Pith. sign in

REVIEW 4 major objections 5 minor 33 references

An Out-Of-Distribution Membership Inference Attack Approach for Cross-Domain Graph Attacks

T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Cross-domain graph membership inference attacks are viable: an attacker can infer whether a node trained a target GNN using only a shadow graph from a different distribution, by learning invariant node representations and extrapolating…

desk verdict Plausible new problem framing, but the central GIB objective is never given a computable form, so the paper's empirical claims are not reproducible as written. read the letter →

arxiv 2505.20074 v1 pith:QQDDYYTT submitted 2025-05-26 cs.LG

Jinyan Wang , Liu Yang , Yuecen Wei , Jiaxuan Si , Chenhao Guo , Qingyun Sun , Xianxian Li , Xingcheng Fu This is my paper
classification cs.LG
keywords membershipinferenceattackgraphneuralnetworksout-of-distributiongeneralizationinvariantriskminimizationinformationbottleneckextrapolationcross-domainprivacyleakage
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper asks whether a membership inference attack on graph neural networks still works when the attacker cannot obtain shadow data drawn from the same distribution as the target. It reframes the distribution gap as an out-of-distribution problem and proposes GOOD-MIA, a two-stage pipeline: a shadow GNN is trained under invariant risk minimization and a graph information bottleneck across data-augmented environments, then a binary attack classifier is trained with risk extrapolation. The paper reports that on citation networks with synthetic distribution shifts and on Twitch and Facebook-100 social graphs, GOOD-MIA beats the TSTS baseline on accuracy and AUC with GCN, GAT, and SGC backbones, and that removing any of the three components degrades attack performance. A sympathetic reader would come away with the claim that cross-domain graph MIAs are viable and stronger than previously assumed.

What carries the argument

The load-bearing mechanism is the combination of three objectives applied to views of a single shadow graph. IRM enforces that representations predict labels equally well across augmented environments; GIB compresses away environment-specific information; and REx equalizes attack risks across environments to dampen the effect of distribution shift at inference time. Named components: Invariant Risk Minimization (IRM), Graph Information Bottleneck (GIB), and Risk Extrapolation (REx).

What would settle it

Train GOOD-MIA and TSTS on a shadow graph and test on a target graph from a disjoint domain, using identical backbones and hyperparameters beyond the reported ones, and report whether GOOD-MIA's accuracy and AUC stay above the TSTS baseline and random guessing. Additionally, check whether Eq. (10)'s GIB term accepts a concrete node-level instantiation; if it does not, the paper's claimed mechanism is not fully specified.

Watch

Extended reading notes

Core claim

Given a target GNN trained on graph $G_t$, an attacker with only a shadow graph from a different distribution can still infer membership of nodes by: (1) constructing $M$ augmented environments from the shadow graph via feature masking and DropEdge; (2) training the shadow GNN with the joint loss $\mathcal{L}_{\text{train}} = \alpha\,\text{GIB} + (1-\alpha)\,R_{\text{IRM}}$ to extract invariant, task-relevant node representations; and (3) training an MLP attack classifier on the shadow model's posteriors, one environment per augmented view, using variance-based risk extrapolation $R_{V-\text{REx}}$ instead of plain cross-entropy. The paper claims this invariant-plus-bottleneck design is what makes the attack transfer across domains, with ablation results attributing each component a distinct role.

Load-bearing premise

The claim rests on the assumption that invariant representations learned from augmented views of one shadow graph carry over to a genuinely different target graph, and that the graph information bottleneck term can actually be computed for node-level representations as Eq. (10) requires.

Editorial extensions

If this is right

  • An attacker does not need identically distributed shadow data; a differently distributed graph suffices to train an effective membership inference model.
  • Graph model publishers should assume membership status leaks even when an adversary observes the model from outside a black-box API with unrelated data.
  • The three components are individually necessary: removing IRM, GIB, or REx lowers attack accuracy in the reported citation-network ablations.
  • Attack performance transfers across GNN backbones (GCN, GAT, SGC), suggesting the pipeline is not tied to a specific encoder.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If real-world domain shifts resemble the augmented environments tested here, then current privacy evaluations that assume matched shadow data systematically understate leakage risk; evaluations should use cross-domain shadow sets.
  • The paper leaves the graph information bottleneck term at a symbolic level for node-level representations; making Eq. (10) concrete with a computable node-level mutual-information estimator would either strengthen or weaken the claimed mechanism.
  • The approach suggests a defense direction: training GNNs to produce representations that differ across domains could frustrate invariant-representation attacks, though the paper does not explore defenses.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes GOOD-MIA, a membership inference attack against GNNs under a cross-domain setting where the shadow dataset is drawn from a different distribution than the target dataset. The method trains a shadow GNN with invariant risk minimization (IRM), a graph information bottleneck (GIB) term, and risk extrapolation (REx) for the attack classifier. The authors report accuracy, AUC, and recall on three citation networks with synthetic distribution shifts and on two social-network collections, comparing against the TSTS baseline and three ablations.

Significance. The cross-domain membership inference question is timely and practically motivated, and the paper is, to the best of its claims, the first to target the setting where the attacker's auxiliary graph is not identically distributed to the target graph. If the proposed objective were fully specified and the empirical gains were statistically supported, the paper would be a useful contribution to both graph privacy and OOD generalization. However, as written the central training objective is not computable from the manuscript, one of the core update equations is not well formed, and the experimental comparison lacks uncertainty quantification; the claimed contribution is therefore not established in the present text.

major comments (4)
  1. [Section 4.2, Eq. (10)] The overall shadow-model loss is written as min_ω Ltrain = αGIB + (1−α)RIRM, but GIB is only abstractly defined in Eq. (5) as a trade-off of mutual information terms. No node-level variational estimator, surrogate, or concrete objective is provided for I(Y;Z) and I(G;Z) in a GNN encoder, so Eq. (10) cannot be instantiated or optimized from the paper. This is load-bearing because the ablation GOOD-MIA\GIB in Table 2 is supposed to isolate the contribution of this term, but the reader cannot tell what was removed or how the reported numbers were produced.
  2. [Section 4.2, Eq. (7)] The layer update h_{e,i}^{(l+1)} = UPDATE(z_i^{(l)}, argmin_{h_{e,i}} L_GIB) is not executable as written: the index on z is inconsistent with the environment subscript e, the variable h_{e,i} is not specified on the right-hand side, and L_GIB is never defined as a function of h_{e,i} or z. This is not a cosmetic typo: Algorithm 1 invokes Eq. (7) as the representation computation on line 5, so the described pipeline cannot be reconstructed from the manuscript.
  3. [Section 5.2 and Section 5.3, Tables 2-4] All reported numbers are point estimates with no standard deviations, confidence intervals, or significance tests. Several full-model improvements over TSTS are very small; for example, in Table 3 the ENGB/GCN row shows ACC 57.14 versus 57.04 and AUC 57.06 versus 56.99, and in Table 4 the Cornell5/Reed row shows REC 56.83 versus 53.48 with no error bars. Without repeated trials or statistical tests, the claim of 'superior attack performance' is not supported even if the objective were fully specified.
  4. [Section 5.1, synthetic data protocol] For Cora, Citeseer, and Pubmed, the authors state that they 'synthetically create spurious node features to introduce distribution shifts,' but no protocol is given for how the spurious features are generated, how large the shift is, or how the training and target graphs are split. This prevents reproduction of the synthetic-domain experiments and makes it difficult to interpret the differences between the synthetic results in Table 2 and the real-world results in Tables 3 and 4.
minor comments (5)
  1. [Section 4.2, Eq. (8)] The notation in Eq. (8) uses fω(eXe, fAe), but fAe is not introduced; the augmented adjacency matrix is denoted eAe in Eq. (6). The symbols should be made consistent.
  2. [Algorithm 1, line 11] The attack model is defined with parameters (ψ, b) in Eq. (11), but Algorithm 1 says 'Train ω by minimizing Eq. (13)'; the attack update should refer to ψ and b rather than the GNN encoder parameters ω.
  3. [Section 3.1, Eq. (1)] The output of the attack is written as {member, non-membe}; 'non-membe' is a typo for 'non-member'.
  4. [Section 2.1] The sentence 'However, the adversary requires all needs a shadow dataset' is grammatically incomplete and should be rephrased for clarity.
  5. [Section 4.3, complexity analysis] The complexity expression O(N L d̄²) and the statement that the overall complexity 'has a linear relationship' are not fully quantified; M copies of the encoder are computed, so the dependence on M should be stated explicitly.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: held-out target-domain attack scores and ablations support the central claim, though the GIB objective is underspecified and some method components are self-cited.

full rationale

The paper's central claim is an empirical one: GOOD-MIA attains higher membership-inference accuracy and AUC than the TSTS baseline when the shadow and target graphs come from different domains (Tables 2-4). The attack model is trained exclusively on shadow-model posteriors and evaluated on held-out target subgraphs (Twitch: DE as target vs ENGB/ES/FR/PTBR/RU/TW as shadow; Facebook-100: John Hopkins/Amherst/Cornell5 vs Penn/Reed), so the reported numbers are not fitting or prediction on the same data. The training objective Eq. (10) combines IRM (Eq. 9), a GIB term (Eq. 5), and REx (Eq. 13); none of these terms is defined as a function of the target attack accuracy, and the ablation study removes each component rather than treating the full model as a fitted prediction. The main weaknesses are implementability and transparency, not circularity: Eq. (7) uses an undefined L_GIB, Eq. (10) never specifies a computable node-level estimator for I(Y;Z) and I(G;Z), and the self-cited GIB/augmentation references (Fu et al. 2025a,b; Fu et al. 2024) are used descriptively rather than as an external uniqueness theorem. Hyperparameters such as alpha are analyzed on the evaluation datasets (Sec. 5.4, Fig. 3), which is a tuning-transparency concern, but the paper does not state that the reported tables are obtained by selecting alpha on the target, so no fitted input is renamed as a prediction. No load-bearing derivation reduces to its own input; the central result rests on held-out empirical comparison.

Assumptions & free parameters 6 free parameters · 4 assumptions · 0 invented entities

The central claim rests on the transfer of synthetic augmented-environment invariance to real domains, on an under-specified GIB implementation, and on unreported hyperparameters. No new scientific entities are introduced; GOOD-MIA is a combination of existing losses and a new threat-model framing.

free parameters (6)
  • alpha (GIB/RIRM balance) = not reported; Fig. 3 varies alpha over [0.1, 0.9]
    Weight in Eq. (10); controls the shadow-model objective and is likely tuned per dataset and model.
  • beta1 (IRM penalty weight) = not reported
    Eq. (9); controls the strength of the invariant risk penalty in shadow-model training.
  • beta2 (REx variance penalty) = not reported
    Eq. (13); controls the variance penalty that encourages equality of risks across attack environments.
  • M (number of augmented environments) = not reported
    Number of augmented graphs in Eq. (6); all experiments depend on this choice.
  • Augmentation rates for feature masking and DropEdge = not reported
    Hyperparameters of the environment construction in Eq. (6); not specified in the paper.
  • Spurious feature shift parameters for synthetic citation data = not reported
    Section 5.1 introduces distribution shifts via synthetic spurious features but gives no generation or strength parameters.
assumptions (4)
  • domain assumption Invariant representations learned on augmented views of the shadow graph transfer to the target domain.
    The M environments in Eq. (6) are created from one shadow graph; the paper assumes IRM over these synthetic views captures the same invariance that would hold across real domains. No formal or empirical justification is given beyond the reported results.
  • ad hoc to paper The graph information bottleneck term in Eq. (10) is a well-defined, computable node-level objective.
    Eq. (5) defines GIB via mutual information I(Y;Z) and I(G;Z), but no estimator, variational bound, or node-level instantiation is provided. Eq. (7) even calls for an arg min over L_GIB inside the layer update, so the optimization in Eq. (10) is not fully specified.
  • domain assumption The shadow model's posterior is informative about target membership even across domains.
    The attack classifier is trained on shadow posteriors and applied to target posteriors; the paper assumes the OOD-regularized shadow model makes member and non-member posterior distributions transferable. This is the core transfer assumption of any shadow-model MIA.
  • domain assumption Synthetic spurious features in Cora, Citeseer, and PubMed approximate real cross-domain shifts.
    Section 5.1 states that spurious node features are synthetically created but does not describe the generation process, so the validity of the synthetic OOD benchmark cannot be assessed.

how reviews work

0 comments
Cite this review

Pith. "Pith review of An Out-Of-Distribution Membership Inference Attack Approach for Cross-Domain Graph Attacks." pith.science (2026). https://pith.science/paper/QQDDYYTT

@misc{pith2026250520074,
  author       = {Pith},
  title        = {Pith review of: An Out-Of-Distribution Membership Inference Attack Approach for Cross-Domain Graph Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/QQDDYYTT}},
  note         = {Machine review of arXiv:2505.20074}
}
read the original abstract

Graph Neural Network-based methods face privacy leakage risks due to the introduction of topological structures about the targets, which allows attackers to bypass the target's prior knowledge of the sensitive attributes and realize membership inference attacks (MIA) by observing and analyzing the topology distribution. As privacy concerns grow, the assumption of MIA, which presumes that attackers can obtain an auxiliary dataset with the same distribution, is increasingly deviating from reality. In this paper, we categorize the distribution diversity issue in real-world MIA scenarios as an Out-Of-Distribution (OOD) problem, and propose a novel Graph OOD Membership Inference Attack (GOOD-MIA) to achieve cross-domain graph attacks. Specifically, we construct shadow subgraphs with distributions from different domains to model the diversity of real-world data. We then explore the stable node representations that remain unchanged under external influences and consider eliminating redundant information from confounding environments and extracting task-relevant key information to more clearly distinguish between the characteristics of training data and unseen data. This OOD-based design makes cross-domain graph attacks possible. Finally, we perform risk extrapolation to optimize the attack's domain adaptability during attack inference to generalize the attack to other domains. Experimental results demonstrate that GOOD-MIA achieves superior attack performance in datasets designed for multiple domains.

Figures

Figures reproduced from arXiv: 2505.20074 by the authors.

Figure 1
Figure 1. Traditional MIA (Trad-MIA) vs GOOD-MIA [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Framework of GOOD-MIA. (1) The input graph is augmented to construct [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Trade-off parameter α analysis. When the shadow model learns invariant representations us￾ing IRM, generalizing to other domains may not be relevant to the downstream tasks. Therefore, it is also necessary to capture the features and structures that are closely related to the downstream tasks. Moreover, when using different GNN models, the attack effect obtained by using different parame￾ters is also different due t… view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

33 extracted references · 24 canonical work pages

  1. [1]

    Invariant risk minimization

    [Arjovsky et al., 2019] Martin Arjovsky, L ´eon Bottou, Ishaan Gulrajani, and David Lopez-Paz. Invariant risk minimization. arXiv preprint arXiv:1907.02893,

    arXiv 2019

  2. [10]

    Out-of-distribution generalization via risk extrapolation (rex)

    [Krueger et al., 2021] David Krueger, Ethan Caballero, Joern-Henrik Jacobsen, Amy Zhang, Jonathan Binas, Dinghuai Zhang, Remi Le Priol, and Aaron Courville. Out-of-distribution generalization via risk extrapolation (rex). In International conference on machine learning , pages 5815–5826. PMLR,

    work page 2021

  3. [11]

    Learning invariant graph representations for out-of-distribution generalization

    [Li et al., 2022] Haoyang Li, Ziwei Zhang, Xin Wang, and Wenwu Zhu. Learning invariant graph representations for out-of-distribution generalization. Advances in Neural In- formation Processing Systems, 35:11828–11841,

    work page 2022

  4. [13]

    To- wards out-of-distribution generalization: A survey

    [Liu et al., 2021] Jiashuo Liu, Zheyan Shen, Yue He, Xingx- uan Zhang, Renzhe Xu, Han Yu, and Peng Cui. To- wards out-of-distribution generalization: A survey. arXiv preprint arXiv:2108.13624,

    arXiv 2021

  5. [14]

    Flood: A flex- ible invariant learning framework for out-of-distribution generalization on graphs

    [Liu et al., 2023] Yang Liu, Xiang Ao, Fuli Feng, Yunshan Ma, Kuan Li, Tat-Seng Chua, and Qing He. Flood: A flex- ible invariant learning framework for out-of-distribution generalization on graphs. In Proceedings of the 29th ACM SIGKDD conference on knowledge discovery and data mining, pages 1548–1558,

    work page 2023

  6. [15]

    Membership inference attack on graph neural networks

    [Olatunji et al., 2021] Iyiola E Olatunji, Wolfgang Nejdl, and Megha Khosla. Membership inference attack on graph neural networks. In 2021 Third IEEE International Con- ference on Trust, Privacy and Security in Intelligent Sys- tems and Applications (TPS-ISA) , pages 11–20. IEEE,

    work page 2021

  7. [16]

    Do imagenet classi- fiers generalize to imagenet? In International conference on machine learning, pages 5389–5400

    [Recht et al., 2019] Benjamin Recht, Rebecca Roelofs, Lud- wig Schmidt, and Vaishaal Shankar. Do imagenet classi- fiers generalize to imagenet? In International conference on machine learning, pages 5389–5400. PMLR,

    work page 2019

  8. [17]

    Twitch gamers: a dataset for evaluating proximity preserving and structural role-based node embeddings

    [Rozemberczki and Sarkar, 2021] Benedek Rozemberczki and Rik Sarkar. Twitch gamers: a dataset for evaluating proximity preserving and structural role-based node embeddings. arXiv preprint arXiv:2101.03091,

    arXiv 2021

Show all 33 references
  1. [18]

    Ml-leaks: Model and data independent member- ship inference attacks and defenses on machine learning models

    [Salem et al., 2018] Ahmed Salem, Yang Zhang, Mathias Humbert, Pascal Berrang, Mario Fritz, and Michael Backes. Ml-leaks: Model and data independent member- ship inference attacks and defenses on machine learning models. arXiv preprint arXiv:1806.01246,

    2018 arXiv

  2. [19]

    Collective classification in network data

    [Sen et al., 2008] Prithviraj Sen, Galileo Namata, Mustafa Bilgic, Lise Getoor, Brian Galligher, and Tina Eliassi-Rad. Collective classification in network data. AI magazine , 29(3):93–93,

    2008

  3. [21]

    Membership infer- ence attacks against machine learning models

    [Shokri et al., 2017] Reza Shokri, Marco Stronati, Con- gzheng Song, and Vitaly Shmatikov. Membership infer- ence attacks against machine learning models. In 2017 IEEE symposium on security and privacy (SP) , pages 3–

    2017

  4. [22]

    Auditing data provenance in text-generation models

    [Song and Shmatikov, 2019] Congzheng Song and Vitaly Shmatikov. Auditing data provenance in text-generation models. In Proceedings of the 25th ACM SIGKDD In- ternational Conference on Knowledge Discovery & Data Mining, pages 196–206,

    2019

  5. [23]

    Social structure of facebook networks

    [Traud et al., 2012] Amanda L Traud, Peter J Mucha, and Mason A Porter. Social structure of facebook networks. Physica A: Statistical Mechanics and its Applications , 391(16):4165–4180,

    2012

  6. [25]

    Principles of risk mini- mization for learning theory

    [Vapnik, 1991] Vladimir Vapnik. Principles of risk mini- mization for learning theory. Advances in neural infor- mation processing systems, 4,

    1991

  7. [27]

    Poincar´e differential privacy for hierarchy-aware graph embedding

    [Wei et al., 2024] Yuecen Wei, Haonan Yuan, Xingcheng Fu, Qingyun Sun, Hao Peng, Xianxian Li, and Chunming Hu. Poincar´e differential privacy for hierarchy-aware graph embedding. In Proceedings of the AAAI Conference on Ar- tificial Intelligence, volume 38, pages 9160–9168,

    2024

  8. [28]

    Prompt- based unifying inference attack on graph neural networks

    [Wei et al., 2025] Yuecen Wei, Xingcheng Fu, Lingyun Liu, Qingyun Sun, Hao Peng, and Chunming Hu. Prompt- based unifying inference attack on graph neural networks. In Proceedings of the AAAI Conference on Artificial Intel- ligence, volume 39, pages 12836–12844,

    2025

  9. [29]

    Sim- plifying graph convolutional networks

    [Wu et al., 2019] Felix Wu, Amauri Souza, Tianyi Zhang, Christopher Fifty, Tao Yu, and Kilian Weinberger. Sim- plifying graph convolutional networks. In International conference on machine learning, pages 6861–6871. Pmlr,

    2019

  10. [30]

    Handling distribution shifts on graphs: An invariance perspective

    [Wu et al., 2022] Qitian Wu, Hengrui Zhang, Junchi Yan, and David Wipf. Handling distribution shifts on graphs: An invariance perspective. arXiv preprint arXiv:2202.02466,

    2022 arXiv

  11. [31]

    Graph con- trastive learning with augmentations

    [You et al., 2020] Yuning You, Tianlong Chen, Yongduo Sui, Ting Chen, Zhangyang Wang, and Yang Shen. Graph con- trastive learning with augmentations. Advances in neural information processing systems, 33:5812–5823,

    2020

  12. [32]

    Graph neural networks and their cur- rent applications in bioinformatics

    [Zhang et al., 2021] Xiao-Meng Zhang, Li Liang, Lin Liu, and Ming-Jing Tang. Graph neural networks and their cur- rent applications in bioinformatics. Frontiers in genetics, 12:690049,

    2021

  13. [33]

    Disen- tangled contrastive learning for fair graph representations

    [Zhang et al., 2025] Guixian Zhang, Guan Yuan, Debo Cheng, Lin Liu, Jiuyong Li, and Shichao Zhang. Disen- tangled contrastive learning for fair graph representations. Neural Networks, 181:106781, 2025

    2025

  14. [1991]

    Graph attention networks

    [Veliˇckovi´c et al., 2017] Petar Veliˇckovi´c, Guillem Cucurull, Arantxa Casanova, Adriana Romero, Pietro Lio, and Yoshua Bengio. Graph attention networks. arXiv preprint arXiv:1710.10903,

    2017 arXiv

  15. [2008]

    A survey of graph neural net- works for social recommender systems

    [Sharma et al., 2024] Kartik Sharma, Yeon-Chang Lee, Sivagami Nambi, Aditya Salian, Shlok Shah, Sang-Wook Kim, and Srijan Kumar. A survey of graph neural net- works for social recommender systems. ACM Computing Surveys, 56(10):1–34,

    2024

  16. [2012]

    Deep fusion clustering network

    [Tu et al., 2021] Wenxuan Tu, Sihang Zhou, Xinwang Liu, Xifeng Guo, Zhiping Cai, En Zhu, and Jieren Cheng. Deep fusion clustering network. In Proceedings of the AAAI conference on artificial intelligence , volume 35, pages 9978–9987,

    2021

  17. [2017]

    Segmentations-leak: Membership in- ference attacks and defenses in semantic image segmen- tation

    [He et al., 2020] Yang He, Shadi Rahimian, Bernt Schiele, and Mario Fritz. Segmentations-leak: Membership in- ference attacks and defenses in semantic image segmen- tation. In Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceed- ings, ...

    2020

  18. [2018]

    Graph neural networks for clinical risk prediction based on electronic health records: A survey

    [Boll et al., 2024] Helo´ısa Oss Boll, Ali Amirahmadi, Mir- farid Musavian Ghazani, Wagner Ourique de Morais, Edi- son Pignaton de Freitas, Amira Soliman, Farzaneh Etmi- nani, Stefan Byttner, and Mariana Recamonde-Mendoza. Graph neural networks for clinical risk prediction bas...

    2024

  19. [2019]

    Recognition in terra incognita

    [Beery et al., 2018] Sara Beery, Grant Van Horn, and Pietro Perona. Recognition in terra incognita. In Proceedings of the European conference on computer vision (ECCV) , pages 456–473,

    2018

  20. [2020]

    Node-level mem- bership inference attacks against graph neural networks

    [He et al., 2021] Xinlei He, Rui Wen, Yixin Wu, Michael Backes, Yun Shen, and Yang Zhang. Node-level mem- bership inference attacks against graph neural networks. arXiv preprint arXiv:2102.05429,

    2021 arXiv

  21. [2021]

    To trust or not to trust prediction scores for membership inference attacks

    [Hintersdorf et al., 2021] Dominik Hintersdorf, Lukas Struppek, and Kristian Kersting. To trust or not to trust prediction scores for membership inference attacks. arXiv preprint arXiv:2111.09076,

    2021 arXiv

  22. [2022]

    Rethinking the impact of noisy labels in graph classification: A utility and privacy perspective

    [Li et al., 2025] Xianxian Li, Zeming Gan, Qiyu Li, Bin Qu, Jinyan Wang, et al. Rethinking the impact of noisy labels in graph classification: A utility and privacy perspective. Neural Networks, 182:106919,

    2025

  23. [2023]

    Hy- perbolic geometric latent diffusion model for graph gener- ation

    [Fu et al., 2024] Xingcheng Fu, Yisen Gao, Yuecen Wei, Qingyun Sun, Hao Peng, Jianxin Li, and Xianxian Li. Hy- perbolic geometric latent diffusion model for graph gener- ation. arXiv preprint arXiv:2405.03188,

    2024 arXiv

  24. [2024]

    Hyperbolic geometric graph representation learning for hierarchy-imbalance node classification

    [Fu et al., 2023] Xingcheng Fu, Yuecen Wei, Qingyun Sun, Haonan Yuan, Jia Wu, Hao Peng, and Jianxin Li. Hyperbolic geometric graph representation learning for hierarchy-imbalance node classification. In Proceedings of the ACM Web Conference 2023, pages 460–468,

    2023

  25. [2025]

    Logan: Member- ship inference attacks against generative models

    [Hayes et al., 2017] Jamie Hayes, Luca Melis, George Danezis, and Emiliano De Cristofaro. Logan: Member- ship inference attacks against generative models. arXiv preprint arXiv:1705.07663,

    2017 arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.