Prompt-based Unifying Inference Attack on Graph Neural Networks

Chunming Hu; Hao Peng; Lingyun Liu; Qingyun Sun; Xingcheng Fu; Yuecen Wei

REVIEW 4 major objections 5 minor 55 references

Prompt-based Unifying Inference Attack on Graph Neural Networks

T0 review · 4 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A single prompt-based framework, ProIA, is claimed to strengthen both membership and attribute inference attacks on graph neural networks by making the prompt part of training.

desk verdict The central claim is undermined by a broken threat model: the attacker trains the target model with its own prompt, so the reported gains are manufactured rather than extracted from a fixed victim. read the letter →

arxiv 2412.15735 v1 pith:JTWPOAXJ submitted 2024-12-20 cs.LG

Yuecen Wei , Xingcheng Fu , Lingyun Liu , Qingyun Sun , Hao Peng , Chunming Hu This is my paper · ORCID

classification cs.LG

keywords graphneuralnetworksmembershipinferenceattackattributepromptinginformationbottleneckcontrastivelearningdisentangledrepresentationprivacyleakage

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

ProIA is a proposed attack framework that uses a trainable graph prompt to improve two kinds of privacy inference against graph neural networks: membership inference (whether a node was in the model's training set) and attribute inference (recovering a sensitive node attribute such as race or region). The paper's claim is that pre-training an encoder with an information-bottleneck objective on local and global graph views, then training target and shadow models with the attacker's prompt, makes the target's outputs leak information that a disentangled attack model can turn into accurate predictions. Experiments report accuracy gains over vanilla attacks on five datasets, the largest being 18.54% on Lastfm with SAGE, and AUC-ROC gains up to 18.7% against three published defenses. If the claim holds, one framework can replace task-specific inference attacks and weaken defenses that otherwise protect GNN outputs.

What carries the argument

The load-bearing mechanism is the trainable graph prompt $p$ injected into target and shadow model training, together with the information-bottleneck pre-training that shapes it. The pre-training objective combines contrastive learning on local and global subgraphs with a graph information bottleneck loss that keeps topology-related content while discarding irrelevant noise, so the prompt carries structural knowledge and appears as a benign query. The disentanglement module in the attack model then splits each prompt feature into $k$ virtual channels and iteratively re-weights node contributions within each channel, producing latent factors that guide the attack classifier through a KL-constrained objective.

What would settle it

Train the target model normally, without the prompt $p$ in its training; query it with ProIA's prompts and run the same attack model. If membership and attribute inference accuracy falls back to the vanilla baseline, the attack's gains depend on training-time control and do not transfer to a fixed victim model.

Watch

Extended reading notes

Core claim

The central claim is that a prompt should be treated not just as a query but as a training-time instrument. ProIA builds prompt features $p$ from a pre-trained encoder, then explicitly trains the target model $F_T$ (and the shadow model $F_S$ for membership attacks) using those prompts via $h_{\text{query}} = \text{READOUT}\{p \odot h\}$, which the authors say increases the target's overfitting and obfuscates the target's training process. The prompted posteriors are then fed into an attack model whose disentanglement module maps them into $k$ virtual channels, re-weights neighbors within each channel, and uses a KL-constrained loss to isolate latent factors relevant to the downstream attack. The paper reports that this unified recipe improves attribute and membership inference over vanilla baselines on Cora, Facebook, Lastfm, Bail, and Pokec-n, and that it disrupts the Vandp, Neighb, and PPGL defenses.

Load-bearing premise

The load-bearing premise is that the attacker can train the target and shadow models with the attacker-designed prompt, so the reported attack success relies on the attacker shaping the victim's training rather than only querying a fixed victim.

Editorial extensions

If this is right

The same framework can drive both attribute and membership inference attacks, so an adversary no longer needs a separate attack module for each supervision signal.
Membership inference succeeds even when the target is a strong, regularized model, because ProIA deliberately widens the training-test gap rather than relying on the target's natural overfitting.
Output noise, neighborhood perturbation, and sensitive-attribute separation defenses lose part of their protection; the paper reports AUC-ROC gains of up to 18.7% on defended models.
Topology retained during pre-training provides an attack signal beyond what label fitting alone offers, which helps attribute inference on sparse graphs such as Pokec-n.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

I infer that the reported gains depend on the attacker training the victim with the prompt: the case study says ProIA increases the target's overfitting, which would not occur when querying a fixed, already-trained victim, so testing against a frozen target is the natural check.
I infer that the same prompting idea could apply to graph-level inference attacks, since the disentanglement module operates on readout features and does not rely on node-level supervision, though the paper does not test this.
I infer that a defense that detects or strips anomalous readout patterns before they reach the model, or that refuses to train with user-supplied prompts, could close this attack vector without degrading normal tasks; the paper does not evaluate such adaptive defenses.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

You should know the punchline first: the paper's core empirical claim does not survive a standard inference-attack threat model. Algorithm 1 line 15 says the adversary trains both the target model FT and the shadow model FS using the attacker-designed prompt p. The case study then openly says ProIA 'increases the target's overfitting' to improve membership inference. Under the usual MIA/AIA setting, the victim model is fixed and the attacker only queries it; here the attacker controls the target's training recipe, so a model can be made to memorize membership on purpose. That makes the reported gains — e.g., +18.54% on Lastfm/SAGE — a function of the adversary's own training choices, not of private information extracted from an independently trained victim. If the intended scenario is training-time poisoning or adversarial pre-training, that is a different threat model and must be stated as such; the paper does not do that.

There is real material here, and I want to credit it. The combination of a graph information bottleneck pre-training objective, prompt features, and a disentanglement module to unify attribute and membership inference is novel, and it is not present in the cited literature. The related work is competent, and the paper ships code and evaluates on five datasets with multiple backbones and defense mechanisms. The idea of using graph prompts as a unifying attack primitive is worth exploring, and the disentanglement mechanism is a reasonable design choice. These pieces justify a serious look.

Now the soft spots, in proportion. The threat-model problem is load-bearing and fatal to the current evaluation. Second, the information-theoretic derivations are restatements of known variational bounds from Nguyen et al. and Wu et al.; that is not a flaw per se, but the theoretical contribution is thinner than the presentation suggests. Third, the results are single runs without error bars, which matters when the claimed improvements are often a few percent. The 'NA' entries in Table 1 are also unexplained. These are minor relative to the threat-model issue, but they would need fixing in any revision.

The paper is for privacy and security researchers interested in GNN inference attacks. It deserves a serious referee because the combination is novel and the flaw is subtle enough that an expert eye is needed. But as it stands, the verdict should be reject, or major revision with a redefined threat model and new experiments under that model. I would not cite it in its current form, though I might revisit a revised version.

Referee Report

4 major / 5 minor

Summary. The paper proposes ProIA, a prompt-based unifying inference attack framework for graph neural networks. ProIA consists of a pre-training stage that combines an information bottleneck objective with global-local contrastive learning, an attack data generation stage that uses prompt features to query target and shadow models, and a disentanglement module for downstream attribute and membership inference attacks. Experiments on five datasets and against several defenses are reported as evidence that ProIA improves attack accuracy and weakens existing defenses.

Significance. If the threat model were valid, the idea of unifying attribute and membership inference attacks under a single prompt framework would be a useful contribution to the graph privacy literature. The paper also provides an information-theoretic formulation and a public code link, which are positive elements. However, the central claim is not supported as stated because the adversary is assumed to train the target model itself, which turns the inference attack into a training-time manipulation. The reported gains are therefore not evidence of private information extraction from an independently trained victim model.

major comments (4)

[Algorithm 1 (line 15)] Algorithm 1 line 15 states 'Train FT and FS with p using Eq. (3)'. This means the adversary trains the target model FT (and shadow model FS) with the attacker-designed prompt p. In the standard inference attack setting (Shokri et al. 2017; Olatunji et al. 2021) the target model is a fixed victim model that the adversary only queries. Under the paper's setup, the leaked information is introduced during training rather than extracted from a fixed model, so the reported attack improvements (e.g., +18.54% on Lastfm/SAGE in Section 5.2) are partly manufactured by the attacker's own training choices. The paper must either adopt and clearly state a training-time threat model (e.g., adversarial pre-training or poisoning) or re-evaluate on a fixed target model.
[Section 5.2 (Case study)] The case study states that ProIA 'obfuscates the target's training process and increases the target's overfitting.' Since membership inference classically relies on target overfitting, deliberately increasing overfitting is equivalent to making the attack easier by construction. This undermines the comparison against Vanilla and the claim of 'disrupting' defenses; the experiment needs to control for target model capacity, regularization, or training epochs, or be repositioned as a poisoning/capacity-manipulation attack.
[Tables 1 and Figure 3] All results are reported as single runs without error bars or significance tests. For an attack method whose reported gains are often a few percent (e.g., Table 1, Facebook GAT F1 = 60.72 vs. Vanilla 55.17), the absence of variance estimates makes it impossible to assess whether the improvements are statistically meaningful. Please report the mean and standard deviation over multiple random seeds, or at least provide the seeds and code to reproduce the exact runs.
[Section 3.3 and Equation (3)] The prompt mechanism is not clearly defined. Equation (3) defines a graph-prompt readout for downstream task adaptation, but it is not explained how p is used as an attack query to FT in Algorithm 1, nor how the 'obfuscation' of malicious intent is achieved. The notation hquery = READ OUT{p ⊙ h} suggests element-wise multiplication with node embeddings, which is not obviously a prompt query in the NLP sense referenced in Section 2.2. Please clarify the query construction and why it is inconspicuous to the target.

minor comments (5)

[Section 4.2] The Jaccard threshold description uses 'u and v' after defining nodes i and j; the notation is inconsistent.
[Algorithm 1] Algorithm 1 Input and Parameter lists contain errors: 'Non-linear rectifier τ' and 'Activation function YC' are misleading (YC is the label set), and the parameter list repeats 't' and uses 'βA.βM ' with a period instead of a comma.
[Section 5.1] Section 5.1 writes 'Neigbh' and 'Vandp' inconsistently; the defense names should be consistent throughout (e.g., 'Neighb' and 'VanDP').
[Table 1] Table 1: the variants 'ProIAp' and 'ProIAd' are not defined before being used in the table; the ablation definitions appear only in Section 5.2.
[Equation (16)] Equation (16) has a formatting issue in the normalization term; please ensure the equation renders correctly and define all variables (e.g., MLP, W_k, b_k) at first use.

Circularity Check

2 steps flagged · score 8.0 of 10

ProIA's reported inference-attack gains reduce to the attacker-controlled training setup: Algorithm 1 line 15 trains the target model FT with the attacker-chosen prompt p, and the case study admits this 'increases the target's overfitting'—the exact defect MIA exploits.

self definitional [Appendix A, Algorithm 1, line 15]
"Train FT and FS with p using Eq. (3);"

Section 3.2 defines the inference attack as one where the adversary constructs prompts p and queries a target model FT, treating FT as the victim whose private training data is to be inferred. Algorithm 1 line 15 instead has the adversary train FT (and the shadow model FS) using the attacker-designed p. The target model is therefore not a fixed, independently trained victim; its behavior under p is a direct product of the attacker's own training objective. Any leakage or membership signal in FT's outputs is manufactured by the attack setup, not extracted from a model trained by someone else. The central claim of enhancing inference attacks is thus self-defined by the training procedure it prescribes.
fitted input called prediction [Section 5.2, Case study and Fig. 4]
"This indicates that ProIA obfuscates the target's training process and increases the target's overfitting."

Section 3.2 states that MIA 'typically relies on the assumption that FT overfits to achieve the attack.' The case study explicitly says ProIA deliberately increases the target's overfitting. Consequently, the improved MIA accuracy reported in Table 1 and Fig. 3 is obtained by manufacturing the exact condition on which MIA success depends, rather than by demonstrating inference capability against a fixed target whose training the adversary does not control. The reported attack 'prediction' is forced by the attacker's training choices, not discovered from an independently trained model. This is a fitted input—induced overfitting—being presented as a general attack enhancement.

full rationale

The paper's headline experimental claim depends on training the target model with the attacker-designed prompt. Section 3.2 establishes the standard inference-attack setting: the adversary constructs prompts p and queries a target model FT to extract private information. Algorithm 1 line 15, however, instructs the adversary to 'Train FT and FS with p using Eq. (3).' This collapses the distinction between the attacked model and the attacker's own training procedure. The target's responses are not those of a fixed victim; they are the result of the adversary's chosen training objective. The case study confirms this by stating that ProIA 'obfuscates the target's training process and increases the target's overfitting,' and the paper itself notes that MIA typically relies on target overfitting. Thus the reported gains (up to 18.54% on Lastfm/SAGE) are consequences of the attacker's control over target training, not evidence of a unified query-time inference attack against fixed models. If the intended scenario is training-time poisoning or adversarial pre-training, that is a different threat model and must be explicitly stated and evaluated as such; under the standard fixed-target threat model the central claim is not demonstrated. No load-bearing self-citation or imported uniqueness theorem was found; the circularity is in the threat-model setup itself.

Assumptions & free parameters 7 free parameters · 4 assumptions · 0 invented entities

The central claim rests on several choices that are not independently justified: the threat model allows the adversary to co-train the target, the information bottleneck objective is a restatement of known bounds, and multiple hyperparameters (t, beta_A, beta_M, alpha, k, tau, lambda, iteration count) are set by hand without principled selection. No new physical or conceptual entity is introduced beyond the architectural components.

free parameters (7)

Jaccard threshold t
Controls edge construction in sampled local subgraphs in Section 4.2; set by hand and not justified.
Lagrangian parameters beta_A, beta_M
Trade-off weights in the information bottleneck objective in Eq. (11); chosen without sensitivity analysis.
Pre-training trade-off alpha
Balances contrastive loss and IB loss in Eq. (15); no ablation or schedule reported.
Number of virtual channels k = dataset-dependent (tuned per dataset)
Hyperparameter in disentanglement module in Eq. (16); Fig. 5 shows sensitivity across datasets.
Temperature tau
Regulates cluster tightness in Eq. (17); no value or sensitivity reported.
Iteration count t in disentanglement
Number of iterations for cluster search in Eqs. (17) and (18); no value reported.
KL penalty lambda
Weight of KL divergence in Eq. (19); no value reported.

assumptions (4)

ad hoc to paper The adversary controls pre-training and fine-tuning of the target model and shadow model with the attacker-designed prompt p.
Algorithm 1 line 15 trains FT and FS with p; without this, the prompt query and pre-training leakage pipeline does not function.
domain assumption A local subgraph is assumed independent of the rest of the graph so the information bottleneck can be optimized via a Markov chain.
Section 4.2 states 'a local subgraph ... assuming independence from the rest of the graph'.
standard math Variational bounds on mutual information (Propositions 1 and 2) are valid and sufficient to optimize Eq. (4).
The proofs in Appendix B restate Nguyen-Wainwright-Jordan and Wu et al. (2020) bounds; the paper provides no new derivation.
domain assumption The shadow model FS mimics the target model's behavior, a standard membership inference assumption.
Section 3.2 describes the shadow model as learning to mimic FT's prediction behavior.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Prompt-based Unifying Inference Attack on Graph Neural Networks." pith.science (2026). https://pith.science/paper/JTWPOAXJ

@misc{pith2026241215735,
  author       = {Pith},
  title        = {Pith review of: Prompt-based Unifying Inference Attack on Graph Neural Networks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/JTWPOAXJ}},
  note         = {Machine review of arXiv:2412.15735}
}

read the original abstract

Graph neural networks (GNNs) provide important prospective insights in applications such as social behavior analysis and financial risk analysis based on their powerful learning capabilities on graph data. Nevertheless, GNNs' predictive performance relies on the quality of task-specific node labels, so it is common practice to improve the model's generalization ability in the downstream execution of decision-making tasks through pre-training. Graph prompting is a prudent choice but risky without taking measures to prevent data leakage. In other words, in high-risk decision scenarios, prompt learning can infer private information by accessing model parameters trained on private data (publishing model parameters in pre-training, i.e., without directly leaking the raw data, is a tacitly accepted trend). However, myriad graph inference attacks necessitate tailored module design and processing to enhance inference capabilities due to variations in supervision signals. In this paper, we propose a novel Prompt-based unifying Inference Attack framework on GNNs, named ProIA. Specifically, ProIA retains the crucial topological information of the graph during pre-training, enhancing the background knowledge of the inference attack model. It then utilizes a unified prompt and introduces additional disentanglement factors in downstream attacks to adapt to task-relevant knowledge. Finally, extensive experiments show that ProIA enhances attack capabilities and demonstrates remarkable adaptability to various inference attacks.

Figures

Figures reproduced from arXiv: 2412.15735 by the authors.

**Figure 2.** The overall framework of ProIA. for the propagation of sensitive attributes and enhance the robustness of the training data. Sample generation. We first quantify the similarity between nodes and their neighbors, which serves as a metric for initializing the construction of local subgraphs Glo. Specifically, we set a threshold hyperparameter t to control the connectivity of edges in the sampled local subgraphs, i.e… view at source ↗

**Figure 3.** Attack AUC-ROC scores of GCN, GAT, and SAGE (from left to right) against defended models for MIA. [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗

Figures from the paper (1 more)

**Figure 4.** Figure 4: Case study. Tab. 1, we employed multiple metrics and devised various method variants. The average increase in ProIA’s attack accuracy indicates superior performance in both MIA and AIA. Specifically, compared to Vanilla, ProIA achieved a maximum accuracy improvement o…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

55 extracted references · 41 canonical work pages

[1]

, " * write output.state after.block = add.period write newline

ENTRY address archivePrefix author booktitle chapter edition editor eid eprint howpublished institution isbn journal key month note number organization pages publisher school series title type volume year label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block FUNCTION init.state.consts #0 'before.a...
[2]

write newline

" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...
[3]

Agarwal, C.; Lakkaraju, H.; and Zitnik, M. 2021. Towards a unified framework for fair and stable graph representation learning. In Uncertainty in Artificial Intelligence, 2114--2124

work page 2021
[4]

A.; Fischer, I.; Dillon, J

Alemi, A. A.; Fischer, I.; Dillon, J. V.; and Murphy, K. 2016. Deep variational information bottleneck. arXiv:1612.00410

arXiv 2016
[5]

J.; and Renner, R

Beaudry, N. J.; and Renner, R. 2011. An intuitive proof of the data processing inequality. arXiv:1107.0740

arXiv 2011
[6]

O.; Amirahmadi, A.; Ghazani, M

Boll, H. O.; Amirahmadi, A.; Ghazani, M. M.; de Morais, W. O.; de Freitas, E. P.; Soliman, A.; Etminani, K.; Byttner, S.; and Recamonde-Mendoza, M. 2024. Graph neural networks for clinical risk prediction based on electronic health records: A survey. Journal of Biomedical Informatics, 104616

work page 2024
[7]

D.; Dhariwal, P.; Neelakantan, A.; Shyam, P.; Sastry, G.; Askell, A.; et al

Brown, T.; Mann, B.; Ryder, N.; Subbiah, M.; Kaplan, J. D.; Dhariwal, P.; Neelakantan, A.; Shyam, P.; Sastry, G.; Askell, A.; et al. 2020. Language models are few-shot learners. NeurIPS, 1877--1901

work page 2020
[8]

B.; Song, D.; Erlingsson, \' U .; Oprea, A.; and Raffel, C

Carlini, N.; Tram \` e r, F.; Wallace, E.; Jagielski, M.; Herbert - Voss, A.; Lee, K.; Roberts, A.; Brown, T. B.; Song, D.; Erlingsson, \' U .; Oprea, A.; and Raffel, C. 2021. Extracting Training Data from Large Language Models. In USENIX Security , 2633--2650

work page 2021

Show all 55 references

[9]

Conti, M.; Li, J.; Picek, S.; and Xu, J. 2022. Label-only membership inference attack against node-level graph neural networks. In Proceedings of the 15th ACM Workshop on Artificial Intelligence and Security, 1--12

2022
[10]

Dai, E.; Cui, L.; Wang, Z.; Tang, X.; Wang, Y.; Cheng, M.; Yin, B.; and Wang, S. 2023. A unified framework of graph information bottleneck for robustness and membership privacy. In KDD , 368--379

2023
[11]

Dai, E.; Zhao, T.; Zhu, H.; Xu, J.; Guo, Z.; Liu, H.; Tang, J.; and Wang, S. 2022. A comprehensive survey on trustworthy graph neural networks: Privacy, robustness, fairness, and explainability. arXiv:2204.08570

2022 arXiv
[12]

J.; and Bing, L

Deng, Y.; Zhang, W.; Pan, S. J.; and Bing, L. 2024. Multilingual jailbreak challenges in large language models. In ICLR

2024
[13]

Dong, X.; He, Y.; Zhu, Z.; and Caverlee, J. 2023. PromptAttack: Probing Dialogue State Trackers with Adversarial Prompts. In ACL (Findings) , 10651--10666

2023
[14]

Duan, M.; Suri, A.; Mireshghallah, N.; Min, S.; Shi, W.; Zettlemoyer, L.; Tsvetkov, Y.; Choi, Y.; Evans, D.; and Hajishirzi, H. 2024. Do membership inference attacks work on large language models? arXiv:2402.07841

2024 arXiv
[15]

Duddu, V.; Boutet, A.; and Shejwalkar, V. 2020. Quantifying privacy leakage in graph embedding. In MobiQuitous , 76--85

2020
[16]

P.; and Borowczak, M

Hu, H.; Cheng, L.; Vap, J. P.; and Borowczak, M. 2022. Learning privacy-preserving graph convolutional network with partially observed sensitive attributes. In WWW , 3552--3561

2022
[17]

A.-Z.; Theodonis, I.; and Bennai, M

Innan, N.; Sawaika, A.; Dhor, A.; Dutta, S.; Thota, S.; Gokal, H.; Patel, N.; Khan, M. A.-Z.; Theodonis, I.; and Bennai, M. 2024. Financial fraud detection using quantum graph neural networks. Quantum Machine Intelligence, 7

2024
[18]

N.; and Welling, M

Kipf, T. N.; and Welling, M. 2017. Semi-Supervised Classification with Graph Convolutional Networks. In ICLR (Poster)

2017
[19]

Leskovec, J.; and Mcauley, J. 2012. Learning to discover social circles in ego networks. In NeurIPS, volume 25

2012
[20]

Li, H.; Guo, D.; Fan, W.; Xu, M.; and Song, Y. 2023. Multi-step jailbreaking privacy attacks on chatgpt. arXiv:2304.05197

2023 arXiv
[21]

Li, K.; Liu, Y.; Ao, X.; Chi, J.; Feng, J.; Yang, H.; and He, Q. 2022. Reliable representations make a stronger defender: Unsupervised structure refinement for robust gnn. In KDD , 925--935

2022
[22]

Li, X.; Wang, R.; Cheng, M.; Zhou, T.; and Hsieh, C.-J. 2024. Drattack: Prompt decomposition and reconstruction makes powerful llm jailbreakers. arXiv:2402.16914

2024 arXiv
[23]

Liu, P.; Yuan, W.; Fu, J.; Jiang, Z.; Hayashi, H.; and Neubig, G. 2023 a . Pre-train, Prompt, and Predict: A Systematic Survey of Prompting Methods in Natural Language Processing. ACM Comput. Surv. , 195:1--195:35

2023
[24]

Liu, X.; Xu, N.; Chen, M.; and Xiao, C. 2024 a . Autodan: Generating stealthy jailbreak prompts on aligned large language models. In ICLR

2024
[25]

Liu, X.; Yu, Z.; Zhang, Y.; Zhang, N.; and Xiao, C. 2024 b . Automatic and universal prompt injection attacks against large language models. arXiv:2403.04957

2024 arXiv
[26]

Liu, Y.; Wu, Z.; Lu, Z.; Nie, C.; Wen, G.; Hu, P.; and Zhu, X. 2024 c . Noisy Node Classification by Bi-level Optimization based Multi-teacher Distillation. arXiv preprint arXiv:2404.17875

2024 arXiv
[27]

Liu, Y.; Wu, Z.; Lu, Z.; Wen, G.; Ma, J.; Lu, G.; and Zhu, X. 2023 b . Multi-teacher Self-training for Semi-supervised Node Classification with Noisy Labels. In Proceedings of the 31st ACM International Conference on Multimedia, 2946--2954

2023
[28]

J.; and Jordan, M

Nguyen, X.; Wainwright, M. J.; and Jordan, M. I. 2010. Estimating divergence functionals and the likelihood ratio by convex risk minimization. IEEE Transactions on Information Theory

2010
[29]

Niu, Z.; Ren, H.; Gao, X.; Hua, G.; and Jin, R. 2024. Jailbreaking attack against multimodal large language model. In ICLR

2024
[30]

E.; Hizber, A.; Sihlovec, O.; and Khosla, M

Olatunji, I. E.; Hizber, A.; Sihlovec, O.; and Khosla, M. 2023. Does black-box attribute inference attacks on graph neural networks constitute privacy risk? arXiv:2306.00578

2023 arXiv
[31]

E.; Nejdl, W.; and Khosla, M

Olatunji, I. E.; Nejdl, W.; and Khosla, M. 2021. Membership Inference Attack on Graph Neural Networks. In TPS-ISA , 11--20

2021
[32]

Poole, B.; Ozair, S.; Van Den Oord, A.; Alemi, A.; and Tucker, G. 2019. On variational bounds of mutual information. In ICML , 5171--5180. PMLR

2019
[33]

Rozemberczki, B.; and Sarkar, R. 2020. Characteristic functions on graphs: Birds of a feather, from statistical descriptors to parametric models. In CIKM , 1325--1334

2020
[34]

Sharma, K.; Lee, Y.-C.; Nambi, S.; Salian, A.; Shah, S.; Kim, S.-W.; and Kumar, S. 2024. A survey of graph neural networks for social recommender systems. ACM Computing Surveys, 1--34

2024
[35]

Shi, J.; Yuan, Z.; Liu, Y.; Huang, Y.; Zhou, P.; Sun, L.; and Gong, N. Z. 2024. Optimization-based Prompt Injection Attack to LLM-as-a-Judge. arXiv:2403.17710

2024 arXiv
[36]

Shokri, R.; Stronati, M.; Song, C.; and Shmatikov, V. 2017. Membership Inference Attacks Against Machine Learning Models. In S & P , 3--18

2017
[37]

Takac, L.; and Zabovsky, M. 2012. Data analysis in public social networks. In International scientific conference and international workshop present day trends of innovations

2012
[38]

Tram \`e r, F.; Shokri, R.; San Joaquin, A.; Le, H.; Jagielski, M.; Hong, S.; and Carlini, N. 2022. Truth serum: Poisoning machine learning models to reveal their secrets. In CCS , 2779--2792

2022
[39]

Velickovic, P.; Cucurull, G.; Casanova, A.; Romero, A.; Li \` o , P.; and Bengio, Y. 2018. Graph Attention Networks. In ICLR

2018
[40]

Wang, X.; and Wang, W. H. 2022. Group property inference attacks against graph neural networks. In CCS , 2871--2884

2022
[41]

Wei, Y.; Yuan, H.; Fu, X.; Sun, Q.; Peng, H.; Li, X.; and Hu, C. 2024. Poincar \'e Differential Privacy for Hierarchy-aware Graph Embedding. In AAAI , 9160--9168

2024
[42]

Wu, B.; Yang, X.; Pan, S.; and Yuan, X. 2021. Adapting membership inference attacks to GNN for graph classification: Approaches and implications. In ICDM , 1421--1426. IEEE

2021
[43]

Wu, T.; Ren, H.; Li, P.; and Leskovec, J. 2020. Graph information bottleneck. NeurIPS , 20437--20448

2020
[44]

Wu, Z.; Zhou, P.; Wen, G.; Wan, Y.; Ma, J.; Cheng, D.; and Zhu, X. 2022. Information Augmentation for Few-shot Node Classification. In IJCAI, 3601--3607

2022
[45]

G.; and Carlsson, M

Yao, D.; Zhang, J.; Harris, I. G.; and Carlsson, M. 2024. Fuzzllm: A novel and universal fuzzing framework for proactively discovering jailbreak vulnerabilities in large language models. In ICASSP , 4485--4489

2024
[46]

Yuan, H.; Sun, Q.; Fu, X.; Ji, C.; and Li, J. 2024 a . Dynamic Graph Information Bottleneck. In Proceedings of the ACM on Web Conference 2024, 469--480

2024
[47]

Yuan, H.; Sun, Q.; Fu, X.; Zhang, Z.; Ji, C.; Peng, H.; and Li, J. 2024 b . Environment-aware dynamic graph learning for out-of-distribution generalization. Advances in Neural Information Processing Systems, 36

2024
[48]

Zarifzadeh, S.; Liu, P.; and Shokri, R. 2024. Low-Cost High-Power Membership Inference Attacks. In ICML

2024
[49]

Zhang, C.; Bengio, S.; Hardt, M.; Recht, B.; and Vinyals, O. 2017. Understanding deep learning requires rethinking generalization. In ICLR

2017
[50]

Zhang, G.; Zhang, S.; and Yuan, G. 2024. Bayesian graph local extrema convolution with long-tail strategy for misinformation detection. ACM Transactions on Knowledge Discovery from Data, 18(4): 1--21

2024
[51]

Zhang, Q.; Wang, H.; Long, C.; Su, L.; He, X.; Chang, J.; Wu, T.; Yin, H.; Yiu, S.-M.; Tian, Q.; et al. 2024. A Survey of Generative Techniques for Spatial-Temporal Data Mining. arXiv:2405.09592

2024 arXiv
[52]

S.; and Derr, T

Zhang, Y.; Zhao, Y.; Li, Z.; Cheng, X.; Wang, Y.; Kotevska, O.; Yu, P. S.; and Derr, T. 2023. A Survey on Privacy in Graph Neural Networks: Attacks, Preservation, and Applications. arXiv:2308.16375

2023 arXiv
[53]

Zhang, Z.; Chen, M.; Backes, M.; Shen, Y.; and Zhang, Y. 2022. Inference Attacks Against Graph Neural Networks. In USENIX Security Symposium , 4543--4560

2022
[54]

Zhang, Z.; Liu, Q.; Wang, H.; Lu, C.; and Lee, C. 2021. Motif-based Graph Self-Supervised Learning for Molecular Property Prediction. In NeurIPS, 15870--15882

2021
[55]

Zhiyao, Z.; Zhou, S.; Mao, B.; Zhou, X.; Chen, J.; Tan, Q.; Zha, D.; Feng, Y.; Chen, C.; and Wang, C. 2024. Opengsl: A comprehensive benchmark for graph structure learning. In NeurIPS

2024

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.

[1] [1]

, " * write output.state after.block = add.period write newline

ENTRY address archivePrefix author booktitle chapter edition editor eid eprint howpublished institution isbn journal key month note number organization pages publisher school series title type volume year label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block FUNCTION init.state.consts #0 'before.a...

[2] [2]

write newline

" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

[3] [3]

Agarwal, C.; Lakkaraju, H.; and Zitnik, M. 2021. Towards a unified framework for fair and stable graph representation learning. In Uncertainty in Artificial Intelligence, 2114--2124

work page 2021

[4] [4]

A.; Fischer, I.; Dillon, J

Alemi, A. A.; Fischer, I.; Dillon, J. V.; and Murphy, K. 2016. Deep variational information bottleneck. arXiv:1612.00410

arXiv 2016

[5] [5]

J.; and Renner, R

Beaudry, N. J.; and Renner, R. 2011. An intuitive proof of the data processing inequality. arXiv:1107.0740

arXiv 2011

[6] [6]

O.; Amirahmadi, A.; Ghazani, M

Boll, H. O.; Amirahmadi, A.; Ghazani, M. M.; de Morais, W. O.; de Freitas, E. P.; Soliman, A.; Etminani, K.; Byttner, S.; and Recamonde-Mendoza, M. 2024. Graph neural networks for clinical risk prediction based on electronic health records: A survey. Journal of Biomedical Informatics, 104616

work page 2024

[7] [7]

D.; Dhariwal, P.; Neelakantan, A.; Shyam, P.; Sastry, G.; Askell, A.; et al

Brown, T.; Mann, B.; Ryder, N.; Subbiah, M.; Kaplan, J. D.; Dhariwal, P.; Neelakantan, A.; Shyam, P.; Sastry, G.; Askell, A.; et al. 2020. Language models are few-shot learners. NeurIPS, 1877--1901

work page 2020

[8] [8]

B.; Song, D.; Erlingsson, \' U .; Oprea, A.; and Raffel, C

Carlini, N.; Tram \` e r, F.; Wallace, E.; Jagielski, M.; Herbert - Voss, A.; Lee, K.; Roberts, A.; Brown, T. B.; Song, D.; Erlingsson, \' U .; Oprea, A.; and Raffel, C. 2021. Extracting Training Data from Large Language Models. In USENIX Security , 2633--2650

work page 2021