Releasing Graph Neural Networks with Differential Privacy Guarantees
arXiv:2109.08907
Abstract
With the increasing popularity of graph neural networks (GNNs) in several sensitive applications like healthcare and medicine, concerns have been raised over the privacy aspects of trained GNNs. More notably, GNNs are vulnerable to privacy attacks, such as membership inference attacks, even if only black-box access to the trained model is granted. We propose PrivGNN, a privacy-preserving framework for releasing GNN models in a centralized setting. Assuming an access to a public unlabeled graph, PrivGNN provides a framework to release GNN models trained explicitly on public data along with knowledge obtained from the private data in a privacy preserving manner. PrivGNN combines the knowledge-distillation framework with the two noise mechanisms, random subsampling, and noisy labeling, to ensure rigorous privacy guarantees. We theoretically analyze our approach in the Renyi differential privacy framework. Besides, we show the solid experimental performance of our method compared to several baselines adapted for graph-structured data. Our code is available at https://github.com/iyempissy/privGnn.
arXiv commentPublished in TMLR 2023
References in corpus (11)
- Deep Learning with Differential Privacy
- Inductive Representation Learning on Large Graphs
- Fast Graph Representation Learning with PyTorch Geometric
- Renyi Differential Privacy
- Pitfalls of Graph Neural Network Evaluation
- Open Graph Benchmark: Datasets for Machine Learning on Graphs
- Graph-Based Deep Learning for Medical Diagnosis and Analysis: Past, Present and Future
- Privacy Amplification by Subsampling: Tight Analyses via Couplings and Divergences
- Using Attribution to Decode Dataset Bias in Neural Network Models for Chemistry
- Subsampled Rényi Differential Privacy and Analytical Moments Accountant
- Towards Representation Identical Privacy-Preserving Graph Neural Network via Split Learning