黑盒环境下，利用图模型解释信息可高效窃取神经网络。
Can Subgraph Explanations Be Weaponized to Steal Graph Neural Networks?
- 通过解释掩码引导蒙特卡洛敏感性分析，定位决策边界。
- 在多个数据集上实现比基线更优的模型提取精度。
- 揭示可解释性接口的潜在安全风险，适合安全与政策研究者。
图机器学习即服务（GMLaaS）平台为满足监管透明要求，越来越多地引入可解释性接口。然而，这种透明性也带来了模型提取攻击的可乘之机。本文首次提出一种专为图分类设计的模型提取攻击，在严格黑盒约束下，攻击者仅能观测离散类别标签和二值解释掩码（无概率分数、梯度或置信度）。我们的方法（1）利用模型解释输出引导蒙特卡洛边敏感性估计，具有霍夫丁浓度保证的估计精度；（2）利用解释子图高效缩小边界搜索空间。在多个领域基准图数据集上的大量实验表明，该方法优于现有基线。研究结果表明，此类可解释性接口会形成可被利用的攻击面，为防御机制与可解释性人工智能政策框架提供重要启示。代码已公开于 https://github.com/LabRAI/XSTEAL/。
原文摘要 · Abstract (English)
Graph Machine Learning as a Service (GMLaaS) platforms increasingly implement explainability interfaces to meet regulatory transparency requirements. However, this transparency creates exploitable vulnerabilities for model extraction attacks. We present the first model extraction attack specifically designed for graph classification under strict black-box constraints where the attacker observes only discrete class labels and binary explanation masks (no probability scores, gradients, or confidence values). Our method (1) uses model explanation outputs to guide Monte Carlo edge sensitivity estimation toward decision boundaries, with Hoeffding concentration guarantees on estimation accuracy and (2) exploits explanation subgraphs to efficiently narrow the boundary search space. Extensive experiments on benchmark graph datasets across multiple domains demonstrate our method's superiority over comparable baselines. These findings demonstrate that such explainability interfaces create exploitable attack surfaces, informing both defensive mechanisms and policy frameworks for explainable AI mandates. The implementation code is provided in https://github.com/LabRAI/XSTEAL/.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。