Prompt-based Unifying Inference Attack on Graph Neural Networks
Authors: Yuecen Wei, Xingcheng Fu, Lingyun Liu, Qingyun Sun, Hao Peng, Chunming Hu
AAAI 2025 | Venue PDF | Archive PDF | Plain Text | LLM Run Details
| Reproducibility Variable | Result | LLM Response |
|---|---|---|
| Research Type | Experimental | In this section, we conduct extensive experiments on five real-world datasets to validate the attacking capability of Pro IA1. We introduce the experimental setup, present the results, and provide a detailed analysis. ...Table 1: Summary results of accuracy, Weighted-F1 and average improvement performance. ...Figure 3: Attack AUC-ROC scores of GCN, GAT, and SAGE (from left to right) against defended models for MIA. |
| Researcher Affiliation | Academia | Yuecen Wei1,2, Xingcheng Fu3, Lingyun Liu3, Qingyun Sun2, Hao Peng2, Chunming Hu1,2* 1School of Software, Beihang University, Beijing, China 2Beijing Advanced Innovation Center for Big Data and Brain Computing, Beihang University, Beijing, China 3Key Lab of Education Blockchain and Intelligent Technology, Ministry of Education, Guangxi Normal University, China EMAIL, EMAIL, EMAIL |
| Pseudocode | Yes | In this section, we will gradually introduce the detailed design of Pro IA, including the overall framework, the pretraining prompts, attack data generation, and the adaptive inference attack. See the appendix for Pro IA s algorithm. |
| Open Source Code | Yes | 1Code available: https://github.com/Ring BDStack/Pro IA |
| Open Datasets | Yes | For the MIA, we employ three widely-used graph datasets. Cora (Kipf and Welling 2017) is a citation network of academic papers. Facebook (Leskovec and Mcauley 2012) describes the social network of relationships between social media pages. Lastfm (Rozemberczki and Sarkar 2020) is a social network reflecting users musical interests. For the AIA, we utilize two datasets that are labeled with sensitive attributes. Bail (Agarwal, Lakkaraju, and Zitnik 2021) is a U.S. bail dataset. Pokec-n (Takac and Zabovsky 2012) is a social network extracted from the Slovakian social network Pokec. |
| Dataset Splits | No | The paper mentions known labeled nodes (Vtr) and unlabeled nodes (Vte = V \ Vtr) for classification tasks, implying a split, but does not provide specific percentages, sample counts, or explicit methodology for how these splits are created or if standard splits were used for the listed datasets. It states: 'We aim to train a node classifier Fθ that distinguishes in AIA and MIA to predict the sensitive labels Yte of remaining unlabeled nodes V te = V \ V tr.' |
| Hardware Specification | No | The paper specifies various parameters for the models and training process, such as the number of layers, learning rates, iteration numbers, representation dimension, and optimizer (Adam). However, it does not mention any specific hardware details like GPU models, CPU types, or memory specifications used for running the experiments. |
| Software Dependencies | No | The paper mentions using the 'Adam optimizer' and graph convolutional networks, but does not provide specific version numbers for any software dependencies like Python, PyTorch, TensorFlow, or other libraries that would be needed to replicate the experiment. |
| Experiment Setup | Yes | Settings. To maximize its advantages, we set the number of baseline layers to 2 and the disentangled mechanism layers in Pro IA to 5. The attack model s learning rate and iteration number are set to 0.01 and 100, and the remaining modules and methods are set to 1e 4 and 200. Common parameters include a representation dimension of 256 and the Adam optimizer. The privacy-preserving model employs a unified privacy budget of 0.2. All other settings use default optimal values. |