提出无后门的图神经网络多比特水印技术,可精准验证模型版权。
WGLE:Backdoor-free and Multi-bit Black-box Watermarking for Graph Neural Networks
- 利用边级距离差异量化节点特征与预测差异,构建水印序列。
- 在6个数据集上实现100%验证准确率,模型性能损失仅1.41%。
- 支持多比特水印,适合需批量管理模型版权的开发者使用。
图神经网络(GNN)在现实应用中日益普及,其知识产权保护亟需所有权验证机制。现有指纹法依赖模型相似性计算,成本高且易受后处理干扰;黑盒水印法虽无需访问模型内部,但依赖后门触发,存在安全风险。此外,二者均无法传递副本附加信息,导致每份模型需单独设计触发图。本文提出WGLE,一种新型无后门黑盒水印框架,可在不使用后门的前提下向GNN模型嵌入多比特信息。核心思想是引入层间边距离差(LDDE),量化图中相连节点的特征距离与预测距离之差。通过为边分配唯一LDDE值并构成水印序列,实现多比特容量。在六个主流GNN架构和六个公开数据集上的实验表明,WGLE达到100%所有权验证准确率,平均精度下降仅1.41%,且对各类攻击具有强鲁棒性。代码已开源。
原文摘要 · Abstract (English)
Graph Neural Networks (GNNs) are increasingly deployed in real-world applications, making ownership verification critical to protect their intellectual property against model theft. Fingerprinting and black-box watermarking are two main methods. However, the former relies on determining model similarity, which is computationally expensive and prone to ownership collisions after model post-processing. The latter embeds backdoors, exposing watermarked models to the risk of backdoor attacks. Moreover, both previous methods enable ownership verification but do not convey additional information about the copy model. If the owner has multiple models, each model requires a distinct trigger graph. To address these challenges, this paper proposes WGLE, a novel black-box watermarking paradigm for GNNs that enables embedding the multi-bit string in GNN models without using backdoors. WGLE builds on a key insight we term Layer-wise Distance Difference on an Edge (LDDE), which quantifies the difference between the feature distance and the prediction distance of two connected nodes in a graph. By assigning unique LDDE values to the edges and employing the LDDE sequence as the watermark, WGLE supports multi-bit capacity without relying on backdoor mechanisms. We evaluate WGLE on six public datasets across six mainstream GNN architectures, and compare WGLE with state-of-the-art GNN watermarking and fingerprinting methods. WGLE achieves 100% ownership verification accuracy, with an average fidelity degradation of only 1.41%. Additionally, WGLE exhibits robust resilience against potential attacks. The code is available in the repository.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。