提出低成本图神经网络模型提取方法,兼顾安全风险与科研高效标注。
CEGA: A Cost-Effective Approach for Graph-Based Model Extraction and Acquisition
- 通过迭代反馈优化节点查询策略,仅用少量初始节点提升模型精度。
- 在有限查询次数下,准确率、保真度和F1值均优于现有基线方法。
- 适用于标注昂贵的生物医学等领域,也揭示了部署模型的安全隐患。
图神经网络(GNN)在众多应用中表现卓越,其日益增长的复杂性使机器学习即服务(MLaaS)成为可扩展部署的可行平台。然而,这种易访问性也使GNN面临严重安全威胁,尤其是模型提取攻击(MEAs),攻击者通过有策略地查询部署模型以构建高保真复制品。本文评估了GNN对MEAs的脆弱性,并探索其在非对抗性研究场景下的低成本模型获取潜力。值得注意的是,自适应节点查询策略在研究中同样关键,尤其当数据标注成本高昂或耗时。通过选择性采样信息丰富的节点,研究人员可用最少监督训练高性能GNN,这对需要专家标注的领域(如生物医学)尤为重要。为此,我们提出一种针对实际但未充分研究场景的节点查询策略:禁止批量查询,仅提供有限初始节点。该方法在多轮学习中迭代优化节点选择机制,利用历史反馈提升提取效率。在基准图数据集上的大量实验表明,在严格查询数量约束下,我们的方法在准确率、保真度和F1分数上均优于可比基线。结果既突显了部署式GNN的脆弱性,也展现了伦理且高效的GNN获取方法在低资源研究环境中的前景。
原文摘要 · Abstract (English)
Graph Neural Networks (GNNs) have demonstrated remarkable utility across diverse applications, and their growing complexity has made Machine Learning as a Service (MLaaS) a viable platform for scalable deployment. However, this accessibility also exposes GNN to serious security threats, most notably model extraction attacks (MEAs), in which adversaries strategically query a deployed model to construct a high-fidelity replica. In this work, we evaluate the vulnerability of GNNs to MEAs and explore their potential for cost-effective model acquisition in non-adversarial research settings. Importantly, adaptive node querying strategies can also serve a critical role in research, particularly when labeling data is expensive or time-consuming. By selectively sampling informative nodes, researchers can train high-performing GNNs with minimal supervision, which is particularly valuable in domains such as biomedicine, where annotations often require expert input. To address this, we propose a node querying strategy tailored to a highly practical yet underexplored scenario, where bulk queries are prohibited, and only a limited set of initial nodes is available. Our approach iteratively refines the node selection mechanism over multiple learning cycles, leveraging historical feedback to improve extraction efficiency. Extensive experiments on benchmark graph datasets demonstrate our superiority over comparable baselines on accuracy, fidelity, and F1 score under strict query-size constraints. These results highlight both the susceptibility of deployed GNNs to extraction attacks and the promise of ethical, efficient GNN acquisition methods to support low-resource research environments.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。