揭露图生成扩散模型的隐私漏洞，可逆推训练数据特征
Inference Attacks Against Graph Generative Diffusion Models
- 设计三类黑箱攻击：结构重建、属性推断、成员身份识别
- 在6个真实图数据集上验证攻击有效，显著优于基线方法
- 提出两种防御方案，兼顾隐私保护与模型性能
图生成扩散模型近年成为生成复杂图结构的强大工具，能有效捕捉图数据中的复杂依赖关系。然而，这类模型的隐私风险尚未被充分研究。本文针对三种黑箱推理攻击展开分析：首先设计图结构重建攻击，从生成图中重构出与训练图结构相似的图；其次提出属性推断攻击，从生成图中推断训练图的平均密度及密度分布等属性；最后开发两种成员身份推理攻击，判断给定图是否在训练集中。在三种不同图生成扩散模型和六个真实世界图数据集上的大量实验表明，这些攻击均有效，显著优于基线方法。最后，本文提出两种防御机制，在防御强度与目标模型效用之间实现更优权衡。代码已公开于 https://zenodo.org/records/17946102。
原文摘要 · Abstract (English)
Graph generative diffusion models have recently emerged as a powerful paradigm for generating complex graph structures, effectively capturing intricate dependencies and relationships within graph data. However, the privacy risks associated with these models remain largely unexplored. In this paper, we investigate information leakage in such models through three types of black-box inference attacks. First, we design a graph reconstruction attack, which can reconstruct graphs structurally similar to those training graphs from the generated graphs. Second, we propose a property inference attack to infer the properties of the training graphs, such as the average graph density and the distribution of densities, from the generated graphs. Third, we develop two membership inference attacks to determine whether a given graph is present in the training set. Extensive experiments on three different types of graph generative diffusion models and six real-world graphs demonstrate the effectiveness of these attacks, significantly outperforming the baseline approaches. Finally, we propose two defense mechanisms that mitigate these inference attacks and achieve a better trade-off between defense strength and target model utility than existing methods. Our code is available at https://zenodo.org/records/17946102.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。