[162]

Graph- fraudster: Adversarial attacks on graph neural network-based vertical federated learning,

J. Chen, G. Huang, H. Zheng, S. Yu, W. Jiang, and C. Cui, “Graph- fraudster: Adversarial attacks on graph neural network-based vertical federated learning,” IEEE Transactions on Computational Social Systems, vol. 10, no. 2, pp. 492–506, 2022

2022
[163]

Membership inference attacks against robust graph neural network,

Z. Liu, X. Zhang, C. Chen, S. Lin, and J. Li, “Membership inference attacks against robust graph neural network,” in In- ternational Symposium on Cyberspace Safety and Security , 2022, pp. 259–273

2022
[164]

A unified framework of graph information bottleneck for robustness and membership privacy,

E. Dai, L. Cui, Z. Wang, X. Tang, Y. Wang, M. Cheng, B. Yin, and S. Wang, “A unified framework of graph information bottleneck for robustness and membership privacy,” inProceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, 2023, pp. 368–379

2023
[165]

Model extraction attacks and defenses on cloud-based machine learning models,

X. Gong, Q. Wang, Y. Chen, W. Yang, and X. Jiang, “Model extraction attacks and defenses on cloud-based machine learning models,” IEEE Communications Magazine , vol. 58, no. 12, pp. 83– 89, 2021

2021
[166]

{ModelGuard}:{Information-Theoretic} defense against model extraction attacks,

M. Tang, A. Dai, L. DiValentin, A. Ding, A. Hass, N. Z. Gong, Y. Chen et al., “ {ModelGuard}:{Information-Theoretic} defense against model extraction attacks,” in 33rd USENIX Security Sym- posium (USENIX Security 24), 2024, pp. 5305–5322

2024
[167]

Towards the worst-case robustness of large language models,

H. Chen, Y. Dong, Z. Wei, H. Su, and J. Zhu, “Towards the worst-case robustness of large language models,” arXiv preprint arXiv:2501.19040, 2025

2025
[168]

Black- box attacks on graph neural networks via white-box methods with performance guarantees,

J. Yang, R. Ding, J. Chen, X. Zhong, H. Zhao, and L. Xie, “Black- box attacks on graph neural networks via white-box methods with performance guarantees,” IEEE Internet of Things Journal , 2024

2024
[169]

Hermes attack: Steal {DNN} models with lossless inference accuracy,

Y. Zhu, Y. Cheng, H. Zhou, and Y. Lu, “Hermes attack: Steal {DNN} models with lossless inference accuracy,” in 30th USENIX Security Symposium (USENIX Security 21) , 2021

2021
[170]

Does black-box attribute inference attacks on graph neural networks constitute privacy risk?

I. E. Olatunji, A. Hizber, O. Sihlovec, and M. Khosla, “Does black-box attribute inference attacks on graph neural networks constitute privacy risk?” arXiv preprint arXiv:2306.00578, 2023

2023 arXiv
[171]

Gcl-leak: Link membership inference attacks against graph contrastive learning,

X. Wang and W. H. Wang, “Gcl-leak: Link membership inference attacks against graph contrastive learning,” Proceedings on Privacy Enhancing Technologies, 2024

2024
[172]

Inference attacks against graph neural networks,

Z. Zhang, M. Chen, M. Backes, Y. Shen, and Y. Zhang, “Inference attacks against graph neural networks,” in 31st USENIX Security Symposium (USENIX Security 22), 2022, pp. 4543–4560

2022
[174]

Unlearn- ing inversion attacks for graph neural networks,

J. Zhang, Y. Wang, Z. Zhang, X. Liu, and S. Wang, “Unlearn- ing inversion attacks for graph neural networks,” arXiv preprint arXiv:2506.00808, 2025

2025
[175]

Plug & play attacks: Towards robust and flexible model inversion attacks,

L. Struppek, D. Hintersdorf, A. D. A. Correia, A. Adler, and K. Kersting, “Plug & play attacks: Towards robust and flexible model inversion attacks,” arXiv preprint arXiv:2201.12179, 2022

2022 arXiv
[176]

Random graphs,

E. N. Gilbert, “Random graphs,” The Annals of Mathematical Statistics, vol. 30, no. 4, pp. 1141–1144, 1959

1959
[177]

Securing graph neural networks in mlaas: A comprehensive realization of query-based integrity verification,

B. Wu, X. Yuan, S. Wang, Q. Li, M. Xue, and S. Pan, “Securing graph neural networks in mlaas: A comprehensive realization of query-based integrity verification,” in 2024 IEEE Symposium on Security and Privacy (SP), 2024, pp. 2534–2552

2024
[178]

Cap: Co-adversarial perturbation on weights and features for improving generalization of graph neural networks,

H. Xue, K. Zhou, T. Chen, K. Guo, X. Hu, Y. Chang, and X. Wang, “Cap: Co-adversarial perturbation on weights and features for improving generalization of graph neural networks,” ArXiv, 2021

2021
[179]

Adversarial training on weights for graph neural networks,

H. Xue, X. Wang, and Y. Wang, “Adversarial training on weights for graph neural networks,” Proceedings of the 2022 5th Interna- tional Conference on Algorithms, Computing and Artificial Intelli- gence, 2022

2022
[180]

Adversarial training for graph neural net- works,

L. Gosch, S. Geisler, D. Sturm, B. Charpentier, D. Zugner, and S. Gunnemann, “Adversarial training for graph neural net- works,” ArXiv, 2023

2023
[181]

A sys- tematic survey of model extraction attacks and defenses: State-of- the-art and perspectives,

K. Zhao, L. Li, K. Ding, N. Z. Gong, Y. Zhao, and Y. Dong, “A sys- tematic survey of model extraction attacks and defenses: State-of- the-art and perspectives,” arXiv preprint arXiv:2508.15031, 2025

2025 arXiv
[182]

Misleader: Defending against model extraction with ensembles of distilled models,

X. Cheng, M. Zheng, S. Zhu, and Y. Dong, “Misleader: Defending against model extraction with ensembles of distilled models,” arXiv preprint arXiv:2506.02362, 2025. IEEE TRANSACTIONS ON KNOWLEDGE AND DATA ENGINEERING 27

2025 arXiv
[183]

Efficient model-stealing attacks against inductive graph neural networks,

M. Podhajski, J. Dubi ´nski, F. Boenisch, A. Dziedzic, A. Pre- gowska, and T. Michalak, “Efficient model-stealing attacks against inductive graph neural networks,” arXiv preprint arXiv:2405.12295, 2024

2024 arXiv
[184]

Adage: Active defenses against gnn extraction,

J. Xu, F. Boenisch, and A. Dziedzic, “Adage: Active defenses against gnn extraction,” arXiv preprint arXiv:2503.00065, 2025

2025 arXiv
[185]

Local differential privacy in graph neural networks: a reconstruction approach,

K. Bhaila, W. Huang, Y. Wu, and X. Wu, “Local differential privacy in graph neural networks: a reconstruction approach,” in Proceedings of the 2024 SIAM International Conference on Data Mining (SDM), 2024, pp. 1–9

2024
[186]

The algorithmic foundations of differ- ential privacy,

C. Dwork, A. Roth et al., “The algorithmic foundations of differ- ential privacy,” Foundations and Trends® in Theoretical Computer Science, vol. 9, no. 3–4, pp. 211–407, 2014

2014
[187]

Vertically federated graph neural net- work for privacy-preserving node classification,

C. Chen, J. Zhou, L. Zheng, H. Wu, L. Lyu, J. Wu, B. Wu, Z. Liu, L. Wang, and X. Zheng, “Vertically federated graph neural net- work for privacy-preserving node classification,” arXiv preprint arXiv:2005.11903, 2020

2005 arXiv
[188]

Heteroguard: Defending heterogeneous graph neural networks against adversarial attacks,

U. Kumarasinghe, M. Nabeel, K. De Zoysa, K. Gunawardana, and C. Elvitigala, “Heteroguard: Defending heterogeneous graph neural networks against adversarial attacks,” in 2022 IEEE Inter- national Conference on Data Mining Workshops (ICDMW), 2022, pp. 698–705

2022
[189]

Two-level adversarial attacks for graph neural networks,

C. Song, L. Niu, and M. Lei, “Two-level adversarial attacks for graph neural networks,” Information Sciences, vol. 654, p. 119877, 2024

2024
[190]

Membership inference attacks against gnn-based hardware trojan detection,

K. Hasegawa, K. Yamashita, S. Hidano, K. Fukushima, K. Hashimoto, and N. Togawa, “Membership inference attacks against gnn-based hardware trojan detection,” in 2023 IEEE 22nd International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom), 20...

2023
[191]

Knowl- edge distillation on graphs: A survey,

Y. Tian, S. Pei, X. Zhang, C. Zhang, and N. V . Chawla, “Knowl- edge distillation on graphs: A survey,” ACM Computing Surveys, vol. 57, no. 8, pp. 1–16, 2025

2025
[192]

Sok: Model inversion attack landscape: Taxonomy, challenges, and future roadmap,

S. V . Dibbo, “Sok: Model inversion attack landscape: Taxonomy, challenges, and future roadmap,” in 2023 IEEE 36th Computer Security Foundations Symposium (CSF), 2023, pp. 439–456

2023
[193]

Quantifying privacy leakage in graph embedding,

V . Duddu, A. Boutet, and V . Shejwalkar, “Quantifying privacy leakage in graph embedding,” in MobiQuitous 2020-17th EAI In- ternational Conference on Mobile and Ubiquitous Systems: Computing, Networking and Services, 2020, pp. 76–85

2020
[194]

Sslguard: A watermarking scheme for self-supervised learning pre-trained encoders,

T. Cong, X. He, and Y. Zhang, “Sslguard: A watermarking scheme for self-supervised learning pre-trained encoders,” in Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communica- tions Security, 2022, pp. 579–593

2022
[195]

Data augmentation for deep graph learning: A survey,

K. Ding, Z. Xu, H. Tong, and H. Liu, “Data augmentation for deep graph learning: A survey,” ACM SIGKDD Explorations Newsletter, vol. 24, no. 2, pp. 61–77, 2022

2022
[196]

Graph representation learning in biomedicine and healthcare,

M. M. Li, K. Huang, and M. Zitnik, “Graph representation learning in biomedicine and healthcare,” Nature Biomedical En- gineering, vol. 6, no. 12, pp. 1353–1369, 2022

2022
[197]

Wiki-cs: A wikipedia-based bench- mark for graph neural networks,

P . Mernyei and C. Cangea, “Wiki-cs: A wikipedia-based bench- mark for graph neural networks,”arXiv preprint arXiv:2007.02901, 2020

2007 arXiv
[198]

Federated social recommendation with graph neural network,

Z. Liu, L. Yang, Z. Fan, H. Peng, and P . S. Yu, “Federated social recommendation with graph neural network,” ACM Transactions on Intelligent Systems and Technology (TIST), vol. 13, no. 4, pp. 1–24, 2022

2022
[199]

Revisiting graph based social recommendation: A distillation enhanced social graph network,

Y. Tao, Y. Li, S. Zhang, Z. Hou, and Z. Wu, “Revisiting graph based social recommendation: A distillation enhanced social graph network,” in Proceedings of the ACM Web Conference 2022 , 2022, pp. 2830–2838

2022
[200]

The political blogosphere and the 2004 us election: divided they blog,

L. A. Adamic and N. Glance, “The political blogosphere and the 2004 us election: divided they blog,” in Proceedings of the 3rd international workshop on Link discovery, 2005, pp. 36–43

2004
[201]

Openp5: Benchmark- ing foundation models for recommendation,

S. Xu, W. Hua, and Y. Zhang, “Openp5: Benchmark- ing foundation models for recommendation,” arXiv preprint arXiv:2306.11134, 2023

2023 arXiv
[202]

Understanding and improving graph injection attack by pro- moting unnoticeability,

Y. Chen, H. Yang, Y. Zhang, K. Ma, T. Liu, B. Han, and J. Cheng, “Understanding and improving graph injection attack by pro- moting unnoticeability,” arXiv preprint arXiv:2202.08057, 2022

2022 arXiv
[203]

Consisrec: Enhancing gnn for social recommendation via consistent neighbor aggrega- tion,

L. Yang, Z. Liu, Y. Dou, J. Ma, and P . S. Yu, “Consisrec: Enhancing gnn for social recommendation via consistent neighbor aggrega- tion,” in Proceedings of the 44th international ACM SIGIR conference on Research and development in information retrieval, 2021, pp. 2141– 2145

2021
[204]

Structure-activity relationship of mutagenic aromatic and heteroaromatic nitro compounds. cor- relation with molecular orbital energies and hydrophobicity,

A. K. Debnath, R. L. Lopez de Compadre, G. Debnath, A. J. Shusterman, and C. Hansch, “Structure-activity relationship of mutagenic aromatic and heteroaromatic nitro compounds. cor- relation with molecular orbital energies and hydrophobicity,” Journal of medicinal chemistry, vo...

1991
[205]

Statistical evaluation of the predictive toxicology challenge 2000–2001,

H. Toivonen, A. Srinivasan, R. D. King, S. Kramer, and C. Helma, “Statistical evaluation of the predictive toxicology challenge 2000–2001,” Bioinformatics, vol. 19, no. 10, pp. 1183–1193, 2003

2000
[206]

Comparison of descrip- tor spaces for chemical compound retrieval and classification,

N. Wale, I. A. Watson, and G. Karypis, “Comparison of descrip- tor spaces for chemical compound retrieval and classification,” Knowledge and Information Systems, vol. 14, pp. 347–375, 2008

2008
[207]

Iam graph database repository for graph based pattern recognition and machine learning,

K. Riesen and H. Bunke, “Iam graph database repository for graph based pattern recognition and machine learning,” in Struc- tural, Syntactic, and Statistical Pattern Recognition: Joint IAPR Inter- national Workshop, SSPR & SPR 2008, Orlando, USA, December 4-6,

2008
[208]

Protein function prediction via graph kernels,

K. M. Borgwardt, C. S. Ong, S. Sch ¨onauer, S. Vishwanathan, A. J. Smola, and H.-P . Kriegel, “Protein function prediction via graph kernels,” Bioinformatics, vol. 21, pp. i47–i56, 2005

2005
[209]

Large-scale analysis of disease pathways in the human interactome,

M. Agrawal, M. Zitnik, and J. Leskovec, “Large-scale analysis of disease pathways in the human interactome,” in P ACIFIC SYMPOSIUM on BIOCOMPUTING 2018: Proceedings of the Pacific Symposium, 2018, pp. 111–122

2018
[210]

Rev2: Fraudulent user prediction in rating platforms,

S. Kumar, B. Hooi, D. Makhija, M. Kumar, C. Faloutsos, and V . Subrahmanian, “Rev2: Fraudulent user prediction in rating platforms,” in Proceedings of the Eleventh ACM International Con- ference on Web Search and Data Mining, 2018, pp. 333–341

2018
[211]

Yelp dataset challenge: Review rating prediction,

N. Asghar, “Yelp dataset challenge: Review rating prediction,” arXiv preprint arXiv:1605.05362, 2016

2016 arXiv
[212]

The datasets dilemma: How much do we really know about recommendation datasets?

J. Y. Chin, Y. Chen, and G. Cong, “The datasets dilemma: How much do we really know about recommendation datasets?” in Proceedings of the Fifteenth ACM International Conference on Web Search and Data Mining, 2022, pp. 141–149

2022
[213]

Roland: graph learning frame- work for dynamic graphs,

J. You, T. Du, and J. Leskovec, “Roland: graph learning frame- work for dynamic graphs,” in Proceedings of the 28th ACM SIGKDD conference on knowledge discovery and data mining , 2022, pp. 2358–2366

2022
[214]

struc2vec: Learning node representations from structural identity,

L. F. Ribeiro, P . H. Saverese, and D. R. Figueiredo, “struc2vec: Learning node representations from structural identity,” in Pro- ceedings of the 23rd ACM SIGKDD international conference on knowl- edge discovery and data mining, 2017, pp. 385–394

2017
[215]

Pooling architecture search for graph classification,

L. Wei, H. Zhao, Q. Yao, and Z. He, “Pooling architecture search for graph classification,” in Proceedings of the 30th ACM Interna- tional Conference on Information & Knowledge Management , 2021, pp. 2091–2100

2021
[216]

Nodeformer: A scalable graph structure learning transformer for node classifica- tion,

Q. Wu, W. Zhao, Z. Li, D. P . Wipf, and J. Yan, “Nodeformer: A scalable graph structure learning transformer for node classifica- tion,” Advances in Neural Information Processing Systems , vol. 35, pp. 27 387–27 401, 2022

2022
[217]

Deeprank- gnn: a graph neural network framework to learn patterns in protein–protein interfaces,

M. R ´eau, N. Renaud, L. C. Xue, and A. M. Bonvin, “Deeprank- gnn: a graph neural network framework to learn patterns in protein–protein interfaces,” Bioinformatics, vol. 39, no. 1, p. btac759, 2023

2023
[218]

A deep graph neural network-based mechanism for social recommendations,

Z. Guo and H. Wang, “A deep graph neural network-based mechanism for social recommendations,” IEEE Transactions on Industrial Informatics, vol. 17, no. 4, pp. 2776–2783, 2020

2020
[219]

Towards differential privacy in sequen- tial recommendation: A noisy graph neural network approach,

W. Hu and H. Fang, “Towards differential privacy in sequen- tial recommendation: A noisy graph neural network approach,” ACM Transactions on Knowledge Discovery from Data, 2023

2023
[220]

A compara- tive study of similarity-based and gnn-based link prediction approaches,

M. K. Islam, S. Aridhi, and M. Smail-Tabbone, “A compara- tive study of similarity-based and gnn-based link prediction approaches,” arXiv preprint arXiv:2008.08879, 2020

2008 arXiv
[221]

Mixed graph neural network-based fake news detection for sustainable vehicular social networks,

Z. Guo, K. Yu, A. Jolfaei, G. Li, F. Ding, and A. Beheshti, “Mixed graph neural network-based fake news detection for sustainable vehicular social networks,” IEEE Transactions on Intelligent Trans- portation Systems, vol. 24, no. 12, pp. 15 486–15 498, 2022

2022
[222]

To milliseconds and beyond: challenges in the simulation of protein folding,

T. J. Lane, D. Shukla, K. A. Beauchamp, and V . S. Pande, “To milliseconds and beyond: challenges in the simulation of protein folding,” Current opinion in structural biology , vol. 23, no. 1, pp. 58–65, 2013

2013
[223]

Modeling polyphar- macy side effects with graph convolutional networks,

M. Zitnik, M. Agrawal, and J. Leskovec, “Modeling polyphar- macy side effects with graph convolutional networks,” Bioinfor- matics, vol. 34, no. 13, pp. i457–i466, 2018

2018
[224]

Biognn: how graph neural networks can solve biological problems,

P . Bongini, N. Pancino, F. Scarselli, and M. Bianchini, “Biognn: how graph neural networks can solve biological problems,” in Artificial Intelligence and Machine Learning for Healthcare: Vol. 1: Image and Data Analytics. Springer, 2022, pp. 211–231

2022
[225]

A bert-gnn approach for metastatic breast cancer IEEE TRANSACTIONS ON KNOWLEDGE AND DATA ENGINEERING 28 prediction using histopathology reports,

A. Basaad, S. Basurra, E. Vakaj, A. K. Eldaly, and M. M. Ab- delsamea, “A bert-gnn approach for metastatic breast cancer IEEE TRANSACTIONS ON KNOWLEDGE AND DATA ENGINEERING 28 prediction using histopathology reports,” Diagnostics, vol. 14, no. 13, p. 1365, 2024

2024
[226]

A survey of graph neural network based recommendation in social networks,

X. Li, L. Sun, M. Ling, and Y. Peng, “A survey of graph neural network based recommendation in social networks,” Neurocom- puting, vol. 549, p. 126441, 2023

2023
[227]

Graph neural networks in recommender systems: a survey,

S. Wu, F. Sun, W. Zhang, X. Xie, and B. Cui, “Graph neural networks in recommender systems: a survey,” ACM Computing Surveys, vol. 55, no. 5, pp. 1–37, 2022

2022
[228]

Financial default prediction via motif-preserving graph neural network with curriculum learning,

D. Wang, Z. Zhang, Y. Zhao, K. Huang, Y. Kang, and J. Zhou, “Financial default prediction via motif-preserving graph neural network with curriculum learning,” in Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, 2023, pp. 2233–2242

2023
[229]

Heteroge- neous graph neural networks for malicious account detection,

Z. Liu, C. Chen, X. Yang, J. Zhou, X. Li, and L. Song, “Heteroge- neous graph neural networks for malicious account detection,” in Proceedings of the 27th ACM international conference on information and knowledge management, 2018, pp. 2077–2085

2018
[230]

Using external knowledge for financial event prediction based on graph neural networks,

Y. Yang, Z. Wei, Q. Chen, and L. Wu, “Using external knowledge for financial event prediction based on graph neural networks,” in Proceedings of the 28th ACM international conference on informa- tion and knowledge management, 2019, pp. 2161–2164

2019
[231]

Idea: An inverse domain expert adaptation based active dnn ip protection method,

C. Xu, Q. Cui, J. Dong, W. He, and C.-H. Chang, “Idea: An inverse domain expert adaptation based active dnn ip protection method,” arXiv preprint arXiv:2410.00059, 2024

2024 arXiv
[232]

Graph-based managing and mining of processes and data in the domain of intellectual property,

G. H ¨ubscher, V . Geist, D. Auer, A. Ekelhart, R. Mayer, S. Nad- schl¨ager, and J. K ¨ung, “Graph-based managing and mining of processes and data in the domain of intellectual property,” Infor- mation Systems, vol. 106, p. 101844, 2022

2022
[233]

Graphnei: A gnn-based network entity identification method for ip geolocation,

Z. Ma, S. Zhang, N. Li, T. Li, X. Hu, H. Feng, Q. Zhou, F. Liu, X. Quan, H. Wang et al., “Graphnei: A gnn-based network entity identification method for ip geolocation,”Computer Networks, vol. 235, p. 109946, 2023

2023
[234]

Fight fire with fire: Towards robust graph neural networks on dynamic graphs via actively defense,

H. Li, S. Di, C. H. Y. Li, L. Chen, and X. Zhou, “Fight fire with fire: Towards robust graph neural networks on dynamic graphs via actively defense,” Proc. VLDB Endow., vol. 17, no. 8, p. 2050–2063, 2024
[235]

Gnn4ip: Graph neural network for hardware intellectual property piracy detection,

R. Yasaei, S.-Y. Yu, E. K. Naeini, and M. A. Al Faruque, “Gnn4ip: Graph neural network for hardware intellectual property piracy detection,” in 2021 58th ACM/IEEE Design Automation Conference (DAC), 2021, pp. 217–222

2021
[236]

A survey of trustworthy graph learning: Reliability, explainability, and privacy protection,

B. Wu, J. Li, J. Yu, Y. Bian, H. Zhang, C. Chen, C. Hou, G. Fu, L. Chen, T. Xu et al. , “A survey of trustworthy graph learning: Reliability, explainability, and privacy protection,” arXiv preprint arXiv:2205.10014, 2022

2022 arXiv
[237]

Explaining graph neural networks for vulnerability discovery,

T. Ganz, M. H ¨arterich, A. Warnecke, and K. Rieck, “Explaining graph neural networks for vulnerability discovery,” in Proceed- ings of the 14th ACM Workshop on Artificial Intelligence and Security, 2021, pp. 145–156

2021
[238]

A critical look at the evaluation of gnns un- der heterophily: Are we really making progress?

O. Platonov, D. Kuznedelev, M. Diskin, A. Babenko, and L. Prokhorenkova, “A critical look at the evaluation of gnns un- der heterophily: Are we really making progress?” arXiv preprint arXiv:2302.11640, 2023

2023 arXiv
[239]

Turn passive to active: A survey on active intellectual property protection of deep learning models,

M. Xue, L. Y. Zhang, Y. Zhang, and W. Liu, “Turn passive to active: A survey on active intellectual property protection of deep learning models,” arXiv preprint arXiv:2310.09822, 2023

2023 arXiv
[240]

To- wards foundation models for knowledge graph reasoning,

M. Galkin, X. Yuan, H. Mostafa, J. Tang, and Z. Zhu, “To- wards foundation models for knowledge graph reasoning,”arXiv preprint arXiv:2310.04562, 2023

2023 arXiv
[241]

Natural language is all a graph needs,

R. Ye, C. Zhang, R. Wang, S. Xu, Y. Zhanget al., “Natural language is all a graph needs,” arXiv preprint arXiv:2308.07134, vol. 4, no. 5, p. 7, 2023

2023 arXiv
[242]

Advances in human event modeling: From graph neural networks to language models,

S. Deng, M. de Rijke, and Y. Ning, “Advances in human event modeling: From graph neural networks to language models,” in Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, 2024, pp. 6459–6469

2024
[243]

Cosmo: A large-scale e-commerce common sense knowledge generation and serving system at amazon,

C. Yu, X. Liu, J. Maia, Y. Li, T. Cao, Y. Gao, Y. Song, R. Goutam, H. Zhang, B. Yin et al. , “Cosmo: A large-scale e-commerce common sense knowledge generation and serving system at amazon,” in Companion of the 2024 International Conference on Management of Data, 2024, pp. 148–160

2024
[244]

Fuselinker: Leveraging llm’s pre-trained text embeddings and domain knowledge to enhance gnn-based link prediction on biomedical knowledge graphs,

Y. Xiao, S. Zhang, H. Zhou, M. Li, H. Yang, and R. Zhang, “Fuselinker: Leveraging llm’s pre-trained text embeddings and domain knowledge to enhance gnn-based link prediction on biomedical knowledge graphs,” Journal of Biomedical Informatics , vol. 158, p. 104730, 2024

2024
[245]

Gnnavi: Navigating the information flow in large language models by graph neural network,

S. Yuan, E. Nie, M. F ¨arber, H. Schmid, and H. Sch ¨utze, “Gnnavi: Navigating the information flow in large language models by graph neural network,” arXiv preprint arXiv:2402.11709, 2024

2024 arXiv
[246]

Empower post-hoc graph explanations with information bottle- neck: A pre-training and fine-tuning perspective,

J. Wang, M. Luo, J. Li, Y. Lin, Y. Dong, J. S. Dong, and Q. Zheng, “Empower post-hoc graph explanations with information bottle- neck: A pre-training and fine-tuning perspective,” in Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, 2023, pp...

2023
[247]

Git-mol: A multi-modal large language model for molecular science with graph, image, and text,

P . Liu, Y. Ren, J. Tao, and Z. Ren, “Git-mol: A multi-modal large language model for molecular science with graph, image, and text,” Computers in biology and medicine, vol. 171, p. 108073, 2024

2024
[248]

Adversar- ial attacks on fairness of graph neural networks,

B. Zhang, Y. Dong, C. Chen, Y. Zhu, M. Luo, and J. Li, “Adversar- ial attacks on fairness of graph neural networks,” arXiv preprint arXiv:2310.13822, 2023. IEEE TRANSACTIONS ON KNOWLEDGE AND DATA ENGINEERING 29 APPENDIX A DETAILED STATISTICS AND DESCRIPTIONS OF BENCHMARK DATAS...

2023 arXiv
[2008]

Proceedings, 2008, pp. 287–297

2008

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.

[1] [137]

FedGIG: Graph Inversion from Gradient in Federated Learning

T. Xiao, Y. Li, Y. Qi, H. Wang, and R. Li, “Fedgig: Graph inversion from gradient in federated learning,” arXiv preprint arXiv:2412.18513, 2024

work page Pith review arXiv 2024

[2] [173]

Gradient inversion attack on graph neural networks,

D. A. Sinha, Y. Liu, R. Du, and Y. Shen, “Gradient inversion attack on graph neural networks,” arXiv preprint arXiv:2411.19440, 2024

arXiv 2024

[3] [125]

Grove: Ownership ver- ification of graph neural networks using embeddings,

A. Waheed, V . Duddu, and N. Asokan, “Grove: Ownership ver- ification of graph neural networks using embeddings,” in 2024 IEEE Symposium on Security and Privacy (SP), 2024, pp. 2460–2477

2024

[4] [18]

Intellectual property protection of dnn models,

S. Peng, Y. Chen, J. Xu, Z. Chen, C. Wang, and X. Jia, “Intellectual property protection of dnn models,” World Wide Web , vol. 26, no. 4, pp. 1877–1911, 2023

1911

[5] [79]

Intellectual property pro- tection for deep learning models: Taxonomy, methods, attacks, and evaluations,

M. Xue, Y. Zhang, J. Wang, and W. Liu, “Intellectual property pro- tection for deep learning models: Taxonomy, methods, attacks, and evaluations,” IEEE Transactions on Artificial Intelligence, vol. 3, no. 6, pp. 908–923, 2021

2021

[6] [80]

Deep intellectual property protection: A survey,

Y. Sun, T. Liu, P . Hu, Q. Liao, S. Fu, N. Yu, D. Guo, Y. Liu, and L. Liu, “Deep intellectual property protection: A survey,” arXiv preprint arXiv:2304.14613, 2023

arXiv 2023

[7] [1]

Cross- links matter for link prediction: rethinking the debiased gnn from a data perspective,

Z. Luo, H. Huang, J. Lian, X. Song, X. Xie, and H. Jin, “Cross- links matter for link prediction: rethinking the debiased gnn from a data perspective,” Advances in Neural Information Processing Systems, vol. 36, 2024

2024

[8] [2]

A Topological Perspective on Demystifying GNN-Based Link Prediction Performance

Y. Wang, T. Zhao, Y. Zhao, Y. Liu, X. Cheng, N. Shah, and T. Derr, “A topological perspective on demystifying gnn-based link prediction performance,” arXiv preprint arXiv:2310.04612 , 2023

work page Pith review arXiv 2023