仅凭预测标签即可精准判断图是否在训练集中，突破了传统攻击限制。
Graph-Level Label-Only Membership Inference Attack against Graph Neural Networks
- 通过扰动图特征并分析预测标签稳定性来构建鲁棒性评分
- 在三个数据集上最高攻击准确率达82.5%，接近基于概率的攻击效果
- 适用于只能获取标签输出的场景，如模型服务接口
图神经网络（GNN）广泛应用于图结构数据，但在图分类任务中易受成员推理攻击（MIA）影响，可能造成数据泄露。现有攻击依赖预测概率向量，但当仅能获取预测标签时失效。本文提出图级标签仅攻击（GLO-MIA），基于训练数据预测比测试数据更稳定的直觉：通过在目标图的有效特征上添加扰动，生成一组扰动图，并查询目标模型获取其预测标签，进而计算目标图的鲁棒性得分。通过与预设阈值比较，可高概率推断目标图的成员身份。在三个数据集和四种GNN模型上的评估表明，GLO-MIA最高攻击准确率达0.825，较基线提升8.5%，且接近基于概率的攻击性能，即使仅有预测标签也可实现高效攻击。
原文摘要 · Abstract (English)
Graph neural networks (GNNs) are widely used for graph-structured data but are vulnerable to membership inference attacks (MIAs) in graph classification tasks, which determine if a graph was part of the training dataset, potentially causing data leakage. Existing MIAs rely on prediction probability vectors, but they become ineffective when only prediction labels are available. We propose a Graph-level Label-Only Membership Inference Attack (GLO-MIA), which is based on the intuition that the target model's predictions on training data are more stable than those on testing data. GLO-MIA generates a set of perturbed graphs for target graph by adding perturbations to its effective features and queries the target model with the perturbed graphs to get their prediction labels, which are then used to calculate robustness score of the target graph. Finally, by comparing the robustness score with a predefined threshold, the membership of the target graph can be inferred correctly with high probability. Our evaluation on three datasets and four GNN models shows that GLO-MIA achieves an attack accuracy of up to 0.825, outperforming baseline work by 8.5% and closely matching the performance of probability-based MIAs, even with only prediction labels.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。