All Your GNN Models and Data Belong to Me

Overview: This presentation evaluates the emerging security posture and adversarial attack surface of Graph Neural Networks (GNNs), highlighting research from Dr. Yang Zhang's group at CISPA. The speakers demonstrate how machine learning pipelines operating on relational graph data inadvertently leak sensitive structural and attribute information. The talk details empirical attack vectors targeting node classification posteriors and graph embedding representations in private databases.

Key Topics: - Graph Neural Network fundamentals: recursive message passing, GCN, and GIN aggregators - The GNN attack surface across node-level and graph-level prediction pipelines - Link re-identification attacks using posterior probability vectors and shadow models - Property inference attacks against compressed graph embeddings using auxiliary MLP models

Technical Details: Graph Neural Networks map non-Euclidean relational graphs into continuous Euclidean vector spaces using recursive message-passing frameworks. By utilizing aggregators such as Graph Convolutional Networks (GCN) or Graph Isomorphism Networks (GIN), GNNs recursively aggregate multi-hop neighborhood information to generate node embeddings and compressed graph-level vectors. These representations power diverse tasks including node classification, link prediction, and molecular toxicity prediction. However, caching computed posterior scores or graph embeddings in backend databases introduces critical leakage surfaces when adversaries gain unauthorized read access.

In link re-identification attacks, an attacker with access to breached node classification posterior probability scores seeks to infer whether a sensitive private edge exists between two target nodes. While simple threshold-based vector similarity calculations offer a baseline attack, the researchers developed an advanced local shadow model methodology. The adversary trains a shadow GNN on an auxiliary dataset and uses the resulting posterior scores to train a Multilayer Perceptron (MLP) binary classifier on positive and negative edge pairs. To resolve vector dimension mismatches between target and shadow datasets, the input representation is unified using vector distance functions combined with four distinct entropy metrics. Crucially, this shadow model demonstrates strong cross-domain transferability; for example, an attack model trained on the CiteSeer citation dataset successfully performs link re-identification on private protein-protein interaction networks.

In graph-level property inference attacks, adversaries exploit compressed graph embeddings obtained from breached databases in conjunction with black-box model query access. The attacker queries the target GNN using auxiliary graphs (such as known public molecular compounds) to collect reference embeddings. A local MLP regression model is then trained using these embeddings alongside ground-truth graph properties, such as total node count. Once trained, the MLP accurately infers macro-level structural properties of private graphs directly from breached embedding vectors without further interaction with the target system.

Key Takeaways: Cached model outputs such as posterior prediction distributions and graph embeddings must be treated as sensitive data assets subject to strict access controls and encryption. Organizations deploying GNNs must recognize that relational data leakage occurs even across disparate data domains due to shared embedding topologies. Defending GNN deployments requires auditing vector storage, minimizing cached prediction granularity, and evaluating differential privacy mechanisms during message passing and embedding export.

(AI summary — Gemini Flash)