Large Language Models Merging for Enhancing the Link Stealing Attack on Graph Neural Networks

Faqian Guan; Tianqing Zhu; Wanlei Zhou; Wei Ren; Wenhan Chang

REVIEW 4 major objections 6 minor 43 references

Large Language Models Merging for Enhancing the Link Stealing Attack on Graph Neural Networks

T0 review · 4 major / 6 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that merging several LLM-based link stealing attack models with its Drop-Elect-Merge method yields a single attack model that outperforms prior link stealing attacks on all four tested graph datasets and remains…

desk verdict A plausible but leaky combination of LLM-based link stealing and model merging; the headline advantage comes from weights fitted on the test datasets, so the main claim needs re-testing. read the letter →

arxiv 2412.05830 v1 pith:ZQ3ZXXAQ submitted 2024-12-08 cs.CR cs.AI

Faqian Guan , Tianqing Zhu , Wenhan Chang , Wei Ren , Wanlei Zhou This is my paper · ORCID

classification cs.CRcs.AI

keywords linkstealingattackgraphneuralnetworkslargelanguagemodelsmodelmergingcross-datasetprivacyattacksparameterout-of-domaingeneralization

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that a group of attackers with different private graph datasets can jointly build a stronger link stealing attack against graph neural networks without sharing any data. It replaces the fixed-size features used in prior attacks with a fine-tuned large language model that consumes node text and target-model posterior probabilities, which lets one model work across datasets of different sizes and feature dimensions. It then merges the attackers' LLMs with a Drop-Elect-Merge procedure that prunes redundant parameter updates, filters out conflicting updates by sign, and weights each model by the difficulty of the dataset it was trained on. The authors report that the merged model achieves 93.33% average accuracy and 93.40% F1 score on Cora, Citeseer, Pubmed, and Ogbn-arxiv, beating both single-dataset attacks and standard merging baselines, and that it keeps near-best performance on an out-of-domain dataset none of the attackers trained on. A sympathetic reader should care because this turns link stealing from a single-attacker, single-dataset game into a realistic collaborative threat that pools knowledge while preserving each party's data privacy.

What carries the argument

The central object is the delta parameter $\delta_t = \theta_t - \theta$, the difference between an attacker's fine-tuned LLM parameters and the shared pretrained base. The Drop step sorts deltas by magnitude and drops each with probability inversely proportional to its magnitude, rescaling survivors by $1/(1-d_i)$ so the expected output of the merged model is unchanged; the Elect step masks out any delta whose sign disagrees with the sign of the summed deltas across all models; the Merge step forms $\delta'_{\text{merge}}^k = \sum_t \lambda_t \delta_t'^k$ with $\lambda_t = \frac{\exp(\text{Max}(Acc_t)-\text{Min}(Acc_t))}{\sum_t \exp(\text{Max}(Acc_t)-\text{Min}(Acc_t))}$, where the accuracy spread is measured across the datasets the models are evaluated on. The drop-rescale step removes redundant parameters, the elect step prevents conflicting updates from canceling, and the weighted merger gives more influence to models trained on datasets that are hard for other models to attack.

What would settle it

Re-run the four-dataset merging evaluation but compute the merging weights $\lambda$ using only each attacker's own held-out validation split, with no labels from the other three datasets; if the merged model's mean accuracy falls to the level of the unweighted Mean or Della baselines, the reported 93.33% advantage traces to target-aware weight selection rather than to the Drop-Elect-Merge mechanism.

Watch

Extended reading notes

Core claim

The paper's central claim is that the knowledge of multiple attackers can be combined into a universal link stealing attack model by fine-tuning the same pretrained LLM on each attacker's dataset and then merging the models, rather than by sharing the data itself. The claim rests on the observation that an LLM's transformer attention handles variable-length node features, so a model trained on one dataset can be applied to another, and on a merging scheme that keeps only the parameter updates that survive magnitude-biased dropping and sign-consistency voting, then sums those updates with per-model weights derived from how differently each dataset behaves under attack. With this scheme, the authors assert, the merged model is more accurate than every individual single-dataset model and every prior merging baseline they test, and it generalizes to held-out graphs.

Load-bearing premise

The method assumes that the attackers can measure how accurate each fine-tuned model is on the very datasets they later attack, because the merge weights $\lambda$ are computed from those accuracy measurements; if they cannot obtain labeled data for those datasets, the weight formula is unusable and the claimed advantage over simple averaging is not established.

Editorial extensions

If this is right

A single merged attack model can target multiple victim GNNs trained on different datasets, removing the need to train a separate attack model per dataset.
No data exchange is required among attackers, so a group of parties with private graph data can pool their attack capability by sharing only model parameters.
The LLM-based attack using node text plus posterior probabilities beats the previous feature-only, posterior-only, and inductive baselines on each of the four single-dataset evaluations.
On the four merged datasets, Drop-Elect-Merge achieves higher mean accuracy and F1 than Mean, TIES, DARE, and Della merging baselines in the paper's experiments.
When the target dataset is held out from the merge, the merged model still matches the best single model in the merge, extending the threat to previously unseen graphs.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

If the method transfers, the same Drop-Elect-Merge recipe could be used for other collaborative LLM-based privacy attacks on graphs, such as membership or attribute inference, wherever several parties hold disjoint private datasets.
A testable variant would compute the merging weights from each attacker's own hold-out validation set only, with no labels from the other parties' datasets; this would show whether the reported advantage over unweighted merging survives when the target datasets are truly unknown.
Because the prompts embed the target model's posterior probabilities, the merged attack is tuned to the query behavior of the GNN family it was trained against; an unstated extension is building one merged model from posteriors of several GNN architectures and testing whether it transfers across architectures.
If the attack is as effective as reported, defenses should anticipate colluding attackers who pool heterogeneous graph data, so future defenses need to be robust to cross-dataset, model-merged adversaries rather than to a single attacker on a single dataset.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The paper's actual new piece is the setting: multiple attackers each fine-tune an LLM on their own graph dataset and then merge parameters to attack not only those datasets but also unseen ones. That is a reasonable extension of link stealing, and the LLM-as-universal-interface idea for cross-dataset attacks is worth taking seriously. The experiments are fairly broad – four datasets, three GNN targets, three LLM backbones, plus an out-of-domain evaluation – and the numbers are reported with means and standard deviations. Credit where due: this is more empirical work than most attack papers bother with.

The soft spot is load-bearing. The lambda weights in Eq. (9) are computed from each single-dataset model's accuracy on the very datasets that Table V later uses for evaluation. In the stated black-box setting, attackers do not know link labels on the target dataset – that is what they are trying to steal. So the weights as written require exactly the information the attack is supposed to infer. The out-of-domain experiment in Fig. 11 is less guilty, since the target dataset is excluded from merging, but the paper never says how lambda is recomputed there, and the text refers back to the same Table IV. Without a clear statement that lambda is computed only from data available to the attackers, the "surpassing all existing methods" claim in Table V is not established. This is fixable – use a validation split of the attackers' own data, or a small held-out portion of known links – but it has to be fixed.

Other soft spots are minor by comparison. The theoretical analysis is informal: the expectation calculation in Eq. (13)-(15) only shows that dropout-style rescaling preserves the expected output of a linear layer; it does not address the elect step or the weighted merge. Fine-tuning details (learning rates, epochs, LoRA vs full fine-tune, compute) are missing. And there is a mismatch on Ogbn-arxiv: the dataset statistics say 128-dimensional numeric features, but the prompt design uses titles and abstracts. Where does the text come from? That needs a sentence or two.

The citation pattern is fine; the authors cite DARE, TIES, and Della, and their own prior LLM link stealing paper is referenced as [7]. The merging recipe itself – magnitude drop, sign election, softmax weighting – is a combination of known components, and the weighting is the only genuinely new twist.

Bottom line: the paper deserves a serious referee, but the referee should demand a leakage-free weight-selection procedure and a clarification of the Ogbn-arxiv text features before the central claim is accepted.

Referee Report

4 major / 6 minor

Summary. The paper proposes a link stealing attack on graph neural networks in which multiple attackers collaboratively build a single attack model. Each attacker fine-tunes a large language model (LLM) on their own dataset, then the resulting models are merged via a novel Drop-Elect-Merge procedure. The merged model is claimed to attack multiple datasets simultaneously and to generalize to previously unseen out-of-domain datasets. Experiments on Cora, Citeseer, Pubmed, and Ogbn-arxiv compare the method against non-LLM link stealing attacks and against existing model merging baselines (Mean, Ties, DARE, Della). The main novelty is the combination of LLM-based cross-dataset attacks with weighted parameter merging, where the weight lambda in Eq. (9) is derived from each model's accuracy across datasets.

Significance. If the results hold, this would be a novel and practically relevant contribution: it demonstrates a realistic collaborative attack model where attackers share only parameters, not data, and it is the first to apply LLMs to link stealing across datasets. The use of known merging techniques (DARE, Della) with an additional weighting step is a reasonable design idea, and the paper includes experiments across multiple GNN and LLM architectures. However, the central empirical claim is currently undermined by a circularity in the weight-allocation scheme: the lambda weights in Eq. (9) are computed from accuracy values on the very datasets later used for evaluation. Because the reported superiority over baselines may be an artifact of fitting lambda to the test labels, the paper's core contribution is not convincingly established as written.

major comments (4)

[Section VI-C, Eq. (9), Tables IV and V] The merging weights lambda in Eq. (9) are computed from the accuracy matrix in Table IV, which evaluates every single-dataset model on all four datasets. These same datasets are used as the test sets for the merged model in Table V and Fig. 11. This is a train-on-test leak: the weights are fitted to the labels whose prediction is claimed as the contribution. The paper must either compute lambda on a held-out validation split that excludes all test nodes, or show that the advantage over unweighted merging and over the DARE/Della baselines persists when lambda is chosen without access to the target datasets. Without this, the headline claim of 'surpassing all existing methods' in Section VI-D is not supportable.
[Section VI-G, Fig. 11] The out-of-domain experiment is described as merging models trained on three datasets and attacking the remaining one. However, the paper does not state whether the target dataset's column is excluded when computing the lambda weights for the three merged models. If the full Table IV matrix, including the target column, is used to compute weights, then the 'out-of-domain' evaluation still depends on target labels through Eq. (9), making the generalization claim circular. The authors should report the exact submatrix used, the resulting lambda values, and a comparison against a fixed-weight (e.g., equal-weight) merging baseline on the same held-out target.
[Section IV-B, Section VI-A, Table II] Fine-tuning details are almost entirely absent: no optimizer, learning rate, batch size, number of epochs, LoRA/QLoRA configuration, or sequence truncation procedure is reported for any experiment. In addition, Ogbn-arxiv has 128-dimensional numeric node features (Table II), but the prompt design in Fig. 3 is based on 'Title, Abstract'; the paper never explains how the numeric features of Ogbn-arxiv are textualized or otherwise fed to the LLM. These omissions prevent replication and leave the cross-dataset mechanism unclear for a main experimental dataset.
[Section V] The theoretical analysis is informal. Equations (13)-(15) only show expectation invariance for a single linear layer and do not account for the Elect masking in Eq. (8) or for the nonlinearity of Transformer blocks. The conclusion that 'Drop and Scaling maintain attack effectiveness' is therefore not established for the actual model, and the statement in Section VIII that the paper provides 'thorough theoretical analysis' overstates what is proven. A precise formal claim, or a removal of the 'thorough' characterization, is needed.

minor comments (6)

[Eq. (5)] The cross-entropy loss formula has mismatched parentheses: it should be written as L_CE = -[y log y_hat + (1-y) log(1-y_hat)].
[Fig. 3] The LLM response text 'Yes or False' should be 'Yes or No'.
[Section VI-E1] The text refers to 'as illustrated in Fig. 4' when discussing the effect of drop probability p; the correct reference is Fig. 10(a).
[Section VI-B2] The sentence 'As shown in the table' following the cross-dataset heat map should read 'As shown in the figure' because the results are in Fig. 7, not a table.
[Table V] The first row, labeled 'Target (Max)', is not a merging method but an upper-bound reference; it should be visually separated from the actual merging baselines to avoid confusion.
[Related Work, Section VII-B] Reference [7] is the authors' own prior work on LLM-based link stealing; it should be explicitly discussed in Section VII-B so that the reader can see how the current paper extends it.

Circularity Check

2 steps flagged · score 7.0 of 10

Lambda weights in Eq. (9) are computed from accuracy on the same datasets where the merged model is evaluated; the claimed out-of-domain generalization uses the only stated weight rule that requires those target-column accuracies.

fitted input called prediction [Section IV-C, Eq. (9); Section VI-C Table IV; Section VI-D Table V]
"we calculate the accuracy of each LLM-based link stealing attack model trained on a single dataset and evaluated across multiple datasets. By comparing the maximum and minimum accuracies on each dataset ... we apply the Softmax function to the differences between maximum and minimum accuracies to establish the final weights. This process can be formulated as: λt = exp(Max(Acc_t) − Min(Acc_t)) / Σ exp(Max(Acc) − Min(Acc))"

The inputs to Eq. (9) are the accuracy scores in Table IV, which evaluate each single-dataset LLM on all four datasets (Cora, Citeseer, Pubmed, Ogbn-arxiv). Those exact four datasets are then used as the evaluation columns in Table V for the merged model. The merging weights are therefore a function of the target evaluation results, so the reported mean accuracy of 93.33% and F1 of 93.40% in Section VI-D are not an out-of-sample prediction of the merged model; the weights already encode which component model is best on each test dataset. The claimed superiority over Mean, TIES, DARE, and Della is not established by a leakage-free weight-selection procedure.
other [Section VI-G; Section III (Attacker Knowledge); Section IV-C Eq. (9)]
"we merge the attack models trained on three out of the four datasets and then use the resulting merged model to attack the remaining dataset. For example, we merge the attack models individually trained by attackers on the Citeseer, Pubmed, and Ogbn-arxiv datasets and evaluate the merged model's performance on the Cora dataset, which is considered out-of-domain since the attackers have no access to it."

The only weight-selection rule stated in the paper is Eq. (9), which requires computing each model's accuracy 'evaluated across multiple datasets,' including the held-out target if the formula is applied as written. Section III states that attackers 'do not have knowledge of the structure or parameters of the target model,' so the target-column accuracies needed by Eq. (9) are unavailable in the out-of-domain setting. The paper reports 'Our (w/o Target Dataset)' in Fig. 11 but does not specify a target-free recomputation of λ or the resulting weights, so the out-of-domain generalization claim is either using target information not available to the attackers or rests on an unstated procedure.

full rationale

The core empirical claim of the paper—that the Drop-Elect-Merge method with weighted λ produces a merged attack model with superior generalization, including on out-of-domain datasets—is compromised by target information in the weight computation. Eq. (9) defines λ from Max(Acc)−Min(Acc) over 'multiple datasets'; Table IV provides exactly those accuracies for all four evaluation datasets, and Table V reports the merged model on the same four datasets. This makes the headline result at least partially a fitted-input prediction: the weights are selected after observing the component models' performance on the test columns. The out-of-domain section does not repair the issue, because it gives no target-free λ formula; the label 'w/o Target Dataset' is not supported by a described computation. I found no load-bearing self-citation chain: DARE, TIES, and Della are external baselines, and the paper's own fine-tuning and merging steps have independent content. The leakage is confined to the λ weighting and the generalization claims built on it, but that is the central claimed contribution, so the score is 7 rather than a lower value. If the authors were to recompute λ from source-only accuracies and re-run Table V and Fig. 11, the circularity would drop substantially.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The central merging claim rests on at least three fitted quantities: the per-model merging weights (derived from evaluation accuracies), the drop probability p, and the maximum magnitude epsilon. The softmax weighting is the most problematic because it uses the evaluation datasets to set the weights.

free parameters (4)

lambda weights = 0.28, 0.06, 0.46, 0.20 (Cora, Citeseer, Pubmed, Ogbn-arxiv)
Computed by softmax over max-min accuracies of individual models on the evaluation datasets (Eq. 9, Table IV). Fitted to the test data.
drop probability p = 0.5
Chosen after sweeping p in [0.1, 0.9] and selecting the best result on the merged model's evaluation (Section VI-E1).
maximum magnitude epsilon = 0.1
Chosen after sweeping epsilon and selecting the best evaluation result (Section VI-E2).
number of attack links per dataset = 2000, 2000, 5000, 30000
Hand-set per dataset (Table II); affects the fine-tuning training set and is not defended as a principled choice.

assumptions (5)

domain assumption Transformer architecture handles variable-length sequences and supports cross-dataset generalization.
Relied upon in Section IV-B and Section V's first 'theoretical analysis'.
domain assumption Fine-tuning an LLM on prompt-based node pairs yields an accurate link classifier.
The method's core capability, shown empirically but not derived.
domain assumption Posterior probabilities of the target GNN are accessible via black-box queries.
Standard link stealing assumption, stated in Section III (Attack Setting).
ad hoc to paper Softmax over max-min accuracy differences assigns weights that improve generalization.
This is the paper's proposed weighting rule (Eq. 9), with no theoretical justification beyond an illustrative example.
domain assumption Shared pre-trained LLM parameters theta are identical across attackers.
Required for delta = theta_t - theta to be meaningful; stated in Section IV-C.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Large Language Models Merging for Enhancing the Link Stealing Attack on Graph Neural Networks." pith.science (2026). https://pith.science/paper/ZQ3ZXXAQ

@misc{pith2026241205830,
  author       = {Pith},
  title        = {Pith review of: Large Language Models Merging for Enhancing the Link Stealing Attack on Graph Neural Networks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ZQ3ZXXAQ}},
  note         = {Machine review of arXiv:2412.05830}
}

read the original abstract

Graph Neural Networks (GNNs), specifically designed to process the graph data, have achieved remarkable success in various applications. Link stealing attacks on graph data pose a significant privacy threat, as attackers aim to extract sensitive relationships between nodes (entities), potentially leading to academic misconduct, fraudulent transactions, or other malicious activities. Previous studies have primarily focused on single datasets and did not explore cross-dataset attacks, let alone attacks that leverage the combined knowledge of multiple attackers. However, we find that an attacker can combine the data knowledge of multiple attackers to create a more effective attack model, which can be referred to cross-dataset attacks. Moreover, if knowledge can be extracted with the help of Large Language Models (LLMs), the attack capability will be more significant. In this paper, we propose a novel link stealing attack method that takes advantage of cross-dataset and Large Language Models (LLMs). The LLM is applied to process datasets with different data structures in cross-dataset attacks. Each attacker fine-tunes the LLM on their specific dataset to generate a tailored attack model. We then introduce a novel model merging method to integrate the parameters of these attacker-specific models effectively. The result is a merged attack model with superior generalization capabilities, enabling effective attacks not only on the attackers' datasets but also on previously unseen (out-of-domain) datasets. We conducted extensive experiments in four datasets to demonstrate the effectiveness of our method. Additional experiments with three different GNN and LLM architectures further illustrate the generality of our approach.

Figures

Figures reproduced from arXiv: 2412.05830 by the authors.

**Figure 2.** Overview of the proposed link stealing attack method. The upper section illustrates the service provider offering the target model for user access. The [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗

**Figure 3.** Prompts designed for LLM-based link stealing attacks. [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗

Figures from the paper (8 more)

**Figure 4.** Figure 4: Schematic diagram of mapping weights to be inversely proportional to [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]

**Figure 5.** Figure 5: Illustrative example of the weight calculation process for [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]

**Figure 6.** Figure 6: Comparison of different link stealing attack methods trained under a [PITH_FULL_IMAGE:figures/full_fig_p010_6.png]

**Figure 7.** Figure 7: Heat map of LLM performance in LLM-base link stealing attacks across [PITH_FULL_IMAGE:figures/full_fig_p010_7.png]

**Figure 8.** Figure 8: Allocation of weight 𝜆 for each attack model during model merging [PITH_FULL_IMAGE:figures/full_fig_p010_8.png]

**Figure 9.** Figure 9: Comparison of model merging method in link stealing attack. [PITH_FULL_IMAGE:figures/full_fig_p011_9.png]

**Figure 10.** Figure 10: Impact of different drop probabilities 𝑑 and maximum magnitude 𝜖 on model merging results [PITH_FULL_IMAGE:figures/full_fig_p011_10.png]

**Figure 11.** Figure 11: Comparison of our method using three attack models for merging and [PITH_FULL_IMAGE:figures/full_fig_p013_11.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

43 extracted references · 36 canonical work pages

[7]

Large Language Models for Link Stealing Attacks Against Graph Neural Networks

F. Guan, T. Zhu, H. Sun, W. Zhou, and P. S. Yu, “Large language models for link stealing attacks against graph neural networks,” CoRR, vol. abs/2406.16963, 2024

work page Pith review arXiv 2024
[1]

The graph neural network model,

F. Scarselli, M. Gori, A. C. Tsoi, M. Hagenbuchner, and G. Monfardini, “The graph neural network model,”IEEE Trans. Neural Networks, vol. 20, no. 1, pp. 61–80, 2009

work page 2009
[2]

Graph neural networks: a survey on the links between privacy and security,

F. Guan, T. Zhu, W. Zhou, and K. R. Choo, “Graph neural networks: a survey on the links between privacy and security,” Artif. Intell. Rev. , vol. 57, no. 2, p. 40, 2024

work page 2024
[3]

Stealing links from graph neural networks,

X. He, J. Jia, M. Backes, N. Z. Gong, and Y. Zhang, “Stealing links from graph neural networks,” in Proc. of USENIX Security Symposium , 2021, pp. 2669–2686

work page 2021
[4]

Demystifying uneven vulnerability of link stealing attacks against graph neural networks,

H. Zhang, B. Wu, S. Wang, X. Yang, M. Xue, S. Pan, and X. Yuan, “Demystifying uneven vulnerability of link stealing attacks against graph neural networks,” in Proc. of ICML , vol. 202, 2023, pp. 41 737–41 752

work page 2023
[5]

Link stealing attacks against inductive graph neural networks,

Y. Wu, X. He, P. Berrang, M. Humbert, M. Backes, N. Z. Gong, and Y. Zhang, “Link stealing attacks against inductive graph neural networks,” Proc. Priv. Enhancing Technol., vol. 2024, no. 4, pp. 818–839, 2024

work page 2024
[6]

Node Injection Link Stealing Attack

O. Zari, J. Parra-Arnau, A. ¨Unsal, and M. ¨Onen, “Node injection link stealing attack,” CoRR, vol. abs/2307.13548, 2023

work page Pith review arXiv 2023
[8]

Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey,

Y. Wan, Y. Qu, W. Ni, Y. Xiang, L. Gao, and E. Hossain, “Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey,” IEEE Communications Surveys & Tutorials, vol. 26, no. 3, pp. 1861–1897, 2024

work page 2024

Show all 43 references

[9]

A Privacy- Preserving and Untraceable Group Data Sharing Scheme in Cloud Computing ,

J. Shen, H. Yang, P. Vijayakumar, and N. Kumar, “ A Privacy- Preserving and Untraceable Group Data Sharing Scheme in Cloud Computing ,” IEEE Transactions on Dependable and Secure Computing, vol. 19, no. 04, pp. 2198–2210, Jul. 2022. [Online]. Available: https://doi.ieeecompute...

2022
[10]

Privacyeafl: Privacy-enhanced aggregation for federated learning in mobile crowdsensing,

M. Zhang, S. Chen, J. Shen, and W. Susilo, “Privacyeafl: Privacy-enhanced aggregation for federated learning in mobile crowdsensing,” Trans. Info. For. Sec., vol. 18, p. 5804–5816, Jan. 2023

2023
[11]

Fundamental capabilities of large language models and their applications in domain scenarios: A survey,

J. Li, Y. Yang, Y. Bai, X. Zhou, Y. Li, H. Sun, Y. Liu, X. Si, Y. Ye, Y. Wu, Y. Lin, B. Xu, R. Bowen, C. Feng, Y. Gao, and H. Huang, “Fundamental capabilities of large language models and their applications in domain scenarios: A survey,” in Proc. of ACL . Association for Comp...

2024
[12]

When software security meets large language models: A survey,

X. Zhu, W. Zhou, Q.-L. Han, W. Ma, S. Wen, and Y. Xiang, “When software security meets large language models: A survey,” IEEE/CAA Journal of Automatica Sinica , 2025

2025
[13]

GLM-130B: an open bilingual pre-trained model,

A. Zeng, X. Liu, Z. Du, Z. Wang, H. Lai, M. Ding, Z. Yang, Y. Xu, W. Zheng, X. Xia, W. L. Tam, Z. Ma, Y. Xue, J. Zhai, W. Chen, Z. Liu, P. Zhang, Y. Dong, and J. Tang, “GLM-130B: an open bilingual pre-trained model,” in Proc. of ICLR , 2023

2023
[14]

Indivec: An exploration of leveraging large language models for media bias detection with fine- grained bias indicators,

L. Lin, L. Wang, X. Zhao, J. Li, and K. Wong, “Indivec: An exploration of leveraging large language models for media bias detection with fine- grained bias indicators,” in Proc. of EACL, 2024, pp. 1038–1050

2024
[15]

ONCE: boosting content- based recommendation with both open- and closed-source large language models,

Q. Liu, N. Chen, T. Sakai, and X. Wu, “ONCE: boosting content- based recommendation with both open- and closed-source large language models,” in Proc. of WSDM , 2024, pp. 452–461

2024
[16]

Merge, ensemble, and cooperate! A survey on collaborative strategies in the era of large language models,

J. Lu, Z. Pang, M. Xiao, Y. Zhu, R. Xia, and J. Zhang, “Merge, ensemble, and cooperate! A survey on collaborative strategies in the era of large language models,” CoRR, vol. abs/2407.06089, 2024

2024 arXiv
[17]

Pre-train, prompt, and predict: A systematic survey of prompting methods in natural language processing,

P. Liu, W. Yuan, J. Fu, Z. Jiang, H. Hayashi, and G. Neubig, “Pre-train, prompt, and predict: A systematic survey of prompting methods in natural language processing,” ACM Comput. Surv. , vol. 55, no. 9, pp. 195:1– 195:35, 2023

2023
[18]

Neural machine translation of rare words with subword units,

R. Sennrich, B. Haddow, and A. Birch, “Neural machine translation of rare words with subword units,” inProc. of ACL , 2016

2016
[19]

A comprehensive survey on applications of transformers for deep learning tasks,

S. Islam, H. Elmekki, A. Elsebai, J. Bentahar, N. Drawel, G. Rjoub, and W. Pedrycz, “A comprehensive survey on applications of transformers for deep learning tasks,” Expert Syst. Appl. , vol. 241, p. 122666, 2024

2024
[20]

Judging llm-as-a-judge with mt-bench and chatbot arena,

L. Zheng, W. Chiang, Y. Sheng, S. Zhuang, Z. Wu, Y. Zhuang, Z. Lin, Z. Li, D. Li, E. P. Xing, H. Zhang, J. E. Gonzalez, and I. Stoica, “Judging llm-as-a-judge with mt-bench and chatbot arena,” in Proc. of NeurIPS , 2023. JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021 15

2023
[21]

How long can open-source llms truly promise on context length?

D. Li, R. Shao, A. Xie, Y. Sheng, L. Zheng, J. Gonzalez, I. Stoica, X. Ma, and H. Zhang, “How long can open-source llms truly promise on context length?” June 2023

2023
[22]

A survey on dropout methods and experimental verification in recommendation,

Y. Li, W. Ma, C. Chen, M. Zhang, Y. Liu, S. Ma, and Y. Yang, “A survey on dropout methods and experimental verification in recommendation,” IEEE Trans. Knowl. Data Eng. , vol. 35, no. 7, pp. 6595–6615, 2023

2023
[23]

Della-merging: Reducing interfer- ence in model merging through magnitude-based sampling,

P. T. Deep, R. Bhardwaj, and S. Poria, “Della-merging: Reducing interfer- ence in model merging through magnitude-based sampling,” CoRR, vol. abs/2406.11617, 2024

2024 arXiv
[24]

Language models are super mario: Absorbing abilities from homologous models as a free lunch,

L. Yu, B. Yu, H. Yu, F. Huang, and Y. Li, “Language models are super mario: Absorbing abilities from homologous models as a free lunch,” in Forty-first International Conference on Machine Learning, ICML 2024, Vienna, Austria, July 21-27, 2024 . OpenReview.net, 2024

2024
[25]

Semi-supervised classification with graph convolutional networks,

T. N. Kipf and M. Welling, “Semi-supervised classification with graph convolutional networks,” inProc. of ICLR , 2017

2017
[26]

Graph robustness benchmark: Benchmarking the adversarial robustness of graph machine learning,

Q. Zheng, X. Zou, Y. Dong, Y. Cen, D. Yin, J. Xu, Y. Yang, and J. Tang, “Graph robustness benchmark: Benchmarking the adversarial robustness of graph machine learning,” Proc. of NeurIPS , 2021

2021
[27]

Graph attention networks,

P. Velickovic, G. Cucurull, A. Casanova, A. Romero, P. Li`o, and Y. Bengio, “Graph attention networks,” in Proc. of ICLR , 2018

2018
[28]

Inductive representation learning on large graphs,

W. L. Hamilton, Z. Ying, and J. Leskovec, “Inductive representation learning on large graphs,” in Proc. of NeurIPS , 2017, pp. 1024–1034

2017
[29]

Ties-merging: Resolving interference when merging models,

P. Yadav, D. Tam, L. Choshen, C. A. Raffel, and M. Bansal, “Ties-merging: Resolving interference when merging models,” inProc. of NeurIPS, 2023

2023
[30]

PpNNT: Multiparty Privacy-Preserving Neural Network Training System ,

Q. Feng, D. He, J. Shen, M. Luo, and K.-K. R. Choo, “ PpNNT: Multiparty Privacy-Preserving Neural Network Training System ,”IEEE Transactions on Artificial Intelligence , vol. 5, no. 01, pp. 370–383, Jan. 2024

2024
[31]

Next-generation consumer electronics data auditing scheme toward cloud–edge distributed and resilient machine learning,

Y. Li, J. Shen, P. Vijayakumar, C.-F. Lai, A. Sivaraman, and P. K. Sharma, “Next-generation consumer electronics data auditing scheme toward cloud–edge distributed and resilient machine learning,” vol. 70, no. 1, p. 2244–2256, Feb. 2024

2024
[32]

Model extraction attacks on graph neural networks: Taxonomy and realisation,

B. Wu, X. Yang, S. Pan, and X. Yuan, “Model extraction attacks on graph neural networks: Taxonomy and realisation,” inProc. of ASIA CCS, 2022, pp. 337–350

2022
[33]

Model stealing attacks against inductive graph neural networks,

Y. Shen, X. He, Y. Han, and Y. Zhang, “Model stealing attacks against inductive graph neural networks,” inProc. of SSP , 2022, pp. 1175–1192

2022
[34]

A realistic model extraction attack against graph neural networks,

F. Guan, T. Zhu, H. Tong, and W. Zhou, “A realistic model extraction attack against graph neural networks,”Knowledge-Based Systems, p. 112144, 06 2024

2024
[35]

Node-level membership inference attacks against graph neural networks,

X. He, R. Wen, Y. Wu, M. Backes, Y. Shen, and Y. Zhang, “Node-level membership inference attacks against graph neural networks,”CoRR, vol. abs/2102.05429, 2021

2021 arXiv
[36]

Adapting membership inference attacks to GNN for graph classification: Approaches and implications,

B. Wu, X. Yang, S. Pan, and X. Yuan, “Adapting membership inference attacks to GNN for graph classification: Approaches and implications,” in Proc. of ICDM , 2021, pp. 1421–1426

2021
[37]

Inference attacks against graph neural networks,

Z. Zhang, M. Chen, M. Backes, Y. Shen, and Y. Zhang, “Inference attacks against graph neural networks,” inProc. of USENIX Security Symposium, 2022

2022
[38]

Group property inference attacks against graph neural networks,

X. Wang and W. H. Wang, “Group property inference attacks against graph neural networks,” in Proc. of CCS , H. Yin, A. Stavrou, C. Cremers, and E. Shi, Eds., 2022, pp. 2871–2884

2022
[39]

GPT-3: its nature, scope, limits, and consequences,

L. Floridi and M. Chiriatti, “GPT-3: its nature, scope, limits, and consequences,” Minds Mach., vol. 30, no. 4, pp. 681–694, 2020

2020
[40]

Explanations as features: Llm-based features for text-attributed graphs,

X. He, X. Bresson, T. Laurent, and B. Hooi, “Explanations as features: Llm-based features for text-attributed graphs,” CoRR, vol. abs/2305.19523, 2023

2023 arXiv
[41]

Natural language is all a graph needs,

R. Ye, C. Zhang, R. Wang, S. Xu, and Y. Zhang, “Natural language is all a graph needs,” CoRR, vol. abs/2308.07134, 2023

2023 arXiv
[42]

Multi-modal molecule structure-text model for text- based retrieval and editing,

S. Liu, W. Nie, C. Wang, J. Lu, Z. Qiao, L. Liu, J. Tang, C. Xiao, and A. Anandkumar, “Multi-modal molecule structure-text model for text- based retrieval and editing,” Nat. Mac. Intell. , vol. 5, no. 12, pp. 1447– 1457, 2023

2023
[43]

Graphedit: Large language models for graph structure learning,

Z. Guo, L. Xia, Y. Yu, Y. Wang, Z. Yang, W. Wei, L. Pang, T. Chua, and C. Huang, “Graphedit: Large language models for graph structure learning,” CoRR, vol. abs/2402.15183, 2024

2024 arXiv

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.

[1] [7]

Large Language Models for Link Stealing Attacks Against Graph Neural Networks

F. Guan, T. Zhu, H. Sun, W. Zhou, and P. S. Yu, “Large language models for link stealing attacks against graph neural networks,” CoRR, vol. abs/2406.16963, 2024

work page Pith review arXiv 2024

[2] [1]

The graph neural network model,

F. Scarselli, M. Gori, A. C. Tsoi, M. Hagenbuchner, and G. Monfardini, “The graph neural network model,”IEEE Trans. Neural Networks, vol. 20, no. 1, pp. 61–80, 2009

work page 2009

[3] [2]

Graph neural networks: a survey on the links between privacy and security,

F. Guan, T. Zhu, W. Zhou, and K. R. Choo, “Graph neural networks: a survey on the links between privacy and security,” Artif. Intell. Rev. , vol. 57, no. 2, p. 40, 2024

work page 2024

[4] [3]

Stealing links from graph neural networks,

X. He, J. Jia, M. Backes, N. Z. Gong, and Y. Zhang, “Stealing links from graph neural networks,” in Proc. of USENIX Security Symposium , 2021, pp. 2669–2686

work page 2021

[5] [4]

Demystifying uneven vulnerability of link stealing attacks against graph neural networks,

H. Zhang, B. Wu, S. Wang, X. Yang, M. Xue, S. Pan, and X. Yuan, “Demystifying uneven vulnerability of link stealing attacks against graph neural networks,” in Proc. of ICML , vol. 202, 2023, pp. 41 737–41 752

work page 2023

[6] [5]

Link stealing attacks against inductive graph neural networks,

Y. Wu, X. He, P. Berrang, M. Humbert, M. Backes, N. Z. Gong, and Y. Zhang, “Link stealing attacks against inductive graph neural networks,” Proc. Priv. Enhancing Technol., vol. 2024, no. 4, pp. 818–839, 2024

work page 2024

[7] [6]

Node Injection Link Stealing Attack

O. Zari, J. Parra-Arnau, A. ¨Unsal, and M. ¨Onen, “Node injection link stealing attack,” CoRR, vol. abs/2307.13548, 2023

work page Pith review arXiv 2023

[8] [8]

Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey,

Y. Wan, Y. Qu, W. Ni, Y. Xiang, L. Gao, and E. Hossain, “Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey,” IEEE Communications Surveys & Tutorials, vol. 26, no. 3, pp. 1861–1897, 2024

work page 2024