GraphGuard: Detecting and Counteracting Training Data Misuse in Graph Neural Networks

GraphGuard: Detecting and Counteracting Training Data Misuse in Graph Neural Networks

Speakers: Bang Wu

Conference: NDSS Symposium

YouTube: (no public video)

Overview

Graph Neural Networks (GNNs) have emerged as a transformative technology for analyzing complex graph-structured data across diverse fields, from e-Commerce recommendations to advanced drug discovery and protein folding. With the increasing adoption of Machine Learning as a Service (MLaaS) platforms, GNN models are frequently deployed in cloud environments, offering public APIs for predictions. While convenient, this paradigm introduces significant transparency challenges, particularly regarding the local training processes undertaken by model developers. This opacity creates a critical vulnerability: the potential for unauthorized accumulation and misuse of vast amounts of graph data, directly infringing upon the intellectual property (IP) rights of data owners.

The talk, "GraphGuard: Detecting and Counteracting Training Data Misuse in Graph Neural Networks" by Bang Wu, addresses this pressing practical and security concern. It highlights that the pursuit of optimal model performance often incentivizes developers to gather extensive datasets, sometimes through illicit means. Such unauthorized data acquisition, as evidenced by recent high-profile lawsuits against AI companies, directly undermines data owners' IP, especially for valuable, costly-to-construct datasets in sensitive domains like pharmaceutical research.

GraphGuard presents a pioneering integrated pipeline designed to detect and mitigate data misuse in GNNs deployed on MLaaS platforms. Crucially, it achieves this without requiring access to the original, proprietary training data, thereby respecting data owners' IP rights. By offering a comprehensive solution that combines proactive detection with training-graph-free unlearning, GraphGuard aims to build more trustworthy and privacy-preserving MLaaS ecosystems for graph-based machine learning.

Background

[▶ Watch: Introduction to GraphGuard and problem overview (0:00)]()

To appreciate the intricacies of GraphGuard, it's essential to understand the foundational concepts and the limitations of prior work. The core focus is on Graph Neural Networks (GNNs), specifically for node classification, where a GNN model f learns to assign labels to nodes based on the graph structure A (adjacency matrix) and node features X. This can occur in transductive settings, where the training and inference graphs are identical, or inductive settings, where they differ. For instance, a 2-layer Graph Convolutional Network (GCN) aggregates features from nodes and their neighbors using a normalized adjacency matrix.

The deployment context for this problem is Machine Learning as a Service (MLaaS). Platforms like Amazon SageMaker enable model developers to train and deploy GNNs in the cloud, exposing them via API endpoints for users to obtain predictions. In inductive settings, which GraphGuard primarily addresses, developers upload only the GNN model, and users provide their inference graphs and node IDs to receive predictions.

A key technique for detecting data misuse is Membership Inference (MI). MI aims to determine if a specific data sample was included in a model's training dataset. For inductive node classification, MI typically infers membership by analyzing the prediction confidence score of a node. Attackers often employ shadow datasets and shadow models to train an MI model, which then predicts membership based on the target model's outputs.

However, existing studies on data misuse detection and mitigation in GNNs exhibit significant limitations:

1. Detecting Data Misuse: Current MI approaches (e.g., [17, 25, 37, 62] cited in the talk) often require data owners to transfer the exact training samples to the cloud for inference. This is problematic due to the sensitive nature of graph data and IP concerns. GraphGuard seeks to overcome this by not requiring the transfer of private graph structures or model parameters.
2. Mitigating Data Misuse: Most unlearning methods (e.g., [6, 11, 14, 64]) are designed to remove the influence of specific training samples. Yet, they frequently demand specific function blocks within the GNN architecture or direct access to the original training graph. These requirements make them incompatible with general GNNs deployed on MLaaS platforms and directly violate data owners' IP rights.

These limitations highlight a critical gap: the urgent need for a unified framework that can both detect and mitigate data misuse in MLaaS-deployed GNNs, without relying on access to the original training graph data, thereby respecting its proprietary nature. GraphGuard is specifically designed to fill this gap.

Key Findings

[▶ Watch: Background: GNNs, MLaaS, and Membership Inference (2:00)]()

GraphGuard makes several significant contributions to the field of GNN security and privacy, particularly within MLaaS environments:

• Pioneering Integrated Pipeline: GraphGuard is presented as the first practical, integrated pipeline framework specifically designed to address both the detection and mitigation of graph data misuse in GNNs within the MLaaS context. This holistic approach is a significant step beyond fragmented solutions.
• Formalized Problem and Requirements: The research formally defines the problem of graph data misuse for MLaaS-deployed GNNs and establishes four critical design requirements: R1-Detectable (misuse must be detectable), R2-Remedial (framework must enable unlearning), R3-Data Privatization (sensitive graph structure must remain private), and R4-Model Agnostic (solution should not require specific GNN architectures or training processes).
• Novel Proactive Misuse Detection: GraphGuard introduces an innovative misuse detection technique that leverages Membership Inference (MI) augmented with radioactive data. By constructing a "radioactive graph" through optimized perturbations of node attributes, the method creates a unique mark that significantly amplifies the difference in output distributions between benign and data-misused models. This leads to near-perfect detection rates, achieving an AUC of almost 1.0 across various GNN models and datasets, and demonstrates robustness against graph denoise methods. Crucially, it respects R3 by not requiring the transmission of confidential graph structures.
• Training-Graph-Free Unlearning: A novel unlearning methodology is proposed that employs synthetic graphs generated by the MLaaS server itself, thereby avoiding the need for confidential graph structures (R3). This method effectively mitigates data misuse by significantly reducing Membership Inference Attack (MIA) success rates on unlearned nodes (e.g., from 86.9% to 51.8% on Cora with GCN), while incurring only a marginal decrease in model accuracy (consistently less than 5%).
• Open-Source Availability: The GraphGuard artifact, implemented using PyTorch and the Deep Graph Library (DGL), is open-source and available on GitHub and Zenodo, facilitating further research and adoption by the community.

Technical Deep Dive

[▶ Watch: System model and threat model definition (4:00)]()

GraphGuard's technical approach is meticulously designed to address the complex problem of detecting and mitigating unauthorized training data use in GNNs deployed on MLaaS, while adhering to stringent privacy requirements.

The System Model involves three entities:

1. Data Owner: Possesses private graph data Gp = (Ap, Xp), where Ap (adjacency matrix) is considered private IP, and Xp (node features) might be less sensitive. They have full access to their data.
2. Model Developer: The adversarial entity. They develop a GNN model fo* and deploy it on MLaaS, having full access to their model and the training graph Gm they use.
3. MLaaS Server: A trusted entity (e.g., Amazon, Microsoft) providing the MLaaS platform. It deploys the GNNs and has full access to the model, potentially receiving less sensitive information like Xp.

The Threat Model focuses on the model developer as the attacker, who acquires unauthorized graph data (Gp) and uses it to train their GNN, infringing on the data owner's IP. Their motivations include achieving superior model performance for commercial gain and avoiding data acquisition costs. The attacker's capabilities include obtaining Gp without authorization and deploying fo* on MLaaS while concealing the illicit use of Gp, as the training process is local and opaque to the MLaaS server.

This leads to Definition 1: Data Misuse for GNNs in MLaaS: A model developer, intending to use an authorized graph Gm, illicitly collects an unauthorized graph Gp and uses Gm' = Gm U Gp as the training set to construct fo* locally. They then provide fo* to the MLaaS server without disclosing the use of Gp.

GraphGuard is built upon four critical Design Requirements (R1-R4):

• R1-Detectable: The method must detect misuse even when the training process is opaque.
• R2-Remedial: The MLaaS server must be able to initiate unlearning to remove the impact of unauthorized data.
• R3-Data Privatization: The graph structure (Ap) of the data owner's data must remain private, not shared with MLaaS or the developer. Similarly, the developer's model and training graph are private.
• R4-Model Agnostic: The design should not require specific GNN architectures or additional training processes.

Meeting these simultaneously presents Technical Challenges: MI efficacy is reduced when avoiding graph structure transmission (R1, R3), and unlearning is formidable without access to the exact graph structure (R2, R3). GraphGuard’s design directly addresses these.

GraphGuard Overview: Two Main Stages

GraphGuard is an integrated pipeline with two main stages: proactive misuse detection and training-graph-free unlearning, designed to meet R1-R4. The overall pipeline is depicted in Figure 1 (as described in the talk).

1. Graph Data Misuse Detection

The objective is to determine if a suspect GNN model fo* was trained using unauthorized Gp, without the data owner divulging Ap. This is an MI problem with privacy constraints. Instead of querying with precise Gp, the data owner queries with a perturbed version.

The main Challenge is that noise in query samples significantly reduces MI effectiveness, as MI relies on detecting overfitting, which is diminished by perturbed queries.

The Design Intuition draws from radioactive data. Instead of just overfitting, GraphGuard constructs a radioactive graph by introducing optimized perturbations to the original graph data. This radioactive graph is designed to bear a unique mark, making the output distributions of a vanilla model (trained without Gp) and a data-misused model (trained with Gp) distinctly different, thus enhancing misuse detection.

The detection process has two phases:

• Initialization Phase: The data owner locally converts their original data Gp into a radioactive graph Gp using a construction algorithm (Step 1 in Figure 1). This Gp is then (potentially illicitly) acquired and used by an adversarial model developer to train fo* (Steps 2 & 3).
• Detection Phase: When misuse is suspected, the data owner crafts a query about their radioactive graph Gp, omitting structural details (e.g., querying only individual nodes with attributes) (Step 4). The MLaaS server performs inference on fo* and transmits results back (Step 5). The data owner evaluates this response to discern if fo* was trained using Gp.

Radioactive Graph Construction:

The goal is to maximize the difference in output distributions between a model trained with the radioactive graph and one trained without it. Formally, this involves maximizing d(A(fo*(Gp)), A(fo*(Gp))), where A() is an MI attack model and Gp is the queried graph with isolated nodes (i.e., Ap = I).

This optimization (Equation 3) is complex. It's converted into a tractable problem: min for(Gp) - fop(Gp)2 - L(for(Gp), Yp) (Equation 4), where L is the GNN's training loss, for is a pre-trained surrogate model, and fop, fop are its classifier and encoder. This is solved using a gradient descent method.

Algorithm 1 details the procedure:

1. Initialize Gp = (Ap, Xp) and Yp.
2. For N epochs, calculate Lopt, which is the difference between the surrogate model's output on Gp and Gp, minus the loss on Gp.
3. Select the top-k largest Xp features based on their absolute gradient magnitude.
4. For these selected features, if the change in loss ΔLi is positive, set Xn+1i to 0; otherwise, set it to 1. This iteratively perturbs Xp to create Gp.

Privacy and Distinctions:

• Privacy Risk: Querying isolated node attributes is less risky than full graphs. Perturbations further reduce link stealing effectiveness.
• Distinction from Backdoor/Poisoning: GraphGuard amplifies differences for detection, not influencing training as an attacker would.
• Distinction from Radioactive Data [50]: Previous work focused on linear models and Euclidean data; GraphGuard is for non-linear GNNs and considers graph structure indirectly.
• Distinction from Model Watermarking: GraphGuard protects the data owner's IP, not the model developer's.

The intuition is that Gp makes the GNN trained on it "learn less" about confidential Ap and produce a greater training loss, increasing its influence on target GNNs and facilitating misuse detection.

2. Training-Graph-Free Unlearning

The objective is to eliminate the influence of unauthorized training data samples from an infringing GNN model fo* without accessing the sensitive graph structure of Gp or the authorized graph Gm. This is challenging because existing unlearning methods typically require direct access to the unlearning samples.

The Design Intuition is to perform unlearning through fine-tuning based on synthetic graphs generated by the MLaaS server itself. This synthesis leverages statistical knowledge from the MI attack model and less sensitive node attributes (Xp) provided by the data owner. This avoids sharing confidential graph structure.

The unlearning architecture (Figure 2) has two stages:

• Unlearned Graph Generation:
• Upon an unlearning request, the MLaaS server requests less-sensitive node attributes Xp from the data owner.
• The server trains a graph generation model g to connect these isolated nodes. g is trained to minimize 1 - A(fo*(g(X))) (Equation 5). The intuition is that A should output 1 if the generated graph g(X) causes overfitting in fo*.
• g also uses Xo (node attributes of the authorized training graph) to facilitate fine-tuning.
• With g, the server generates the synthetic unlearned graph Gp = g(Xp) and the synthetic remaining graph Gr = g(Xo). This generation synthesizes graphs exclusively from node attributes and latent patterns, without reconstructing private edges.
• Membership-aware Fine-tuning:
• The objective is to make fo* forget Gp while maintaining performance on Gr.
• The unlearned GNN fo is obtained by minimizing L(fo(Gr)) - αL(fo(Gp)) (Equation 6).
• L is the training loss, and α is a hyper-parameter balancing unlearning effectiveness and GNN utility. A higher α increases loss on Gp, neutralizing its impact, while L(fo(Gr)) preserves performance on Gr. The talk uses α = 0.5.

This two-stage approach enables effective unlearning without exposing sensitive graph structure to the MLaaS server.

Integrated GraphGuard Framework

The complete GraphGuard framework (Figure 1) combines these modules:

1. Data Owner Constructs Proactive Graph (Step 1): Locally perturbs Gp to create radioactive Gp.
2. Data Misuse Occurs (Steps 2 & 3): Malicious developer illicitly acquires Gp, trains fo* on Gm' = Gm U Gp, and deploys it to MLaaS.
3. Data Owner Submits MI Queries (Step 4): Queries MLaaS with Gp (isolated nodes, no graph structure).
4. MLaaS Server Processes Queries (Step 4): Performs inference on fo* and sends results to data owner.
5. Data Owner Detects Misuse (Step 5): Analyzes confidence scores to detect misuse.
6. Data Owner Requests Unlearning (Step 6): Provides Xp and inference model A to MLaaS.
7. MLaaS Server Generates Unlearned/Remaining Graphs (Step 7): Uses Xp, Xo (from developer), and A to generate synthetic Gp and Gr.
8. MLaaS Server Performs Membership-aware Fine-tuning (Step 8): Fine-tunes fo* using Gp and Gr to obtain unlearned fo.

This integrated pipeline ensures GraphGuard is detectable (R1), remedial (R2), respects data privatization (R3), and is model agnostic (R4).

Demo / Proof of Concept

[▶ Watch: Formal definition of GNN data misuse (4:50)]()

The efficacy of GraphGuard was validated through extensive experiments focusing on the four design requirements (R1-R4). The evaluation settings effectively served as a proof of concept, demonstrating the practical applicability and performance of the proposed framework.

Evaluation Settings:

• R1 - Misuse Detection Effectiveness: Measured by detection rate and AUC (Area Under the ROC Curve). A higher AUC signifies better detection of whether a node was used in training.
• R2 - Unlearning Effectiveness: Assessed by the attack success rate of Membership Inference Attacks (MIA) on both unlearned and remaining nodes. A lower MIA success rate on unlearned nodes indicates successful forgetting.
• R3 - Data Privatization: Inherently satisfied by GraphGuard's design, which ensures the data owner queries only isolated nodes without graph structure, the model developer does not provide training graph structure to MLaaS, and MLaaS does not provide direct GNN model access for misuse detection.
• R4 - GNN Model Agnostic: Demonstrated by testing GraphGuard across various popular GNN architectures and datasets without requiring specific GNN architectures or training processes.

Datasets: Four widely recognized public graph datasets were used (summarized in Table IV):

• Cora, Citeseer, Pubmed: Citation networks where nodes are publications, attributes are keywords, and edges signify citations.
• Flickr: An image dataset with nodes representing images, attributes detailing image profiles, and edges indicating common information.

GNN Models: GraphGuard was tested on four state-of-the-art GNN models:

• GCN [32]
• GraphSage [23]
• GAT (Graph Attention Networks) [56]
• GIN [68]

All models used 16 features in the hidden layer, ReLU activation, Adam optimizer (learning rate 0.01), 300 training epochs, and cross-entropy loss.

MLaaS Settings Simulation: For ethical considerations, the MLaaS environment was simulated. Data access for each entity was strictly restricted to mirror MLaaS constraints (Table II), and data transmission was emulated to ensure no private graph structure was transmitted.

Artifact Details: The artifact is implemented using PyTorch and the Deep Graph Library (DGL). It does not require GPU support and runs on a Linux server. The source code is available on GitHub and Zenodo, with a detailed guide for reproduction. All datasets are integrated into DGL for automatic download.

Evaluation and Results: Misuse Detection (R1, R4)

GraphGuard's proactive misuse detection module demonstrated exceptional effectiveness:

• AUC (Table V): Achieved an AUC of almost 1.0 across all four GNN models and datasets. For example, on Cora with GCN, the AUC increased from a baseline of 0.874 to 0.999 (a gain of 0.125). For Citeseer with GraphSage, it went from 0.822 to 1.0 (a gain of 0.178). This indicates near-perfect detection, meaning a threshold can almost perfectly identify if a node was used in training.
• TPRs at 1% FPR (Table VI): Consistently achieved much higher True Positive Rates at a low False Positive Rate (1%) compared to the baseline. For example, on Cora with GCN, GraphGuard's TPR was 0.945 compared to the baseline's 0.257 (an increase of 0.688). For Pubmed with GraphSage, it was 1.0 compared to 0.360 (a gain of 0.640). This highlights strong correct misuse detection with minimal false alarms.
• Output Distribution Comparisons (Figure 3): Visualized the impact of radioactive graph construction. In the baseline, output distributions of benign and misused GNNs largely overlapped. With GraphGuard, data-misused GNNs showed a clear distinction in performance, with very few overlaps between authorized and unauthorized nodes, making misuse identification straightforward. This is attributed to the radioactive graph forcing GNNs to learn more from attributes, amplifying performance disparity.
• Robustness to Denoising (Table VII): GraphGuard maintained its effectiveness against graph denoise methods. The AUC of misuse detection remained almost the same with and without denoising (e.g., on Cora with GCN, AUC was 1.0 with denoising and 0.999 without). This indicates robustness to common graph structure modifications.

These results confirm that GraphGuard's proactive misuse detection is highly effective, robust, and generalizable across different GNN models and datasets, satisfying R1 and R4.

Evaluation and Results: Unlearning (R2, R4)

The training-graph-free unlearning module also showed strong performance:

• Effectiveness of Unlearning (Table IX): Measured by the MIA (Membership Inference Attack) success rate. GraphGuard demonstrated a significant reduction in MIA attack success rates on unlearned nodes. For instance, on Cora with GCN, the MIA success rate dropped from 86.9% to 51.8% (a decrease of 35.1%). For Pubmed with GIN, it fell from 84.1% to 47.6% (a decrease of 36.5%). These post-unlearning rates are very close to 50%, signifying a random guess for membership, effectively eliminating the impact of the unlearned nodes.
• Utility of Unlearning (Table VIII): The GNN model's accuracy on remaining data incurred only a marginal decrease, consistently less than 5%. For example, on Cora with GCN, accuracy dropped from 75.7% to 74.3% (a decrease of only 1.2%). On Pubmed with GAT, accuracy decreased from 83.6% to 81.3% (a drop of 2.3%). This minor reduction is deemed reasonable given the inherent nature of knowledge removal.
• Time Cost (Table X): GraphGuard's unlearning method showed significant efficiency improvements compared to retraining the model from scratch. For Cora with GCN, unlearning was approximately 4.99 times faster than retraining. For Citeseer with GraphSage, it was about 6.08 times faster. Smaller datasets exhibited greater relative efficiency (3-6x) compared to larger ones like Pubmed (1-2x). The computational cost for graph synthesis is borne by the MLaaS server, which typically has ample resources, making the design suitable for MLaaS settings.

These results validate that GraphGuard's unlearning module effectively mitigates data misuse by significantly reducing MIA success rates while preserving model utility with only a marginal accuracy decrease, thus satisfying R2 and R4.

Defensive Implications

[▶ Watch: GraphGuard's four critical design requirements (5:15)]()

GraphGuard provides crucial defensive capabilities for protecting intellectual property and ensuring ethical practices in the rapidly expanding domain of GNNs deployed via MLaaS platforms.

For Data Owners, GraphGuard offers a robust mechanism to assert and protect their IP rights. By utilizing the proactive misuse detection module, data owners can periodically query MLaaS-deployed GNNs using their uniquely marked radioactive graphs. This allows them to effectively detect if their proprietary graph structure has been illicitly incorporated into a model's training data, even without sharing their private graph. Upon detection, they can confidently request unlearning, compelling the MLaaS provider to remove the influence of their unauthorized data.

MLaaS Providers can leverage GraphGuard to enhance the trustworthiness and compliance of their platforms. By integrating GraphGuard's unlearning capabilities, MLaaS providers can offer a verifiable mechanism for data owners to request the removal of misused data. This not only mitigates legal and ethical risks associated with data misuse but also builds confidence among data providers, encouraging broader adoption of GNN services. Implementing such a framework positions MLaaS platforms as responsible stewards of sensitive data.

For Model Developers, GraphGuard serves as a strong deterrent against unauthorized data acquisition. The high detectability of misuse implies that any attempt to illicitly use proprietary graph data carries a significant risk of exposure and subsequent unlearning, negating any performance advantages gained. Ethical model developers should understand these implications and ensure rigorous data governance and acquisition processes to avoid IP infringement.

More broadly, GraphGuard highlights the critical need for greater transparency and auditable processes in machine learning model training, particularly in cloud environments. It pushes the industry towards developing and adopting standardized protocols for data provenance and responsible AI, fostering an ecosystem where data owners retain control over their valuable intellectual assets.

Key Takeaways

• GraphGuard is the first integrated pipeline designed for both detecting and mitigating graph data misuse in GNNs deployed on MLaaS, addressing a critical gap in existing solutions.
• Its novel "radioactive graph" proactive misuse detection achieves near-perfect detection rates (AUC of almost 1.0) and robustness against denoising, all while preserving data privacy by avoiding the transmission of sensitive graph structures.
• The "training-graph-free unlearning" methodology effectively removes the influence of misused data from GNN models (reducing MIA success rates to near 50%) with only a marginal impact on model utility (accuracy decrease consistently less than 5%).
• The framework is model-agnostic and has been validated across state-of-the-art GNN architectures (GCN, GraphSage, GAT, GIN) and diverse datasets (Cora, Citeseer, Pubmed, Flickr).
• Unlearning with GraphGuard offers significant efficiency improvements (3-6x faster for smaller datasets) compared to retraining models from scratch, making it practical for MLaaS environments.
• GraphGuard provides a crucial step towards building more trustworthy and privacy-preserving MLaaS ecosystems for graph-based machine learning, protecting data owners' intellectual property.

About the Speaker(s)

The talk "GraphGuard: Detecting and Counteracting Training Data Misuse in Graph Neural Networks" was presented by Bang Wu. The transcript and metadata do not provide further biographical details about the speaker, such as their title or affiliation.