Pith. sign in

REVIEW 3 major objections 5 minor 4 cited by

This survey claims to be the first comprehensive taxonomy of intellectual-property protection for graph machine learning, organizing attacks and defenses into model-level and data-level categories and providing an open-source library, PyGIP

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

A systematic review that organizes graph-ML IP protection into model-level and data-level attacks and defenses, and ships a benchmark library, PyGIP.

T0 review reviewed 2026-08-05 challenge →

load-bearing objection Useful survey of GML IP protection with a workable taxonomy and a real code library; the 'first comprehensive' claim is undercut by black-box/white-box scope contradictions and sloppy dataset stats, but it deserves a serious referee. the 3 major comments →

arxiv 2508.19641 v1 pith:PH3WTNU7 submitted 2025-08-27 cs.CR cs.AI

Intellectual Property in Graph-Based Machine Learning as a Service: Attacks and Defenses

Lincan Li , Bolin Shen , Chenxi Zhao , Yuxiang Sun , Kaixiang Zhao , Shirui Pan , Yushun Dong This is my paper
classification cs.CR cs.AI
keywords intellectual property protectiongraph machine learningmodel extraction attackmodel inversion attackmembership inference attackwatermarkingfingerprintingGMLaaS
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that the scattered work on protecting graph machine learning models and data can be organized into a single, first-of-its-kind taxonomy with four branches: model-level attacks, model-level defenses, data-level attacks, and data-level defenses. If that organization holds, researchers and practitioners get a common language for positioning new attack or defense methods, and a shared benchmark library, PyGIP, for comparing them. The survey also argues that existing surveys of graph learning security miss the intellectual-property angle, and that existing DNN IP-protection work does not transfer directly because graph models expose structural as well as attribute information. The practical payoff would be clearer threat modeling for graph-based machine-learning-as-a-service and more reproducible evaluation of watermarking, fingerprinting, differential privacy, and related defenses.

Core claim

On the paper's own terms, the central claim is that graph-learning IP protection can be systematically partitioned into model-level attacks (model extraction), model-level defenses (watermarking, fingerprinting, adversarial training), data-level attacks (model inversion and membership inference), and data-level defenses (differential privacy, adversarial training, topology perturbation, regularization, knowledge distillation). The authors assert this is the first taxonomy to cover both threats and defenses at both the model and data levels for graph learning. They pair the taxonomy with an evaluation framework covering attack effectiveness, attack efficiency, task utility, privacy protection

What carries the argument

The load-bearing object is the four-branch taxonomy tree: model-level attack, model-level defense, data-level attack, and data-level defense, each with its own representative methods and evaluation metrics. PyGIP is the accompanying implementation layer that turns the taxonomy from a conceptual map into runnable benchmark tooling, letting a user take a taxonomy branch and immediately execute a corresponding attack or defense.

Load-bearing premise

The taxonomy's claimed comprehensiveness depends on every relevant graph-learning IP protection method fitting into the four model/data attack-defense categories, and on black-box API access being the practically important threat setting.

What would settle it

A concrete check would be to enumerate the published graph-learning IP protection literature and test whether every established attack or defense fits exactly one of the four taxonomy leaves; a single widely used method that falls outside the partition, or a realistic GMLaaS theft that requires white-box access to succeed, would falsify the comprehensiveness claim. A second check would be to run a representative benchmark pair—say, a model extraction attack against a watermarking defense—through PyGIP and see whether the library reproduces the published success and fidelity numbers.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • New IP-protection methods can be positioned within a standard four-branch scheme, making it easier to see what a proposal adds and what it competes with.
  • PyGIP gives the community a common implementation platform, so accuracy, fidelity, robustness, and efficiency claims can be compared under the same codebase and datasets.
  • The proposed evaluation metrics give authors a checklist—attack effectiveness, attack efficiency, task utility, privacy protection, resource cost—that could become the default reporting standard for the field.
  • The benchmark dataset survey gives practitioners a map of which graphs (citation, social, molecular, protein, e-commerce, traffic, collaboration) support which kinds of IP-protection experiments.
  • Future work can use the taxonomy to identify gaps, e.g., classes of graph models or attacks that have no assigned defense branch yet.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The paper's exclusive focus on black-box access means the taxonomy likely underrepresents white-box and gray-box threats, which could become more relevant as open-weight graph models and federated graph training spread.
  • Because defenses are grouped by mechanism rather than by formal privacy guarantee, methods placed in the same branch (e.g., differential privacy and adversarial training) may have incomparable privacy semantics; a shared quantitative threat model would be needed to truly benchmark them side by side.
  • The same four-branch structure could extend naturally to graph-based large language models, where the boundary between 'model theft' and 'data leakage' is blurrier than in classic GNNs.
  • A testable extension would be to use PyGIP as a seed for a community benchmark: if multiple groups can reproduce published attack-success and defense-fidelity numbers on the same datasets, the evaluation framework would gain the credibility the survey argues for.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. This survey reviews intellectual property (IP) protection for graph-based machine learning as a service (GMLaaS). It organizes existing work into a proposed taxonomy with four top-level categories: model-level attacks, model-level defenses, data-level attacks, and data-level defenses. For each category it discusses representative methods, threat assumptions, and evaluation metrics. It also tabulates benchmark datasets, describes real-world application domains, and introduces an open-source library called PyGIP for implementing and comparing attack and defense methods. The paper's central claims are that it provides the first comprehensive taxonomy of GML IP protection, a systematic evaluation framework, a curated set of benchmark datasets, and a reusable software library.

Significance. If the central claims are substantiated, the survey would be a useful reference for a fragmented and growing area: it collects model extraction, model inversion, membership inference, watermarking, fingerprinting, adversarial training, differential privacy, perturbation-based, regularization-based, and knowledge-distillation methods under one framework. The accompanying PyGIP library is a practical contribution that could lower the barrier to reproducing and comparing methods. The evaluation-metric discussion and dataset summary are also potentially valuable. However, the paper currently contains internal contradictions in its stated threat-model scope and in its dataset statistics, and the 'first comprehensive taxonomy' claim is not fully supported as written. These issues are fixable, but they affect the survey's core reliability.

major comments (3)
  1. [§3, §4.1.1, §4.2.2, §5.1.2] The paper's threat-model scope is internally inconsistent. Section 4.1.1 states 'we focus exclusively on this setting in our discussion' after restricting model-level attacks to black-box access, and Section 4.2.2 states 'we consider these attacks exclusively under the black-box setting.' Yet Section 4.2.2 includes FedGIG [137] and gradient-inversion attacks [173], which require access to model gradients or parameters (white-box), and Section 5.1.2 includes GrOVe [125], described explicitly as a white-box static fingerprinting method. Section 5.2.4 also mentions 'white-box gradient inspection' as part of the regularization-defense procedure. The taxonomy in Fig. 2 has no threat-model dimension, so the stated black-box restriction is not consistently applied. This undermines the 'comprehensive taxonomy' claim as written. The authors should either include an explicit white-box/gray-box dim
  2. [Table 2 and Appendix A] The benchmark dataset statistics are contradictory and contain clear errors. Table 2 lists Reddit as 232,965 nodes and 57,307,946 edges, while Appendix A.2 says 'over 50,000 nodes and over 860,000 edges.' LastFM is 7,083 nodes/25,814 edges in Table 2 but 7,624 nodes/27,806 edges in Appendix A.2. Computers is 245,861 edges in Table 2 but 287,209 edges in Appendix A.4. The column header '(Avg.) #Nodes' mixes aggregate and average counts across rows: MUTAG and NCI1 give averages, while Cora, Citeseer, and Reddit give totals. The AIDS row reports 31,385 nodes and 64,780 edges while Appendix A.3 says the dataset comprises 43,467 compounds (graphs). Because systematic dataset characterization is one of the paper's stated contributions, these inconsistencies must be corrected and the table/appendix aligned.
  3. [Abstract, §1, §3] The claim of 'the first comprehensive taxonomy' is stronger than what is currently supported. The paper does not state the inclusion/exclusion criteria used to select literature, nor does it compare the proposed four-category partition with existing IP-protection taxonomies for deep learning (e.g., [18], [79], [80]). As noted above, the taxonomy is also applied inconsistently with respect to white-box methods. The authors should either substantiate the 'first/comprehensive' claim through a defined literature search and explicit comparison with prior taxonomies, or soften the claim and describe the taxonomy as a structured organization of the black-box GML IP-protection literature.
minor comments (5)
  1. [§2.1] The notation is inconsistent: G is defined as (V, A, X) with V ∈ R^n, but V is later called the node set; E is introduced but not used in the graph tuple. Please clarify.
  2. [Fig. 2] The 'Differential Privacy' entry under Data-Level Defense has a dangling citation '[?]' and no reference number. This should be fixed.
  3. [§6.1, Table 2] The text uses 'NCT1 & NCI109' while Table 2 uses 'NCI1'; also 'Tmall' appears in Table 2 but is not discussed in Section 6.1. Please unify names and descriptions.
  4. [§1, §6.1, Fig. 4, Fig. 7] Several typos remain: 'prortective' (§1), 'acadeMInvA' (§6.1), 'Legismate' (Fig. 4 caption), and 'Distutbances' (Fig. 7 caption). A careful proofread is needed.
  5. [§1, §8] PyGIP is a highlighted contribution, but the manuscript gives no list of implemented methods, module structure, or compatibility details. A brief appendix or link summary would help readers judge the library's coverage.

Circularity Check

0 steps flagged

No material circularity: the survey's taxonomy is an organizational structure grounded in independent literature, and its self-citations are auxiliary rather than load-bearing.

full rationale

This is a survey/taxonomy paper rather than a derivation chain, so the classic circularity patterns (fitted input called prediction, self-definitional equations, uniqueness theorem imported from authors, ansatz smuggled via citation) do not apply. The Section 3 taxonomy is defined by mechanism, goal, function, and scenario, and its four top-level categories are supported by numerous independent primary references (e.g., [43], [53], [57], [112], [134], [161]); no category is defined in terms of the authors' own prior results. Self-citations do appear (e.g., [51] for an early GNN model-extraction framework, [108] for ATOM, [181] for evaluation criteria), but they are cited as representative methods or as one of several references for standard metrics, not as the justification for the central taxonomy or the evaluation framework. The paper contains no fitted parameters and makes no quantitative prediction that would reduce to an input. The main defect identified by a skeptical reading is an internal-scope inconsistency: Section 4.1.1 states 'we focus exclusively on this setting in our discussion' after limiting model-level attacks to black-box access, Section 4.2.2 says 'we consider these attacks exclusively under the black-box setting,' yet the same section covers FedGIG [137] and gradient-inversion attacks [173], and Section 5.1.2 includes GrOVe [125], a white-box fingerprinting defense. This is a consistency/completeness concern about the 'first comprehensive taxonomy' claim, not a circularity reduction, and it does not raise the circularity score under the hard rules.

Axiom & Free-Parameter Ledger

0 free parameters · 3 axioms · 0 invented entities

No free parameters or invented entities apply because the paper is a survey. The load-bearing assumptions are domain choices about the threat model, the completeness of the taxonomy, and the accuracy of dataset descriptions.

axioms (3)
  • domain assumption The GMLaaS black-box threat model adequately captures the majority of real-world GML IP protection scenarios.
    Section 4.1.1 says 'we focus exclusively on this setting in our discussion' for model-level attacks, and Section 4.2.1 similarly restricts data-level attacks to black-box settings. The taxonomy is built on this restriction.
  • ad hoc to paper Existing GML IP protection literature can be partitioned into the four top-level categories: model-level attacks, model-level defenses, data-level attacks, and data-level defenses.
    Section 3 defines this taxonomy as an organizational choice. No proof of exhaustiveness or mutual exclusivity is provided, and the paper does not map alternative taxonomies from prior work to this one.
  • domain assumption The benchmark dataset statistics in Table 2 are accurate representations of the original datasets.
    Section 6 relies on Table 2 to characterize the benchmark landscape. The paper provides no pipeline or checksums to verify these statistics, and some entries are internally inconsistent, such as the Reddit counts.

reviewed 2026-08-05 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Intellectual Property in Graph-Based Machine Learning as a Service: Attacks and Defenses." pith.science (2026). https://pith.science/paper/PH3WTNU7

@misc{pith2026250819641,
  author       = {Pith},
  title        = {Pith review of: Intellectual Property in Graph-Based Machine Learning as a Service: Attacks and Defenses},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/PH3WTNU7}},
  note         = {Machine review of arXiv:2508.19641}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Graph-structured data, which captures non-Euclidean relationships and interactions between entities, is growing in scale and complexity. As a result, training state-of-the-art graph machine learning (GML) models have become increasingly resource-intensive, turning these models and data into invaluable Intellectual Property (IP). To address the resource-intensive nature of model training, graph-based Machine-Learning-as-a-Service (GMLaaS) has emerged as an efficient solution by leveraging third-party cloud services for model development and management. However, deploying such models in GMLaaS also exposes them to potential threats from attackers. Specifically, while the APIs within a GMLaaS system provide interfaces for users to query the model and receive outputs, they also allow attackers to exploit and steal model functionalities or sensitive training data, posing severe threats to the safety of these GML models and the underlying graph data. To address these challenges, this survey systematically introduces the first taxonomy of threats and defenses at the level of both GML model and graph-structured data. Such a tailored taxonomy facilitates an in-depth understanding of GML IP protection. Furthermore, we present a systematic evaluation framework to assess the effectiveness of IP protection methods, introduce a curated set of benchmark datasets across various domains, and discuss their application scopes and future challenges. Finally, we establish an open-sourced versatile library named PyGIP, which evaluates various attack and defense techniques in GMLaaS scenarios and facilitates the implementation of existing benchmark methods. The library resource can be accessed at: https://labrai.github.io/PyGIP. We believe this survey will play a fundamental role in intellectual property protection for GML and provide practical recipes for the GML community.

Figures

Figures reproduced from arXiv: 2508.19641 by Bolin Shen, Chenxi Zhao, Kaixiang Zhao, Lincan Li, Shirui Pan, Yushun Dong, Yuxiang Sun.

Figure 1
Figure 1. Figure 1: The detailed illustration of GMLaaS ecosystem with the safeguard of intellectual property protection. [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Illustration of the Comprehensive Taxonomy of Graph Learning IP Protection Methodologies. [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Overview of watermarking verification workflow. [PITH_FULL_IMAGE:figures/full_fig_p011_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: The primary goal of Fingerprinting is to guarantee [PITH_FULL_IMAGE:figures/full_fig_p011_4.png] view at source ↗
Figure 4
Figure 4. Figure 4: The workflow of fingerprinting, including active authorization control and users’ identities verification. Each [PITH_FULL_IMAGE:figures/full_fig_p012_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: The paradigm of model-level adversarial training [PITH_FULL_IMAGE:figures/full_fig_p013_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: The general procedure paradigm of differential pri [PITH_FULL_IMAGE:figures/full_fig_p014_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: The paradigm of data-level adversarial training de [PITH_FULL_IMAGE:figures/full_fig_p015_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: The graph is perturbed by deleting an edge and [PITH_FULL_IMAGE:figures/full_fig_p016_8.png] view at source ↗
Figure 9
Figure 9. Figure 9: The general procedure of knowledge distillation defense for graph machine learning models. [PITH_FULL_IMAGE:figures/full_fig_p018_9.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Forward citations

Cited by 4 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. GraphIP-Bench: How Hard Is It to Steal a Graph Neural Network, and Can We Stop It?

    cs.CR 2026-05 accept novelty 8.0

    GraphIP-Bench shows stealing GNNs is easy at moderate query budgets, most defenses fail to block or reliably trace extraction, and watermarks lose verification power on surrogates while heterophilic graphs are harder ...

  2. AGDN: Learning to Solve Traveling Salesman Problem with Anisotropic Graph Diffusion Network

    cs.LG 2026-06 unverdicted novelty 7.0

    AGDN is a new GNN framework using a MixScore matrix and anisotropic graph diffusion to outperform prior methods on TSP instances across sizes and distributions.

  3. GraphIP-Bench: How Hard Is It to Steal a Graph Neural Network, and Can We Stop It?

    cs.CR 2026-05 unverdicted novelty 7.0

    GraphIP-Bench is a new unified benchmark showing GNN model extraction succeeds at moderate query budgets while most defenses fail to prevent it or retain verification signals on surrogates.

  4. Can Subgraph Explanations Be Weaponized to Steal Graph Neural Networks?

    cs.LG 2026-05 unverdicted novelty 6.0

    The paper demonstrates a black-box model extraction attack on graph classification models that leverages binary subgraph explanations to guide Monte Carlo edge sensitivity estimation with concentration guarantees.

Reference graph

Works this paper leans on

247 extracted references · 45 canonical work pages · cited by 3 Pith papers · 23 internal anchors

  1. [1]

    Cross- links matter for link prediction: rethinking the debiased gnn from a data perspective,

    Z. Luo, H. Huang, J. Lian, X. Song, X. Xie, and H. Jin, “Cross- links matter for link prediction: rethinking the debiased gnn from a data perspective,” Advances in Neural Information Processing Systems, vol. 36, 2024

    2024

  2. [2]

    A Topological Perspective on Demystifying GNN-Based Link Prediction Performance

    Y. Wang, T. Zhao, Y. Zhao, Y. Liu, X. Cheng, N. Shah, and T. Derr, “A topological perspective on demystifying gnn-based link prediction performance,” arXiv preprint arXiv:2310.04612 , 2023

    work page internal anchor Pith review Pith/arXiv arXiv 2023

  3. [3]

    Page-link: Path-based graph neural network expla- nation for heterogeneous link prediction,

    S. Zhang, J. Zhang, X. Song, S. Adeshina, D. Zheng, C. Faloutsos, and Y. Sun, “Page-link: Path-based graph neural network expla- nation for heterogeneous link prediction,” in Proceedings of the ACM Web Conference 2023, 2023, pp. 3784–3793

    2023

  4. [4]

    Contrastive attributed network anomaly detection with data augmentation,

    Z. Xu, X. Huang, Y. Zhao, Y. Dong, and J. Li, “Contrastive attributed network anomaly detection with data augmentation,” in Pacific-Asia conference on knowledge discovery and data mining . Springer, 2022, pp. 444–457

    2022

  5. [5]

    Adbench: Anomaly detection benchmark,

    S. Han, X. Hu, H. Huang, M. Jiang, and Y. Zhao, “Adbench: Anomaly detection benchmark,” Advances in Neural Information Processing Systems, vol. 35, pp. 32 142–32 159, 2022

    2022

  6. [6]

    Few-shot network anomaly detection via cross-network meta-learning,

    K. Ding, Q. Zhou, H. Tong, and H. Liu, “Few-shot network anomaly detection via cross-network meta-learning,” in Proceed- ings of the Web Conference 2021, 2021, pp. 2448–2456

    2021

  7. [7]

    Graph wavenet for deep spatial-temporal graph modeling,

    Z. Wu, S. Pan, G. Long, J. Jiang, and C. Zhang, “Graph wavenet for deep spatial-temporal graph modeling,” arXiv preprint arXiv:1906.00121, 2019

    Pith/arXiv arXiv 1906

  8. [8]

    Pre-training enhanced spatial-temporal graph neural network for multivariate time series forecasting,

    Z. Shao, Z. Zhang, F. Wang, and Y. Xu, “Pre-training enhanced spatial-temporal graph neural network for multivariate time series forecasting,” in Proceedings of the 28th ACM SIGKDD confer- ence on knowledge discovery and data mining , 2022, pp. 1567–1577

    2022

  9. [9]

    Adaptive graph convolutional recurrent network for traffic forecasting,

    L. Bai, L. Yao, C. Li, X. Wang, and C. Wang, “Adaptive graph convolutional recurrent network for traffic forecasting,” Advances in neural information processing systems , vol. 33, pp. 17 804–17 815, 2020

    2020

  10. [10]

    Dgrec: Graph neural network for recommendation with diver- sified embedding generation,

    L. Yang, S. Wang, Y. Tao, J. Sun, X. Liu, P . S. Yu, and T. Wang, “Dgrec: Graph neural network for recommendation with diver- sified embedding generation,” in Proceedings of the sixteenth ACM international conference on web search and data mining , 2023, pp. 661–669

    2023

  11. [11]

    Distributionally robust graph-based recommen- dation system,

    B. Wang, J. Chen, C. Li, S. Zhou, Q. Shi, Y. Gao, Y. Feng, C. Chen, and C. Wang, “Distributionally robust graph-based recommen- dation system,” in Proceedings of the ACM on Web Conference 2024, 2024, pp. 3777–3788

    2024

  12. [12]

    Disease prediction via graph neural networks,

    Z. Sun, H. Yin, H. Chen, T. Chen, L. Cui, and F. Yang, “Disease prediction via graph neural networks,” IEEE Journal of Biomedical and Health Informatics, vol. 25, no. 3, pp. 818–826, 2020

    2020

  13. [13]

    Learning the graphical structure of electronic health records with graph convolutional transformer,

    E. Choi, Z. Xu, Y. Li, M. Dusenberry, G. Flores, E. Xue, and A. Dai, “Learning the graphical structure of electronic health records with graph convolutional transformer,” inProceedings of the AAAI conference on artificial intelligence, vol. 34, no. 01, 2020, pp. 606–613. IEEE TRANSACTIONS ON KNOWLEDGE AND DATA ENGINEERING 23

    2020

  14. [14]

    Map-adaptive multimodal trajectory prediction using hierarchical graph neural networks,

    X. Mo, Y. Xing, H. Liu, and C. Lv, “Map-adaptive multimodal trajectory prediction using hierarchical graph neural networks,” IEEE Robotics and Automation Letters , vol. 8, no. 6, pp. 3685–3692, 2023

    2023

  15. [15]

    Graph relational reinforcement learning for mobile robot navigation in large-scale crowded environments,

    Z. Liu, Y. Zhai, J. Li, G. Wang, Y. Miao, and H. Wang, “Graph relational reinforcement learning for mobile robot navigation in large-scale crowded environments,” IEEE Transactions on Intelli- gent Transportation Systems, vol. 24, no. 8, pp. 8776–8787, 2023

    2023

  16. [16]

    Gnn at the edge: Cost-efficient graph neural network processing over distributed edge servers,

    L. Zeng, C. Yang, P . Huang, Z. Zhou, S. Yu, and X. Chen, “Gnn at the edge: Cost-efficient graph neural network processing over distributed edge servers,” IEEE Journal on Selected Areas in Communications, vol. 41, no. 3, pp. 720–739, 2022

    2022

  17. [17]

    Machine learning as a service: Challenges in research and applications,

    R. Philipp, A. Mladenow, C. Strauss, and A. V ¨olz, “Machine learning as a service: Challenges in research and applications,” in Proceedings of the 22nd International Conference on Information Integration and Web-based Applications & Services , 2020, pp. 396– 406

    2020

  18. [18]

    Intellectual property protection of dnn models,

    S. Peng, Y. Chen, J. Xu, Z. Chen, C. Wang, and X. Jia, “Intellectual property protection of dnn models,” World Wide Web , vol. 26, no. 4, pp. 1877–1911, 2023

    1911

  19. [19]

    Protecting intellectual property of language generation apis with lexical watermark,

    X. He, Q. Xu, L. Lyu, F. Wu, and C. Wang, “Protecting intellectual property of language generation apis with lexical watermark,” in Proceedings of the AAAI Conference on Artificial Intelligence , vol. 36, no. 10, 2022, pp. 10 758–10 766

    2022

  20. [20]

    Hardware- assisted intellectual property protection of deep learning mod- els,

    A. Chakraborty, A. Mondai, and A. Srivastava, “Hardware- assisted intellectual property protection of deep learning mod- els,” in 2020 57th ACM/IEEE Design Automation Conference (DAC), 2020, pp. 1–6

    2020

  21. [21]

    Secgnn: Privacy-preserving graph neural network training and inference as a cloud service,

    S. Wang, Y. Zheng, and X. Jia, “Secgnn: Privacy-preserving graph neural network training and inference as a cloud service,” IEEE Transactions on Services Computing , vol. 16, no. 4, pp. 2923–2938, 2023

    2023

  22. [22]

    Ch- iron: Privacy-preserving machine learning as a service,

    T. Hunt, C. Song, R. Shokri, V . Shmatikov, and E. Witchel, “Ch- iron: Privacy-preserving machine learning as a service,” arXiv preprint arXiv:1803.05961, 2018

    Pith/arXiv arXiv 2018

  23. [23]

    Veriml: Enabling integrity assurances and fair payments for machine learning as a service,

    L. Zhao, Q. Wang, C. Wang, Q. Li, C. Shen, and B. Feng, “Veriml: Enabling integrity assurances and fair payments for machine learning as a service,” IEEE Transactions on Parallel and Distributed Systems, vol. 32, no. 10, pp. 2524–2540, 2021

    2021

  24. [24]

    Privacy- preserving deep learning on machine learning as a service—a comprehensive survey,

    H. C. Tanuwidjaja, R. Choi, S. Baek, and K. Kim, “Privacy- preserving deep learning on machine learning as a service—a comprehensive survey,” IEEE Access, vol. 8, pp. 167 425–167 447, 2020

    2020

  25. [25]

    Model extraction attacks revisited,

    J. Liang, R. Pang, C. Li, and T. Wang, “Model extraction attacks revisited,” in Proceedings of the 19th ACM Asia Conference on Computer and Communications Security, 2024, pp. 1231–1245

    2024

  26. [26]

    Model extraction warning in mlaas paradigm,

    M. Kesarwani, B. Mukhoty, V . Arya, and S. Mehta, “Model extraction warning in mlaas paradigm,” in Proceedings of the 34th Annual Computer Security Applications Conference , 2018, pp. 371– 380

    2018

  27. [27]

    Learn what you want to unlearn: Unlearning inversion attacks against machine unlearn- ing,

    H. Hu, S. Wang, T. Dong, and M. Xue, “Learn what you want to unlearn: Unlearning inversion attacks against machine unlearn- ing,” arXiv preprint arXiv:2404.03233, 2024

    Pith/arXiv arXiv 2024

  28. [28]

    Cloud-driven machine learning with aws: A comprehensive review of services,

    M. K. Ravindranathan, D. S. Vadivu, and N. Rajagopalan, “Cloud-driven machine learning with aws: A comprehensive review of services,” in 2024 International Conference on Intelligent and Innovative Technologies in Computing, Electrical and Electronics (IITCEE), 2024, pp. 1–8

    2024

  29. [29]

    Machine learning as a service cloud selection: An mcdm approach for optimal decision making,

    S. G. Bhol, S. Mohanty, and P . K. Pattnaik, “Machine learning as a service cloud selection: An mcdm approach for optimal decision making,” Procedia Computer Science, vol. 233, pp. 909–918, 2024

    2024

  30. [30]

    Cat-gnn: Enhancing credit card fraud detection via causal temporal graph neural networks,

    Y. Duan, G. Zhang, S. Wang, X. Peng, W. Ziqi, J. Mao, H. Wu, X. Jiang, and K. Wang, “Cat-gnn: Enhancing credit card fraud detection via causal temporal graph neural networks,” arXiv preprint arXiv:2402.14708, 2024

    Pith/arXiv arXiv 2024

  31. [31]

    Internet financial fraud detection based on graph learning,

    R. Li, Z. Liu, Y. Ma, D. Yang, and S. Sun, “Internet financial fraud detection based on graph learning,” IEEE Transactions on Computational Social Systems, vol. 10, no. 3, pp. 1394–1401, 2022

    2022

  32. [32]

    Finsformer: A novel approach to detecting financial attacks using transformer and cluster-attention,

    H. An, R. Ma, Y. Yan, T. Chen, Y. Zhao, P . Li, J. Li, X. Wang, D. Fan, and C. Lv, “Finsformer: A novel approach to detecting financial attacks using transformer and cluster-attention,” Applied Sciences, vol. 14, no. 1, p. 460, 2024

    2024

  33. [33]

    A survey on model extraction attacks and defenses for large language models,

    K. Zhao, L. Li, K. Ding, N. Z. Gong, Y. Zhao, and Y. Dong, “A survey on model extraction attacks and defenses for large language models,” arXiv preprint arXiv:2506.22521, 2025

    Pith/arXiv arXiv 2025

  34. [34]

    Scn gnn: A gnn-based fraud detection algorithm combining strong node and graph topology information,

    J. Chen, Q. Chen, F. Jiang, X. Guo, K. Sha, and Y. Wang, “Scn gnn: A gnn-based fraud detection algorithm combining strong node and graph topology information,” Expert Systems with Applica- tions, vol. 237, p. 121643, 2024

    2024

  35. [35]

    Exploiting explanations for model inversion attacks,

    X. Zhao, W. Zhang, X. Xiao, and B. Lim, “Exploiting explanations for model inversion attacks,” in Proceedings of the IEEE/CVF international conference on computer vision, 2021, pp. 682–692

    2021

  36. [36]

    Gradient mechanism to pre- serve differential privacy and deter against model inversion attacks in healthcare analytics,

    A. Krall, D. Finke, and H. Yang, “Gradient mechanism to pre- serve differential privacy and deter against model inversion attacks in healthcare analytics,” in 2020 42nd Annual International Conference of the IEEE Engineering in Medicine & Biology Society (EMBC), 2020, pp. 5714–5717

    2020

  37. [37]

    Towards electronic health record-based medical knowledge graph construction, completion, and applications: A literature study,

    L. Murali, G. Gopakumar, D. M. Viswanathan, and P . Nedungadi, “Towards electronic health record-based medical knowledge graph construction, completion, and applications: A literature study,” Journal of biomedical informatics, vol. 143, p. 104403, 2023

    2023

  38. [38]

    Deepnote-gnn: predicting hospital readmission using clinical notes and patient network,

    S. N. Golmaei and X. Luo, “Deepnote-gnn: predicting hospital readmission using clinical notes and patient network,” in Pro- ceedings of the 12th ACM International Conference on Bioinformatics, Computational Biology, and Health Informatics, 2021, pp. 1–9

    2021

  39. [39]

    How to cover up anomalous accesses to electronic health records,

    X. Xu, Q. Hao, Z. Yang, B. Li, D. Liebovitz, G. Wang, and C. A. Gunter, “How to cover up anomalous accesses to electronic health records,” in 32nd USENIX Security Symposium (USENIX Security 23), 2023, pp. 229–246

    2023

  40. [40]

    A systematic review of graph neural network in healthcare- based applications: Recent advances, trends, and future direc- tions,

    S. G. Paul, A. Saha, M. Z. Hasan, S. R. H. Noori, and A. Moustafa, “A systematic review of graph neural network in healthcare- based applications: Recent advances, trends, and future direc- tions,” IEEE Access, vol. 12, pp. 15 145–15 170, 2024

    2024

  41. [41]

    I know what you trained last summer: A survey on stealing machine learning models and defences,

    D. Oliynyk, R. Mayer, and A. Rauber, “I know what you trained last summer: A survey on stealing machine learning models and defences,” ACM Computing Surveys , vol. 55, no. 14s, pp. 1–41, 2023

    2023

  42. [42]

    Model extraction attacks and defenses on cloud-based machine learning models,

    X. Gong, Q. Wang, Y. Chen, W. Yang, and X. Jiang, “Model extraction attacks and defenses on cloud-based machine learning models,” IEEE Communications Magazine , vol. 58, no. 12, pp. 83– 89, 2020

    2020

  43. [43]

    Adversarial attack and defense on graph data: A survey,

    L. Sun, Y. Dou, C. Yang, K. Zhang, J. Wang, S. Y. Philip, L. He, and B. Li, “Adversarial attack and defense on graph data: A survey,” IEEE Transactions on Knowledge and Data Engineering, vol. 35, no. 8, pp. 7693–7711, 2022

    2022

  44. [44]

    Privacy leakage on dnns: A sur- vey of model inversion attacks and defenses,

    H. Fang, Y. Qiu, H. Yu, W. Yu, J. Kong, B. Chong, B. Chen, X. Wang, and S.-T. Xia, “Privacy leakage on dnns: A sur- vey of model inversion attacks and defenses,” arXiv preprint arXiv:2402.04013, 2024

    Pith/arXiv arXiv 2024

  45. [45]

    Stealing machine learning models via prediction {APIs},

    F. Tram `er, F. Zhang, A. Juels, M. K. Reiter, and T. Ristenpart, “Stealing machine learning models via prediction {APIs},” in 25th USENIX security symposium (USENIX Security 16) , 2016, pp. 601–618

    2016

  46. [46]

    Model reconstruction from model explanations,

    S. Milli, L. Schmidt, A. D. Dragan, and M. Hardt, “Model reconstruction from model explanations,” in Proceedings of the Conference on Fairness, Accountability, and Transparency , 2019, pp. 1–9

    2019

  47. [47]

    Knockoff nets: Stealing functionality of black-box models,

    T. Orekondy, B. Schiele, and M. Fritz, “Knockoff nets: Stealing functionality of black-box models,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , 2019, pp. 4954–4963

    2019

  48. [49]

    Adversarial model extraction on graph neural networks,

    D. DeFazio and A. Ramesh, “Adversarial model extraction on graph neural networks,” arXiv preprint arXiv:1912.07721, 2019

    Pith/arXiv arXiv 1912

  49. [50]

    Model stealing attacks against inductive graph neural networks,

    Y. Shen, X. He, Y. Han, and Y. Zhang, “Model stealing attacks against inductive graph neural networks,” in 2022 IEEE Sympo- sium on Security and Privacy (SP) , 2022, pp. 1175–1192

    2022

  50. [51]

    Model extraction at- tacks on graph neural networks: Taxonomy and realisation,

    B. Wu, X. Yang, S. Pan, and X. Yuan, “Model extraction at- tacks on graph neural networks: Taxonomy and realisation,” in Proceedings of the 2022 ACM on Asia conference on computer and communications security, 2022, pp. 337–350

    2022

  51. [52]

    Knowledge-enhanced black-box attacks for recommendations,

    J. Chen, W. Fan, G. Zhu, X. Zhao, C. Yuan, Q. Li, and Y. Huang, “Knowledge-enhanced black-box attacks for recommendations,” in Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, 2022, pp. 108–117

    2022

  52. [53]

    Unveiling the secrets without data: Can graph neural networks be exploited through {Data-Free} model extraction attacks?

    Y. Zhuang, C. Shi, M. Zhang, J. Chen, L. Lyu, P . Zhou, and L. Sun, “Unveiling the secrets without data: Can graph neural networks be exploited through {Data-Free} model extraction attacks?” in 33rd USENIX Security Symposium (USENIX Security 24), 2024, pp. 5251–5268

    2024

  53. [54]

    A comprehensive survey of privacy- preserving federated learning: A taxonomy, review, and future IEEE TRANSACTIONS ON KNOWLEDGE AND DATA ENGINEERING 24 directions,

    X. Yin, Y. Zhu, and J. Hu, “A comprehensive survey of privacy- preserving federated learning: A taxonomy, review, and future IEEE TRANSACTIONS ON KNOWLEDGE AND DATA ENGINEERING 24 directions,” ACM Computing Surveys (CSUR) , vol. 54, no. 6, pp. 1–36, 2021

    2021

  54. [55]

    Model inversion attacks that exploit confidence information and basic countermeasures,

    M. Fredrikson, S. Jha, and T. Ristenpart, “Model inversion attacks that exploit confidence information and basic countermeasures,” in Proceedings of the 22nd ACM SIGSAC conference on computer and communications security, 2015, pp. 1322–1333

    2015

  55. [56]

    Group property inference attacks against graph neural networks,

    X. Wang and W. H. Wang, “Group property inference attacks against graph neural networks,” in Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security , 2022, pp. 2871–2884

    2022

  56. [57]

    Model inversion attacks against graph neural networks,

    Z. Zhang, Q. Liu, Z. Huang, H. Wang, C.-K. Lee, and E. Chen, “Model inversion attacks against graph neural networks,” IEEE Transactions on Knowledge and Data Engineering, 2022

    2022

  57. [58]

    Graphmi: Extracting private graph data from graph neural networks,

    Z. Zhang, Q. Liu, Z. Huang, H. Wang, C. Lu, C. Liu, and E. Chen, “Graphmi: Extracting private graph data from graph neural networks,” arXiv preprint arXiv:2106.02820, 2021

    Pith/arXiv arXiv 2021

  58. [59]

    Model Inversion Attacks on Homogeneous and Heterogeneous Graph Neural Networks

    R. Liu, W. Zhou, J. Zhang, X. Liu, P . Si, and H. Li, “Model inversion attacks on homogeneous and heterogeneous graph neural networks,” arXiv preprint arXiv:2310.09800, 2023

    work page internal anchor Pith review Pith/arXiv arXiv 2023

  59. [60]

    GAMIN: An Adversarial Approach to Black-Box Model Inversion

    U. A ¨ıvodji, S. Gambs, and T. Ther, “Gamin: An adversar- ial approach to black-box model inversion,” arXiv preprint arXiv:1909.11835, 2019

    work page internal anchor Pith review Pith/arXiv arXiv 1909

  60. [61]

    Digital rights management and wa- termarking of multimedia content for m-commerce applications,

    F. Hartung and F. Ramme, “Digital rights management and wa- termarking of multimedia content for m-commerce applications,” IEEE communications magazine, vol. 38, no. 11, pp. 78–84, 2000

    2000

  61. [62]

    Pregip: Watermarking the pre- training of graph neural networks for deep intellectual property protection,

    E. Dai, M. Lin, and S. Wang, “Pregip: Watermarking the pre- training of graph neural networks for deep intellectual property protection,” arXiv preprint arXiv:2402.04435, 2024

    Pith/arXiv arXiv 2024

  62. [63]

    Watermarking graph neural networks based on backdoor attacks,

    J. Xu, S. Koffas, O. Ersoy, and S. Picek, “Watermarking graph neural networks based on backdoor attacks,” in 2023 IEEE 8th European Symposium on Security and Privacy (EuroS&P) , 2023, pp. 1179–1197

    2023

  63. [64]

    Transferable Watermarking to Self-supervised Pre-trained Graph Encoders by Trigger Embeddings

    X. Zhao, H. Wu, and X. Zhang, “Transferable watermarking to self-supervised pre-trained graph encoders by trigger embed- dings,” arXiv preprint arXiv:2406.13177, 2024

    work page internal anchor Pith review Pith/arXiv arXiv 2024

  64. [65]

    Gnnfingers: A fingerprinting framework for verifying ownerships of graph neural networks,

    X. You, Y. Jiang, J. Xu, M. Zhang, and M. Yang, “Gnnfingers: A fingerprinting framework for verifying ownerships of graph neural networks,” in Proceedings of the ACM on Web Conference 2024, 2024, pp. 652–663

    2024

  65. [66]

    Gnnguard: A finger- printing framework for verifying ownerships of graph neural networks,

    X. You, Y. Jiang, J. Xu, and M. Zhang, “Gnnguard: A finger- printing framework for verifying ownerships of graph neural networks,” in The Web Conference 2024, 2024

    2024

  66. [67]

    Smoothing adversarial training for gnn,

    J. Chen, X. Lin, H. Xiong, Y. Wu, H. Zheng, and Q. Xuan, “Smoothing adversarial training for gnn,” IEEE Transactions on Computational Social Systems, vol. 8, no. 3, pp. 618–629, 2020

    2020

  67. [69]

    Sok: Differential privacy on graph-structured data,

    T. T. Mueller, D. Usynin, J. C. Paetzold, D. Rueckert, and G. Kaissis, “Sok: Differential privacy on graph-structured data,” arXiv preprint arXiv:2203.09205, 2022

    Pith/arXiv arXiv 2022

  68. [70]

    Netfense: Adversarial defenses against privacy attacks on neural networks for graph data,

    I.-C. Hsieh and C.-T. Li, “Netfense: Adversarial defenses against privacy attacks on neural networks for graph data,”IEEE Transac- tions on Knowledge and Data Engineering, vol. 35, no. 1, pp. 796–809, 2021

    2021

  69. [71]

    Gnnguard: Defending graph neural networks against adversarial attacks,

    X. Zhang and M. Zitnik, “Gnnguard: Defending graph neural networks against adversarial attacks,” Advances in neural informa- tion processing systems, vol. 33, pp. 9263–9275, 2020

    2020

  70. [72]

    A comprehensive survey on trustworthy graph neu- ral networks: Privacy, robustness, fairness, and explainability,

    E. Dai, T. Zhao, H. Zhu, J. Xu, Z. Guo, H. Liu, J. Tang, and S. Wang, “A comprehensive survey on trustworthy graph neu- ral networks: Privacy, robustness, fairness, and explainability,” Machine Intelligence Research, pp. 1–51, 2024

    2024

  71. [73]

    Trustworthy graph learning: Reliability, explainability, and privacy protection,

    B. Wu, Y. Bian, H. Zhang, J. Li, J. Yu, L. Chen, C. Chen, and J. Huang, “Trustworthy graph learning: Reliability, explainability, and privacy protection,” in Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining , 2022, pp. 4838–4839

    2022

  72. [74]

    Trustwor- thy graph neural networks: Aspects, methods and trends,

    H. Zhang, B. Wu, X. Yuan, S. Pan, H. Tong, and J. Pei, “Trustwor- thy graph neural networks: Aspects, methods and trends,” arXiv preprint arXiv:2205.07424, 2022

    Pith/arXiv arXiv 2022

  73. [75]

    Trustworthy graph learning: Reliability, explainability, and privacy protection,

    B. Wu, Y. Bian, H. Zhang, J. Li, J. Yu, L. Chen, C. Chen, and J. Huang, “Trustworthy graph learning: Reliability, explainability, and privacy protection,” in Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining , 2022, p. 4838–4839

    2022

  74. [76]

    A review of adversarial attacks and defenses on graphs,

    H. Sun, W. Yang, and Y. Xiao, “A review of adversarial attacks and defenses on graphs,” in Proceedings of the 4th International Conference on Artificial Intelligence and Computer Engineering, 2024, p. 416–421

    2024

  75. [77]

    Graph robustness benchmark: Benchmarking the adversarial robustness of graph machine learning,

    Q. Zheng, X. Zou, Y. Dong, Y. Cen, D. Yin, J. Xu, Y. Yang, and J. Tang, “Graph robustness benchmark: Benchmarking the adversarial robustness of graph machine learning,” in Thirty-fifth Conference on Neural Information Processing Systems Datasets and Benchmarks Track, 2021

    2021

  76. [78]

    Adversarial attack and defense on graph data: A survey,

    L. Sun, Y. Dou, C. Yang, K. Zhang, J. Wang, P . S. Yu, L. He, and B. Li, “Adversarial attack and defense on graph data: A survey,” IEEE Transactions on Knowledge and Data Engineering, vol. 35, no. 8, pp. 7693–7711, 2023

    2023

  77. [79]

    Intellectual property pro- tection for deep learning models: Taxonomy, methods, attacks, and evaluations,

    M. Xue, Y. Zhang, J. Wang, and W. Liu, “Intellectual property pro- tection for deep learning models: Taxonomy, methods, attacks, and evaluations,” IEEE Transactions on Artificial Intelligence, vol. 3, no. 6, pp. 908–923, 2021

    2021

  78. [80]

    Deep intellectual property protection: A survey,

    Y. Sun, T. Liu, P . Hu, Q. Liao, S. Fu, N. Yu, D. Guo, Y. Liu, and L. Liu, “Deep intellectual property protection: A survey,” arXiv preprint arXiv:2304.14613, 2023

    Pith/arXiv arXiv 2023

  79. [81]

    A survey of graph neural networks in real world: Imbalance, noise, privacy and ood challenges,

    W. Ju, S. Yi, Y. Wang, Z. Xiao, Z. Mao, H. Li, Y. Gu, Y. Qin, N. Yin, S. Wang et al. , “A survey of graph neural networks in real world: Imbalance, noise, privacy and ood challenges,” arXiv preprint arXiv:2403.04468, 2024

    arXiv 2024

  80. [82]

    A machine learning-based approach to identify unlawful practices in online terms of service: analysis, implementation and eval- uation,

    A. Guarino, N. Lettieri, D. Malandrino, and R. Zaccagnino, “A machine learning-based approach to identify unlawful practices in online terms of service: analysis, implementation and eval- uation,” Neural Computing and Applications , vol. 33, pp. 17 569– 17 587, 2021

    2021

Showing first 80 references.

This paper was first reviewed by deepseek-v4-flash on August 5, 2026.