On Stealing Graph Neural Network Models

Current graph neural network (GNN) model-stealing methods rely heavily on queries to the victim model, assuming no hard query limits. However, in reality, the number of allowed queries can be severely limited. In this paper, we demonstrate how an adversary can extract a GNN with very limited interactions with the model. Our approach first enables the adversary to obtain the model backbone without making direct queries to the victim model and then to strategically utilize a fixed query limit to extract the most informative data. The experiments on eight real-world datasets demonstrate the effectiveness of the attack, even under a very restricted query limit and under defense against model extraction in place. Our findings underscore the need for robust defenses against GNN model extraction threats.

Authors

• Marcin Podhajski Institute of Fundamental Technological Research, Polish Academy of Sciences IDEAS NCBR
• Jan Dubiński Warsaw University of Technology NASK National Research Institute
• Franziska Boenisch CISPA Helmholtz Center for Information Security
• Adam Dziedzic CISPA Helmholtz Center for Information Security
• Agnieszka Pręgowska Institute of Fundamental Technological Research, Polish Academy of Sciences
• Tomasz Paweł Michalak University of Warsaw IDEAS Research Institute

Keywords

No keywords are indexed for this paper.