仅用极少查询即可窃取图神经网络模型，威胁真实场景安全。
On Stealing Graph Neural Network Models
- 先无查询获取模型结构，再精准利用有限查询提取关键数据
- 在8个真实数据集上验证有效，即使查询限制严格也成功攻击
- 揭示现有防御措施不足，适合关注模型安全的研究者阅读
当前的图神经网络（GNN）模型窃取方法高度依赖对目标模型的大量查询，假设无严格查询限制。然而在实际中，查询次数常受严格限制。本文展示了一种攻击者仅通过极少交互即可提取完整GNN模型的方法：首先在不直接查询目标模型的情况下获取其模型主干结构，随后战略性地利用固定的查询限额提取最具信息量的数据。在八个真实世界数据集上的实验表明，该攻击在极低查询限制下依然有效，且能突破现有的模型提取防御机制。研究结果凸显了针对GNN模型提取威胁构建强健防御的必要性。
原文摘要 · Abstract (English)
Current graph neural network (GNN) model-stealing methods rely heavily on queries to the victim model, assuming no hard query limits. However, in reality, the number of allowed queries can be severely limited. In this paper, we demonstrate how an adversary can extract a GNN with very limited interactions with the model. Our approach first enables the adversary to obtain the model backbone without making direct queries to the victim model and then to strategically utilize a fixed query limit to extract the most informative data. The experiments on eight real-world datasets demonstrate the effectiveness of the attack, even under a very restricted query limit and under defense against model extraction in place. Our findings underscore the need for robust defenses against GNN model extraction threats.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。