Pith. sign in

REVIEW 4 major objections 6 minor 60 references

Who Owns This Sample: Cross-Client Membership Inference Attack in Federated Graph Neural Networks

T0 review · 4 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A malicious client in federated graph learning can infer which client owns a given node, the paper claims, by combining a shadow-dataset membership classifier with gradient-inversion prototype matching.

desk verdict This paper names a real gap—cross-client ownership inference in FedGNNs—but the evaluation uses a stronger adversary than the threat model grants, so the headline numbers don't back the claim. read the letter →

arxiv 2507.19964 v1 pith:QXSAL5UX submitted 2025-07-26 cs.LG

Kunhao Li , Di Wu , Jun Bai , Jing Xu , Lei Yang , Ziyi Zhang , Yiliao Song , Wencheng Yang
show 2 more authors
Taotao Cai Yan Li
This is my paper · ORCID
classification cs.LG
keywords cross-clientmembershipinferencefederatedgraphneuralnetworksclientownershipidentificationgradientinversionprototypematchingnodeclassificationprivacyattack
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that in federated graph learning, a malicious client can learn not just whether a node was in another client's training set but which client owns it. It proposes CC-MIA, a two-part attack: a shadow-dataset classifier performs membership inference on node embeddings, while gradient inversion plus class-specific prototype matching attributes nodes to their source clients. The authors report AUC up to 86.04% for membership inference on Citeseer with SCAFFOLD and ownership accuracy up to 27.95% for ten clients against a 10% random baseline. If correct, this shows that client identity leaks through model updates and graph structure even in federated settings.

What carries the argument

Two mechanisms carry the attack. First, membership inference: the attacker trains an MLP classifier with batch normalization and dropout on embeddings from a shadow graph, labeled by whether the corresponding node was in the shadow training set; the classifier is then applied to target nodes through the global GNN. Second, client identification: the attacker inverts each intercepted client gradient by minimizing negative cosine similarity between real and synthetic gradients with graph smoothness and sparsity penalties, computes class prototypes per client from reconstructed subgraph embeddings, and assigns a node to the client whose same-class prototype has maximum cosine similarity.

What would settle it

An evaluation that withholds the full target graph and ground-truth labels, allowing the attacker only its own subgraph, a public shadow dataset, and intercepted gradients, would settle whether the reported accuracy survives the stated threat model: if accuracy collapses toward random, the attack's headlined performance depends on oracle access.

Watch

Extended reading notes

Core claim

On its own terms, the paper's central discovery is that sample-to-client attribution is learnable in federated GNNs: the global model's message passing makes node embeddings cluster by client and class, and those clusters can be recovered by an attacker that eavesdrops on client gradients. Membership inference succeeds because a publicly available graph from the same domain, passed through the global model, produces embeddings that train a transferable binary member/non-member classifier. Client identification succeeds because gradient inversion reconstructs each client's subgraph, and the first GNN layer's class prototypes are distinctive enough that cosine similarity assigns a query node to its true client.

Load-bearing premise

The results assume the attacker already possesses the full target graph and the true labels of the queried nodes, while the stated threat model gives the attacker only its own subgraph, a public shadow dataset, and intercepted gradients.

Editorial extensions

If this is right

  • Cross-client membership inference works across FedAvg, FedProx, SCAFFOLD, FedDF, and FedNova, and across GCN, GAT, and GraphSAGE, so the risk is not tied to one aggregation rule or model family.
  • Public shadow datasets from the same domain suffice for membership inference, meaning the attacker does not need access to the victims' local data.
  • Client attribution stays above the uniform random baseline by at least 95% and, in relative terms, improves as the number of clients grows, so larger federations do not erase the identity signal.
  • Gradient inversion quality degrades as the number of clients increases, with feature reconstruction error rising, which bounds the client-identification arm under heavier federation.
  • The paper's defense analysis indicates that perturbation-based defenses only drive client identification to near-random at noise levels that severely damage global model utility.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial extension: if the prototype-separability finding transfers beyond these transductive citation datasets, the same two-stage attack may apply to dynamic or inductive federated graph settings.
  • Editorial extension: the construction of gradient inversion plus prototype matching could likely be adapted to attribute edges or subgraphs rather than only nodes.
  • Editorial extension: applying the attack under randomized or IID client partitions would directly test the paper's stated limitation that real-world non-IID distributions may break prototype separability.
  • Editorial extension: because Algorithm 2's matching requires the full target graph and true labels, the strong reported numbers likely overstate the stated threat model; re-running with the attacker strictly limited to its own subgraph would isolate how much of the signal is structural rather than oracle-based.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper introduces CC-MIA, a two-part attack framework for federated graph neural networks (FedGNNs). The first part is a cross-client membership inference attack in which a malicious client trains a binary classifier on a public shadow dataset to infer whether a node was in another client's training set. The second part is a client-data identification attack that eavesdrops on client gradients, reconstructs client subgraphs via gradient inversion, builds class-specific prototypes, and assigns query nodes to clients by prototype matching. The authors evaluate the attack across six datasets, five federated aggregation algorithms, and three GNN architectures, reporting membership-inference AUCs up to 86.04% and client-identification accuracy up to 27.95% for 10 clients against a uniform 10% baseline. The central claim is that a malicious client with only its local subgraph, a public shadow dataset, and eavesdropped gradients can both infer membership and attribute nodes to source clients.

Significance. If the claimed attack worked under the stated threat model, it would be a meaningful contribution: it targets a privacy risk specific to federated graph learning, namely client-level attribution of nodes, and it addresses an underexplored setting. The paper covers a broad experimental matrix and includes ablation studies, complexity analysis, and a defense discussion, which are useful. However, the evaluation does not instantiate the adversary defined in Section 3.1: the client-identification algorithm requires the full target graph and ground-truth labels, and the membership-inference shadow dataset is selected using target-set performance. These are not minor implementation details; they directly affect whether the reported numbers support the paper's headline claims. As a result, the significance of the empirical findings is not established for the claimed threat model.

major comments (4)
  1. [§3.1, Algorithm 2, Eq. (16)] The client-identification evaluation does not instantiate the adversary defined in §3.1. The threat model grants the attacker only its own local subgraph Ga, a public shadow dataset, and eavesdropped gradients, but Algorithm 2 takes the full target graph (X,A) as input and line 8 computes E = F1(X,A) over the entire graph. Moreover, Eq. (16) uses the true label yi of every queried node to select the prototype μ(k)_yi, and Algorithm 1 requires ground-truth labels Y as input. Without full-graph embeddings and true labels, the prototype-matching step cannot be computed as written, so the client-identification results in Table 1 (right side) and Table 7 are achieved by an adversary strictly stronger than the one claimed. This is load-bearing because the paper's central claim is that a malicious client can perform these attacks with only the capabilities listed in §3.1.
  2. [§5.3, Table 1] The membership-inference results are inflated by test-set shadow selection. Section 5.3 states that the authors report 'the shadow dataset for each target dataset that achieves the best attack performance,' which means the shadow dataset is chosen by evaluating on the target dataset. Under the §3.1 threat model, the attacker does not have access to the target graph or its member/non-member labels, so selecting the shadow dataset by target-set performance violates the threat model and makes the reported AUCs (e.g., 86.04% for Citeseer/SCAFFOLD) optimistic. A valid evaluation would pre-register the shadow dataset based only on public information or report results averaged over all candidate shadow datasets.
  3. [§5.4, Table 1, Fig. 4] The client-identification baseline is too weak to support the reported improvements. The only comparison is 'Client-uniform Probability' (1/K), but Fig. 4 shows that METIS produces strongly class-homogeneous client subgraphs; a trivial attacker that predicts the client from the node class, or from class-conditional prototypes, would already beat 1/K. The 'Max Improve %' row in Table 1 is therefore an improvement over uniform random, not over a realistic baseline, and the reported 27.95% accuracy for 10 clients does not demonstrate that CC-MIA's prototype matching adds value beyond class-based leakage. The ablation 'CC-MIA (no prot)' in Table 3 still achieves 20.82% with 10 clients, which should be compared against a class-only baseline before attribution accuracy is attributed to the proposed method.
  4. [Eqs. (15)-(16), Algorithm 2] The client-identification pipeline is partly circular with respect to the data. Prototypes Pk are built from reconstructed subgraphs using labels (Eq. 15), and the same labels are used to match query nodes in Eq. (16). Because METIS creates class-homogeneous clients, the matching procedure can reduce to a class-prediction task rather than a client-identity task. The paper does not control for this, for example by reporting performance conditioned on correct versus incorrect label predictions or by comparing against a classifier that uses only predicted class, so the attribution accuracy may overstate the attack's ability to distinguish clients beyond class structure.
minor comments (6)
  1. [§5.3, Table 1] The claim of 'a maximum improvement of 72.16%' is relative to the HP-MIA baseline on Citeseer/SCAFFOLD; the reference baseline should be stated explicitly whenever percentage improvements are reported.
  2. [Appendix A.7] There is a typo: 'Reciever' should be 'Receiver.' Also, Eq. (18) defines RNMSE as ||x_v - \hat{x}_v|| / ||x_v||, which is a relative error rather than a normalized root mean squared error in the usual sense; the metric name should be reconciled with the definition.
  3. [Algorithm 1, Algorithm 2] The notation \hat{E}^j_k and I^c_k is used without defining the superscript j as a node index; the notation should be clarified for reproducibility.
  4. [References] The reference list contains duplicate entries: [15] and [16] both refer to He et al., 'Node-level membership inference attacks against graph neural networks.' The duplicates should be unified.
  5. [Table 3] The 'CC-MIA (norm)' entry for 10 clients is 9.12%, below the 10% uniform baseline; the text says it 'performs near random,' but below-random accuracy suggests a systematic bias in the normalized variant and deserves a comment.
  6. [Figure 3] The captions and legends in Figure 3 are difficult to parse: each subfigure mixes client-class labels and the caption labels like '(a) Client3' appear inconsistent with the number of clients displayed; the figure should be reorganized for clarity.

Circularity Check

1 steps flagged · score 4.0 of 10

Membership-inference AUCs are partly fitted by selecting the best shadow dataset on the target test data; the client-identification setup also assumes full-graph and ground-truth-label access outside the declared threat model, though the core attack pipeline is not derivationally circular.

  1. fitted input called prediction [Section 5.3, Table 1 (Membership Inference Attack Results)]
    "Specifically, we report the shadow dataset for each target dataset that achieves the best attack performance when the number of clients is set to 5. AUC is employed to evaluate attack performance, ensuring that biases introduced by training-set proportion are effectively mitigated. The MIA results obtained using the optimal shadow data set are reported on the left side of Table 1."

    The shadow dataset is a training input to the MIA classifier (Eq. 9 optimizes f_w on the shadow-graph embeddings and membership labels). Selecting the shadow dataset that maximizes the target dataset's AUC means the reported AUC is the maximum over candidate attack configurations, measured on the same target nodes that drove the selection. The 'prediction' is therefore fitted to the target labels/nodes rather than produced by a fixed adversary that must commit to one shadow before seeing the target. This inflates the headline membership-inference numbers, including the 86.04% Citeseer/SCAFFOLD AUC, and the claimed 'maximum improvement of 72.16%' is relative to the optimally chosen shadow, not to an a-priori setup.

full rationale

The derivation chain of CC-MIA itself is not circular: the membership-inference classifier is trained on a public shadow graph and applied to global-GNN embeddings of target nodes, and the client-identification pipeline uses gradient inversion to build client prototypes and then matches query-node embeddings to those prototypes. These are independent predictive signals, and no load-bearing result is imported from the authors' own prior work. The main circular element is the shadow-selection protocol in Section 5.3, where the attack configuration is chosen by peeking at the target test AUC and the resulting selected maximum is then reported as CC-MIA performance; this is a fitted-input-called-prediction issue. A separate, non-circular validity concern is that Algorithm 2 takes the full real graph (X, A) as input and uses ground-truth labels y_i in Eq. 16 and line 11, while the Section 3.1 threat model grants only the attacker's own subgraph, a shadow dataset, and eavesdropped gradients; this mismatches the declared adversary, but it does not make the client-identification computation equivalent to its output by construction, so it is weighed as a correctness/threat-model gap rather than as a circularity step. Because the core attack has independent content and only the membership-inference evaluation is partly fitted, a score of 4 is appropriate.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The central claim depends on several assumptions that are either unstated or only weakly supported: full graph access, known labels, class-homogeneous partitions, and the ability to eavesdrop on raw gradients. The free parameters are standard hyperparameters plus the test-set-selected shadow dataset.

free parameters (6)
  • alpha (smoothness weight) = 1e-3
    Eq 12 balances gradient fitting versus feature smoothness; set by hand.
  • beta (sparsity weight) = 1e-4
    Eq 12 balances adjacency sparsity; set by hand.
  • hidden dimension = 128
    Section 5.2 sets hidden neurons to 128 for both GNN and attack model.
  • training fraction = 40%
    Section 5.2 allocates 40% of the target dataset as the training set, which determines membership ground truth.
  • edge density rho = known
    Eq 14 assumes the attacker knows the edge density to retain the top Ne edges.
  • best shadow dataset = chosen per target dataset
    Section 5.3 selects the shadow dataset that maximizes attack AUC on the target test set, a form of test-set selection.
assumptions (5)
  • domain assumption Gradient labels can be inferred from intercepted gradients
    Section 4.2 states labels are known and 'can be easily inferred from gradients [59]'; no validation is provided for graph data.
  • ad hoc to paper Attacker can access the full target graph (X, A) for inference
    Algorithm 2 line 8 computes E = F1(X, A), which requires the full target graph; the threat model only grants the attacker its own subgraph.
  • domain assumption Graph data satisfies feature smoothness
    Eq 11 smoothness loss assumes connected nodes have similar features, which only holds for certain graph types.
  • domain assumption METIS partitions produce class-homogeneous subgraphs
    Section 5.2 and Fig 4 show strongly non-IID class distributions, which may make client inference easier via class priors.
  • domain assumption Eavesdropping on client gradient uploads is possible
    Threat model item 3 in Section 3.1 assumes the attacker can intercept individual client gradients, citing prior work.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Who Owns This Sample: Cross-Client Membership Inference Attack in Federated Graph Neural Networks." pith.science (2026). https://pith.science/paper/QXSAL5UX

@misc{pith2026250719964,
  author       = {Pith},
  title        = {Pith review of: Who Owns This Sample: Cross-Client Membership Inference Attack in Federated Graph Neural Networks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/QXSAL5UX}},
  note         = {Machine review of arXiv:2507.19964}
}
read the original abstract

Graph-structured data is prevalent in many real-world applications, including social networks, financial systems, and molecular biology. Graph Neural Networks (GNNs) have become the de facto standard for learning from such data due to their strong representation capabilities. As GNNs are increasingly deployed in federated learning (FL) settings to preserve data locality and privacy, new privacy threats arise from the interaction between graph structures and decentralized training. In this paper, we present the first systematic study of cross-client membership inference attacks (CC-MIA) against node classification tasks of federated GNNs (FedGNNs), where a malicious client aims to infer which client owns the given data. Unlike prior centralized-focused work that focuses on whether a sample was included in training, our attack targets sample-to-client attribution, a finer-grained privacy risk unique to federated settings. We design a general attack framework that exploits FedGNNs' aggregation behaviors, gradient updates, and embedding proximity to link samples to their source clients across training rounds. We evaluate our attack across multiple graph datasets under realistic FL setups. Results show that our method achieves high performance on both membership inference and ownership identification. Our findings highlight a new privacy threat in federated graph learning-client identity leakage through structural and model-level cues, motivating the need for attribution-robust GNN design.

Figures

Figures reproduced from arXiv: 2507.19964 by the authors.

Figure 1
Figure 1. 4.1 Membership Inference Attack Local GNN Training. Given the threat model and Definition 1, the target graph is partitioned by METIS [19] across K clients as G(X, A) = G1(X1, A1), . . . , Gk(XK, AK), where client k holds subgraph Gk with node features Xk and adjacency Ak. 3 [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 1
Figure 1. Framework overview of CC-MIA. Our MIA is designed to address two objectives: (i) Membership inference, where the attacker employs a public shadow dataset with a similar structure to the target data to train a binary classifier, enabling inference of whether a given node belongs to the training set; and (ii) Client-data identification, which employs gradient inversion to reconstruct pseudo node features and adjacenci… view at source ↗
Figure 4
Figure 4. Specifically, 40% of the target dataset is allocated as the training-set, while the entire shadow dataset is used for [PITH_FULL_IMAGE:figures/full_fig_p007_4.png] view at source ↗
Figures from the paper (7 more)
Figure 2
Figure 2. Figure 2: Inverse comparison of node features of each client on Citeseer. Clt: Client; GT: Ground-truth; Inv: Inverse. [PITH_FULL_IMAGE:figures/full_fig_p009_2.png]
Figure 3
Figure 3. Figure 3: The visualization of each client prototype on Cora generated by [PITH_FULL_IMAGE:figures/full_fig_p010_3.png]
Figure 4
Figure 4. Figure 4: Class distribution in different clients based on citation networks. [PITH_FULL_IMAGE:figures/full_fig_p016_4.png]
Figure 5
Figure 5. Figure 5: The convergence of CC-MIA under membership inference. A.11 Convergence Analysis To validate the effectiveness of CC-MIA, we conducted convergence evaluations for both membership inference and client-data identification. Specifically, for membership inference, we plot t…
Figure 6
Figure 6. Figure 6: The convergence of CC-MIA under client-data identification. For client-data identification, we examined the convergence of gradient inversion by plotting the loss curves for reconstructing node features and graph structures, as shown in [PITH_FULL_IMAGE:figures/full_f…
Figure 7
Figure 7. Figure 7: The potential defense against CC-MIA for training-set inference. 2000 4000 6000 8000 10000 Privacy Budget 62 64 66 68 Utility Accuracy Utility Accuracy 34 36 38 40 42 44 46 48 MIA Accuracy MIA Accuracy (a) 3-Client 2000 4000 6000 8000 10000 Privacy Budget 62 64 66 68 7…
Figure 8
Figure 8. Figure 8: The potential defense against CC-MIA for client-data identification. 21 [PITH_FULL_IMAGE:figures/full_fig_p021_8.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

60 extracted references · 55 canonical work pages

  1. [1]

    Anand Sinha, Y

    D. Anand Sinha, Y . Liu, R. Du, and Y . Shen. Gradient inversion attack on graph neural networks.arXiv e-prints, pages arXiv–2411, 2024

    work page 2024

  2. [2]

    Bagdasaryan, A

    E. Bagdasaryan, A. Veit, Y . Hua, D. Estrin, and V . Shmatikov. How to backdoor federated learning. InInternational conference on artificial intelligence and statistics, pages 2938–2948. PMLR, 2020

    2020

  3. [3]

    J. Bai, D. Wu, S. Zeng, Y . Zhao, Y . Qu, and S. Yu. Non-iid free federated learning with fuzzy optimization for consumer electronics systems. IEEE Transactions on Consumer Electronics, 2025

    work page 2025

  4. [4]

    L. Bai, H. Hu, Q. Ye, H. Li, L. Wang, and J. Xu. Membership inference attacks and defenses in federated learning: A survey. ACM Computing Surveys, 57(4):1–35, 2024

    work page 2024

  5. [5]

    Behnia, M

    R. Behnia, M. R. Ebrahimi, J. Pacheco, and B. Padmanabhan. Ew-tune: A framework for privately fine-tuning large language models with differential privacy. In 2022 IEEE International Conference on Data Mining Workshops (ICDMW), pages 560–566. IEEE, 2022

    work page 2022

  6. [6]

    A. N. Bhagoji, S. Chakraborty, P. Mittal, and S. Calo. Analyzing federated learning through an adversarial lens. In International conference on machine learning, pages 634–643. PMLR, 2019. 9 Li et al. Cross-Client Membership Inference Attack Client 0 - Class 0 Client 0 - Class 1 Client 0 - Class 2 Client 0 - Class 3 Client 0 - Class 4 Client 0 - Class 5 C...

    work page 2019

  7. [7]

    Bojchevski and S

    A. Bojchevski and S. Günnemann. Deep gaussian embedding of graphs: Unsupervised inductive learning via ranking. 2018

    work page 2018

  8. [8]

    Chatzikokolakis, M

    K. Chatzikokolakis, M. E. Andrés, N. E. Bordenabe, and C. Palamidessi. Broadening the scope of differential privacy using metrics. In international symposium on privacy enhancing technologies symposium, pages 82–102. Springer, 2013

    work page 2013

Show all 60 references
  1. [9]

    S. Chen, W. Wang, Y . Zhong, Z. Ying, W. Tang, and Z. Pan. Hp-mia: A novel membership inference attack scheme for high membership prediction precision. Computers & Security, 136:103571, 2024

    2024

  2. [10]

    W. Chen, S. He, H. Qu, and X. Zhang. {LeapGNN}: Accelerating distributed {GNN} training leveraging {Feature-Centric} model migration. In 23rd USENIX Conference on File and Storage Technologies (FAST 25), pages 255–270, 2025

    2025

  3. [11]

    Conti, J

    M. Conti, J. Li, S. Picek, and J. Xu. Label-only membership inference attack against node-level graph neural networks. In Proceedings of the 15th ACM Workshop on Artificial Intelligence and Security, pages 1–12, 2022

    2022

  4. [12]

    Y . Gu, Y . Bai, and S. Xu. Cs-mia: Membership inference attack based on prediction confidence series in federated learning. Journal of Information Security and Applications, 67:103201, 2022

    2022

  5. [13]

    Hamilton, Z

    W. Hamilton, Z. Ying, and J. Leskovec. Inductive representation learning on large graphs. Advances in neural information processing systems, 30, 2017

    2017

  6. [14]

    S. He, F. Bastani, S. Jagwani, E. Park, S. Abbar, M. Alizadeh, H. Balakrishnan, S. Chawla, S. Madden, and M. A. Sadeghi. Roadtagger: Robust road attribute inference with graph neural networks. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 34, pages 1...

    2020

  7. [16]

    X. He, R. Wen, Y . Wu, M. Backes, Y . Shen, and Y . Zhang. Node-level membership inference attacks against graph neural networks. arXiv preprint arXiv:2102.05429, 2021

    2021 arXiv

  8. [17]

    R. Hu, Y . Gong, and Y . Guo. Federated learning with sparsification-amplified privacy and adaptive optimization. In Proceedings of the Thirtieth International Joint Conference on Artificial Intelligence, 2021

    2021

  9. [18]

    S. P. Karimireddy, S. Kale, M. Mohri, S. Reddi, S. Stich, and A. T. Suresh. Scaffold: Stochastic controlled averaging for federated learning. In International conference on machine learning, pages 5132–5143. PMLR, 2020

    2020

  10. [19]

    Karypis and V

    G. Karypis and V . Kumar. A fast and high quality multilevel scheme for partitioning irregular graphs.SIAM J. Sci. Comput., 20(1):359–392, Dec. 1998. ISSN 1064-8275

    1998

  11. [20]

    T. N. Kipf and M. Welling. Semi-supervised classification with graph convolutional networks. 2017

    2017

  12. [21]

    T. Li, A. K. Sahu, M. Zaheer, M. Sanjabi, A. Talwalkar, and V . Smith. Federated optimization in heterogeneous networks. Proceedings of Machine learning and systems, 2:429–450, 2020

    2020

  13. [22]

    Z. Li, Y . Liu, X. He, N. Yu, M. Backes, and Y . Zhang. Auditing membership leakages of multi-exit networks. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, pages 1917–1931, 2022

    2022

  14. [23]

    T. Lin, L. Kong, S. U. Stich, and M. Jaggi. Ensemble distillation for robust model fusion in federated learning. Advances in neural information processing systems, 33:2351–2363, 2020

    2020

  15. [24]

    J. Liu, B. Chen, B. Xue, M. Guo, and Y . Xu. Piafgnn: Property inference attacks against federated graph neural networks. Computers, Materials & Continua, 82(2), 2025

    2025

  16. [25]

    R. Liu, P. Xing, Z. Deng, A. Li, C. Guan, and H. Yu. Federated graph neural networks: Overview, techniques, and challenges. IEEE transactions on neural networks and learning systems, 2024

    2024

  17. [26]

    Y . Liu, P. Jiang, and L. Zhu. Subject-level membership inference attack via data augmentation and model discrepancy. IEEE Transactions on Information Forensics and Security, 18:5848–5859, 2023

    2023

  18. [27]

    Z. Liu, X. Zhang, C. Chen, S. Lin, and J. Li. Membership inference attacks against robust graph neural network. In International Symposium on Cyberspace Safety and Security, pages 259–273. Springer, 2022

    2022

  19. [28]

    K. Ma, R. Liu, X. Yan, Z. Cai, X. Song, M. Wang, Y . Li, and J. Cheng. Adaptive parallel training for graph neural networks. In Proceedings of the 30th ACM SIGPLAN Annual Symposium on Principles and Practice of Parallel Programming, pages 29–42, 2025

    2025

  20. [29]

    McMahan, E

    B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas. Communication-efficient learning of deep networks from decentralized data. In Artificial intelligence and statistics, pages 1273–1282. PMLR, 2017

    2017

  21. [30]

    Melis, C

    L. Melis, C. Song, E. De Cristofaro, and V . Shmatikov. Exploiting unintended feature leakage in collaborative learning. In 2019 IEEE symposium on security and privacy (SP), pages 691–706. IEEE, 2019

    2019

  22. [31]

    M. Nasr, R. Shokri, and A. Houmansadr. Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning. In 2019 IEEE symposium on security and privacy (SP), pages 739–753. IEEE, 2019

    2019

  23. [33]

    I. E. Olatunji, W. Nejdl, and M. Khosla. Membership inference attack on graph neural networks. In 2021 Third IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications (TPS-ISA), pages 11–20. IEEE, 2021

    2021

  24. [34]

    S. Park, S. Han, F. Wu, S. Kim, B. Zhu, X. Xie, and M. Cha. Feddefender: Client-side attack-tolerant federated learning. In Proceedings of the 29th ACM SIGKDD conference on knowledge discovery and data mining, pages 1850–1861, 2023

    2023

  25. [35]

    B. Rao, J. Zhang, D. Wu, C. Zhu, X. Sun, and B. Chen. Privacy inference attack and defense in centralized and federated learning: A comprehensive survey. IEEE Transactions on Artificial Intelligence, 2024

    2024

  26. [36]

    Sajadmanesh and D

    S. Sajadmanesh and D. Gatica-Perez. Locally private graph neural networks. In Proceedings of the 2021 ACM SIGSAC conference on computer and communications security, pages 2130–2145, 2021

    2021

  27. [37]

    Schmierer, T

    T. Schmierer, T. Li, and Y . L. Di Wu. Advancing doa assessment through federated learning: A one-shot pseudo data approach. Neurocomputing, 634, 2025. 11 Li et al. Cross-Client Membership Inference Attack

    2025

  28. [38]

    Shchur, M

    O. Shchur, M. Mumme, A. Bojchevski, and S. Günnemann. Pitfalls of graph neural network evaluation. In Relational Representation Learning Workshop, NeurIPS 2018, 2018

    2018

  29. [39]

    H. Sui, X. Sun, J. Zhang, B. Chen, and W. Li. Multi-level membership inference attacks in federated learning based on active gan. Neural Computing and Applications, 35(23):17013–17027, 2023

    2023

  30. [40]

    Y . Sun, Z. Liu, J. Cui, J. Liu, K. Ma, and J. Liu. Client-side gradient inversion attack in federated learning using secure aggregation. IEEE Internet of Things Journal, 2024

    2024

  31. [41]

    Velickovic, G

    P. Velickovic, G. Cucurull, A. Casanova, A. Romero, P. Lio, and Y . Bengio. Graph attention networks. 2018

    2018

  32. [42]

    J. Wang, Q. Liu, H. Liang, G. Joshi, and H. V . Poor. Tackling the objective inconsistency problem in heterogeneous federated optimization. Advances in neural information processing systems, 33:7611–7623, 2020

    2020

  33. [43]

    P. Wang, S. Li, Y . Han, F. Ye, and Q. Zhang. Fast-response edge caching scheme for graph data.IEEE Transactions on Networking, 2025

    2025

  34. [44]

    Z. Wang, M. Song, Z. Zhang, Y . Song, Q. Wang, and H. Qi. Beyond inferring class representatives: User-level privacy leakage from federated learning. InIEEE INFOCOM 2019-IEEE conference on computer communications, pages 2512–2520. IEEE, 2019

    2019

  35. [45]

    B. Wu, X. Yang, S. Pan, and X. Yuan. Adapting membership inference attacks to gnn for graph classification: Approaches and implications. In 2021 IEEE International Conference on Data Mining (ICDM), pages 1421–1426. IEEE, 2021

    2021

  36. [46]

    D. Wu, J. Bai, Y . Song, J. Chen, W. Zhou, Y . Xiang, and A. Sajjanhar. Fedinverse: Evaluating privacy leakage in federated learning. In The twelfth international conference on learning representations, 2024

    2024

  37. [47]

    H. Wu, Y . Fang, N. Li, X. Yuan, Z. Wei, G. Nan, and X. Tao. Secret key generation with untrusted internal eavesdropper: Token-based anti-eavesdropping. IEEE Transactions on Information Forensics and Security, 2025

    2025

  38. [48]

    Z. Wu, S. Pan, F. Chen, G. Long, C. Zhang, and P. S. Yu. A comprehensive survey on graph neural networks. IEEE transactions on neural networks and learning systems, 32(1):4–24, 2020

    2020

  39. [49]

    H. Xie, J. Ma, L. Xiong, and C. Yang. Federated graph classification over non-iid graphs. Advances in neural information processing systems, 34:18839–18852, 2021

    2021

  40. [50]

    Y . Xie, B. Chen, J. Zhang, and D. Wu. Defending against membership inference attacks in federated learning via adversarial example. In 2021 17th International Conference on Mobility, Sensing and Networking (MSN), pages 153–160. IEEE, 2021

    2021

  41. [51]

    Y . Xu, M. Yin, M. Fang, and N. Z. Gong. Robust federated learning mitigates client-side training data distribution inference attacks. In Companion Proceedings of the ACM Web Conference 2024, pages 798–801, 2024

    2024

  42. [52]

    H. Yan, S. Li, Y . Wang, Y . Zhang, K. Sharif, H. Hu, and Y . Li. Membership inference attacks against deep learning models via logits distribution. IEEE Transactions on Dependable and Secure Computing, 20(5):3799–3808, 2022

    2022

  43. [53]

    W. Yang, S. Shao, Y . Yang, X. Liu, X. Liu, Z. Xia, G. Schaefer, and H. Fang. Watermarking in secure federated learning: A verification framework based on client-side backdooring. ACM Transactions on Intelligent Systems and Technology, 15(1):1–25, 2023

    2023

  44. [54]

    Z. Yang, W. Cohen, and R. Salakhudinov. Revisiting semi-supervised learning with graph embeddings. In ICML, pages 40–48. PMLR, 2016

    2016

  45. [55]

    Zhang, B

    G. Zhang, B. Liu, T. Zhu, M. Ding, and W. Zhou. Label-only membership inference attacks and defenses in semantic segmentation models. IEEE Transactions on Dependable and Secure Computing, 20(2):1435–1449, 2022

    2022

  46. [56]

    Zhang, C

    J. Zhang, C. Zhu, X. S. Di Wu, J. Yong, and G. Long. Badfss: backdoor attacks on federated self-supervised learning. In Proceedings of the 33rd International Joint Conference on Artificial Intelligence (IJCAI), 2021

    2021

  47. [57]

    Zhang, Q

    Z. Zhang, Q. Liu, Z. Huang, H. Wang, C. Lu, C. Liu, and E. Chen. Graphmi: Extracting private graph data from graph neural networks. In Proceedings of the Thirtieth International Joint Conference on Artificial Intelligence, IJCAI-21, pages 3749–3755, 8 2021. Main Track

    2021

  48. [58]

    Zhang, M

    Z. Zhang, M. Chen, M. Backes, Y . Shen, and Y . Zhang. Inference attacks against graph neural networks. In31st USENIX Security Symposium (USENIX Security 22), pages 4543–4560, 2022

    2022

  49. [59]

    B. Zhao, K. R. Mopuri, and H. Bilen. idlg: Improved deep leakage from gradients. arXiv preprint arXiv:2001.02610, 2020. 12 Li et al. Cross-Client Membership Inference Attack

    2001 arXiv

  50. [60]

    Y . Zhao, J. Chen, J. Zhang, D. Wu, J. Teng, and S. Yu. Pdgan: A novel poisoning defense method in federated learning using generative adversarial network. In Algorithms and Architectures for Parallel Processing: 19th International Conference, ICA3PP 2019, Melbourne, VIC, Aust...

    2019

  51. [61]

    J. Zhu, A. Reganti, E. W. Huang, C. Dickens, N. Rao, K. Subbian, and D. Koutra. Simplifying distributed neural network training on massive graphs: Randomized partitions improve model aggregation. ACM Transactions on Knowledge Discovery from Data, 19(1):1–26, 2025

    2025

  52. [62]

    right to be forgotten

    L. Zhu, Z. Liu, and S. Han. Deep leakage from gradients. Advances in neural information processing systems, 32, 2019. A Technical Appendices and Supplementary Material A.1 Motivation Most existing GNN-specific attacks are confined to centralized settings, where the assumption ...

    2019

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.