Pith. sign in

REVIEW 3 major objections 6 minor 50 references

GRID: Protecting Training Graph from Link Stealing Attacks on GNN Models

T0 review · 3 major / 6 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read GRID defends GNN link privacy by adding noise only to a vertex cover of core nodes, so adjacent pairs look like distant pairs while every predicted label is unchanged.

desk verdict GRID is a plausible prediction-perturbation defense for link stealing with broad experiments, but its core disguise guarantee is not actually ensured by the algorithm, and the strongest attack still lands near 70% AUC at the default budget. read the letter →

arxiv 2501.10985 v2 pith:GWJVV5GF submitted 2025-01-19 cs.LG cs.CR

Jiadong Lou , Xu Yuan , Rui Zhang , Xingliang Yuan , Neil Gong , Nian-Feng Tzeng This is my paper · ORCID
classification cs.LGcs.CR
keywords linkstealingattackgraphneuralnetworkprivacypredictionvectorperturbationcorenodeselectionvertexcoverzeroutilitylossdefenseinductiveGNN
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes a defense, called GRID, against link-stealing attacks on graph neural networks. It adds small noise vectors to the prediction outputs of a carefully chosen subset of nodes, the core nodes, so that the similarity of any two adjacent nodes' predictions is pushed down to the level of nodes that are several hops apart. The added noise is constrained so that the argmax of every prediction vector stays the same, giving zero change in classification accuracy, while the distortion stays within a budget. On five datasets, the paper reports that attack accuracy and AUC fall from the 85–98 percent range to roughly 50–74 percent for eight similarity-based attacks and the strongest inductive attacks, while model accuracy is unchanged.

What carries the argument

The load-bearing object is the similarity gap $D_i$ of Eq. (8), which is minimized for each core node so that adjacent nodes become similarity-indistinguishable from $n$-hop indirect neighbors. The core node set is a threshold-based vertex cover: each edge with similarity above a threshold gets at least one endpoint noised, while low-similarity edges are left alone, which avoids noise offset and cuts computation. The optimization OPT-GRID is a constrained non-linear problem solved by iterative gradient descent with KKT conditions and a projection-based constraint check that enforces the label-preservation, probability-distribution, and distortion-budget constraints.

What would settle it

Query an inductive GAT model with node pairs that were not part of the training graph $D_1$ and run Attack-6 on the returned prediction vectors. If GRID does not specify how the defender obtains $P_i$ and $Q_i$ for these unseen nodes, the attack accuracy on that held-out pair set should remain close to the no-defense baseline, which would show that the zero-utility guarantee does not transfer to inductive queries.

Watch

Extended reading notes

Core claim

The central claim is that a trained GNN can be wrapped by a post-processing step that makes link-stealing attacks statistically useless without changing the model's predictions. For every edge, GRID selects at least one endpoint as a core node and optimizes a noise vector $s_i$ for that node's prediction vector $v_i$ so that the similarity gap $D_i = \sum_{j \in P_i} \operatorname{sim}(v_i+s_i, v_j) - \sum_{k \in Q_i} \operatorname{sim}(v_i+s_i, v_k)$ is minimized, where $P_i$ is the adjacent-node set and $Q_i$ is the $n$-hop indirect set. Minimizing this gap makes the noisy prediction of a core node look as similar to its neighbors as to nodes $n$ hops away, thereby disguising links. The optimization is constrained so that the argmax of each prediction vector is preserved (zero label loss), the noisy vector remains a probability distribution, and the $\ell^1$ distortion stays under a budget $\theta$. In the paper's experiments, eight similarity-based attacks and the strongest inductive ILS attacks lose most of their advantage, with AUC and accuracy falling from roughly 85–98 percent to 50–74 percent while model accuracy is exactly unchanged.

Load-bearing premise

The defense only works if the model provider already knows, for every node whose predictions are queried, which other nodes it is directly connected to and which nodes lie several hops away.

Editorial extensions

If this is right

  • Similarity-based link-stealing attacks, including unsupervised Attack-0 and supervised black-box and gray-box attacks, drop from roughly 85–98 percent AUC to 56–74 percent across Citeseer, Cora, Pubmed, AIDS, and ENZYMES.
  • The strongest inductive ILS attacks A2 and A9 on GAT fall to 57–69 percent AUC, so the defense transfers from transductive GCN to inductive GAT, GraphSAGE, and GIN models.
  • Noising only core nodes avoids the noise-offset problem: full-graph noising leaves attack accuracy several points higher and costs about six times more computation, e.g., 45,052 seconds versus 7,938 seconds on Pubmed with $n=5$.
  • With distortion budget $\theta=0.4$, recall of all eight original attacks drops below roughly 70 percent, and as $\theta$ approaches 1.0 the recall approaches 50 percent, i.e., random guessing.
  • Compared with the differential-privacy defense GAP, GRID keeps model accuracy flat while GAP's accuracy falls toward 60 percent at small privacy budgets, giving a better reported privacy-utility trade-off but with empirical rather than formal privacy guarantees.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • In inductive settings the paper does not specify who provides $P_i$ and $Q_i$ for nodes outside the training graph; if the provider must know a query node's neighborhood to noise it, the defense either fails for unseen nodes or leaks the very adjacency it protects.
  • Because the disguise target is a single global threshold $\delta$ estimated from sampled $n$-hop pairs, graphs with heterogeneous local density may be over-noised in sparse regions and under-noised in dense regions; per-region thresholds are a natural testable extension.
  • An attacker who ignores prediction similarity and uses other signals, such as influence-based or attribute-based cues, could bypass GRID; the paper's own numbers show influence-attack recall falls only about 10 percent, suggesting the defense is tuned specifically to similarity statistics.
  • The zero-utility guarantee covers label prediction only; downstream tasks that consume the full prediction vectors still see distortion up to $\theta$, so 'zero utility loss' is narrower than zero information loss.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper proposes GRID, a defense that adds noise to the prediction vectors of a selected subset of nodes (core nodes) after a GNN has been trained, with the goal of making the similarity of any adjacent node pair look like the similarity of an n-hop indirect pair, while constraining the noise so that the predicted label of every node is preserved and the distortion is bounded. The defense is formulated as a constrained optimization problem (OPT-GRID) and solved per core node by KKT-based projected gradient descent; core nodes are chosen by a threshold-based vertex-cover heuristic. Experiments on Citeseer, Cora, Pubmed, AIDS, and ENZYMES with GCN, GAT, GraphSAGE, and GIN report large reductions in link-stealing attack accuracy, unchanged model accuracy, and a better privacy-utility trade-off than five baselines.

Significance. The paper addresses an important and timely problem, and the experimental picture is broad: five datasets, eight similarity-based attacks, the ILS attacks, two influence-based attacks, four GNN backbones, and five baseline defenses, with ablations over the distortion budget, the hop count, and similarity metrics. The idea of disguising linked node pairs as n-hop indirect pairs is intuitive, and the reported attack degradation is consistent across tables, with model accuracy unchanged, which supports the empirical utility claim. However, the paper has no released code, no error bars or seeds, and several load-bearing formal claims are not supported by the provided algorithms, so the significance is contingent on fixing those gaps.

major comments (3)
  1. [4.2, Algorithm 1, Eq. (8)] The assertion in Section 4.2 that 'only one node in each edge is considered' is not guaranteed by Algorithm 1. As printed, the else branch (lines 17-19) adds nj whenever at least one endpoint is already in Nc, so after processing a triangle both endpoints of an edge can end up in Nc; moreover, even for a standard vertex-cover algorithm, a vertex cover is not an independent set and can contain both endpoints of an edge. For any edge (i,j) with i and j both in Nc, the per-node objectives Di and Dj in Eq. (8) are minimized against the unperturbed vectors vj and vi respectively, so the deployed quantity sim(vi+si, vj+sj) is not the quantity controlled by the optimization. The paper therefore does not establish the abstract's claim that the noisy prediction vectors of any two adjacent nodes have n-hop-like similarity; this is a load-bearing gap, not a tuning issue.
  2. [4.3.4, Algorithm 3] The paper claims a formal utility guarantee, but Algorithm 3 does not provably enforce the constraints of OPT-GRID. In Step 1 the vector is centered to satisfy sum_a s_a = 0 and then each coordinate is clamped to [-v_a, 1-v_a]; clamping changes the sum, and no subsequent step restores sum_a s_a = 0, so the returned noise can violate the probability-distribution constraint (6). The label-preservation adjustment in Step 3 is also heuristic: fixing one violated inequality can perturb earlier ones, and no termination or feasibility proof is given for the loop. A formal claim requires either a projection sequence with an invariant or an explicit statement that utility is guaranteed only when the solver converges to a feasible point.
  3. [5.1.3, Eq. (8), Section 6.1] Eq. (8) defines the similarity gap using the adjacent set Pi and n-hop set Qi of the node being perturbed. For nodes outside the training graph, which is the actual inductive setting described in Section 2.1, the defender does not have a neighborhood in the training graph, so Pi and Qi are undefined and no noise can be computed. The experimental protocol in Section 5.1.3 samples attack node pairs from D1, the training graph, so the reported GAT results do not demonstrate defense for unseen inductive queries. The paper should either restrict its claims to nodes with known adjacency or specify how Pi and Qi are obtained for out-of-training-graph queries.
minor comments (6)
  1. [Section 5.1] The experimental tables report no error bars or standard deviations over random seeds, which makes it difficult to assess the stability of the claimed attack degradation.
  2. [Section 5.2, Tables 4-5] Table 5 appears to be a duplicate of Table 4 with only the GCN values; the numbering and content should be checked.
  3. [Section 5.1.3] The description of the dataset splits is confusing: the text introduces D3 and D4, then says the defender classifier uses D4, and the testing pairs are later described as sampled 'In D1'; the relationship between these sets should be clarified.
  4. [Algorithm 1] There is a typo on line 11 ('countine' instead of 'continue'), and the condition 'ni, nj /∈ Nc' should be written explicitly as 'ni notin Nc and nj notin Nc' to avoid ambiguity.
  5. [References and Figures] Reference [3] has a malformed URL and is labelled 'Moco' while the text says it is the GAT code, and several figure axis labels appear corrupted (e.g., Figure 1 and Figure 2), so the figures need to be regenerated with proper text.
  6. [Section 1 and Section 5.2] The introduction claims that attack accuracy drops to around 50%, but the tables at the default setting θ=0.4 report Attack-6 accuracy around 68-69%; the settings under which the 50% figure holds should be stated near the first occurrence.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: GRID's objective directly targets the link-stealing signal, but the derivation is not equivalent to its inputs; only minor non-load-bearing self-citations by a co-author of the attack and MemGuard baselines were found.

full rationale

GRID's core optimization (Eq. 8) minimizes the gap between a core node's average similarity to its neighbors and its average similarity to n-hop nodes using the same corr+cos metric that similarity-based attacks use. This makes attack degradation unsurprising, but it is a design choice rather than a circular derivation: the paper does not fit GRID's parameters to attack accuracy, and it evaluates against eight attack variants, alternative similarity metrics (Fig. 1), and influence-based attacks that do not use the same objective. The 'zero utility loss' guarantee is enforced by the explicit argmax constraint (Eq. 5) and the projection in Algorithm 3; labeling a constraint as a guarantee is tautological in presentation but not a derived prediction. The paper cites [11] and [15], both co-authored by Neil Gong, for the attack model and a baseline, but the attack is a public benchmark with code and the similarity premise is independently verified in Section 4.1, so these self-citations are not load-bearing. The manuscript itself admits in Section 6.2 that a mathematical proof of guaranteed performance under stronger adaptive attacks is left to future work, and the claim in Section 4.2 that 'only one node in each edge is considered' is not guaranteed by Algorithm 1, which can place both endpoints of an edge in the core set; these are correctness or overclaim gaps, not circularity. Overall the derivation is self-contained against external benchmarks, so no circular step is established.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The central claim rests on a small number of hand-set parameters (theta, n, delta via data, optimizer settings) and three domain assumptions: attackers rely on corr+cos prediction similarity, defenders know Pi and Qi for every query, and the KKT-based solver reaches a feasible noise vector. No new physical or conceptual entities are introduced.

free parameters (4)
  • distortion budget theta = 0.4 (default), swept 0 to 1
    User-set upper bound on the L1 norm of the noise vector; all main tables use theta=0.4 and defense strength grows with theta.
  • hop count n = 3 (default), swept 2 to 6
    Defines the target n-hop indirect neighbor set Qi and the threshold delta; larger n improves defense but increases computation time.
  • similarity threshold delta = dataset-dependent average n-hop similarity, approximated from up to 1000 sampled pairs
    Used in Algorithm 1 to drop low-similarity edges from the core cover; derived from prediction vectors of the target model.
  • optimizer hyperparameters alpha, beta, K = K=20 in ablation; alpha and beta not reported
    Gradient descent step size and Lagrange multiplier update step for Algorithm 2; missing values hurt reproducibility.
assumptions (4)
  • domain assumption Attackers infer links primarily from the similarity of adjacent nodes' prediction vectors, measured by corr and cos.
    GRID optimizes exactly this signal in Eq. (3) and Eq. (8); if a future attack uses unrelated signals, the defense may not transfer. Section 3.2.2.
  • domain assumption For every queried node i, the defender knows its adjacent node set Pi and n-hop indirect node set Qi.
    Eq. (8) defines the defense objective in terms of these sets; the paper does not establish how they are obtained for unseen nodes in inductive settings. Section 5.1.3.
  • domain assumption The average similarity of n-hop indirect nodes is a valid disguise target for all protected edges.
    Used to set threshold delta and the optimization target; if n-hop pairs are too similar or too sparse, the disguise may fail. Algorithm 1.
  • standard math The KKT-based gradient descent procedure can find a noise vector satisfying L1-L3 constraints.
    The paper invokes Lagrange multipliers and KKT conditions but gives no convexity, convergence, or feasibility proof for Algorithm 2/3. Section 4.3.4.

how reviews work

0 comments
Cite this review

Pith. "Pith review of GRID: Protecting Training Graph from Link Stealing Attacks on GNN Models." pith.science (2026). https://pith.science/paper/GWJVV5GF

@misc{pith2026250110985,
  author       = {Pith},
  title        = {Pith review of: GRID: Protecting Training Graph from Link Stealing Attacks on GNN Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/GWJVV5GF}},
  note         = {Machine review of arXiv:2501.10985}
}
read the original abstract

Graph neural networks (GNNs) have exhibited superior performance in various classification tasks on graph-structured data. However, they encounter the potential vulnerability from the link stealing attacks, which can infer the presence of a link between two nodes via measuring the similarity of its incident nodes' prediction vectors produced by a GNN model. Such attacks pose severe security and privacy threats to the training graph used in GNN models. In this work, we propose a novel solution, called Graph Link Disguise (GRID), to defend against link stealing attacks with the formal guarantee of GNN model utility for retaining prediction accuracy. The key idea of GRID is to add carefully crafted noises to the nodes' prediction vectors for disguising adjacent nodes as n-hop indirect neighboring nodes. We take into account the graph topology and select only a subset of nodes (called core nodes) covering all links for adding noises, which can avert the noises offset and have the further advantages of reducing both the distortion loss and the computation cost. Our crafted noises can ensure 1) the noisy prediction vectors of any two adjacent nodes have their similarity level like that of two non-adjacent nodes and 2) the model prediction is unchanged to ensure zero utility loss. Extensive experiments on five datasets are conducted to show the effectiveness of our proposed GRID solution against different representative link-stealing attacks under transductive settings and inductive settings respectively, as well as two influence-based attacks. Meanwhile, it achieves a much better privacy-utility trade-off than existing methods when extended to GNNs.

Figures

Figures reproduced from arXiv: 2501.10985 by the authors.

Figure 1
Figure 1. Link stealing attack recall variations for eight different attacks [PITH_FULL_IMAGE:figures/full_fig_p010_1.png] view at source ↗
Figure 2
Figure 2. Link stealing attack recall variations for eight different attacks under GRID with increasing distortion thresholds. [PITH_FULL_IMAGE:figures/full_fig_p012_2.png] view at source ↗
Figure 3
Figure 3. Link stealing attack recall and the core node set size variations [PITH_FULL_IMAGE:figures/full_fig_p012_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: The model prediction accuracy and link stealing attack accuracy variations for GAP and GRID with different hyperparameters. [PITH_FULL_IMAGE:figures/full_fig_p013_4.png]
Figure 5
Figure 5. Figure 5: Trade-offs between the defense performance and the utility [PITH_FULL_IMAGE:figures/full_fig_p013_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

50 extracted references · 45 canonical work pages

  1. [1]

    https://https://github.com/tkipf/gcn

    Graph convolutional networks. https://https://github.com/tkipf/gcn

    work page

  2. [2]

    https://github.com/xinle ihe/link stealing attack

    Stealing links from graph neural networks. https://github.com/xinle ihe/link stealing attack

    work page

  3. [3]

    https://github.com/PetarV-/GAT, 2017

    Moco. https://github.com/PetarV-/GAT, 2017

    work page 2017

  4. [4]

    Deep learning with differential privacy

    Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the ACM SIGSAC conference on computer and communications security (CCS) , pages 308–318, 2016

    work page 2016

  5. [5]

    Structural, Syntactic, and Statistical Pattern Recognition

    Terry Caelli, Adnan Amin, Robert PW Duin, Mohamed Kamel, and Dick de Ridder. Structural, Syntactic, and Statistical Pattern Recognition. Springer, 2002

    work page 2002

  6. [6]

    Extracting training data from large language models

    Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-V oss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, et al. Extracting training data from large language models. In Proceedings of USENIX Security Symposium (USENIX Security 21) , pages 2633–2650, 2021

    work page 2021

  7. [7]

    Exploring connections between active learning and model extraction

    Varun Chandrasekaran, Kamalika Chaudhuri, Irene Giacomelli, Somesh Jha, and Songbai Yan. Exploring connections between active learning and model extraction. In USENIX Security Symposium, pages 1309–1326, 2020

    work page 2020

  8. [8]

    Label-only membership inference attacks

    Christopher A Choquette-Choo, Florian Tramer, Nicholas Carlini, and Nicolas Papernot. Label-only membership inference attacks. In Proceedings of International Conference on Machine Learning (ICML), pages 1964–1974, 2021

    work page 1964

Show all 50 references
  1. [9]

    Distinguishing enzyme structures from non-enzymes without alignments

    Paul D Dobson and Andrew J Doig. Distinguishing enzyme structures from non-enzymes without alignments. Journal of molecular biology , 330(4):771–783, 2003

    2003

  2. [10]

    Inductive repre- sentation learning on large graphs

    Will Hamilton, Zhitao Ying, and Jure Leskovec. Inductive repre- sentation learning on large graphs. Advances in neural information processing systems, 30, 2017

    2017

  3. [11]

    Stealing links from graph neural networks

    Xinlei He, Jinyuan Jia, Michael Backes, Neil Zhenqiang Gong, and Yang Zhang. Stealing links from graph neural networks. In USENIX Security Symposium (USENIX Security 21) , pages 2669–2686, 2021

    2021

  4. [12]

    Node-level membership inference attacks against graph neural networks

    Xinlei He, Rui Wen, Yixin Wu, Michael Backes, Yun Shen, and Yang Zhang. Node-level membership inference attacks against graph neural networks. arXiv preprint arXiv:2102.05429 , 2021

    2021 arXiv

  5. [13]

    Transmia: membership inference attacks using transfer shadow training

    Seira Hidano, Takao Murakami, and Yusuke Kawamoto. Transmia: membership inference attacks using transfer shadow training. In Proceedings of International Joint Conference on Neural Networks (IJCNN), pages 1–10, 2021

    2021

  6. [14]

    High accuracy and high fidelity extraction of neural networks

    Matthew Jagielski, Nicholas Carlini, David Berthelot, Alex Kurakin, and Nicolas Papernot. High accuracy and high fidelity extraction of neural networks. In USENIX security symposium , pages 1345–1362, 2020

    2020

  7. [15]

    Memguard: Defending against black-box membership inference attacks via adversarial examples

    Jinyuan Jia, Ahmed Salem, Michael Backes, Yang Zhang, and Neil Zhenqiang Gong. Memguard: Defending against black-box membership inference attacks via adversarial examples. In Proceed- ings of the ACM SIGSAC conference on computer and communica- tions security (CCS) , pages 259...

    2019

  8. [16]

    Semi-supervised classification with graph convolutional networks

    Thomas N Kipf and Max Welling. Semi-supervised classification with graph convolutional networks. 2017

    2017

  9. [17]

    Stolen memories: Leveraging model memorization for calibrated {White-Box} membership inference

    Klas Leino and Matt Fredrikson. Stolen memories: Leveraging model memorization for calibrated {White-Box} membership inference. In USENIX Security Symposium (USENIX Security 20) , pages 1605– 1622, 2020

    2020

  10. [18]

    Membership inference attacks and defenses in classification models

    Jiacheng Li, Ninghui Li, and Bruno Ribeiro. Membership inference attacks and defenses in classification models. In Proceedings of the Eleventh ACM Conference on Data and Application Security and Privacy (CODASPY), pages 5–16, 2021

    2021

  11. [19]

    Membership leakage in label-only exposures

    Zheng Li and Yang Zhang. Membership leakage in label-only exposures. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security (CCS) , pages 880–895, 2021

    2021

  12. [20]

    Encodermi: Membership inference against pre-trained encoders in contrastive learning

    Hongbin Liu, Jinyuan Jia, Wenjie Qu, and Neil Zhenqiang Gong. Encodermi: Membership inference against pre-trained encoders in contrastive learning. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security (CCS) , pages 2081–2095, 2021

    2021

  13. [21]

    Devil in disguise: Breaching graph neural networks privacy through infiltration

    Lingshuo Meng, Yijie Bai, Yanjiao Chen, Yutong Hu, Wenyuan Xu, and Haiqin Weng. Devil in disguise: Breaching graph neural networks privacy through infiltration. In Proceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS) , pages 1153–1167, 2023

    2023

  14. [22]

    Comprehensive pri- vacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning

    Milad Nasr, Reza Shokri, and Amir Houmansadr. Comprehensive pri- vacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning. In Proceedings of IEEE symposium on security and privacy (S&P) , pages 739–753

  15. [23]

    Machine learning with membership privacy using adversarial regularization

    Milad Nasr, Reza Shokri, and Amir Houmansadr. Machine learning with membership privacy using adversarial regularization. In Pro- ceedings of the ACM SIGSAC conference on computer and commu- nications security , pages 634–646, 2018

    2018

  16. [24]

    Membership inference attack on graph neural networks

    Iyiola E Olatunji, Wolfgang Nejdl, and Megha Khosla. Membership inference attack on graph neural networks. In IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications (TPS-ISA) , pages 11–20, 2021

    2021

  17. [25]

    White-box vs black-box: Bayes optimal strategies for membership inference

    Alexandre Sablayrolles, Matthijs Douze, Cordelia Schmid, Yann Ol- livier, and Herv ´e J ´egou. White-box vs black-box: Bayes optimal strategies for membership inference. In Proceedings of International Conference on Machine Learning (ICML) , pages 5558–5567, 2019

    2019

  18. [26]

    Gap: Differentially private graph neural net- works with aggregation perturbation

    Sina Sajadmanesh, Ali Shahin Shamsabadi, Aur ´elien Bellet, and Daniel Gatica-Perez. Gap: Differentially private graph neural net- works with aggregation perturbation. In USENIX Security 2023, 2023

    2023

  19. [27]

    Gap: Differentially private graph neural net- works with aggregation perturbation

    Sina Sajadmanesh, Ali Shahin Shamsabadi, Aur ´elien Bellet, and Daniel Gatica-Perez. Gap: Differentially private graph neural net- works with aggregation perturbation. In USENIX Security Symposium (USENIX Security) , 2023

    2023

  20. [28]

    Updates-leak: Data set inference and reconstruction attacks in online learning

    Ahmed Salem, Apratim Bhattacharya, Michael Backes, Mario Fritz, and Yang Zhang. Updates-leak: Data set inference and reconstruction attacks in online learning. In Proceedings of 29th {USENIX} Security Symposium, pages 1291–1308, 2020

    2020

  21. [29]

    Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models

    Ahmed Salem, Yang Zhang, Mathias Humbert, Mario Fritz, and Michael Backes. Ml-leaks: Model and data independent membership inference attacks and defenses on machine learning models. In Network and Distributed Systems Security Symposium (NDSS) , 2019

    2019

  22. [30]

    The graph neural network model

    Franco Scarselli, Marco Gori, Ah Chung Tsoi, Markus Hagenbuchner, and Gabriele Monfardini. The graph neural network model. IEEE transactions on neural networks , 20(1):61–80, 2008

    2008

  23. [31]

    Privacy-preserving deep learning

    Reza Shokri and Vitaly Shmatikov. Privacy-preserving deep learning. In Proceedings of the ACM SIGSAC conference on computer and communications security (CCS) , pages 1310–1321, 2015

    2015

  24. [32]

    Membership inference attacks against machine learning models

    Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In IEEE symposium on security and privacy (S&P) , pages 3–18, 2017

    2017

  25. [33]

    Information leakage in embedding models

    Congzheng Song and Ananth Raghunathan. Information leakage in embedding models. In Proceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS) , pages 377–390, 2020

    2020

  26. [34]

    Systematic evaluation of privacy risks of machine learning models

    Liwei Song and Prateek Mittal. Systematic evaluation of privacy risks of machine learning models. In Proceedings of {USENIX} Security Symposium, 2021

    2021

  27. [35]

    Privacy risks of securing machine learning models against adversarial examples

    Liwei Song, Reza Shokri, and Prateek Mittal. Privacy risks of securing machine learning models against adversarial examples. In Proceedings of ACM SIGSAC Conference on Computer and Commu- nications Security (CCS) , pages 241–257, 2019

    2019

  28. [36]

    Dropout: a simple way to prevent neural networks from overfitting

    Nitish Srivastava, Geoffrey Hinton, Alex Krizhevsky, Ilya Sutskever, and Ruslan Salakhutdinov. Dropout: a simple way to prevent neural networks from overfitting. The journal of machine learning research , 15(1):1929–1958, 2014

    1929

  29. [37]

    Stealing machine learning models via prediction {APIs}

    Florian Tram `er, Fan Zhang, Ari Juels, Michael K Reiter, and Thomas Ristenpart. Stealing machine learning models via prediction {APIs}. In USENIX security symposium , pages 601–618, 2016

    2016

  30. [38]

    Graph attention networks

    Petar Veli ˇckovi´c, Guillem Cucurull, Arantxa Casanova, Adriana Romero, Pietro Li `o, and Yoshua Bengio. Graph attention networks. In International Conference on Learning Representations , 2018

    2018

  31. [39]

    Stealing hyperparameters in machine learning

    Binghui Wang and Neil Zhenqiang Gong. Stealing hyperparameters in machine learning. In 2018 IEEE Symposium on Security and Privacy (SP), pages 36–52. IEEE, 2018

    2018

  32. [40]

    Differentially private empirical risk minimization revisited: Faster and more general

    Di Wang, Minwei Ye, and Jinhui Xu. Differentially private empirical risk minimization revisited: Faster and more general. Advances in Neural Information Processing Systems , 30, 2017

    2017

  33. [41]

    Link membership inference at- tacks against unsupervised graph representation learning

    Xiuling Wang and Wendy Hui Wang. Link membership inference at- tacks against unsupervised graph representation learning. In Proceed- ings of the 39th Annual Computer Security Applications Conference , pages 477–491, 2023

    2023

  34. [42]

    Semi-supervised classification with graph convolutional networks

    Max Welling and Thomas N Kipf. Semi-supervised classification with graph convolutional networks. In International Conference on Learning Representations (ICLR) , 2017

    2017

  35. [43]

    Vertex cover

    Wikipedia. Vertex cover. https://en.wikipedia.org/wiki/Vertex cover

  36. [44]

    Adapting membership inference attacks to gnn for graph classification: Ap- proaches and implications

    Bang Wu, Xiangwen Yang, Shirui Pan, and Xingliang Yuan. Adapting membership inference attacks to gnn for graph classification: Ap- proaches and implications. In IEEE International Conference on Data Mining (ICDM) , pages 1421–1426, 2021

    2021

  37. [45]

    Linkteller: Recovering private edges from graph neural networks via influence analysis

    Fan Wu, Yunhui Long, Ce Zhang, and Bo Li. Linkteller: Recovering private edges from graph neural networks via influence analysis. In IEEE Symposium on Security and Privacy (SP) , pages 2005–2024, 2022

    2005

  38. [46]

    Link stealing attacks against inductive graph neural networks

    Yixin Wu, Xinlei He, Pascal Berrang, Mathias Humbert, Michael Backes, Neil Zhenqiang Gong, and Yang Zhang. Link stealing attacks against inductive graph neural networks. arXiv preprint arXiv:2405.05784, 2024

    2024 arXiv

  39. [47]

    How powerful are graph neural networks? In International Conference on Learning Representations (ICLR) , 2019

    Keyulu Xu, Weihua Hu, Jure Leskovec, and Stefanie Jegelka. How powerful are graph neural networks? In International Conference on Learning Representations (ICLR) , 2019

    2019

  40. [48]

    Differentially private model publishing for deep learning

    Lei Yu, Ling Liu, Calton Pu, Mehmet Emre Gursoy, and Stacey Truex. Differentially private model publishing for deep learning. In 2019 IEEE Symposium on Security and Privacy (SP) , pages 332–349. IEEE, 2019

    2019

  41. [49]

    Graph transformer networks

    Seongjun Yun, Minbyul Jeong, Raehyun Kim, Jaewoo Kang, and Hyunwoo J Kim. Graph transformer networks. Advances in neural information processing systems , 32, 2019

    2019

  42. [50]

    Demystifying uneven vulnerability of link stealing attacks against graph neural networks

    He Zhang, Bang Wu, Shuo Wang, Xiangwen Yang, Minhui Xue, Shirui Pan, and Xingliang Yuan. Demystifying uneven vulnerability of link stealing attacks against graph neural networks. In International Conference on Machine Learning (ICML) , pages 41737–41752, 2023. Appendix A. Addi...

    2023

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.