Gradient Inversion Attack on Graph Neural Networks

Athina Markopolou; Divya Anand Sinha; Ruijie Du; Yanning Shen; Yezi Liu

REVIEW 3 major objections 5 minor 1 cited by

Gradient Inversion Attack on Graph Neural Networks

T0 review · 3 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that in federated learning with Graph Neural Networks, a curious server can reconstruct both private node features and graph structure from gradients alone, and proves exact recovery for GraphSAGE when per-node gradients…

desk verdict Worth engaging, but the flagship exact-reconstruction claim conflates per-node with averaged gradients and omits a rank condition. read the letter →

arxiv 2411.19440 v2 pith:OZZORAHQ submitted 2024-11-29 cs.LG cs.AI

Divya Anand Sinha , Ruijie Du , Yezi Liu , Athina Markopolou , Yanning Shen This is my paper · ORCID

classification cs.LGcs.AI MSC 68T07

keywords gradientinversionattackfederatedgraphlearningneuralnetworkprivacySAGEGCNnodefeaturereconstructionstructureGLG

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Federated learning protects data by sharing only gradients, and this paper asks whether that protection holds for graph data. It argues it does not: a curious server that sees the gradients of a GNN can reconstruct the private node-feature matrix and the adjacency (graph structure) matrix. The paper proves that for GraphSAGE with mean aggregation, per-node first-layer gradients determine both $X$ and the normalized adjacency matrix exactly, with no prior information; for GCN, the same analytic reconstruction works if either the features or the structure is already known and the relevant matrix has full rank. It then proposes GLG, a gradient-matching attack with feature-smoothness and sparsity regularizers, and shows near-perfect reconstruction on social-network, citation, and molecular datasets. If correct, the result undermines the assumption that gradient exchange alone is a safe privacy boundary for federated graph learning.

What carries the argument

The machinery is the ratio identity between weight-gradient and bias-gradient at the first GNN layer. Because the activation is applied elementwise after an affine map, $\nabla_{(W_1)_i}\mathcal{L}_v = \nabla_{b_i}\mathcal{L}_v \cdot x_{\text{agg},v}$ (and similarly for $W_2$ with $x_v$), so the unknown input appears as a ratio of two gradients; this identity is what turns gradient access into exact input recovery. The second piece is the pseudoinverse step $\tilde{A} = X_{\text{agg}} X^\dagger$ (or $X = X_{\text{agg}} \tilde{A}^\dagger$), which reconstructs the missing one of the pair $\{X, \tilde{A}\}$ when the other is known and full rank. For settings without an analytic guarantee, GLG closes the gap with a cosine-similarity gradient-matching loss plus a feature-smoothness regularizer $\operatorname{tr}(X L X^\top)$ and a Frobenius sparsity penalty on $A$.

What would settle it

Run Algorithm 2 against a standard federated round where the server sees only the batch-averaged gradient of Eq. (9) with batch size $B \ge 2$: if neither node features nor adjacency are recovered with near-zero error, Proposition 5's per-node-gradient premise is essential and the claim does not hold under the protocol the paper itself defines.

Watch

Extended reading notes

Core claim

The central claim is that the first layer of a GNN linearizes the attack: for a GraphSAGE layer with pre-activation $\tilde{h}_v = x_{\text{agg},v} W_1^\top + x_v W_2^\top + b$, the elementwise nonlinearity makes the gradient with respect to a weight row proportional to the gradient with respect to the corresponding bias entry times the input, so $x_{\text{agg},v}$ and $x_v$ are recovered by dividing those gradients (Propositions 1 and 2). With per-node gradients for every node in a subgraph, this yields the full matrices $X_{\text{agg}}$ and $X$, and the normalized adjacency matrix follows as $\tilde{A} = X_{\text{agg}} X^\dagger$ (Proposition 5), so no prior graph knowledge is needed for GraphSAGE. For GCN, the paper proves $\tilde{A} = X_{\text{agg}} X^\dagger$ when $X$ is full row-rank and $X = X_{\text{agg}} \tilde{A}^\dagger$ when $\tilde{A}$ is full column-rank (Propositions 3 and 4), and for graph classification it proves $\tilde{A} = X(\nabla_{W_2}\mathcal{L})^\dagger (\nabla_{W_1}\mathcal{L}) X^\dagger$ when $X$ is known and full row-rank (Proposition 6). Empirically, GLG reconstructs node features with RNMSE near $10^{-3}$ and the adjacency matrix with AUC and AP near $1.0$ on Facebook and GitHub for GraphSAGE, and recovers graph structure well for GCN even without a theoretical guarantee.

Load-bearing premise

The load-bearing premise is that the attacker receives gradients computed separately for each node in the subgraph; the federated averaging rule in the paper gives the server only one gradient summed over the client's whole batch, and without per-node gradients the exact reconstruction formulas do not apply.

Editorial extensions

If this is right

A honest-but-curious server in federated graph learning can fully reconstruct a GraphSAGE client's private node features and graph edges from first-layer per-node gradients, with no prior graph knowledge.
For GCN, the same reconstruction is exact when the attacker has either the features or the structure plus a full-rank condition, so GraphSAGE is not the only vulnerable architecture.
The paper's batched experiments show that larger batch sizes (up to 50) do not by themselves stop feature leakage, so batch-size-based defenses alone are insufficient.
The regularizers are load-bearing: without $L_s$ and $\|A\|_F^2$, adjacency reconstruction for GCN drops, indicating that graph-specific priors (smoothness, sparsity) are what make empirical recovery work.
The attack transfers to graph classification and molecular datasets, where structure recovery succeeds when the feature matrix is full row-rank, as Proposition 6 predicts.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Any privacy-preserving mechanism for federated graph learning must break the per-node gradient structure (e.g., secure aggregation, shuffling, or gradient corruption that destroys the weight-bias ratio) rather than merely adding noise that preserves linearity.
The weight-gradient/bias-gradient ratio is a general probe: any GNN layer with an elementwise, monotone nonlinearity and a linear pre-activation exposes its input through this ratio, so other message-passing designs may inherit the vulnerability.
Proposition 5 requires $X^\dagger$; when the feature dimension is much smaller than the number of nodes, the recovered $\tilde{A}$ will be low-rank, so exact topology recovery should degrade as the graph grows—this gives a testable scaling boundary the paper does not explore.
The authors use the term honest-but-curious, but the same formulas would work for a fully malicious server that manipulates weights, so these results likely transfer to stronger threat models.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Here's the short version: this is a serious paper worth engaging, but the headline claim—exact reconstruction of both features and adjacency from per-node gradients—has two holes. First, the federated protocol in Eq. (9) shares averaged gradients, while Node Attacker 2 and Propositions 3-5 assume per-node gradients for each node in the subgraph. Those are different threat models, and the paper's own setup does not deliver the per-node gradients. Second, Proposition 5's reconstruction \tilde{A}=Xagg X† requires X to have full row rank, and that condition is omitted. When N>D, X is rank-deficient and infinitely many adjacency matrices give the same Xagg; the closed-form equality does not follow. The appendix experiments use 3-hop subgraphs from Facebook/GitHub, where N>D is plausible, so the exactness claim in the main text is not justified by the proof. The empirical Algorithm 2 is a regularized optimization; it doesn't repair the proposition.

What is actually new: the paper is among the first to do gradient inversion for GNNs with explicit graph-structure reconstruction, and it gives a systematic taxonomy of threat models for node and graph classification. The analytic results for Node Attacker 1 (Propositions 1-2) and for the known-features/known-structure cases (Propositions 3-4) are correct under their stated rank conditions. The graph classification experiments, especially the Graph Attacker-G results where GraphSAGE is recovered perfectly, are solid. The comparison with GRAIN in Appendix H is useful and goes beyond what most papers do.

The soft spots are the two above, plus: the regularizers \alpha,\beta are grid-searched on the test tasks, and in the no-prior-knowledge TU dataset experiments the dummy initialization is chosen after inspecting results. That doesn't invalidate the empirical attack, but it lowers the evidential value of the GN numbers. No code is released, which matters for a paper whose empirical claims depend on many hyperparameters.

Bottom line: this deserves a serious referee and a conditional accept. The threat-model mismatch should be disclosed prominently, the statement of Proposition 5 should be corrected with the rank condition, and the averaged-gradient case should either be attacked directly or explicitly scoped out. If those fixes land, this would be a citable contribution. As it stands, the strongest claims are overstated.

Referee Report

3 major / 5 minor

Summary. The paper studies gradient inversion attacks in federated graph learning for GNNs (GCN and GraphSAGE). It introduces a taxonomy of attackers (Node Attacker 1, Node Attacker 2-G/N/GN, and Graph Attacker-G/N/GN), proposes an attack called GLG that combines dummy-gradient matching with feature-smoothness and sparsity regularizers, and gives analytic propositions for exact reconstruction in several settings. Experiments on Facebook, GitHub, synthetic graphs, and molecular datasets compare GLG against DLG and, on Tox21, against the graph-specific baseline GRAIN, reporting near-perfect reconstruction in several GraphSAGE settings and competitive structure recovery for GCN.

Significance. If the claims hold, the paper would be a valuable contribution to the privacy analysis of federated graph learning: it identifies which gradient information can leak node features and graph topology, and it provides a systematic threat-model taxonomy. The analytic propositions are self-contained linear-algebra derivations with no fitted parameters in the theorems, and the empirical study is broad, including a comparison with the only other graph-specific attack (GRAIN). The observation that GraphSAGE's separate W1/W2 transforms allow individual recovery of aggregated and target-node features (Propositions 1 and 2) is a useful and nontrivial insight. However, the strongest claims are currently not supported because (i) the actual federated protocol in Eq. (9) shares averaged gradients rather than per-node gradients, and (ii) Proposition 5 omits a rank condition needed for the closed-form reconstruction of the adjacency matrix; these issues affect the paper's central node-classification conclusions.

major comments (3)

[§3.2, §4.1, §5.1] The threat model used for the paper's main node-classification results does not match the federated protocol defined in Eq. (9): the server receives the gradient averaged over the client's batch, while Node Attacker 2 and Propositions 2–5 assume that the attacker receives the gradient of the loss for each node in the subgraph separately. Because the reconstruction formulas in Proposition 2 are ratios of per-sample gradients, they do not survive averaging, and the batched experiments in Appendix F.2 cover only Node Attacker 1 and Graph Attacker-N, not Node Attacker 2. The paper therefore does not establish that the proposed node-classification attacks work in the federated setting it itself defines.
[§5.1, Proposition 5] Proposition 5 is not valid as stated because the reconstruction step \tilde{A}=X_agg X† requires X to have full row rank so that X X† = I; Proposition 3 explicitly includes this assumption, but Proposition 5 omits it. When the subgraph has more nodes than feature dimensions (N > D), X is not full row-rank, infinitely many matrices A satisfy X_agg = A X, and the closed-form X_agg X† generally does not recover the true \tilde{A}. The near-perfect results in Table 6 come from Algorithm 2, a regularized optimization procedure, rather than from the closed-form formula used in the proof, so the theoretical claim of exact, prior-free reconstruction of A is not established.
[§5.2, Proposition 6 and Appendix E] The proof of Proposition 6 has an algebraic gap: Eq. (43) sets ∇\tilde{H}L = (X^T)† ∇W2 L^T, but this is only the minimum-norm solution of the underdetermined system in Eq. (41); the true ∇\tilde{H}L need not lie in the column space of X^T. Consequently, the closed form \tilde{A} = X(∇W2 L)†(∇W1 L)X† does not follow from the stated assumptions alone. A concrete counterexample (N=D=2, X=I, \tilde{A}=[[0,1],[1,0]], ∇\tilde{H}L=diag(1,0)) satisfies X full row-rank but gives a different matrix from the formula. Since Proposition 6 is used to justify the Graph Attacker-G results, this is a load-bearing gap in the theoretical analysis.

minor comments (5)

[§4.1] There is a typo in the phrase 'categorize the attacker furhter'; it should be 'further'.
[Eq. (13)] The expression for the feature-smoothness regularizer is written as a sum of vector differences, but it should be a sum of squared norms (with a factor of 1/2) to equal tr(X L X^T); please clarify the notation.
[Table 1] The symbols used in Table 1 ('!' and '%') are not defined in the caption or text; the reader cannot tell which columns indicate successful reconstruction.
[§7] The conclusion states that 'even in batches of size 50, the private data can be reconstructed with high accuracy', but Table 11 reports mean RNMSE of 132±83 (×10^{-2}) for GitHub at B=50, which does not support 'high accuracy' for that dataset; please qualify the claim.
[Appendix G, Table 18] Some entries in Table 18 contain formatting errors, for example '1.54 ±0.1.48' in the GCN section; these should be corrected for readability.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the reconstruction propositions are direct algebraic inversions of first-layer gradient identities.

full rationale

The paper's theoretical chain (Propositions 1-6) is self-contained linear algebra rather than a circular restatement of its conclusions. Propositions 1 and 2 are direct consequences of the chain rule for a GCN or GraphSAGE first layer: the gradient with respect to a weight row is the bias-gradient scalar times the input vector (e.g., equation 30), so the ratio x_agg = ∇(W)_i L / ∇(b)_i L inverts the gradient map. This is an invertibility statement, not a definition of the input in terms of the output. Propositions 3-5 solve the matrix equation X_agg = ÃX (or its GraphSAGE analogue) for Ã = X_agg X† or X = X_agg Ã† under the stated rank conditions; these are algebraic inversions of a linear system, not circular identities. Proposition 6 similarly inverts the two gradient equations in Appendix E, with X assumed known and full row-rank. None of these steps relies on a self-citation or on an imported uniqueness theorem; the cited works (DLG, Geiping et al., Zhang et al. 2022) are used for baseline objectives and regularizers, not to establish the propositions. The empirical attack tunes α and β by grid search on the same datasets and sometimes selects initialization values after inspecting the data, which is an in-sample tuning caveat and a reproducibility concern, but it does not make the analytic derivation circular. Similarly, the omitted full-row-rank condition in Proposition 5 and the mismatch between per-node gradients in the threat model and the averaged gradient in equation (9) are correctness or scope issues, not circularity. No load-bearing step reduces to its own input by construction.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The paper's central theoretical claims rest on per-node gradient availability and full-rank data matrices. The empirical attack also depends on grid-selected regularizers and, in some graph classification settings, on initialization values chosen after inspecting the target datasets. The per-node gradient premise conflicts with the averaged-gradient FL protocol described in Section 3.2.

free parameters (3)

alpha (feature smoothness regularizer) = 1e-9 (grid-selected)
Controls the graph-Laplacian smoothness term in Eq. (14); the authors state it was chosen by grid search for best attack performance.
beta (adjacency sparsity regularizer) = 1e-7 (grid-selected)
Controls the Frobenius-norm penalty on the adjacency matrix in Eq. (14); grid-selected and important for AP improvements.
dtree (dummy tree degree in Node Attacker 1) = 10 by default; actual neighbor count in Appendix F.1
The dummy graph for Node Attacker 1 is a depth-2 tree with this degree; it determines the size of the reconstructed neighborhood and affects reconstruction quality.

assumptions (5)

domain assumption Per-node gradient availability
Node Attacker 2 is defined as having access to the gradient of the loss for each node separately (Section 4.1), whereas the FL protocol in Eq. (9) shares only the averaged gradient over the client's batch. This assumption is what makes Propositions 3-5 and Algorithm 2 possible.
domain assumption X full row rank
Propositions 3 and 6 require the node feature matrix X to be full row rank to exactly reconstruct the adjacency matrix via pseudoinverse; this need not hold for subgraphs with more nodes than feature dimensions.
domain assumption Normalized adjacency matrix full column rank
Proposition 4 requires the normalized adjacency matrix to be full column rank; many graphs yield singular normalized adjacency matrices, so the guarantee is conditional.
domain assumption Feature smoothness and sparsity of real-world graphs
The attack objective (Eq. 14) is regularized by the graph Laplacian smoothness and Frobenius norm sparsity; the empirical success on Facebook and GitHub depends on these priors matching the data.
domain assumption Exact gradient transmission
The attack assumes the honest-but-curious server observes exact client gradients with no noise, clipping, or secure aggregation; defenses such as differential privacy would break this assumption.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Gradient Inversion Attack on Graph Neural Networks." pith.science (2026). https://pith.science/paper/OZZORAHQ

@misc{pith2026241119440,
  author       = {Pith},
  title        = {Pith review of: Gradient Inversion Attack on Graph Neural Networks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/OZZORAHQ}},
  note         = {Machine review of arXiv:2411.19440}
}

read the original abstract

Graph federated learning is of essential importance for training over large graph datasets while protecting data privacy, where each client stores a subset of local graph data, while the server collects the local gradients and broadcasts only the aggregated gradients. Recent studies reveal that a malicious attacker can steal private image data from the gradient exchange of neural networks during federated learning. However, the vulnerability of graph data and graph neural networks under such attacks, i.e., reconstructing both node features and graph structure from gradients, remains largely underexplored. To answer this question, this paper studies the problem of whether private data can be reconstructed from leaked gradients in both node classification and graph classification tasks and proposes a novel attack named Graph Leakage from Gradients (GLG). Two widely used GNN frameworks are analyzed, namely GCN and GraphSAGE. The effects of different model settings on reconstruction are extensively discussed. Theoretical analysis and empirical validation demonstrate that, by leveraging the unique properties of graph data and GNNs, GLG achieves more accurate reconstruction of both nodal features and graph structure from gradients.

Figures

Figures reproduced from arXiv: 2411.19440 by the authors.

**Figure 2.** The heatmaps of the reconstructed adjacency matrix with Graph Attacker-G from the gradient of [PITH_FULL_IMAGE:figures/full_fig_p014_2.png] view at source ↗

**Figure 3.** One-hop neighbor reconstruction (RNMSE) for Node Attacker-1 with GraphSAGE. [PITH_FULL_IMAGE:figures/full_fig_p022_3.png] view at source ↗

Figures from the paper (3 more)

**Figure 4.** Figure 4: Variation in RNMSE of the reconstructed target features vs. the number of hidden channels for a [PITH_FULL_IMAGE:figures/full_fig_p023_4.png]

**Figure 5.** Figure 5: Variation of AUC and AP vs. α and β for Graph Attacker-G. G Additional Graph Classification results on TUDatasets All attack settings considered in previous experiments in Section 6 are defined within the context of social networks. In order to assess the efficacy of t…

**Figure 6.** Figure 6: Reconstruction of different graph structures (MAE) for Graph Attacker-GN using GraphSAGE. [PITH_FULL_IMAGE:figures/full_fig_p026_6.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

Intellectual Property in Graph-Based Machine Learning as a Service: Attacks and Defenses
cs.CR 2025-08 conditional novelty 4.0 of 10

A systematic review that organizes graph-ML IP protection into model-level and data-level attacks and defenses, and ships a benchmark library, PyGIP.

Reference graph

Works this paper leans on

24 extracted references · 13 canonical work pages · cited by 1 Pith paper

[1]

Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang

Martin Abadi, Andy Chu, Ian Goodfellow, H. Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. InProceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, CCS ’16, pp. 308–318, New York, NY, USA,

work page 2016
[2]

1: Input: GNN modelF (X, A, W), W: parameter weights;∇WL : gradients calculated by private training data for each node in the graph,y: True label 2: Output: private training dataX, A 3: Initialize dummy features and labelsˆX1, ˆA1 4: for p← 1 to P do 5: //Compute dummy gradients: 6: ∇W ˆL =∂L(F ( ˆXp, ˆAp, W), y)/∂W 7: Compute ˆDp as given in equation 14 ...

work page 2020
[5]

Also, the performance remains roughly the same across all degrees. F.3 Sensitivity Analysis for Hyperparameters In our attack, numerous hyperparameters come into play, including but not limited to the regularization parameters α and β, the graph size, and the network width. In our analysis, we examined a subset of these hyperparameters in different settin...

work page 2000
[13]

Federated graph learning–a position paper

Huanding Zhang, Tao Shen, Fei Wu, Mingyang Yin, Hongxia Yang, and Chao Wu. Federated graph learning–a position paper. arXiv preprint arXiv:2105.11099,

arXiv
[14]

Bo Zhao, Konda Reddy Mopuri, and Hakan Bilen

doi: 10.1109/TKDE.2022.3207915. Bo Zhao, Konda Reddy Mopuri, and Hakan Bilen. idlg: Improved deep leakage from gradients.CoRR, abs/2001.02610, 2020a. Bo Zhao, Konda Reddy Mopuri, and Hakan Bilen. idlg: Improved deep leakage from gradients.arXiv preprint arXiv:2001.02610, 2020b. Junyi Zhu and Matthew Blaschko. R-gap: Recursive gradient attack on privacy. a...

arXiv 2022
[15]

18 Published in Transactions on Machine Learning Research (06/2025) A Attack Algorithms Algorithm 1GLG (Node Attacker). 1: Input: 2-layer GNN modelF (xv,{xvj}j∈Nv, W) 2: ∇WLv: gradients calculated by training data,yv: True label 3: Output: private data xv 4: //Initialize dummy target and neighboring node features by creating a two level tree with degree a...

work page 2025
[17]

20 Published in Transactions on Machine Learning Research (06/2025) E Proof of Proposition 6 Proof. For a GraphSAGE framework as shown in equation 6, let˜H be the hidden node representation matrix before applying the non-linearity as shown below H =σ( ˜H), (35) ˜H = ˜AXW⊤ 1 + XW⊤ 2 +− →1 b. (36) The derivatives of the loss function with respect to the wei...

work page 2025
[18]

Hence, the performance may improve if attack techniques for batch data are also incorporated

have been proposed to reconstruct image data from large batches, here we tested the performance of the attackers by simply optimizing with respect to the dummy input batch. Hence, the performance may improve if attack techniques for batch data are also incorporated. Due to possible permutation ambiguity in a batch setting, the Hungarian algorithm is used ...

work page 2025

Show all 24 references

[21]

We apply min-max normalization to the resultingˆA before thresholding

(45) Also, instead of directly sampling edges from the probabilistic adjacency matrix as given in Section 4.2, the MAE is also evaluated with and without thresholding the reconstructed adjacency matrix. We apply min-max normalization to the resultingˆA before thresholding. Aft...

2025
[22]

MUTAG COIL-RAG FRANK

implies that all entries are initialized from the standard Table 15: Reconstruction ofX (RNMSE) for Graph Attacker-N. MUTAG COIL-RAG FRANK. GraphSAGE(×10−2) 0.07±0.06 6.91 ±7.1 21.95 ±16.05 GCN 8.80 ±1.27 1.51 ±0.17 2.68 ±0.30 25 Published in Transactions on Machine Learning R...

2025
[23]

For example,τ = 0.8 works well for MUTAG and FRANKENSTEIN in the case of GraphSAGE, and for MUTAG in the case of GCN

Few of the threshold values reduce the MAE by a considerable amount. For example,τ = 0.8 works well for MUTAG and FRANKENSTEIN in the case of GraphSAGE, and for MUTAG in the case of GCN. Vulnerable graph structures:In order to identify vulnerable graph structures, we tested th...

2025
[24]

Figure 6 shows the MAE of reconstructingA for different graphs

3.26±0.36 0.48 ± 0.05 0.47± 0.07 7.98 ± 1.50 0.20± 0.12 0.14± 0.08 4.54 ± 0.44 0.41± 0.08 0.388± 0.11 Specifically, the performance was tested on Erdos-Renyi graphs (with varying edge probabilities). Figure 6 shows the MAE of reconstructingA for different graphs. The number of...

2025
[100]

However, for a GCN framework, the attack only managed to reconstruct the aggregated nodal features

In the setting of Node Attacker 1, the attack couldsuccessfully reconstruct the target nodal features for a GraphSAGE framework with high accuracy. However, for a GCN framework, the attack only managed to reconstruct the aggregated nodal features. Consequently, in this section...
[2005]

Kipf and Max Welling

Thomas N. Kipf and Max Welling. Semi-supervised classification with graph convolutional networks.CoRR, abs/1609.02907,

arXiv
[2008]

Multi-scale attributed node embedding

Benedek Rozemberczki, Carl Allen, and Rik Sarkar. Multi-scale attributed node embedding. CoRR, abs/1909.13021,

1909 arXiv
[2014]

ISBN 978-1-931971-16-4

USENIX Association. ISBN 978-1-931971-16-4. H Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, et al. Communication-efficient learning of deep networks from decentralized data.arXiv preprint arXiv:1602.05629, 2016a. H. Brendan McMahan, Eider Moore, Daniel Ramage, and...

arXiv
[2016]

ISBN 9781450341394

Association for Computing Machinery. ISBN 9781450341394. Franziska Boenisch, Adam Dziedzic, Roei Schuster, Ali Shahin Shamsabadi, Ilia Shumailov, and Nicolas Paper- not. When the curious abandon honesty: Federated learning is not private.arXiv preprint arXiv:2112.02918,

arXiv
[2017]

Fedgraphnn: A federated learning system and benchmark for graph neural networks.CoRR, abs/2104.07145,

Chaoyang He, Keshav Balasubramanian, Emir Ceyani, Yu Rong, Peilin Zhao, Junzhou Huang, Murali Annavaram, and Salman Avestimehr. Fedgraphnn: A federated learning system and benchmark for graph neural networks.CoRR, abs/2104.07145,

arXiv
[2018]

Recovering private text in federated learning of language models.arXiv preprint arXiv:2205.08514,

Samyak Gupta, Yangsibo Huang, Zexuan Zhong, Tianyu Gao, Kai Li, and Danqi Chen. Recovering private text in federated learning of language models.arXiv preprint arXiv:2205.08514,

arXiv
[2019]

Multi-Scale Attributed Node Embedding.Journal of Complex Networks, 9(2),

17 Published in Transactions on Machine Learning Research (06/2025) Benedek Rozemberczki, Carl Allen, and Rik Sarkar. Multi-Scale Attributed Node Embedding.Journal of Complex Networks, 9(2),

2025
[2021]

Open graph benchmark: Datasets for machine learning on graphs.Advances in neural information processing systems, 33:22118–22133,

16 Published in Transactions on Machine Learning Research (06/2025) Weihua Hu, Matthias Fey, Marinka Zitnik, Yuxiao Dong, Hongyu Ren, Bowen Liu, Michele Catasta, and Jure Leskovec. Open graph benchmark: Datasets for machine learning on graphs.Advances in neural information pro...

2025
[2022]

Hamilton, Rex Ying, and Jure Leskovec

William L. Hamilton, Rex Ying, and Jure Leskovec. Inductive representation learning on large graphs.CoRR, abs/1706.02216,

arXiv
[2023]

Fishing for user data in large-batch federated learning via gradient magnification.arXiv:2202.00580 [cs], February

Yuxin Wen, Jonas Geiping, Liam Fowl, Micah Goldblum, and Tom Goldstein. Fishing for user data in large-batch federated learning via gradient magnification.arXiv:2202.00580 [cs], February

arXiv
[2025]

Decepticons: Corrupted transformers breach privacy in federated learning for language models.arXiv preprint arXiv:2201.12675, 2022a

Liam Fowl, Jonas Geiping, Steven Reich, Yuxin Wen, Wojtek Czaja, Micah Goldblum, and Tom Goldstein. Decepticons: Corrupted transformers breach privacy in federated learning for language models.arXiv preprint arXiv:2201.12675, 2022a. Liam H Fowl, Jonas Geiping, Wojciech Czaja, ...

arXiv

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.

[1] [1]

Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang

Martin Abadi, Andy Chu, Ian Goodfellow, H. Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. InProceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, CCS ’16, pp. 308–318, New York, NY, USA,

work page 2016

[2] [2]

1: Input: GNN modelF (X, A, W), W: parameter weights;∇WL : gradients calculated by private training data for each node in the graph,y: True label 2: Output: private training dataX, A 3: Initialize dummy features and labelsˆX1, ˆA1 4: for p← 1 to P do 5: //Compute dummy gradients: 6: ∇W ˆL =∂L(F ( ˆXp, ˆAp, W), y)/∂W 7: Compute ˆDp as given in equation 14 ...

work page 2020

[3] [5]

Also, the performance remains roughly the same across all degrees. F.3 Sensitivity Analysis for Hyperparameters In our attack, numerous hyperparameters come into play, including but not limited to the regularization parameters α and β, the graph size, and the network width. In our analysis, we examined a subset of these hyperparameters in different settin...

work page 2000

[4] [13]

Federated graph learning–a position paper

Huanding Zhang, Tao Shen, Fei Wu, Mingyang Yin, Hongxia Yang, and Chao Wu. Federated graph learning–a position paper. arXiv preprint arXiv:2105.11099,

arXiv

[5] [14]

Bo Zhao, Konda Reddy Mopuri, and Hakan Bilen

doi: 10.1109/TKDE.2022.3207915. Bo Zhao, Konda Reddy Mopuri, and Hakan Bilen. idlg: Improved deep leakage from gradients.CoRR, abs/2001.02610, 2020a. Bo Zhao, Konda Reddy Mopuri, and Hakan Bilen. idlg: Improved deep leakage from gradients.arXiv preprint arXiv:2001.02610, 2020b. Junyi Zhu and Matthew Blaschko. R-gap: Recursive gradient attack on privacy. a...

arXiv 2022

[6] [15]

18 Published in Transactions on Machine Learning Research (06/2025) A Attack Algorithms Algorithm 1GLG (Node Attacker). 1: Input: 2-layer GNN modelF (xv,{xvj}j∈Nv, W) 2: ∇WLv: gradients calculated by training data,yv: True label 3: Output: private data xv 4: //Initialize dummy target and neighboring node features by creating a two level tree with degree a...

work page 2025

[7] [17]

20 Published in Transactions on Machine Learning Research (06/2025) E Proof of Proposition 6 Proof. For a GraphSAGE framework as shown in equation 6, let˜H be the hidden node representation matrix before applying the non-linearity as shown below H =σ( ˜H), (35) ˜H = ˜AXW⊤ 1 + XW⊤ 2 +− →1 b. (36) The derivatives of the loss function with respect to the wei...

work page 2025

[8] [18]

Hence, the performance may improve if attack techniques for batch data are also incorporated

have been proposed to reconstruct image data from large batches, here we tested the performance of the attackers by simply optimizing with respect to the dummy input batch. Hence, the performance may improve if attack techniques for batch data are also incorporated. Due to possible permutation ambiguity in a batch setting, the Hungarian algorithm is used ...

work page 2025