{"record_type":"pith_number_record","schema_url":"https://pith.science/schemas/pith-number/v1.json","pith_number":"pith:2026:B6X7YNKJ6RSVGV3R6R5OX5DICX","short_pith_number":"pith:B6X7YNKJ","schema_version":"1.0","canonical_sha256":"0faffc3549f465535771f47aebf46815e99c6bb1af6e73d3149262a73e06aa5e","source":{"kind":"arxiv","id":"2605.12827","version":1},"attestation_state":"computed","paper":{"title":"GraphIP-Bench: How Hard Is It to Steal a Graph Neural Network, and Can We Stop It?","license":"http://creativecommons.org/licenses/by/4.0/","headline":"Stealing a graph neural network is straightforward at medium query budgets, and existing defenses rarely prevent extraction or preserve ownership signals on surrogates.","cross_cats":["cs.AI","cs.LG"],"primary_cat":"cs.CR","authors_text":"Bolin Shen, Kaixiang Zhao, Shayok Chakraborty, Yushun Dong, Yuyang Dai","submitted_at":"2026-05-12T23:49:45Z","abstract_excerpt":"Graph neural networks (GNNs) deployed as cloud services can be \\emph{stolen} through \\emph{model-extraction attacks}, which train a surrogate from query responses to reproduce the target's behaviour, and a growing line of ownership defenses tries to prevent or trace such theft. The title of this paper asks two questions: \\emph{how hard is it to steal a GNN?}, and \\emph{can we stop it?} Prior work cannot answer either, because experiments use inconsistent datasets, threat models, and metrics. We introduce \\emph{GraphIP-Bench}, a unified benchmark which evaluates both sides under a single black-"},"verification_status":{"content_addressed":true,"pith_receipt":true,"author_attested":false,"weak_author_claims":0,"strong_author_claims":0,"externally_anchored":false,"storage_verified":false,"citation_signatures":0,"replication_records":0,"graph_snapshot":true,"references_resolved":true,"formal_links_present":false},"canonical_record":{"source":{"id":"2605.12827","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-05-12T23:49:45Z","cross_cats_sorted":["cs.AI","cs.LG"],"title_canon_sha256":"052da90012bb32bdcf35f3ecb86e5c26399f16d61d2fc0fe93e7db36b88e19f3","abstract_canon_sha256":"c13b853b9f0f5f7992f486ca8262326335d92fb72ad79d05c4a8994158445719"},"schema_version":"1.0"},"receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-18T03:09:12.139982Z","signature_b64":"k8+utM0r4giGXh5G7WqwvTjL/MGg05ihDSKkk42T8JCiv6ECS8T4/gFpgOR1HFIj+cxBCT6mFaN5TrJg+BYLBA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"0faffc3549f465535771f47aebf46815e99c6bb1af6e73d3149262a73e06aa5e","last_reissued_at":"2026-05-18T03:09:12.139156Z","signature_status":"signed_v1","first_computed_at":"2026-05-18T03:09:12.139156Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"graph_snapshot":{"paper":{"title":"GraphIP-Bench: How Hard Is It to Steal a Graph Neural Network, and Can We Stop It?","license":"http://creativecommons.org/licenses/by/4.0/","headline":"Stealing a graph neural network is straightforward at medium query budgets, and existing defenses rarely prevent extraction or preserve ownership signals on surrogates.","cross_cats":["cs.AI","cs.LG"],"primary_cat":"cs.CR","authors_text":"Bolin Shen, Kaixiang Zhao, Shayok Chakraborty, Yushun Dong, Yuyang Dai","submitted_at":"2026-05-12T23:49:45Z","abstract_excerpt":"Graph neural networks (GNNs) deployed as cloud services can be \\emph{stolen} through \\emph{model-extraction attacks}, which train a surrogate from query responses to reproduce the target's behaviour, and a growing line of ownership defenses tries to prevent or trace such theft. The title of this paper asks two questions: \\emph{how hard is it to steal a GNN?}, and \\emph{can we stop it?} Prior work cannot answer either, because experiments use inconsistent datasets, threat models, and metrics. We introduce \\emph{GraphIP-Bench}, a unified benchmark which evaluates both sides under a single black-"},"claims":{"count":4,"items":[{"kind":"strongest_claim","text":"stealing a GNN is easy at medium query budgets and most defenses do not change this; several watermarks verify reliably on the protected model but lose most of their verification signal on the extracted surrogate","source":"verdict.strongest_claim","status":"machine_extracted","claim_id":"C1","attestation":"unclaimed"},{"kind":"weakest_assumption","text":"The twelve attacks, twelve defenses, ten graphs, three backbones and three tasks chosen for the benchmark are representative enough that conclusions about real-world GNN services will hold.","source":"verdict.weakest_assumption","status":"machine_extracted","claim_id":"C2","attestation":"unclaimed"},{"kind":"one_line_summary","text":"GraphIP-Bench shows stealing GNNs is easy at moderate query budgets, most defenses fail to block or reliably trace extraction, and watermarks lose verification power on surrogates while heterophilic graphs are harder to steal.","source":"verdict.one_line_summary","status":"machine_extracted","claim_id":"C3","attestation":"unclaimed"},{"kind":"headline","text":"Stealing a graph neural network is straightforward at medium query budgets, and existing defenses rarely prevent extraction or preserve ownership signals on surrogates.","source":"verdict.pith_extraction.headline","status":"machine_extracted","claim_id":"C4","attestation":"unclaimed"}],"snapshot_sha256":"16eec270102c3699db52ba9c7ec353b9bce9ca21048ecf9c812d8c9daf8c1fd6"},"source":{"id":"2605.12827","kind":"arxiv","version":1},"verdict":{"id":"9fd4a2f6-d95d-4e03-a5ec-a912a2260bd0","model_set":{"reader":"grok-4.3"},"created_at":"2026-05-14T19:22:32.061097Z","strongest_claim":"stealing a GNN is easy at medium query budgets and most defenses do not change this; several watermarks verify reliably on the protected model but lose most of their verification signal on the extracted surrogate","one_line_summary":"GraphIP-Bench shows stealing GNNs is easy at moderate query budgets, most defenses fail to block or reliably trace extraction, and watermarks lose verification power on surrogates while heterophilic graphs are harder to steal.","pipeline_version":"pith-pipeline@v0.9.0","weakest_assumption":"The twelve attacks, twelve defenses, ten graphs, three backbones and three tasks chosen for the benchmark are representative enough that conclusions about real-world GNN services will hold.","pith_extraction_headline":"Stealing a graph neural network is straightforward at medium query budgets, and existing defenses rarely prevent extraction or preserve ownership signals on surrogates."},"references":{"count":45,"sample":[{"doi":"","year":2024,"title":"Pregip: Watermarking the pretraining of graph neural networks for deep intellectual property protection.arXiv preprint arXiv:2402.04435, 2024","work_id":"b33049db-31af-4ce5-bf0a-1b189eca50dc","ref_index":1,"cited_arxiv_id":"","is_internal_anchor":false},{"doi":"","year":2024,"title":"A comprehensive survey on trustworthy graph neural networks: Privacy, robustness, fairness, and explainability.Machine Intelligence Research, pages 1–51, 2024","work_id":"8c0cad55-e35d-4c49-8f6d-46f39255f1f9","ref_index":2,"cited_arxiv_id":"","is_internal_anchor":false},{"doi":"","year":1912,"title":"Adversarial Model Extraction on Graph Neural Networks, December 2019","work_id":"40088c8c-be7c-41ef-91ed-5e932250a629","ref_index":3,"cited_arxiv_id":"","is_internal_anchor":false},{"doi":"","year":2024,"title":"A realistic model extraction attack against graph neural networks.Knowledge-Based Systems, page 112144, 2024","work_id":"f4412ae5-f170-4097-949b-528c785d8b63","ref_index":4,"cited_arxiv_id":"","is_internal_anchor":false},{"doi":"","year":2017,"title":"Inductive representation learning on large graphs.Advances in neural information processing systems, 30, 2017","work_id":"610fc11a-d77b-4bc2-a248-24c750f40834","ref_index":5,"cited_arxiv_id":"","is_internal_anchor":false}],"resolved_work":45,"snapshot_sha256":"cc027f5b52dd57203f495e4f84392633519451e44e6ff72ca891cbdeec8a19bf","internal_anchors":2},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"aliases":[{"alias_kind":"arxiv","alias_value":"2605.12827","created_at":"2026-05-18T03:09:12.139299+00:00"},{"alias_kind":"arxiv_version","alias_value":"2605.12827v1","created_at":"2026-05-18T03:09:12.139299+00:00"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2605.12827","created_at":"2026-05-18T03:09:12.139299+00:00"},{"alias_kind":"pith_short_12","alias_value":"B6X7YNKJ6RSV","created_at":"2026-05-18T12:33:37.589309+00:00"},{"alias_kind":"pith_short_16","alias_value":"B6X7YNKJ6RSVGV3R","created_at":"2026-05-18T12:33:37.589309+00:00"},{"alias_kind":"pith_short_8","alias_value":"B6X7YNKJ","created_at":"2026-05-18T12:33:37.589309+00:00"}],"events":[],"event_summary":{},"paper_claims":[],"inbound_citations":{"count":0,"internal_anchor_count":0,"sample":[]},"formal_canon":{"evidence_count":0,"sample":[],"anchors":[]},"links":{"html":"https://pith.science/pith/B6X7YNKJ6RSVGV3R6R5OX5DICX","json":"https://pith.science/pith/B6X7YNKJ6RSVGV3R6R5OX5DICX.json","graph_json":"https://pith.science/api/pith-number/B6X7YNKJ6RSVGV3R6R5OX5DICX/graph.json","events_json":"https://pith.science/api/pith-number/B6X7YNKJ6RSVGV3R6R5OX5DICX/events.json","paper":"https://pith.science/paper/B6X7YNKJ"},"agent_actions":{"view_html":"https://pith.science/pith/B6X7YNKJ6RSVGV3R6R5OX5DICX","download_json":"https://pith.science/pith/B6X7YNKJ6RSVGV3R6R5OX5DICX.json","view_paper":"https://pith.science/paper/B6X7YNKJ","resolve_alias":"https://pith.science/api/pith-number/resolve?arxiv=2605.12827&json=true","fetch_graph":"https://pith.science/api/pith-number/B6X7YNKJ6RSVGV3R6R5OX5DICX/graph.json","fetch_events":"https://pith.science/api/pith-number/B6X7YNKJ6RSVGV3R6R5OX5DICX/events.json","actions":{"anchor_timestamp":"https://pith.science/pith/B6X7YNKJ6RSVGV3R6R5OX5DICX/action/timestamp_anchor","attest_storage":"https://pith.science/pith/B6X7YNKJ6RSVGV3R6R5OX5DICX/action/storage_attestation","attest_author":"https://pith.science/pith/B6X7YNKJ6RSVGV3R6R5OX5DICX/action/author_attestation","sign_citation":"https://pith.science/pith/B6X7YNKJ6RSVGV3R6R5OX5DICX/action/citation_signature","submit_replication":"https://pith.science/pith/B6X7YNKJ6RSVGV3R6R5OX5DICX/action/replication_record"}},"created_at":"2026-05-18T03:09:12.139299+00:00","updated_at":"2026-05-18T03:09:12.139299+00:00"}