{"id":"f996d283-751a-49d1-bc61-21a67bc3d481","arxiv_id":"2608.11495","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":7,"one_line_summary":"GraphRP uses structure-gated reprogramming noise to poison model-extraction queries against GNNs, cutting clone accuracy while keeping benign accuracy nearly unchanged.","lead":"This paper proposes a defense that alters a graph-based AI model's answers for suspicious queries, so attackers who try to copy the model get misleading training data. Normal users keep getting correct answers, while attackers' imitation models become much less accurate.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Defense and Theorem 5.1 both hinge on attack queries being OOD; if an attacker can drive the gate alpha near 0, no defense is guaranteed, yet the paper never tests this scenario.","rationale":"The reader's identified weakest assumption is the OOD premise, and the paper's own formal result makes the dependence explicit: the protective term in Eq. 13 is multiplied by alpha(G)^2, so if an attacker's queries look in-distribution to the gating mechanism, the bound degenerates to the vacuous -2M*TV term. The empirical evaluation never varies this assumption; all reported attacks use either synthetic OOD queries or a GraphGAN-based adaptive attack whose reported numbers are internally inconsistent (Table A3 shows lower clone accuracy under adaptive attack than under standard attack, which is counterintuitive and suggests the adaptive attacker is not a strong adversary). The central conditional claim, that GraphRP degrades clone accuracy while preserving utility, remains plausible for genuinely OOD queries, but the evidence does not establish robustness to an attacker who can obtain or approximate in-distribution data. A concrete experiment with ID-distributed attack queries would settle whether the defense has any effect in the data-based ME setting, which is a primary real-world threat model. The verdict CONDITIONAL is therefore appropriate; no adjustment is needed beyond requiring this test and clarification of the adaptive-attack results.","tokens_in":18962,"tokens_out":8196,"duration_ms":75980,"concrete_test":"Run the MUTAG soft-label experiment with the attacker's query set sampled from the same distribution as D_id (e.g., a held-out 50/50 split of MUTAG, with no synthetic OOD graphs), keeping GraphRP trained exactly as in Algorithm 1. Record clone accuracy and the mean gate alpha over attack queries. If clone accuracy stays near the undefended 76.5% level (or mean alpha remains below, say, 0.1), the defense does not engage on in-distribution queries and the OOD premise fails.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The defense is only active when the structure gate alpha(G) (Eq. 7) is close to 1 for the attacker's queries. Both the mechanism (Eq. 8) and the theoretical bound (Theorem 5.1, Eq. 13) scale the protective perturbation by alpha(G)^2, so alpha near 0 makes the first term vanish and leaves only the typically negative -2M*TV(G_id, G_ood) term. The paper explicitly assumes attack queries are OOD: Sec. 3.1 defines D_ood with D_id intersect D_ood = empty, and Sec. 3.4 says the defender knows that attack queries are likely to be OOD. This is precisely the setting in which the defense is strongest; it says nothing about data-based ME, where the attacker holds a surrogate dataset distributionally similar to the private data (the common KnockoffNet setup). In that regime alpha stays near 0, the reprogramming noise is dormant, and the clone can extract the original decision boundary. Sec. 4.3 asserts spectral signatures are hard to spoof, but the attacker does not need to spoof them explicitly: with black-box access to the defended API, an attacker can train a generator to minimize the KL or confidence distortion of returned outputs, effectively finding inputs with alpha near 0. The paper's adaptive-attack experiment (Sec. 6.3, Table 3) uses a GraphGAN trained to mimic benign topology, yet Table A3 reports that the adaptive, unknown-architecture clone has lower accuracy than the standard attack (0.522 vs 0.603), which is hard to interpret and suggests the adaptive attacker is not actually optimizing against the defense. The central capability claim therefore rests on an unvalidated distributional premise.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The manuscript proposes GraphRP, a proactive defense against model extraction attacks on graph neural networks. The method combines layer-wise learnable perturbations (repurposed from model reprogramming) with a structure-aware gate that computes a gating factor alpha from the distance of the input graph to learned benign structural prototypes based on spectral and topological features. For in-distribution queries the gate suppresses the perturbation, preserving benign utility; for out-of-distribution queries the gate activates the perturbation, which is trained to maximize the KL divergence between the original and reprogrammed outputs. The paper proves a lower bound (Theorem 5.1) on the loss disparity between an optimal clone and the victim in terms of a Fisher-information-weighted perturbation term minus a distribution-shift term. Experiments on MUTAG, ENZYMES, NCI1, PROTEINS, OGB-MolHIV, and COLLAB compare GraphRP against several baselines under soft-label and hard-label attacks, adaptive attacks, data leakage, and varying query budgets.","tokens_in":19237,"tokens_out":5102,"duration_ms":47666,"significance":"If the proposed defense works as claimed, it addresses a real and under-served problem: active, stateless, low-latency protection for GNN model extraction without retraining the victim. The structural-gating idea is a reasonable departure from image-based random perturbation defenses, and the evaluation covers a broad set of graph benchmarks and attack configurations. The theoretical result, however, is close to a restatement of the training objective rather than an independent guarantee, and several empirical claims lack statistical support. The central mechanism hinges on attack queries being out-of-distribution, which is not always the case for data-based model extraction. The paper should be revised to clarify the scope of its guarantee and to strengthen the adaptive-attack validation; the core direction is defensible but the current evidence is not conclusive.","major_comments":[{"comment":"The first term of the bound, E[1/2 alpha(G)^2 delta~^T I_h(G) delta~], is exactly the second-order Taylor expansion of the KL divergence that L_defense in Eq. (10) is trained to maximize. Combined with assumption (A2), which sets C* to perfectly mimic T_R on the query distribution, the theorem reduces to 'if the defense maximizes the KL divergence and the attacker perfectly copies the poisoned model, then the clone differs from the victim by that KL divergence.' This is true but does not provide information beyond the training loss. I recommend repositioning the theorem as an interpretation of the defense objective, or proving a bound that does not assume the attacker perfectly matches the reprogrammed model.","section":"Theorem 5.1, Eq. (13) and Appendix A.2"},{"comment":"The defense is only active when the gate alpha(G) is close to 1. For queries that are distributionally similar to the private training data, alpha stays near 0, the perturbation in Eq. (8) is dormant, and the positive first term in Eq. (13) vanishes. Section 2.1 explicitly includes Data-Based Model Extraction, where the attacker holds a dataset distributionally similar to the victim's training data, but the paper's threat model in Sec. 3.4 assumes attack queries are OOD. Table 4 only tests a 10% ID leak mixed into OOD queries, not a pure ID-like query regime. The paper should either test the full ID-like DBME regime or clearly state that the defense targets only OOD-query attacks.","section":"Sec. 3.1, Sec. 3.4, Eq. (7) and Theorem 5.1"},{"comment":"The adaptive GraphGAN attack is reported to produce lower clone accuracy than the standard attack (e.g., hard-label clone accuracy 0.522 vs. 0.603 for GraphSAGE in Table A3). This means the 'adaptive' attacker is less effective than the non-adaptive one, which is counterintuitive and suggests the attack is not actually optimizing against the defense. The claim that GraphRP remains robust to adaptive attackers is therefore not supported. Please report the adaptive attacker's training objective, the achieved alpha values on generated queries, and the KL distortion of returned outputs, or redesign the attack to directly minimize the gate or the defense's obfuscation effect.","section":"Sec. 6.3 and Table A3"},{"comment":"No error bars, confidence intervals, or significance tests are reported anywhere in the main experiments. Several comparisons are close, for instance Table 1 on ENZYMES with GIC clone: GraphRP 0.545 vs. MeCo 0.552, and NCI1 with GIUNET: 0.656 vs. 0.683. Without variance estimates across multiple seeds, the headline claim that GraphRP 'significantly outperforms' baselines is not statistically justified. Please report means and standard deviations over at least three runs and, where relevant, pairwise significance tests.","section":"Tables 1-5 and Figure 3"},{"comment":"The assertion that spectral signatures are 'mathematically difficult to spoof' is made without proof. Since the gate alpha(G) is a smooth function of the structural embedding Phi(G), a black-box attacker with access to the defended API can in principle optimize queries to drive alpha toward 0 by minimizing the distortion of returned outputs or by estimating the gating decision boundary. The paper should either provide a formal statement with assumptions or an empirical evaluation of such a gate-evasion attack, rather than relying on an intuitive claim about inverse problems.","section":"Sec. 4.3, 'Robustness against Structural Spoofing'"}],"minor_comments":[{"comment":"The hinge formulation max(0, mu - D_KL) means that minimizing L_defense drives D_KL to be at least mu, not arbitrarily large. The text says the optimization 'encourages a large KL divergence'; consider clarifying the margin interpretation.","section":"Eq. (10)"},{"comment":"The pseudocode updates prototypes in Step 2 using L_struct, while Step 4 says prototypes are excluded from Theta_rep gradients. This is consistent but could be stated more explicitly to avoid confusion about when prototypes are updated relative to the reprogramming parameters.","section":"Algorithm 1, Step 2 vs. Step 4"},{"comment":"The complexity statement in Sec. 4.2 mentions O(|E| + n^3) or 'approximated in linear time'; Appendix B.1 clarifies that top-k Laplacian eigenvalues are used. Please state in the main text that practical complexity is dominated by the top-k spectral computation using iterative methods.","section":"Sec. 4.2 and Appendix B.1"},{"comment":"The reported l1 norm of output difference is exactly 1.0 for several baselines and 0.0 for the undefended model. Please specify what reference output the l1 difference is measured against, since the values suggest a uniform-output transformation for those baselines.","section":"Table 2"},{"comment":"The caption says 'up to ~15%' while the contributions section says 'up to 17%'. Please reconcile these numbers for consistency.","section":"Figure 3 and Contributions"}],"recommendation":"major_revision","confidential_remarks":"The paper is within scope for a machine learning conference and addresses a timely problem. The main concern is not novelty but rigor: the theoretical guarantee is close to a restatement of the loss, the threat model is narrow relative to the Data-Based ME setting described in the related work, and the adaptive-attack evaluation appears to produce an attacker that is weaker than the standard one. With substantial revisions to the theory framing and empirical methodology, the paper could be made acceptable; the current version is not yet there."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The paper is a legitimate new defense for GNN model extraction, but its central premise is narrower than the title suggests. It deserves a serious referee, not a desk reject, because the mechanism is coherent and the experimental coverage is broad, but the authors need to confront the OOD assumption directly.\n\nWhat is new: the combination of model reprogramming with a prototype-based structural gate that only activates perturbation when a query is topologically OOD. That is a real departure from prior perturbation defenses for graphs, and the utility-preservation numbers (under 2% drop) are believable given the gate. The empirical work spans soft-label, hard-label, different clone architectures, query budgets, and larger datasets, and the code is public. Those are genuine positives.\n\nThe soft spots are proportionate but important. The entire defense turns on attack queries being OOD (Sec. 3.4). If an attacker uses in-distribution-like queries—which is the common KnockoffNet setup—alpha stays near zero and the perturbation never fires. The paper's Table 4 tests 10% ID leakage, but not the case where the attacker's whole query set lies on the benign manifold. That is the load-bearing scenario, and it is untested. Theorem 5.1 is logically fine, but the bound is essentially the training objective restated: the first term is the KL the defense maximizes, and the second term is always negative. If alpha is small, the bound is empty. I would not call it circular, but it does not add independent evidence.\n\nThe adaptive-attack section also leaves me uneasy. Table A3 shows the \"adaptive, unknown architecture\" clone achieving lower clone accuracy than the standard attack, which is backwards if the attacker is actually adapting. That suggests the adaptive attacker is not truly optimizing against the defense. The missing ADAGE comparison is excusable given the stateful/stateless difference, but it is waved away too quickly. No error bars appear anywhere, and the headline reductions are single numbers, so treat them as provisional.\n\nBottom line: for someone in GNN security, this is a useful read and a legitimate new angle. It deserves peer review with major revisions: test the in-distribution query regime, clarify the adaptive attack, and add variance estimates. I would send it back for revision rather than reject.","headline":"A coherent OOD-gated reprogramming defense for GNN extraction that deserves peer review, but the central distributional assumption is stronger than the paper admits and the adaptive-attack results are confusing.","tokens_in":19839,"tokens_out":3079,"would_cite":true,"duration_ms":28987,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A GNN served through an API can be defended against model extraction by gating a learnable reprogramming perturbation on the query's graph topology, activating it only for out-of-distribution queries.","keywords":["model extraction","graph neural networks","model reprogramming","structure-aware gating","Fisher information","out-of-distribution detection","MLaaS","adversarial defense"],"falsifier":"A decisive check is to build an adaptive generator that explicitly optimizes generated graphs to match the defender's benign structural statistics (Laplacian spectrum, degree moments, clustering coefficients), then measure the gate values it receives; if the average $\\alpha(G)$ stays below roughly 0.1 and the clone's accuracy approaches the undefended level, the structural-firewall premise fails. The paper's own adaptive-attack tables provide a first place to look: clone accuracy under a known-architecture adaptive attacker should stay close to the standard-attack value, not rise toward the undefended baseline.","tokens_in":18675,"feed_emoji":"🛡️","tokens_out":8423,"duration_ms":66164,"temperature":0.7,"pith_summary":"This paper tries to establish that a graph neural network deployed behind an API can be actively defended against model-extraction attacks by reprogramming its own hidden layers: the defender learns a bounded perturbation per layer, and a structure-aware gate switches that perturbation on only when a query looks structurally foreign to the private training distribution. The payoff, if the claim holds, is that an attacker who clones the oracle by querying it learns a surrogate whose decision boundary is pushed far from the benign one, without retraining the victim model and without the utility collapse that random image-style noise causes on graphs. The central quantity is a gating factor $\\alpha(G)$ that compares the query graph's spectral and topological signature with learned benign prototypes: $\\alpha\\approx 0$ for benign queries and $\\alpha\\approx 1$ for adversarial ones, while the perturbation's effect on the attacker's estimation error is governed by the Fisher information of the victim GNN along the perturbation direction. The paper reports that on MUTAG under soft-label attack, GraphRP lowers clone accuracy from 76.5% to 60.3% while keeping benign utility loss below 2%.","feed_headline":"GraphRP drops cloned GNN accuracy from 76.5% to 60.3%","feed_subtitle":"A gated reprogramming layer poisons out-of-distribution queries while leaving benign users' accuracy nearly intact.","key_machinery":"The load-bearing mechanism is model reprogramming with structure-aware gating. At each GNN layer $l$, a bounded perturbation $\\tilde{\\delta}^{(l)}=\\lambda\\cdot\\mathrm{Tanh}(\\delta^{(l)})$ is added to the node embeddings, and the whole perturbation is scaled by a gate $\\alpha(G)=\\mathrm{Sigmoid}\\big(\\gamma\\,(\\min_k\\|\\Phi(G)-c_k\\|_2^2-\\tau)\\big)$, where $\\Phi(G)$ is a permutation-invariant structural embedding built from Laplacian eigenvalues, degree statistics, and clustering coefficients, and $\\{c_k\\}$ are prototypes learned only on private in-distribution data. Because $\\alpha\\approx 0$ for benign graphs and $\\alpha\\approx 1$ for OOD graphs, the perturbation acts as a 'structural firewall' that is dormant for legitimate users and active for attackers. In the proof, the Fisher information matrix $I_h(G)$ supplies the curvature that converts the gate-scaled perturbation into a lower bound on the attacker's estimation error; the training objective alternates between minimizing cross-entropy on benign data, maximizing KL divergence on an auxiliary OOD set, and tightening the prototypes around benign structures.","core_discovery":"On its own terms, the paper's discovery is that model extraction from a GNN can be countered by turning the victim into a conditional oracle: queries on the private in-distribution manifold receive normal predictions, while out-of-distribution queries receive outputs deliberately distorted along high-curvature directions, so that an optimal attacker who perfectly mimics the observed responses learns a clone that is provably far from the victim on benign tasks. Concretely, the paper proves that under bounded loss, an optimal attacker, and a local second-order approximation, the clone's performance gap on benign data is at least $\\frac{1}{2}\\alpha(G)^2\\,\\tilde{\\delta}^\\top I_h(G)\\,\\tilde{\\delta} - 2M\\,\\mathrm{TV}(G_{\\mathrm{id}},G_{\\mathrm{ood}})$, where $\\alpha(G)$ is the gating factor, $\\tilde{\\delta}$ the bounded reprogramming perturbation, and $I_h(G)$ the Fisher information matrix of the victim's output with respect to the hidden representation. Empirically, the paper reports that this defense yields the lowest clone accuracy across five benchmarks and three clone architectures, weakens adaptive gray-box attackers that try to imitate benign topology, saturates the attacker's learning as the query budget grows, and degrades even a Graph Transformer surrogate while keeping target utility nearly intact.","pith_inferences":["Beyond the paper, the crux is that GraphRP converts model-extraction defense into an out-of-distribution-detection problem; whether spectral signatures are truly hard to spoof is assumed rather than proven, so the practical security margin hinges on how expensive it is for an adversary to reach the benign manifold in structural embedding space.","One testable extension would be to calibrate the gate by the Fisher-information term itself: instead of a single threshold $\\tau$, make the perturbation magnitude proportional to $\\alpha(G)^2\\,I_h(G)$, so the defense spends its distortion budget where it provably hurts the attacker most.","The same gating-plus-reprogramming template could apply to node-level tasks by replacing graph-level prototypes with ego-graph prototypes, but the paper does not demonstrate that spectral fingerprints discriminate as cleanly at node granularity.","When the attacker's query distribution is close to the private distribution, the negative term $2M\\,\\mathrm{TV}(G_{\\mathrm{id}},G_{\\mathrm{ood}})$ can dominate the bound; a defender should measure this total-variation distance on the deployed domain before enabling GraphRP, because a small distribution shift can void the guarantee."],"forward_implications":["If the bound is right, a defender can quantify how much protection a given reprogramming perturbation provides by measuring $\\alpha(G)^2\\,\\tilde{\\delta}^\\top I_h(G)\\,\\tilde{\\delta}$ over the anticipated query distribution, and can increase protection by steering $\\tilde{\\delta}$ toward high-curvature directions.","Because the gate suppresses the perturbation for in-distribution queries, the method preserves benign accuracy and keeps inference latency near the undefended model; the paper measures under 2% utility loss and about 7.9% added latency.","Since the defense is stateless and acts on every OOD query at inference time, it removes the exploitable early-stage window that reactive query-logging defenses have, and it applies to data-based and data-free extraction alike.","The reported saturation under growing query budgets implies that an attacker cannot simply average out the noise by spending more queries, because each OOD response is consistently reprogrammed rather than randomly perturbed.","The defense transfers across clone architectures even when the clone is more powerful than the victim; a Graph Transformer clone's accuracy is reported to drop from 82.4% to 64.1%."],"supporting_citations":[{"why":"Supplies the model reprogramming paradigm that the defense repurposes for security.","marker":"[3]"},{"why":"Provides the graph-layer perturbation approach that layer-wise reprogramming builds on.","marker":"[17]"},{"why":"Defines the KnockoffNet query strategy used as the attacker's foundation.","marker":"[31]"},{"why":"Is the prediction-poisoning baseline from which P-Poison and RandP are drawn and compared against.","marker":"[32]"},{"why":"Is the MeCo contrastive defense that GraphRP is benchmarked against and outperforms.","marker":"[44]"},{"why":"Introduces StealGNN, the data-free GNN extraction attack that motivates the OOD-query threat model.","marker":"[50]"},{"why":"Supplies the GraphGAN structural generator used to implement the adaptive gray-box attacker.","marker":"[42]"},{"why":"Is the source of the TUDataset benchmarks (MUTAG, ENZYMES, NCI1, PROTEINS) used in evaluation.","marker":"[28]"},{"why":"Grounds the Laplacian eigenvalues used as spectral structural signatures in the gating mechanism.","marker":"[4]"}],"fun_headline_variants":["GraphRP: structural firewall poisons out-of-distribution GNN queries","GNN defense reprograms victim to distort clone-training queries","GraphRP: learnable gating foils attackers, spares benign users","Proactive GNN defense: gated reprogramming preserves utility, blocks cloners","GraphRP: turn your GNN into a poisoned oracle to defeat model stealing"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The whole defense depends on the premise that attack queries are out-of-distribution relative to the private training manifold: if an attacker can query with in-distribution-like graphs, the gating factor stays near zero, the reprogramming noise stays dormant, and the lower bound no longer guarantees any protection.","fun_headline_variants_meta":{"raw":{"variants":["GraphRP: structural firewall poisons out-of-distribution GNN queries","GNN defense reprograms victim to distort clone-training queries","GraphRP: learnable gating foils attackers, spares benign users","Proactive GNN defense: gated reprogramming preserves utility, blocks cloners","GraphRP: turn your GNN into a poisoned oracle to defeat model stealing"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000654,"raw_usage":{"total_tokens":3057,"prompt_tokens":1065,"completion_tokens":1992,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":681,"completion_tokens_details":{"reasoning_tokens":1894}},"tokens_in":681,"tokens_out":1992,"duration_ms":14945,"temperature":1.0,"reasoning_tokens":1894,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T14:12:39.097596+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"A decisive check is to build an adaptive generator that explicitly optimizes generated graphs to match the defender's benign structural statistics (Laplacian spectrum, degree moments, clustering coefficients), then measure the gate values it receives; if the average $\\alpha(G)$ stays below roughly 0.1 and the clone's accuracy approaches the undefended level, the structural-firewall premise fails. The paper's own adaptive-attack tables provide a first place to look: clone accuracy under a known-architecture adaptive attacker should stay close to the standard-attack value, not rise toward the undefended baseline.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the model reprogramming paradigm that the defense repurposes for security."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the graph-layer perturbation approach that layer-wise reprogramming builds on."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Is the prediction-poisoning baseline from which P-Poison and RandP are drawn and compared against."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Is the MeCo contrastive defense that GraphRP is benchmarked against and outperforms."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Introduces StealGNN, the data-free GNN extraction attack that motivates the OOD-query threat model."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the GraphGAN structural generator used to implement the adaptive gray-box attacker."}],"review_version":1}