Node-Level Membership Inference Attacks Against Graph Neural Networks

Abstract

Many real-world data comes in the form of graphs, such as social networks and protein structure. To fully utilize the information contained in graph data, a new family of machine learning (ML) models, namely graph neural networks (GNNs), has been introduced. Previous studies have shown that machine learning models are vulnerable to privacy attacks. However, most of the current efforts concentrate on ML models trained on data from the Euclidean space, like images and texts. On the other hand, privacy risks stemming from GNNs remain largely unstudied. In this paper, we fill the gap by performing the first comprehensive analysis of node-level membership inference attacks against GNNs. We systematically define the threat models and propose three node-level membership inference attacks based on an adversary's background knowledge. Our evaluation on three GNN structures and four benchmark datasets shows that GNNs are vulnerable to node-level membership inference even when the adversary has minimal background knowledge. Besides, we show that graph density and feature similarity have a major impact on the attack's success. We further investigate two defense mechanisms and the empirical results indicate that these defenses can reduce the attack performance but with moderate utility loss.

References in corpus (14)

• Comprehensive Privacy Analysis of Deep Learning: Passive and Active White-box Inference Attacks against Centralized and Federated Learning
• Adversarial Attacks on Neural Networks for Graph Data
• The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networks
• Adversarial Attacks on Graph Neural Networks via Meta Learning
• GAN-Leaks: A Taxonomy of Membership Inference Attacks against Generative Models
• Adversarial Attack and Defense on Graph Data: A Survey
• Adversarial Attacks on Node Embeddings via Graph Poisoning
• Stolen Memories: Leveraging Model Memorization for Calibrated White-Box Membership Inference
• Adversarial Examples on Graph Data: Deep Insights into Attack and Defense
• Label-Only Membership Inference Attacks
• Overlearning Reveals Sensitive Attributes
• A Survey of Adversarial Learning on Graphs
• Differentially Private Data Generative Models
• Model Extraction Attacks on Graph Neural Networks: Taxonomy and Realization

Cited by in corpus (7)

• Trustworthy Graph Neural Networks: Aspects, Methods and Trends
• A Comprehensive Survey on Trustworthy Graph Neural Networks: Privacy, Robustness, Fairness, and Explainability
• Differentially Private Graph Classification with GNNs
• Membership Inference Attacks and Generalization: A Causal Perspective
• Membership Inference on Word Embedding and Beyond
• On the Privacy Risks of Cell-Based NAS Architectures
• Quantifying and Mitigating Privacy Risks of Contrastive Learning