arXiv AI
GraphIP-Bench: How Hard Is It to Steal a Graph Neural Network, and Can We Stop It?
Read the original on arXiv AI →The Flow has not summarised this story yet — read it at arXiv AI.
Related stories
arXiv Machine Learning
Aug 13
Defending against Model Extraction for GNNs with Model Reprogramming
arXiv:2608. 11495v1 Announce Type: new Abstract: Graph Neural Networks (GNNs) serve as the backbone for high-stakes applications in Machine-Learning-as-a-Service (MLaaS).
arXiv Machine Learning
Jun 8
ADAGE: Active Defenses Against GNN Extraction
arXiv:2503. 00065v4 Announce Type: replace-cross Abstract: Graph Neural Networks (GNNs) achieve high performance in various real-world applications, such as drug discovery, traffic states prediction, and recommendation systems.
arXiv AI
Sep 30
Dagger: Decoupling-based Model Stealing Attack against Graph Neural Networks
arXiv:2609.37972v1 Announce Type: cross Abstract: As Graph Neural Networks (GNNs) are widely deployed as Machine Learning-as-a-Service (MLaaS) APIs, model stealing attacks have emerged as a critical...
arXiv AI
Jun 30
Rethinking Generative Reconstruction Attacks against Graph Neural Network Models
arXiv:2606. 29748v1 Announce Type: new Abstract: The application of graph data in numerous disciplines raises the need for gathering and analyzing huge volumes of data, some of which is private and sensitive.
arXiv AI
Sep 11
Kernel-Complexity Edge Sanitization for Training-Free Defense against Structural Graph Attacks
Kernel-Complexity Edge Sanitization (KCES) is a training‑free, model‑agnostic defense for Graph Neural Networks that identifies and removes edges with high Kernel‑Complexity (KC) scores, which are indicative of structural influence on the graph kernel complexity metric. KCES leverages a theoretical upper bound on GNN test error derived from the graph Gram matrix to compute edge‑specific KC scores, pruning edges that are empirically enriched with adversarial perturbations. The method is computationally efficient, scalable to large graphs, and consistently outperforms representative robust baselines across diverse attack settings without requiring retraining.
arXiv Machine Learning
Oct 15
Blackknife: Query-Free Black-Box Rewiring Attacks on Heterogeneous Graph Neural Networks
Blackknife is a query‑free, strict black‑box evasion attack designed for heterogeneous graph neural networks (HGNNs). It relies solely on observing one‑hop structures, ground‑truth labels, and raw features of target nodes, without using victim‑model outputs. The attack trains a shared surrogate on observable edges and relation types, then optimizes structural perturbations via continuous relaxation and projected gradient ascent, preserving node degrees while adding a cosine‑similarity penalty and adaptive structural classifier for regularization. Experiments show competitive success rates across multiple victim architectures and defense settings, revealing HGNN vulnerabilities under restricted graph access and query‑free attack generation.