Pith. sign in

REVIEW 5 major objections 5 minor 51 references

Defending against Model Extraction for GNNs with Model Reprogramming

T0 review · 5 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A GNN served through an API can be defended against model extraction by gating a learnable reprogramming perturbation on the query's graph topology, activating it only for out-of-distribution queries.

desk verdict A coherent OOD-gated reprogramming defense for GNN extraction that deserves peer review, but the central distributional assumption is stronger than the paper admits and the adaptive-attack results are confusing. read the letter →

arxiv 2608.11495 v1 pith:FAKZYQRI submitted 2026-08-11 cs.LG cs.CRcs.IR

Yan Wen , Zhenyi Wang , Heng Huang This is my paper · ORCID
classification cs.LGcs.CRcs.IR
keywords modelextractiongraphneuralnetworksreprogrammingstructure-awaregatingFisherinformationout-of-distributiondetectionMLaaSadversarialdefense
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that a graph neural network deployed behind an API can be actively defended against model-extraction attacks by reprogramming its own hidden layers: the defender learns a bounded perturbation per layer, and a structure-aware gate switches that perturbation on only when a query looks structurally foreign to the private training distribution. The payoff, if the claim holds, is that an attacker who clones the oracle by querying it learns a surrogate whose decision boundary is pushed far from the benign one, without retraining the victim model and without the utility collapse that random image-style noise causes on graphs. The central quantity is a gating factor $\alpha(G)$ that compares the query graph's spectral and topological signature with learned benign prototypes: $\alpha\approx 0$ for benign queries and $\alpha\approx 1$ for adversarial ones, while the perturbation's effect on the attacker's estimation error is governed by the Fisher information of the victim GNN along the perturbation direction. The paper reports that on MUTAG under soft-label attack, GraphRP lowers clone accuracy from 76.5% to 60.3% while keeping benign utility loss below 2%.

What carries the argument

The load-bearing mechanism is model reprogramming with structure-aware gating. At each GNN layer $l$, a bounded perturbation $\tilde{\delta}^{(l)}=\lambda\cdot\mathrm{Tanh}(\delta^{(l)})$ is added to the node embeddings, and the whole perturbation is scaled by a gate $\alpha(G)=\mathrm{Sigmoid}\big(\gamma\,(\min_k\|\Phi(G)-c_k\|_2^2-\tau)\big)$, where $\Phi(G)$ is a permutation-invariant structural embedding built from Laplacian eigenvalues, degree statistics, and clustering coefficients, and $\{c_k\}$ are prototypes learned only on private in-distribution data. Because $\alpha\approx 0$ for benign graphs and $\alpha\approx 1$ for OOD graphs, the perturbation acts as a 'structural firewall' that is dormant for legitimate users and active for attackers. In the proof, the Fisher information matrix $I_h(G)$ supplies the curvature that converts the gate-scaled perturbation into a lower bound on the attacker's estimation error; the training objective alternates between minimizing cross-entropy on benign data, maximizing KL divergence on an auxiliary OOD set, and tightening the prototypes around benign structures.

What would settle it

A decisive check is to build an adaptive generator that explicitly optimizes generated graphs to match the defender's benign structural statistics (Laplacian spectrum, degree moments, clustering coefficients), then measure the gate values it receives; if the average $\alpha(G)$ stays below roughly 0.1 and the clone's accuracy approaches the undefended level, the structural-firewall premise fails. The paper's own adaptive-attack tables provide a first place to look: clone accuracy under a known-architecture adaptive attacker should stay close to the standard-attack value, not rise toward the undefended baseline.

Watch

Extended reading notes

Core claim

On its own terms, the paper's discovery is that model extraction from a GNN can be countered by turning the victim into a conditional oracle: queries on the private in-distribution manifold receive normal predictions, while out-of-distribution queries receive outputs deliberately distorted along high-curvature directions, so that an optimal attacker who perfectly mimics the observed responses learns a clone that is provably far from the victim on benign tasks. Concretely, the paper proves that under bounded loss, an optimal attacker, and a local second-order approximation, the clone's performance gap on benign data is at least $\frac{1}{2}\alpha(G)^2\,\tilde{\delta}^\top I_h(G)\,\tilde{\delta} - 2M\,\mathrm{TV}(G_{\mathrm{id}},G_{\mathrm{ood}})$, where $\alpha(G)$ is the gating factor, $\tilde{\delta}$ the bounded reprogramming perturbation, and $I_h(G)$ the Fisher information matrix of the victim's output with respect to the hidden representation. Empirically, the paper reports that this defense yields the lowest clone accuracy across five benchmarks and three clone architectures, weakens adaptive gray-box attackers that try to imitate benign topology, saturates the attacker's learning as the query budget grows, and degrades even a Graph Transformer surrogate while keeping target utility nearly intact.

Load-bearing premise

The whole defense depends on the premise that attack queries are out-of-distribution relative to the private training manifold: if an attacker can query with in-distribution-like graphs, the gating factor stays near zero, the reprogramming noise stays dormant, and the lower bound no longer guarantees any protection.

Editorial extensions

If this is right

  • If the bound is right, a defender can quantify how much protection a given reprogramming perturbation provides by measuring $\alpha(G)^2\,\tilde{\delta}^\top I_h(G)\,\tilde{\delta}$ over the anticipated query distribution, and can increase protection by steering $\tilde{\delta}$ toward high-curvature directions.
  • Because the gate suppresses the perturbation for in-distribution queries, the method preserves benign accuracy and keeps inference latency near the undefended model; the paper measures under 2% utility loss and about 7.9% added latency.
  • Since the defense is stateless and acts on every OOD query at inference time, it removes the exploitable early-stage window that reactive query-logging defenses have, and it applies to data-based and data-free extraction alike.
  • The reported saturation under growing query budgets implies that an attacker cannot simply average out the noise by spending more queries, because each OOD response is consistently reprogrammed rather than randomly perturbed.
  • The defense transfers across clone architectures even when the clone is more powerful than the victim; a Graph Transformer clone's accuracy is reported to drop from 82.4% to 64.1%.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper, the crux is that GraphRP converts model-extraction defense into an out-of-distribution-detection problem; whether spectral signatures are truly hard to spoof is assumed rather than proven, so the practical security margin hinges on how expensive it is for an adversary to reach the benign manifold in structural embedding space.
  • One testable extension would be to calibrate the gate by the Fisher-information term itself: instead of a single threshold $\tau$, make the perturbation magnitude proportional to $\alpha(G)^2\,I_h(G)$, so the defense spends its distortion budget where it provably hurts the attacker most.
  • The same gating-plus-reprogramming template could apply to node-level tasks by replacing graph-level prototypes with ego-graph prototypes, but the paper does not demonstrate that spectral fingerprints discriminate as cleanly at node granularity.
  • When the attacker's query distribution is close to the private distribution, the negative term $2M\,\mathrm{TV}(G_{\mathrm{id}},G_{\mathrm{ood}})$ can dominate the bound; a defender should measure this total-variation distance on the deployed domain before enabling GraphRP, because a small distribution shift can void the guarantee.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The manuscript proposes GraphRP, a proactive defense against model extraction attacks on graph neural networks. The method combines layer-wise learnable perturbations (repurposed from model reprogramming) with a structure-aware gate that computes a gating factor alpha from the distance of the input graph to learned benign structural prototypes based on spectral and topological features. For in-distribution queries the gate suppresses the perturbation, preserving benign utility; for out-of-distribution queries the gate activates the perturbation, which is trained to maximize the KL divergence between the original and reprogrammed outputs. The paper proves a lower bound (Theorem 5.1) on the loss disparity between an optimal clone and the victim in terms of a Fisher-information-weighted perturbation term minus a distribution-shift term. Experiments on MUTAG, ENZYMES, NCI1, PROTEINS, OGB-MolHIV, and COLLAB compare GraphRP against several baselines under soft-label and hard-label attacks, adaptive attacks, data leakage, and varying query budgets.

Significance. If the proposed defense works as claimed, it addresses a real and under-served problem: active, stateless, low-latency protection for GNN model extraction without retraining the victim. The structural-gating idea is a reasonable departure from image-based random perturbation defenses, and the evaluation covers a broad set of graph benchmarks and attack configurations. The theoretical result, however, is close to a restatement of the training objective rather than an independent guarantee, and several empirical claims lack statistical support. The central mechanism hinges on attack queries being out-of-distribution, which is not always the case for data-based model extraction. The paper should be revised to clarify the scope of its guarantee and to strengthen the adaptive-attack validation; the core direction is defensible but the current evidence is not conclusive.

major comments (5)
  1. [Theorem 5.1, Eq. (13) and Appendix A.2] The first term of the bound, E[1/2 alpha(G)^2 delta~^T I_h(G) delta~], is exactly the second-order Taylor expansion of the KL divergence that L_defense in Eq. (10) is trained to maximize. Combined with assumption (A2), which sets C* to perfectly mimic T_R on the query distribution, the theorem reduces to 'if the defense maximizes the KL divergence and the attacker perfectly copies the poisoned model, then the clone differs from the victim by that KL divergence.' This is true but does not provide information beyond the training loss. I recommend repositioning the theorem as an interpretation of the defense objective, or proving a bound that does not assume the attacker perfectly matches the reprogrammed model.
  2. [Sec. 3.1, Sec. 3.4, Eq. (7) and Theorem 5.1] The defense is only active when the gate alpha(G) is close to 1. For queries that are distributionally similar to the private training data, alpha stays near 0, the perturbation in Eq. (8) is dormant, and the positive first term in Eq. (13) vanishes. Section 2.1 explicitly includes Data-Based Model Extraction, where the attacker holds a dataset distributionally similar to the victim's training data, but the paper's threat model in Sec. 3.4 assumes attack queries are OOD. Table 4 only tests a 10% ID leak mixed into OOD queries, not a pure ID-like query regime. The paper should either test the full ID-like DBME regime or clearly state that the defense targets only OOD-query attacks.
  3. [Sec. 6.3 and Table A3] The adaptive GraphGAN attack is reported to produce lower clone accuracy than the standard attack (e.g., hard-label clone accuracy 0.522 vs. 0.603 for GraphSAGE in Table A3). This means the 'adaptive' attacker is less effective than the non-adaptive one, which is counterintuitive and suggests the attack is not actually optimizing against the defense. The claim that GraphRP remains robust to adaptive attackers is therefore not supported. Please report the adaptive attacker's training objective, the achieved alpha values on generated queries, and the KL distortion of returned outputs, or redesign the attack to directly minimize the gate or the defense's obfuscation effect.
  4. [Tables 1-5 and Figure 3] No error bars, confidence intervals, or significance tests are reported anywhere in the main experiments. Several comparisons are close, for instance Table 1 on ENZYMES with GIC clone: GraphRP 0.545 vs. MeCo 0.552, and NCI1 with GIUNET: 0.656 vs. 0.683. Without variance estimates across multiple seeds, the headline claim that GraphRP 'significantly outperforms' baselines is not statistically justified. Please report means and standard deviations over at least three runs and, where relevant, pairwise significance tests.
  5. [Sec. 4.3, 'Robustness against Structural Spoofing'] The assertion that spectral signatures are 'mathematically difficult to spoof' is made without proof. Since the gate alpha(G) is a smooth function of the structural embedding Phi(G), a black-box attacker with access to the defended API can in principle optimize queries to drive alpha toward 0 by minimizing the distortion of returned outputs or by estimating the gating decision boundary. The paper should either provide a formal statement with assumptions or an empirical evaluation of such a gate-evasion attack, rather than relying on an intuitive claim about inverse problems.
minor comments (5)
  1. [Eq. (10)] The hinge formulation max(0, mu - D_KL) means that minimizing L_defense drives D_KL to be at least mu, not arbitrarily large. The text says the optimization 'encourages a large KL divergence'; consider clarifying the margin interpretation.
  2. [Algorithm 1, Step 2 vs. Step 4] The pseudocode updates prototypes in Step 2 using L_struct, while Step 4 says prototypes are excluded from Theta_rep gradients. This is consistent but could be stated more explicitly to avoid confusion about when prototypes are updated relative to the reprogramming parameters.
  3. [Sec. 4.2 and Appendix B.1] The complexity statement in Sec. 4.2 mentions O(|E| + n^3) or 'approximated in linear time'; Appendix B.1 clarifies that top-k Laplacian eigenvalues are used. Please state in the main text that practical complexity is dominated by the top-k spectral computation using iterative methods.
  4. [Table 2] The reported l1 norm of output difference is exactly 1.0 for several baselines and 0.0 for the undefended model. Please specify what reference output the l1 difference is measured against, since the values suggest a uniform-output transformation for those baselines.
  5. [Figure 3 and Contributions] The caption says 'up to ~15%' while the contributions section says 'up to 17%'. Please reconcile these numbers for consistency.

Circularity Check

1 steps flagged · score 6.0 of 10

Theorem 5.1's positive lower-bound term is the same KL divergence that L_defense is trained to maximize; the theoretical guarantee is largely a restatement of the training objective, though the empirical evaluation is independent.

  1. fitted input called prediction [Section 5, Theorem 5.1 (Eq. 13); Section 4.4.1 (Eq. 10); Appendix A (Eq. 18)]
    "L_defense = E_{x∼D_ood}[max(0, μ − D_KL(T(x;θ_T) ∥ T(x;θ_T,Θ_rep)))] (Eq. 10); D_KL(T(G)∥T_R(G)) ≈ 1/2 α(G)^2 δ̃^⊤ I_h(G) δ̃ (App. Eq. 18); Q(C∗,T) ≥ E_{G∼G_ood}[1/2 α(G)^2 · δ̃^⊤ I_h(G) δ̃] − 2M·TV(G_id,G_ood) (Eq. 13)."

    The positive term in Eq. (13), called the 'Structural Sensitivity Term,' is identified by the paper's own Appendix A Taylor expansion as D_KL(T(G)∥T_R(G)) on OOD queries. But Eq. (10) defines the defense objective L_defense as a hinge loss in exactly this KL divergence, and Algorithm 1 trains Θ_rep = {δ, τ} to maximize it by minimizing max(0, μ − KL). The proof's optimal-attacker assumption (A2) makes C∗ ≈ T_R on G_ood, so L_ood(C∗) ≥ E[D_KL(T∥T_R)] follows immediately from the definition of cross-entropy and the optimality assumption; the Fisher step is just a second-order Taylor re-writing of the same KL.

full rationale

The paper's empirical evaluation (Tables 1–5, A1–A5) is conventional and independent: clone accuracy is measured against undefended and baseline defenses on public datasets, so those results are not circular. However, the central theoretical claim (Theorem 5.1) is close to a restatement of the training loss. The proof's key substitution (Appendix A, Eq. 18) expresses the KL divergence that L_defense (Eq. 10) maximizes as the quadratic Fisher term appearing verbatim in the bound (Eq. 13). Under the optimal-attacker assumption (A2), the bound's positive term is exactly the trained objective; the only non-loss component is the distribution-shift term −2M·TV(G_id,G_ood), which is not a function of the defense parameters and can be negative. Thus the bound does not convey security information beyond what the optimization already encodes. Separately, the best baseline MeCo [44] shares a co-author (Zhenyi Wang) with this paper, and the paper cites [44] for the OOD-attack assumption; this is self-referential but not load-bearing in the derivation, since the gating mechanism and loss are defined directly. The adaptive-attack robustness claim in Sec. 4.3 is asserted without proof, and Sec. 6.3's Table A3 shows the adaptive attacker sometimes yields lower clone accuracy than the standard attack, which undercuts the robustness narrative, but those are correctness concerns rather than circularity. Overall score 6: the main theoretical contribution reduces to the training objective by construction, while the experimental contribution stands independently.

Assumptions & free parameters 7 free parameters · 6 assumptions · 0 invented entities

The central claim rests on explicit assumptions: bounded loss and optimal attacker appear in the theorem; OOD query premise and spectral-spoofing difficulty are the fragile domain assumptions. All free parameters are method hyperparameters, most with unspecified values.

free parameters (7)
  • tau = initialized at 95th percentile of benign distances, then trained
    Distance threshold for gating; fitted to benign data so alpha flips at the benign boundary.
  • gamma = 10
    Sharpness of the sigmoid gate, chosen by hand (Appendix B.2); controls how abruptly OOD activates defense.
  • K = 5
    Number of benign structural prototypes, chosen by hand; affects how finely the benign manifold is covered.
  • lambda = not specified
    Scale of bounded perturbation in Eq. (4); bounds the Taylor regime but no value is reported.
  • mu = not specified
    Hinge margin in Eq. (10); value absent from main text and appendix.
  • beta_1 = not specified
    Loss weight for extraction defense in Eq. (12); value absent from main text and appendix.
  • beta_2 = not specified
    Loss weight for structural compactness in Eq. (12); value absent from main text and appendix.
assumptions (6)
  • standard math A1: loss is bounded by constant M
    Used in Lemma (14) to bound distribution-shift error; standard assumption in generalization bounds.
  • domain assumption A2: attacker is optimal, C* perfectly mimics T_R on G_ood
    Needed for Eq. (16); an idealized attacker, not guaranteed in practice.
  • domain assumption A3: KL admits local second-order Taylor expansion with Fisher Information
    Requires small effective perturbation and smooth output distribution; lambda bounds the perturbation but the Taylor remainder is not quantified.
  • domain assumption The victim T is well-trained, so L_id(T) is approximately 0
    Used in Step 1 of the proof (Appendix A) to replace Q with L_id(C*).
  • ad hoc to paper Attack queries are OOD and the defender has an auxiliary OOD dataset
    Stated in Sec. 3.4; without it the gating never activates and Theorem 5.1 loses its first term.
  • ad hoc to paper Spectral signatures are mathematically difficult to spoof
    In Sec. 4.3, cited to [49]; no proof is given, and it underpins the adaptive-attacker robustness claim.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Defending against Model Extraction for GNNs with Model Reprogramming." pith.science (2026). https://pith.science/paper/FAKZYQRI

@misc{pith2026260811495,
  author       = {Pith},
  title        = {Pith review of: Defending against Model Extraction for GNNs with Model Reprogramming},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/FAKZYQRI}},
  note         = {Machine review of arXiv:2608.11495}
}
read the original abstract

Graph Neural Networks (GNNs) serve as the backbone for high-stakes applications in Machine-Learning-as-a-Service (MLaaS). Still, their black-box deployment exposes them to Model Extraction (ME) attacks, in which adversaries steal intellectual property by querying APIs. Existing defenses suffer from a critical ''Euclidean bias'': they transfer image-based strategies (e.g., random noise) to graphs, ignoring the complex topological dependencies between nodes, which often results in severe utility degradation. Passive methods like watermarking also fail to prevent theft in real time. To bridge this gap, we propose GraphRP (Graph Reprogramming Protection), a proactive defense framework that repurposes Model Reprogramming for security. Unlike static perturbations, GraphRP introduces a Structure-Aware Gating Mechanism driven by learnable topological prototypes. This creates a dynamic ''structural firewall'' that selectively modulates the model's decision boundary: it preserves fidelity for benign queries residing on the training manifold, while maximizing the Fisher Information along the perturbation direction for adversarial queries. Under standard assumptions (bounded loss, optimal attacker, and local second-order approximation), we prove a lower bound on the attacker's estimation error that increases with the structural sensitivity of the reprogramming noise. Extensive experiments on both hard-label and soft-label ME attacks demonstrate that GraphRP significantly degrades attack effectiveness while preserving benign utility.

Figures

Figures reproduced from arXiv: 2608.11495 by the authors.

Figure 1
Figure 1. Overview of the Proposed Defense Framework. Comparison between a standard GNN pipeline and our approach. [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Architecture of the GraphRP Framework. The system operates via two coupled pathways. The [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Attack Success Rate comparison. Clone model ac [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Utility vs. Defense Trade-off on NCI1. The y-axis rep [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: Effect of Query Budget on Attack Success (NCI1). As [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]
Figure 6
Figure 6. Figure 6: Feature Importance Ablation (MUTAG). Removing [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

51 extracted references · 32 canonical work pages

  1. [1]

    Alireza Amouzad, Zahra Dehghanian, Saeed Saravani, Maryam Amirmazlaghani, and Behnam Roshanfekr. 2024. Graph isomorphism U-Net.Expert Systems with Applications236 (2024), 121280

    work page 2024

  2. [2]

    Karsten M Borgwardt, Cheng Soon Ong, Stefan Schönauer, SVN Vishwanathan, Alex J Smola, and Hans-Peter Kriegel. 2005. Protein function prediction via graph kernels.Bioinformatics21, suppl_1 (2005), i47–i56

    work page 2005

  3. [3]

    Pin-Yu Chen. 2024. Model reprogramming: Resource-efficient cross-domain machine learning. InProceedings of the AAAI Conference on Artificial Intelligence, Vol. 38. 22584–22591

    work page 2024

  4. [4]

    1997.Spectral graph theory

    Fan RK Chung. 1997.Spectral graph theory. Vol. 92. American Mathematical Soc

    1997

  5. [5]

    Jacson Rodrigues Correia-Silva, Rodrigo F Berriel, Claudine Badue, Alberto F De Souza, and Thiago Oliveira-Santos. 2018. Copycat cnn: Stealing knowledge by persuading confession with random non-labeled data. In2018 International joint conference on neural networks (IJCNN). IEEE, 1–8

    work page 2018

  6. [6]

    Asim Kumar Debnath, Rosa L Lopez de Compadre, Gargi Debnath, Alan J Shus- terman, and Corwin Hansch. 1991. Structure-activity relationship of mutagenic aromatic and heteroaromatic nitro compounds. correlation with molecular or- bital energies and hydrophobicity.Journal of medicinal chemistry34, 2 (1991), 786–797

    work page 1991

  7. [7]

    David DeFazio and Arti Ramesh. 2019. Adversarial model extraction on graph neural networks.arXiv preprint arXiv:1912.07721(2019)

    arXiv 2019

  8. [8]

    Michaël Defferrard, Xavier Bresson, and Pierre Vandergheynst. 2016. Convolu- tional neural networks on graphs with fast localized spectral filtering. InAdvances in Neural Information Processing Systems (NeurIPS), Vol. 29. 3844–3852

    work page 2016

Show all 51 references
  1. [9]

    Jane Downer, Ren Wang, and Binghui Wang. 2025. Watermarking Graph Neural Networks via Explanations for Ownership Protection.arXiv preprint arXiv:2501.05614(2025)

    2025 arXiv

  2. [10]

    Vijay Prakash Dwivedi and Xavier Bresson. 2020. A generalization of transformer networks to graphs.arXiv preprint arXiv:2012.09699(2020)

    2020 arXiv

  3. [11]

    Gamaleldin F Elsayed, Ian Goodfellow, and Jascha Sohl-Dickstein. 2018. Ad- versarial reprogramming of neural networks.arXiv preprint arXiv:1806.11146 (2018)

    2018 arXiv

  4. [12]

    Will Hamilton, Zhitao Ying, and Jure Leskovec. 2017. Inductive representation learning on large graphs.Advances in neural information processing systems30 (2017)

    2017

  5. [13]

    Geoffrey Hinton, Oriol Vinyals, and Jeff Dean. 2015. Distilling the knowledge in a neural network.arXiv preprint arXiv:1503.02531(2015)

    2015 arXiv

  6. [14]

    Weihua Hu, Matthias Fey, Marinka Zitnik, Yuxiao Dong, Hongyu Ren, Bowen Liu, Michele Catasta, and Jure Leskovec. 2020. Open Graph Benchmark: Datasets for Machine Learning on Graphs. InAdvances in Neural Information Processing Systems (NeurIPS), Vol. 33. 22118–22133

    2020

  7. [15]

    Hengrui Jia, Christopher A Choquette-Choo, Varun Chandrasekaran, and Nicolas Papernot. 2021. Entangled watermarks as a defense against model extraction. In 30th USENIX security symposium (USENIX Security 21). 1937–1954

    2021

  8. [16]

    Jiatao Jiang, Zhen Cui, Chunyan Xu, and Jian Yang. 2019. Gaussian-induced con- volution for graphs. InProceedings of the AAAI conference on artificial intelligence, Vol. 33. 4007–4014

    2019

  9. [17]

    Yongcheng Jing, Chongbin Yuan, Li Ju, Yiding Yang, Xinchao Wang, and Dacheng Tao. 2023. Deep graph reprogramming. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 24345–24354

    2023

  10. [18]

    Sanjay Kariyappa, Atul Prakash, and Moinuddin K Qureshi. 2021. Maze: Data-free model stealing attack using zeroth-order gradient estimation. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 13814–13823

    2021

  11. [19]

    Sanjay Kariyappa, Atul Prakash, and Moinuddin K Qureshi. 2021. Protecting dnns from theft using an ensemble of diverse models. InInternational Conference on Learning Representations

    2021

  12. [20]

    Sanjay Kariyappa and Moinuddin K Qureshi. 2020. Defending against model stealing attacks with adaptive misinformation. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 770–778

    2020

  13. [21]

    Kipf and Max Welling

    Thomas N. Kipf and Max Welling. 2017. Semi-Supervised Classification with Graph Convolutional Networks. InInternational Conference on Learning Repre- sentations

    2017

  14. [22]

    Xiao Li, Li Sun, Mengjie Ling, and Yan Peng. 2023. A survey of graph neural network based recommendation in social networks.Neurocomputing549 (2023), 126441

    2023

  15. [23]

    Yang Liu, Xiang Ao, Zidi Qin, Jianfeng Chi, Jinghua Feng, Hao Yang, and Qing He. 2021. Pick and choose: a GNN-based imbalanced learning approach for fraud detection. InProceedings of the web conference 2021. 3168–3177

    2021

  16. [24]

    Yixin Liu, Chenrui Fan, Pan Zhou, and Lichao Sun. 2023. Unlearnable graph: Protecting graphs from unauthorized exploitation.arXiv preprint arXiv:2303.02568 (2023)

    2023 arXiv

  17. [25]

    Yahui Long, Min Wu, Yong Liu, Yuan Fang, Chee Keong Kwoh, Jinmiao Chen, Jiawei Luo, and Xiaoli Li. 2022. Pre-training graph neural networks for link prediction in biomedical networks.Bioinformatics38, 8 (2022), 2254–2262

    2022

  18. [26]

    Pratyush Maini, Mohammad Yaghini, and Nicolas Papernot. 2021. Dataset infer- ence: Ownership resolution in machine learning.arXiv preprint arXiv:2104.10706 (2021)

    2021 arXiv

  19. [27]

    Mantas Mazeika, Bo Li, and David Forsyth. 2022. How to steer your adversary: Targeted and efficient model stealing defenses with gradient redirection. In International Conference on Machine Learning. PMLR, 15241–15254

    2022

  20. [28]

    Christopher Morris, Nils M Kriege, Franka Bause, Kristian Kersting, Petra Mutzel, and Marion Neumann. 2020. Tudataset: A collection of benchmark datasets for learning with graphs.arXiv preprint arXiv:2007.08663(2020)

    2020 arXiv

  21. [29]

    Seong Joon Oh, Bernt Schiele, and Mario Fritz. 2019. Towards reverse-engineering black-box neural networks.Explainable AI: interpreting, explaining and visualizing deep learning(2019), 121–144

    2019

  22. [30]

    Daryna Oliynyk, Rudolf Mayer, and Andreas Rauber. 2023. I know what you trained last summer: A survey on stealing machine learning models and defences. Comput. Surveys55, 14s (2023), 1–41

    2023

  23. [31]

    Tribhuvanesh Orekondy, Bernt Schiele, and Mario Fritz. 2019. Knockoff nets: Stealing functionality of black-box models. InProceedings of the IEEE/CVF confer- ence on computer vision and pattern recognition. 4954–4963

    2019

  24. [32]

    Tribhuvanesh Orekondy, Bernt Schiele, and Mario Fritz. 2020. Prediction Poi- soning: Towards Defenses Against DNN Model Stealing Attacks. InInternational Conference on Learning Representations

    2020

  25. [33]

    Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z Berkay Celik, and Ananthram Swami. 2017. Practical black-box attacks against machine learning. InProceedings of the 2017 ACM on Asia conference on computer and communications security. 506–519

    2017

  26. [34]

    Robert Nikolai Reith, Thomas Schneider, and Oleksandr Tkachenko. 2019. Effi- ciently stealing your machine learning models. InProceedings of the 18th ACM Workshop on Privacy in the Electronic Society. 198–210

    2019

  27. [35]

    Yun Shen, Xinlei He, Yufei Han, and Yang Zhang. 2022. Model stealing attacks against inductive graph neural networks. In2022 IEEE Symposium on Security and Privacy (SP). IEEE, 1175–1192

    2022

  28. [36]

    Xiangguo Sun et al. 2023. All in One: Multi-Task Prompting for Graph Neural Networks. InProceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining. 2120–2131

    2023

  29. [37]

    Sebastian Szyller, Buse Gul Atli, Samuel Marchal, and N Asokan. 2021. Dawn: Dynamic adversarial watermarking of neural networks. InProceedings of the 29th ACM International Conference on Multimedia. 4417–4425

    2021

  30. [38]

    Jean-Baptiste Truong, Pratyush Maini, Robert J Walls, and Nicolas Papernot

  31. [39]

    Petar Veličković, Guillem Cucurull, Arantxa Casanova, Adriana Romero, Pietro Liò, and Yoshua Bengio. 2018. Graph Attention Networks. InInternational Con- ference on Learning Representations

    2018

  32. [40]

    Nikil Wale, Ian A Watson, and George Karypis. 2008. Comparison of descrip- tor spaces for chemical compound retrieval and classification.Knowledge and Information Systems14 (2008), 347–375

    2008

  33. [41]

    Binghui Wang and Neil Zhenqiang Gong. 2018. Stealing hyperparameters in machine learning. In2018 IEEE symposium on security and privacy (SP). IEEE, 36–52

    2018

  34. [42]

    Hongwei Wang, Jia Wang, Jialin Wang, Miao Zhao, Weinan Zhang, Fuzheng Zhang, Xing Xie, and Minyi Guo. 2018. Graphgan: Graph representation learning with generative adversarial nets. InProceedings of the AAAI conference on artificial intelligence, Vol. 32

    2018

  35. [43]

    Zi Wang. 2021. Zero-shot knowledge distillation from a decision-based black-box model. InInternational conference on machine learning. PMLR, 10675–10685

    2021

  36. [44]

    Zhenyi Wang, Li Shen, Tongliang Liu, Tiehang Duan, Yanjun Zhu, Donglin Zhan, David Doermann, and Mingchen Gao. 2023. Defending against Data-Free Model Extraction by Distributionally Robust Defensive Training.Advances in Neural Information Processing Systems36 (2023)

    2023

  37. [45]

    Bang Wu, Xiangwen Yang, Shirui Pan, and Xingliang Yuan. 2022. Model extraction attacks on graph neural networks: Taxonomy and realisation. InProceedings of the 2022 ACM on Asia Conference on Computer and Communications Security. 337–350

    2022

  38. [46]

    Shiwen Wu, Fei Sun, Wentao Zhang, Xu Xie, and Bin Cui. 2022. Graph neural networks in recommender systems: a survey.Comput. Surveys55, 5 (2022), 1–37

    2022

  39. [47]

    Haoyan Xu, Ruizhi Qian, Jiate Li, Yushun Dong, Minghao Lin, Hanson Yan, Zhengtao Yao, Qinghua Liu, Junhao Dong, Ruopeng Huang, et al. 2025. A Sys- tematic Study of Model Extraction Attacks on Graph Foundation Models.arXiv preprint arXiv:2511.11912(2025)

    2025

  40. [48]

    Jing Xu, Franziska Boenisch, and Adam Dziedzic. 2025. ADAGE: Active Defenses Against GNN Extraction.arXiv preprint arXiv:2503.00065(2025)

    2025 arXiv

  41. [49]

    Zhitao Ying, Jiaxuan You, Christopher Morris, Xiang Ren, William L Hamilton, and Jure Leskovec. 2018. Hierarchical Graph Representation Learning with Differentiable Pooling. InAdvances in Neural Information Processing Systems (NeurIPS), Vol. 31

    2018

  42. [50]

    Yuanxin Zhuang, Chuan Shi, Mengmei Zhang, Jinghui Chen, Lingjuan Lyu, Pan Zhou, and Lichao Sun. 2024. Unveiling the Secrets without Data: Can Graph Neural Networks Be Exploited through Data-Free Model Extraction Attacks?. In 33rd USENIX Security Symposium (USENIX Security 24)....

    2024

  43. [2021]

    InProceedings of the IEEE/CVF conference on computer vision and pattern recognition

    Data-free model extraction. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition. 4771–4780

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.