Pith. sign in

REVIEW 4 major objections 5 minor 51 references

Do Explanations Increase the Risk of Decision Logic Leakage? Explanation-Guided Stealing of Graph Models

T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Explanation outputs from explainable GNN APIs materially increase model-stealing risk, and EGSteal exploits that leak.

desk verdict First explanation-guided stealing attack for GNNs with broad, consistent experiments, but the headline 'decision logic' claim rests on a metric that is also the training objective and on an unvalidated style-invariance assumption. read the letter →

arxiv 2506.03087 v2 pith:5SFC3ZNV submitted 2025-06-03 cs.LG cs.AI

Bin Ma , Yuyuan Feng , Minhua Lin , Enyan Dai This is my paper
classification cs.LGcs.AI
keywords modelstealinggraphneuralnetworksexplainableGNNexplanation-guidedattackdataaugmentationcausalinvariancedecisionlogicleakagesecurity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper asks whether explanation outputs from explainable GNN APIs make those models easier to steal, and answers yes. It proposes EGSteal, an attack that trains a surrogate GNN to match the target's predictions and its node-importance rankings, so the clone inherits the target's decision logic, not just its outputs. Because explanations let the attacker tell causal from stylistic structure, the surrogate can generate new training graphs by perturbing low-importance nodes and labeling them for free, which stretches a small query budget. If the paper is right, any organization serving GNN predictions with explanations should treat those explanations as sensitive, not as harmless transparency artifacts.

What carries the argument

The argument is carried by a structural causal model that decomposes each input graph $G$ into an explanation subgraph $G_E$ and a style subgraph $G_S$, with only $G_E$ causally affecting the prediction $Y$; the target model's explanation scores identify $G_E$ as the high-importance nodes. From this decomposition the paper derives a style-invariance condition, $p_{do(G_S=G_S^i)}(Y|G_E;\theta')=p(Y|G_E;\theta)$, which says the surrogate can be trained on intervened graphs labeled with the original answer without extra queries. Two mechanisms implement the condition: a rank-based explanation alignment loss that matches the surrogate's node-importance ordering to the target's using pairwise sigmoid cross-entropy, and explanation-guided data augmentation that drops or rewires low-importance nodes to multiply the training set. The surrogate produces its own explanations by Class Activation Mapping, so the alignment loss is differentiable and backpropagates into the surrogate's parameters.

What would settle it

Delete the lowest-ranked 20% of nodes from each graph in a held-out set, query the target model, and count how often its prediction changes; the free-augmentation step is mislabeling the training set if a substantial share of predictions change.

Watch

Extended reading notes

Core claim

The paper claims that explanations are a model-stealing channel for GNNs, not just a transparency tool. Using EGSteal, a surrogate trained on queried predictions and explanation rankings reproduces both the predictive behavior and the decision logic of the target, with explanation rank correlation far above prior stealing baselines (42.38% versus 18.62% on NCI1 at a 30% query budget). The causal reading is that explanations reveal the causal subgraph; once the surrogate aligns its own explanations to that subgraph, style invariance lets the attacker generate additional training samples by intervening on the remaining nodes without paying for more queries. The empirical claim is that this combination beats recent GNN-stealing baselines and remains effective under reduced query budgets, distribution shift, noisy or binary explanations, different target architectures, and five explanation mechanisms.

Load-bearing premise

The target model's explanation output correctly separates causal from non-causal nodes, so deleting or perturbing low-importance nodes leaves the target's prediction unchanged.

Editorial extensions

If this is right

  • An explainable graph model deployed behind a prediction-and-explanation API can be stolen with substantially lower query budgets than prediction-only attacks.
  • The surrogate trained by EGSteal matches the target's explanation rankings, not just its labels, so the attacker gains a model with similar reasoning patterns, not only similar outputs.
  • The attack remains effective across target architectures, explanation methods, and simplified binary or noisy explanations, which broadens its practical reach.
  • Explanation outputs should be treated as sensitive alongside predictions when defending deployed GNNs.
  • Adding noise to released explanations degrades but does not eliminate the attack, with explanation-rank correlation the most affected metric.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: the same style-invariance test could be inverted into a defense audit, measuring how often a target's prediction changes when low-importance nodes are deleted; honest explanations should show few changes.
  • Editorial inference: the rank-alignment objective suggests that explanation APIs could release deliberately coarsened or shuffled importance rankings to reduce logic leakage while preserving useful qualitative explanations.
  • Editorial inference: the framework's reliance on Class Activation Mapping for the surrogate predicts that architectures lacking a natural CAM analog will be harder to align, so surrogate-model choice may matter more than target-model choice in practice.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper studies whether the explanations returned by explainable GNN APIs can be exploited for model stealing. It proposes EGSteal, which trains a surrogate GNN with a rank-based explanation alignment loss (Eqs. 7 and 10) and augments the training set by intervening on nodes that the target explanation ranks as unimportant (Eqs. 8 and 9), using the original label as the pseudo-label for augmented samples. Experiments on seven molecular datasets and two node-classification datasets, with multiple architectures and explainers, report improvements over teacher-student and GNN-stealing baselines in AUC, prediction fidelity, and explanation rank correlation.

Significance. The question is timely and practically important: if explanation APIs materially increase model-stealing risk, deployers must weigh transparency against security. The paper's strengths are the breadth of its empirical evaluation (multiple datasets, architectures, explainers, query budgets, and distribution shifts), the clear ablation study that attributes gains to the two proposed components, and the release of code. However, the principal evidence for 'decision logic' capture is a rank-correlation metric that is essentially the same objective being optimized, and the augmentation relies on an unvalidated causal assumption about style subgraphs. The paper's contribution would be significant if these gaps are closed with an independent evaluation and a prediction-preservation check.

major comments (4)
  1. [§5.2.1, Eq. (10) and Eq. (19)] The metric used to support the claim that EGSteal 'captures the target model's decision logic' is Kendall's tau between the target and surrogate explanation vectors (Eq. 19). This is the same signal that the rank-based explanation alignment loss in Eq. (10) optimizes (through the pairwise RankNet loss in Eq. 7). The evaluation is therefore circular: a high score on this metric is expected simply because the training objective directly minimizes a pairwise ranking loss on the same explanation vectors. The paper should validate decision-logic transfer with an independent test, e.g., agreement on counterfactual or intervened inputs, performance on a downstream task that requires true causal structure, or comparison against a surrogate trained with the same augmentation but without the alignment loss (which the current ablation does not isolate). Without such a test, the 'logic stealing' interpretation in Section 5.2.1 and the Conclusion is unsupported.
  2. [§4.2.2, Eq. (9) and Algorithm 1] The augmentation procedure assumes that nodes ranked below alpha in the target explanation are non-causal 'style' nodes whose removal or perturbation leaves the target prediction unchanged, so that the pseudo-label y_q can be assigned to the augmented graph G~ (Eq. 9). This is a load-bearing assumption that is never validated. Section 5.3.3 tests robustness to injected noise in the explanation outputs, but it does not measure whether the target's own prediction on an augmented graph agrees with the pseudo-label. The paper should report a prediction-preservation rate, i.e., the fraction of augmented graphs for which f_theta(G~) == f_theta(G) under the node-dropping and edge-perturbation strategies. If this rate is substantially below 1 for message-passing GNNs (where low-importance nodes can affect representations through aggregation), the augmented training set is partially mislabeled, and the reported gains may reflect regularization from additional (mislabeled) samples rather than transferred decision logic.
  3. [§4.2.2, Eq. (8)] The definition of the style node set is contradictory. The text states that V_S contains nodes with low importance, and Eq. (8) sets V_S = {v_i | rank(E_i) <= alpha·|V|}, with alpha described as the 'proportion of important nodes.' If rank 1 corresponds to the highest importance (the usual convention), this inequality selects the most important nodes, not the least important ones; if the ranking is reversed, the description of alpha is wrong. Moreover, the paper never states the default values of alpha, beta, and rho, and Section 5.6 varies only the augmentation ratio r and the alignment coefficient lambda. Since these hyperparameters control which nodes are intervened on and how aggressively, their effect on the reported improvements must be documented. Please correct the inequality or the text, define the ranking order, and provide a sensitivity analysis for alpha, beta, and rho.
  4. [§5.2.2, Table 2; Conclusion] The conclusion that EGSteal 'consistently outperforms existing approaches' and replicates 'both predictive behavior and underlying decision logic' is overstated. In Table 2, the fidelity of EGSteal on HIV is 95.54%, lower than MEA-GNN (97.34%), GNNStealing (97.56%), EfficientGNN (97.19%), DET (97.55%), and STEALGNN (97.54%); on Tox21, fidelity (88.53%) is below DET (89.26%) and STEALGNN (89.39%). Since fidelity measures agreement with the target's hard predictions, the surrogate does not consistently match the target's predictive behavior. The paper should either restrict the claim to AUC and rank-correlation improvements, or explain why lower fidelity is acceptable for a model-stealing attack in these settings.
minor comments (5)
  1. [§3.2] In the cross-distribution setting description, 'not from the sample distribution' should read 'not from the same distribution.'
  2. [§5.6 vs. §4.2.2] Section 5.6 uses r for the augmentation ratio, while Algorithm 1 and Section 4.2.2 use rho for the augmentation probability; please unify the notation.
  3. [Appendix A.2] The claim 'we are the first to investigate the susceptibility of GNNs to model extraction attacks caused by model explanations' is too strong given existing works on explanation-based extraction (e.g., [20, 39]) that are not GNN-specific but may apply; please qualify the novelty statement.
  4. [Section 1, Contributions] In the third bullet, 'can effectively performs' should be 'can effectively perform.'
  5. [§4.2.2, Eq. (9)] The notation E_q[G~_q] is not defined; clarify that it denotes the explanation vector restricted to the nodes that remain after the intervention.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the paper's attack framework is an empirical method evaluated on independent predictive metrics, and the flagged assumptions are validation concerns, not input–output equivalences.

full rationale

The paper does not contain a load-bearing circular step. The closest candidate is the relation between the rank-based explanation alignment loss (Eqs. 6-7, 10) and the evaluation metric 'Rank Correlation' (Eq. 19): both measure agreement between target and surrogate node-importance rankings. Optimizing the former on queried graphs and reporting the latter on held-out test graphs is a standard training/evaluation design, not a case where the prediction is statistically forced or identical to the fitted input by construction. The paper's stronger attack claims are additionally supported by independent AUC and prediction-fidelity gains over prediction-only baselines, which are not defined in terms of explanation alignment. The style-invariance property in Eq. (3) is an assumption encoded in the proposed SCM, not a derived result; Eq. (9) inherits it when assigning pseudo-labels to augmented graphs. Lack of direct validation of prediction preservation under style interventions is a legitimate correctness/robustness concern, but it is not circularity because the augmented labels are not constructed from the quantity being predicted. The causal framing cites prior causal-invariance work [4, 29, 36] as background and does not import a self-cited uniqueness theorem or ansatz. Author self-citations [6, 7] appear only as related work on explainable GNNs and are not load-bearing. No equation reduces another equation to its own input, and no fitted parameter is renamed as a prediction. Accordingly, the derivation chain is self-contained as an empirical attack study.

Assumptions & free parameters 5 free parameters · 4 assumptions · 1 invented entities

The method rests on a small number of hand-chosen hyperparameters (alpha, beta, rho, lambda, K) and on the assumption that explanations separate causal from non-causal structure. The style subgraph is a latent construct without independent evidence. These are the main costs the paper pulls from assumption rather than from data or prior proven results.

free parameters (5)
  • alpha (style-node selection threshold)
    Used in Eq. (8) to decide which nodes are treated as non-causal style nodes; no default value is reported in the main text.
  • beta (style node drop fraction)
    Controls how many nodes are randomly removed in style graph node dropping; the value used in experiments is not stated.
  • rho (augmentation probability)
    Per-sample probability of generating augmented graphs in Algorithm 1; default is not reported in the main text.
  • lambda (alignment loss coefficient)
    Balances prediction loss and explanation alignment loss in Eq. (10); sensitivity is analyzed from 0.01 to 100 in Section 5.6, but the default used in main tables is not stated.
  • K (augmentation factor) = 1
    Default number of augmented variants per queried graph, set to 1 in Section 4.2.4.
assumptions (4)
  • domain assumption Structural causal model: graph is composed of a causal explanation subgraph G_E and a non-causal style subgraph G_S, with G_S having no causal effect on prediction Y.
    Introduced in Section 4.1 and Figure 2. This is the premise on which style invariance and explanation-guided augmentation rest; it is not empirically established for the target models.
  • domain assumption Style invariance: p_do(G_S=G_S^i)(Y|G_E;theta) = p(Y|G_E;theta), so labels of style-intervened graphs are identical to the original label.
    Equation (3) in Section 4.1. Used to label all augmented samples in Eq. (9) with the original label; if false, augmentation injects label noise.
  • ad hoc to paper Target explanations identify the causal subgraph well enough that low-importance nodes can be safely intervened on.
    Equation (8) uses target explanation scores to select V_S. The paper does not validate this separation against ground-truth causal substructures.
  • domain assumption CAM explanations faithfully reflect the surrogate model's decision logic and support gradient-based optimization.
    Section 4.2.1 adopts CAM for the surrogate and calls it faithful; the paper does not compare whether other explainers give different alignment behavior.
invented entities (1)
  • Style subgraph G_S
    purpose: Latent non-causal graph component used in the SCM to justify that interventions on low-importance nodes do not change predictions and labels can be reused.
    The paper provides no direct measurement or falsifiable handle for G_S; it is inferred from explanation scores, which are themselves imperfect.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Do Explanations Increase the Risk of Decision Logic Leakage? Explanation-Guided Stealing of Graph Models." pith.science (2026). https://pith.science/paper/5SFC3ZNV

@misc{pith2026250603087,
  author       = {Pith},
  title        = {Pith review of: Do Explanations Increase the Risk of Decision Logic Leakage? Explanation-Guided Stealing of Graph Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/5SFC3ZNV}},
  note         = {Machine review of arXiv:2506.03087}
}
read the original abstract

Graph Neural Networks (GNNs) have become essential tools for analyzing graph-structured data in domains such as drug discovery and financial analysis, leading to a growing demand for model transparency. Recent advances in explainable GNNs have addressed this need by revealing important subgraphs that influence predictions, but these explanation mechanisms may inadvertently expose these models to security risks. This paper investigates how such explanations potentially leak critical decision logic that can be exploited for model stealing. We propose {\method}, a novel stealing framework that integrates explanation alignment for capturing decision logic with guided data augmentation for efficient training under limited queries, enabling effective replication of both the predictive behavior and underlying reasoning patterns of target models. Experiments on molecular graph datasets demonstrate that our approach shows advantages over conventional methods in model stealing. This work highlights important security considerations for the deployment of explainable GNNs in sensitive domains and suggests the need for protective measures against explanation-based attacks. Our code is available at https://github.com/beanmah/EGSteal.

Figures

Figures reproduced from arXiv: 2506.03087 by the authors.

Figure 1
Figure 1. Explainable GNNs and the potential leakage of [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. SCM of explainable graph prediction. (2) G𝐸 → 𝑌: The explanation subgraph G𝐸 consists of critical decision-related structures, which determine the prediction 𝑌, while the style subgraph G𝑆 has no causal effect on 𝑌. Following the principle of Independence of Mechanisms, inter￾ventions on the style variable G𝑆 should not change the conditional distribution 𝑝(𝑌 |G𝐸). Formally, for the target model, the following invar… view at source ↗
Figure 3
Figure 3. Overview framework of our EGSteal. network. The necessity of aligning explanations is further justified by the causal analysis presented in Sec. 4.1. Therefore, we propose an explanation alignment module detailed below. Explanation Mechanism for Surrogate Model. To enable ex￾planation alignment, both target and surrogate models must have interpretable explanation mechanisms. While various explanation methods, such a… view at source ↗
Figures from the paper (12 more)
Figure 4
Figure 4. Figure 4: Robustness analysis under different practical scenarios. (a) Impact of query budget on extraction performance on [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: Performance improvements over teacher-student [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: Model Stealing Results on Binary Explanations. [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 8
Figure 8. Figure 8: Sensitivity analysis of data augmentation ratio [PITH_FULL_IMAGE:figures/full_fig_p008_8.png]
Figure 9
Figure 9. Figure 9: Impact of query budget on extraction performance across datasets. The x-axis shows the percentage of target model’s [PITH_FULL_IMAGE:figures/full_fig_p015_9.png]
Figure 10
Figure 10. Figure 10: Model extraction performance with different shadow datasets. The target model is trained on NCI109, while shadow [PITH_FULL_IMAGE:figures/full_fig_p015_10.png]
Figure 11
Figure 11. Figure 11: Performance under different explanation noise levels across three metrics. Each plot shows our method’s performance [PITH_FULL_IMAGE:figures/full_fig_p016_11.png]
Figure 12
Figure 12. Figure 12: Performance comparison with binary explanation format across datasets. Each subplot shows the performance of TS [PITH_FULL_IMAGE:figures/full_fig_p016_12.png]
Figure 13
Figure 13. Figure 13: Performance improvements over teacher-student baseline with different model architectures on NCI109. [PITH_FULL_IMAGE:figures/full_fig_p017_13.png]
Figure 14
Figure 14. Figure 14: Ablation study results across four datasets showing the impact of removing data augmentation and explanation [PITH_FULL_IMAGE:figures/full_fig_p018_14.png]
Figure 15
Figure 15. Figure 15: Sensitivity analysis of data augmentation ratio [PITH_FULL_IMAGE:figures/full_fig_p018_15.png]
Figure 16
Figure 16. Figure 16: Visualization of molecular substructures identified as important by target and surrogate models. Blue highlights [PITH_FULL_IMAGE:figures/full_fig_p019_16.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

51 extracted references · 29 canonical work pages

  1. [1]

    Ulrich Aïvodji, Alexandre Bolot, and Sébastien Gambs. 2020. Model extraction from counterfactual explanations.arXiv preprint arXiv:2009.01884(2020)

    arXiv 2020

  2. [2]

    Federico Baldassarre and Hossein Azizpour. 2019. Explainability Techniques for Graph Convolutional Networks. InInternational Conference on Machine Learn- ing (ICML) Workshops, 2019 Workshop on Learning and Reasoning with Graph- Structured Representations

    work page 2019

  3. [3]

    Chris Burges, Tal Shaked, Erin Renshaw, Ari Lazier, Matt Deeds, Nicole Hamilton, and Greg Hullender. 2005. Learning to rank using gradient descent. InProceedings of the 22nd international conference on Machine learning. 89–96

    2005

  4. [4]

    Yongqiang Chen, Yonggang Zhang, Yatao Bian, Han Yang, MA Kaili, Binghui Xie, Tongliang Liu, Bo Han, and James Cheng. 2022. Learning causally invariant representations for out-of-distribution generalization on graphs.Advances in Neural Information Processing Systems35 (2022), 22131–22148

    work page 2022

  5. [5]

    Ziheng Chen, Fabrizio Silvestri, Jia Wang, Yongfeng Zhang, Zhenhua Huang, Hongshik Ahn, and Gabriele Tolomei. 2022. Grease: Generate factual and counterfactual explanations for gnn-based recommendations.arXiv preprint arXiv:2208.04222(2022)

    arXiv 2022

  6. [6]

    Enyan Dai and Suhang Wang. 2021. Towards self-explainable graph neural network. InProceedings of the 30th ACM international conference on information & knowledge management. 302–311

    work page 2021

  7. [7]

    Enyan Dai and Suhang Wang. 2025. Towards prototype-based self-explainable graph neural network.ACM Transactions on Knowledge Discovery from Data19, 2 (2025), 1–20

    work page 2025

  8. [8]

    Enyan Dai, Tianxiang Zhao, Huaisheng Zhu, Junjie Xu, Zhimeng Guo, Hui Liu, Jiliang Tang, and Suhang Wang. 2024. A comprehensive survey on trustworthy graph neural networks: Privacy, robustness, fairness, and explainability.Machine Intelligence Research21, 6 (2024), 1011–1061

    work page 2024

Show all 51 references
  1. [9]

    Faqian Guan, Tianqing Zhu, Hanjin Tong, and Wanlei Zhou. 2024. A realistic model extraction attack against graph neural networks.Knowledge-Based Systems 300 (2024), 112144

    2024

  2. [10]

    Will Hamilton, Zhitao Ying, and Jure Leskovec. 2017. Inductive representation learning on large graphs.Advances in neural information processing systems30 (2017)

    2017

  3. [11]

    Maximilian Harl, Sven Weinzierl, Mathias Stierle, and Martin Matzner. 2020. Explainable predictive business process monitoring using gated graph neural networks.Journal of Decision Systems29, sup1 (2020), 312–327

    2020

  4. [12]

    Weihua Hu, Bowen Liu, Joseph Gomes, Marinka Zitnik, Percy Liang, Vijay Pande, and Jure Leskovec. 2019. Strategies for Pre-training Graph Neural Networks. In International Conference on Learning Representations

    2019

  5. [13]

    Qiang Huang, Makoto Yamada, Yuan Tian, Dinesh Singh, and Yi Chang. 2022. Graphlime: Local interpretable model explanations for graph neural networks. IEEE Transactions on Knowledge and Data Engineering35, 7 (2022), 6968–6972

    2022

  6. [14]

    Jeremy Kawahara, Colin J Brown, Steven P Miller, Brian G Booth, Vann Chau, Ruth E Grunau, Jill G Zwicker, and Ghassan Hamarneh. 2017. BrainNetCNN: Convolutional neural networks for brain networks; towards predicting neurode- velopment.NeuroImage146 (2017), 1038–1049

    2017

  7. [15]

    Thomas N Kipf and Max Welling. 2017. Semi-Supervised Classification with Graph Convolutional Networks. InInternational Conference on Learning Repre- sentations

    2017

  8. [16]

    Xiaoxiao Li, Yuan Zhou, Nicha Dvornek, Muhan Zhang, Siyuan Gao, Juntang Zhuang, Dustin Scheinost, Lawrence H Staib, Pamela Ventola, and James S Dun- can. 2021. Braingnn: Interpretable brain graph neural network for fmri analysis. Medical Image Analysis74 (2021), 102233

    2021

  9. [17]

    Dongsheng Luo, Wei Cheng, Dongkuan Xu, Wenchao Yu, Bo Zong, Haifeng Chen, and Xiang Zhang. 2020. Parameterized explainer for graph neural network. Advances in neural information processing systems33 (2020), 19620–19631

    2020

  10. [18]

    Le Lv, Jianbo Cheng, Nanbo Peng, Min Fan, Dongbin Zhao, and Jianhong Zhang

  11. [19]

    Smitha Milli, Ludwig Schmidt, Anca D Dragan, and Moritz Hardt. 2019. Model reconstruction from model explanations. InProceedings of the Conference on Fairness, Accountability, and Transparency. 1–9

    2019

  12. [20]

    Takayuki Miura, Toshiki Shibahara, and Naoto Yanai. 2024. Megex: Data-free model extraction attack against gradient-based explainable ai. InProceedings of the 2nd ACM Workshop on Secure and Trustworthy Deep Learning Systems. 56–66

    2024

  13. [21]

    Kriege, Franka Bause, Kristian Kersting, Petra Mutzel, and Marion Neumann

    Christopher Morris, Nils M. Kriege, Franka Bause, Kristian Kersting, Petra Mutzel, and Marion Neumann. 2020. TUDataset: A collection of benchmark datasets for learning with graphs. InICML 2020 Workshop on Graph Representation Learning and Beyond (GRL+ 2020). arXiv:2007.08663 w...

    2020 arXiv

  14. [22]

    2009.Causality

    Judea Pearl. 2009.Causality. Cambridge university press

    2009

  15. [23]

    Marcin Podhajski, Jan Dubiński, Franziska Boenisch, Adam Dziedzic, Agnieszka Pregowska, and Tomasz P Michalak. 2024. Efficient model-stealing attacks against inductive graph neural networks. InECAI 2024. IOS Press, 1438–1445

    2024

  16. [24]

    Phillip E Pope, Soheil Kolouri, Mohammad Rostami, Charles E Martin, and Heiko Hoffmann. 2019. Explainability methods for graph convolutional neural net- works. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition. 10772–10781

    2019

  17. [25]

    Ladislav Rampášek, Michael Galkin, Vijay Prakash Dwivedi, Anh Tuan Luu, Guy Wolf, and Dominique Beaini. 2022. Recipe for a general, powerful, scalable graph transformer.Advances in Neural Information Processing Systems35 (2022), 14501–14515

    2022

  18. [26]

    Michael Sejr Schlichtkrull, Nicola De Cao, and Ivan Titov. 2020. Interpreting graph neural networks for NLP with differentiable edge masking.arXiv preprint arXiv:2010.00577(2020)

    2020 arXiv

  19. [27]

    Ramprasaath R Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedan- tam, Devi Parikh, and Dhruv Batra. 2017. Grad-cam: Visual explanations from deep networks via gradient-based localization. InProceedings of the IEEE interna- tional conference on computer vision. 618–626

    2017

  20. [28]

    Yun Shen, Xinlei He, Yufei Han, and Yang Zhang. 2022. Model stealing attacks against inductive graph neural networks. In2022 IEEE Symposium on Security and Privacy (SP). IEEE, 1175–1192

    2022

  21. [29]

    Yongduo Sui, Xiang Wang, Jiancan Wu, Min Lin, Xiangnan He, and Tat-Seng Chua

  22. [30]

    Mengying Sun, Sendong Zhao, Coryandar Gilvary, Olivier Elemento, Jiayu Zhou, and Fei Wang. 2020. Graph convolutional networks for computational drug development and discovery.Briefings in bioinformatics21, 3 (2020), 919–935

    2020

  23. [31]

    Florian Tramèr, Fan Zhang, Ari Juels, Michael K Reiter, and Thomas Ristenpart

  24. [32]

    Petar Veličković, Guillem Cucurull, Arantxa Casanova, Adriana Romero, Pietro Liò, and Yoshua Bengio. 2018. Graph Attention Networks. InInternational Con- ference on Learning Representations

    2018

  25. [33]

    JIANIAN WANG, SHENG ZHANG, YANGHUA XIAO, and RUI SONG. 2022. A Review on Graph Neural Network Methods in Financial Applications.Journal of Data Science20, 2 (2022)

    2022

  26. [34]

    Bang Wu, Xiangwen Yang, Shirui Pan, and Xingliang Yuan. 2022. Model extraction attacks on graph neural networks: Taxonomy and realisation. InProceedings of the 2022 ACM on Asia conference on computer and communications security. 337–350

    2022

  27. [35]

    Shiwen Wu, Fei Sun, Wentao Zhang, Xu Xie, and Bin Cui. 2022. Graph neural networks in recommender systems: a survey.Comput. Surveys55, 5 (2022), 1–37

    2022

  28. [36]

    Ying-Xin Wu, Xiang Wang, An Zhang, Xiangnan He, and Tat-Seng Chua. 2022. Discovering invariant rationales for graph neural networks.arXiv preprint arXiv:2201.12872(2022). KDD 2026, August 9–13, 2026, Jeju Island, Republic of Korea. Bin Ma, Yuyuan Feng, Minhua Lin, and Enyan Dai

    2022 arXiv

  29. [37]

    Jiacheng Xiong, Zhaoping Xiong, Kaixian Chen, Hualiang Jiang, and Mingyue Zheng. 2021. Graph neural networks for automated de novo drug design.Drug discovery today26, 6 (2021), 1382–1393

    2021

  30. [38]

    Keyulu Xu, Weihua Hu, Jure Leskovec, and Stefanie Jegelka. 2018. How powerful are graph neural networks?arXiv preprint arXiv:1810.00826(2018)

    2018 arXiv

  31. [39]

    Anli Yan, Ruitao Hou, Hongyang Yan, and Xiaozhang Liu. 2023. Explanation- based data-free model extraction attacks.World Wide Web26, 5 (2023), 3081–3092

    2023

  32. [40]

    Anli Yan, Teng Huang, Lishan Ke, Xiaozhang Liu, Qi Chen, and Changyu Dong

  33. [41]

    Zhitao Ying, Dylan Bourgeois, Jiaxuan You, Marinka Zitnik, and Jure Leskovec

  34. [42]

    Hao Yuan, Haiyang Yu, Shurui Gui, and Shuiwang Ji. 2022. Explainability in graph neural networks: A taxonomic survey.IEEE transactions on pattern analysis and machine intelligence45, 5 (2022), 5782–5799

    2022

  35. [43]

    Hao Yuan, Haiyang Yu, Jie Wang, Kang Li, and Shuiwang Ji. 2021. On explain- ability of graph neural networks via subgraph explorations. InInternational conference on machine learning. PMLR, 12241–12252

    2021

  36. [44]

    Bolei Zhou, Aditya Khosla, Agata Lapedriza, Aude Oliva, and Antonio Torralba

  37. [45]

    wo Align

    Yuanxin Zhuang, Chuan Shi, Mengmei Zhang, Jinghui Chen, Lingjuan Lyu, Pan Zhou, and Lichao Sun. 2024. Unveiling the Secrets without Data: Can Graph Neural Networks Be Exploited through Data-Free Model Extraction Attacks?. In 33rd USENIX Security Symposium (USENIX Security 24)....

    2024

  38. [46]

    Gnnexplainer: Generating explanations for graph neural networks.Ad- vances in neural information processing systems32 (2019)

    2019

  39. [50]

    InProceedings of the IEEE conference on computer vision and pattern recognition

    Learning deep features for discriminative localization. InProceedings of the IEEE conference on computer vision and pattern recognition. 2921–2929

  40. [2016]

    In25th USENIX security symposium (USENIX Security 16)

    Stealing machine learning models via prediction APIs. In25th USENIX security symposium (USENIX Security 16). 601–618

  41. [2019]

    In2019 IEEE Conference on Computational Intelligence for Financial Engineering & Economics (CIFEr)

    Auto-encoder based graph convolutional networks for online financial anti-fraud. In2019 IEEE Conference on Computational Intelligence for Financial Engineering & Economics (CIFEr). IEEE, 1–6

  42. [2022]

    In Proceedings of the 28th ACM SIGKDD conference on knowledge discovery and data mining

    Causal attention for interpretable and generalizable graph classification. In Proceedings of the 28th ACM SIGKDD conference on knowledge discovery and data mining. 1696–1705

  43. [2023]

    Explanation leaks: Explanation-guided model extraction attacks.Informa- tion Sciences632 (2023), 269–284

    2023

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.