LinkTeller: Recovering Private Edges from Graph Neural Networks via Influence Analysis

Wang, Fan; Long, Yunhui; Zhang, Ce; Li, Bo

doi:10.48550/arxiv.2108.06504

Cited by 6 publications

(27 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

Section: Prior Work a Few Recent Work Have Attempted To Learnmentioning

confidence: 99%

“…GNNs with DP [10,40,47,57], but they either consider restrictive assumptions or their methods incur high privacy costs to achieve reasonable accuracy, which is often unacceptable for end users. Wu et al [57] propose an edge-level DP GNN learning algorithm by directly perturbing the adjacency matrix of the graph. However, due to the huge dimensions of the adjacency matrix and the excessive noise injected, their method only work well for relatively large privacy budgets (𝜖 ≥ 10).…”

Section: Prior Work a Few Recent Work Have Attempted To Learnmentioning

confidence: 99%

“…Zhang et al [72] study the connection between model inversion risk and edge influence, and show that edges with greater influence are more likely to be inferred. Wu et al [57] also study the link stealing attack via influence analysis and propose an effective attack against GNNs based on the node influence information. The feasibility of the membership inference attack against GNNs has also been studied and several attacks with different threat models have been proposed in the literature [4,12,25,41].…”

Section: Related Workmentioning

confidence: 99%

“…However, real-world deployments of GNNs raise privacy concerns when graphs contain users' data: for instance, social or financial networks involve sensitive information about individuals and their interactions. Recent works [24,25,41,57] have extended the study of the privacy leakage of standard deep learning models to GNNs, showing that the risk of leaking information about the training data is even higher in GNNs, as they incorporate not only node features and labels but also the graph structure itself [12]. Consequently, GNNs are vulnerable to various privacy attacks, such as node membership inference [25,41] and edge stealing [24,57].…”

Section: Introductionmentioning

confidence: 99%

“…Recent works [24,25,41,57] have extended the study of the privacy leakage of standard deep learning models to GNNs, showing that the risk of leaking information about the training data is even higher in GNNs, as they incorporate not only node features and labels but also the graph structure itself [12]. Consequently, GNNs are vulnerable to various privacy attacks, such as node membership inference [25,41] and edge stealing [24,57]. For example, a GNN trained over a social network for friendship recommendation could reveal the existing friendship links between the users through its predictions.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

GAP: Differentially Private Graph Neural Networks with Aggregation Perturbation

Sajadmanesh¹,

Shamsabadi²,

Bellet³

et al. 2022

Preprint

View full text Add to dashboard Cite

Graph Neural Networks (GNNs) are powerful models designed for graph data that learn node representation by recursively aggregating information from each node's local neighborhood. However, despite their state-of-the-art performance in predictive graph-based applications, recent studies have shown that GNNs can raise significant privacy concerns when graph data contain sensitive information. As a result, in this paper, we study the problem of learning GNNs with Differential Privacy (DP). We propose GAP, a novel differentially private GNN that safeguards the privacy of nodes and edges using aggregation perturbation, i.e., adding calibrated stochastic noise to the output of the GNN's aggregation function, which statistically obfuscates the presence of a single edge (edge-level privacy) or a single node and all its adjacent edges (node-level privacy). To circumvent the accumulation of privacy cost at every forward pass of the model, we tailor the GNN architecture to the specifics of private learning. In particular, we first precompute private aggregations by recursively applying neighborhood aggregation and perturbing the output of each aggregation step. Then, we privately train a deep neural network on the resulting perturbed aggregations for any node-wise classification task. A major advantage of GAP over previous approaches is that we guarantee edgelevel and node-level DP not only for training, but also at inference time with no additional costs beyond the training's privacy budget. We theoretically analyze the formal privacy guarantees of GAP using Rényi DP. Empirical experiments conducted over three real-world graph datasets demonstrate that GAP achieves a favorable privacy-accuracy trade-off and significantly outperforms existing approaches.

show abstract

Section: Prior Work a Few Recent Work Have Attempted To Learnmentioning

confidence: 99%

Section: Prior Work a Few Recent Work Have Attempted To Learnmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

GAP: Differentially Private Graph Neural Networks with Aggregation Perturbation

Sajadmanesh¹,

Shamsabadi²,

Bellet³

et al. 2022

Preprint

View full text Add to dashboard Cite

show abstract

Locally Private Graph Neural Networks

Sajadmanesh

Gática-Pérez

2021

Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security

View full text Add to dashboard Cite

Graph Neural Networks (GNNs) have become a popular tool for learning on graphs, but their widespread use raises privacy concerns as graph data can contain personal or sensitive information. Differentially private GNN models have been recently proposed to preserve privacy while still allowing for effective learning over graph-structured datasets. However, achieving an ideal balance between accuracy and privacy in GNNs remains challenging due to the intrinsic structural connectivity of graphs. In this paper, we propose a new differentially private GNN called ProGAP that uses a progressive training scheme to improve such accuracy-privacy trade-offs. Combined with the aggregation perturbation technique to ensure differential privacy, ProGAP splits a GNN into a sequence of overlapping submodels that are trained progressively, expanding from the first submodel to the complete model. Specifically, each submodel is trained over the privately aggregated node embeddings learned and cached by the previous submodels, leading to an increased expressive power compared to previous approaches while limiting the incurred privacy costs. We formally prove that ProGAP ensures edge-level and node-level privacy guarantees for both training and inference stages, and evaluate its performance on benchmark graph datasets. Experimental results demonstrate that ProGAP can achieve up to 5-10% higher accuracy than existing state-of-the-art differentially private GNNs.

show abstract

LPGNet: Link Private Graph Networks for Node Classification

Kolluri¹,

Baluta²,

Hooi³

et al. 2022

Preprint

View full text Add to dashboard Cite

Classification tasks on labeled graph-structured data have many important applications ranging from social recommendation to financial modeling. Deep neural networks are increasingly being used for node classification on graphs, wherein nodes with similar features have to be given the same label. Graph convolutional networks (GCNs) are one such widely studied neural network architecture that perform well on this task. However, powerful link-stealing attacks on GCNs have recently shown that even with black-box access to the trained model, inferring which links (or edges) are present in the training graph is practical. In this paper, we present a new neural network architecture called LPGNet for training on graphs with privacy-sensitive edges. LPGNet provides differential privacy (DP) guarantees for edges using a novel design for how graph edge structure is used during training. We empirically show that LPGNet models often lie in the sweet spot between providing privacy and utility: They can offer better utility than "trivially" private architectures which use no edge information (e.g., vanilla MLPs) and better resilience against existing link-stealing attacks than vanilla GCNs which use the full edge structure. LPGNet also offers consistently better privacy-utility tradeoffs than DpGCN, which is the state-of-the-art mechanism for retrofitting differential privacy into conventional GCNs, in most of our evaluated datasets.

show abstract

LinkTeller: Recovering Private Edges from Graph Neural Networks via Influence Analysis

Cited by 6 publications

References 0 publications

GAP: Differentially Private Graph Neural Networks with Aggregation Perturbation

GAP: Differentially Private Graph Neural Networks with Aggregation Perturbation

Locally Private Graph Neural Networks

LPGNet: Link Private Graph Networks for Node Classification

Contact Info

Product

Resources

About