Stealing Links from Graph Neural Networks

Abstract

Graph data, such as chemical networks and social networks, may be deemed confidential/private because the data owner often spends lots of resources collecting the data or the data contains sensitive information, e.g., social relationships. Recently, neural networks were extended to graph data, which are known as graph neural networks (GNNs). Due to their superior performance, GNNs have many applications, such as healthcare analytics, recommender systems, and fraud detection. In this work, we propose the first attacks to steal a graph from the outputs of a GNN model that is trained on the graph. Specifically, given a black-box access to a GNN model, our attacks can infer whether there exists a link between any pair of nodes in the graph used to train the model. We call our attacks link stealing attacks. We propose a threat model to systematically characterize an adversary's background knowledge along three dimensions which in total leads to a comprehensive taxonomy of 8 different link stealing attacks. We propose multiple novel methods to realize these 8 attacks. Extensive experiments on 8 real-world datasets show that our attacks are effective at stealing links, e.g., AUC (area under the ROC curve) is above 0.95 in multiple cases. Our results indicate that the outputs of a GNN model reveal rich information about the structure of the graph used to train the model.

To appear in the 30th Usenix Security Symposium, August 2021, Vancouver, B.C., Canada

References in corpus (22)

• Neural Machine Translation by Jointly Learning to Align and Translate
• Explaining and Harnessing Adversarial Examples
• Deep Residual Learning for Image Recognition
• Inductive Representation Learning on Large Graphs
• Neural Message Passing for Quantum Chemistry
• Comprehensive Privacy Analysis of Deep Learning: Passive and Active White-box Inference Attacks against Centralized and Federated Learning
• Adversarial Attacks on Neural Networks for Graph Data
• The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networks
• Adversarial Attacks on Graph Neural Networks via Meta Learning
• Benchmarking Graph Neural Networks
• Adversarial Attacks on Node Embeddings via Graph Poisoning
• A Fair Comparison of Graph Neural Networks for Graph Classification
• Stolen Memories: Leveraging Model Memorization for Calibrated White-Box Membership Inference
• Adversarial Examples on Graph Data: Deep Insights into Attack and Defense
• Updates-Leak: Data Set Inference and Reconstruction Attacks in Online Learning
• Prediction Poisoning: Towards Defenses Against DNN Model Stealing Attacks
• Certifiable Robustness to Graph Perturbations
• Differentially Private Data Generative Models
• DeepCity: A Feature Learning Framework for Mining Location Check-ins
• Fast Matrix Factorization for Online Recommendation with Implicit Feedback
• Location Prediction: Communities Speak Louder than Friends
• Robust Membership Encoding: Inference Attacks and Copyright Protection for Deep Learning

Cited by in corpus (5)

• Adversarial Attack and Defense on Graph Data: A Survey
• Model Extraction Attacks on Graph Neural Networks: Taxonomy and Realization
• Confidential Machine Learning Computation in Untrusted Environments: A Systems Security Perspective
• Independent Distribution Regularization for Private Graph Embedding
• Private Graph Extraction via Feature Explanations