mlsanityData to 14 Oct 2026

Membership Inference Attack on Graph Neural Networks

arXiv 2101.06570 ↗First posted 17 Jan 2021cs.LG cs.CRcited by 81

Not on the map. Why?

Cited by 29 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Graph Neural Networks (GNNs), which generalize traditional deep neural networks on graph data, have achieved state-of-the-art performance on several graph analytical tasks. We focus on how trained GNN models could leak information about the member nodes that they were trained on. We introduce two realistic settings for performing a membership inference (MI) attack on GNNs. While choosing the simplest possible attack model that utilizes the posteriors of the trained model (black-box access), we thoroughly analyze the properties of GNNs and the datasets which dictate the differences in their robustness towards MI attack. While in traditional machine learning models, overfitting is considered the main cause of such leakage, we show that in GNNs the additional structural information is the major contributing factor. We support our findings by extensive experiments on four representative GNN models. To prevent MI attacks on GNN, we propose two effective defenses that significantly decreases the attacker's inference by up to 60% without degradation to the target model's performance. Our code is available at https://github.com/iyempissy/rebMIGraph.

Key facts. Cited by 81 papers in the map (data through 14 Oct 2026). Builds on 27 of its 50 references that are in the map. First posted on arXiv 17 Jan 2021.

Builds on

27 of 50 references.

References · 27

  1. 2016Semi-Supervised Classification with Graph Convolutional Networkscited by 11,361
  2. 2017Graph Attention Networkscited by 8,923
  3. 2017Inductive Representation Learning on Large Graphscited by 6,320
  4. 2019Fast Graph Representation Learning with PyTorch Geometriccited by 2,434
  5. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,281
  6. 2016Understanding deep learning requires rethinking generalizationcited by 1,674
  7. 2019Simplifying Graph Convolutional Networkscited by 1,477
  8. 2018The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networkscited by 864
  9. 2016Stealing Machine Learning Models via Prediction APIscited by 619
  10. 2018Exploiting Unintended Feature Leakage in Collaborative Learningcited by 520
  11. 2018ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Modelscited by 498
  12. 2019Local Model Poisoning Attacks to Byzantine-Robust Federated Learningcited by 493
15 more
  1. 2018Adversarial Attacks on Neural Networks for Graph Datacited by 397
  2. 2017Certified Defenses for Data Poisoning Attackscited by 303
  3. 2018Adversarial Attack on Graph Structured Datacited by 301
  4. 2019High Accuracy and High Fidelity Extraction of Neural Networkscited by 214
  5. 2019MemGuard: Defending against Black-Box Membership Inference Attacks via Adversarial Examplescited by 197
  6. 2018Machine Learning with Membership Privacy using Adversarial Regularizationcited by 186
  7. 2020Backdoor Attacks to Graph Neural Networkscited by 128
  8. 2019Updates-Leak: Data Set Inference and Reconstruction Attacks in Online Learningcited by 122
  9. 2018Stealing Hyperparameters in Machine Learningcited by 118
  10. 2016Towards the Science of Security and Privacy in Machine Learningcited by 89
  11. 2018Exploring Connections Between Active Learning and Model Extractioncited by 85
  12. 2019Attacking Graph-based Classification via Manipulating the Graph Structurecited by 53
  13. 2018Privacy in Social Media: Identification, Mitigation and Applicationscited by 19
  14. 2019On Inferring Training Data Attributes in Machine Learning Modelscited by 6
  15. 2019Differentially Private Link Prediction With Protected Connectionscited by 1

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 9; 2022: 14; 2023: 20; 2024: 14; 2025: 18; 2026: 6.

81 papers.

Sort:

By area:

  1. 2021Membership Inference Attacks on Machine Learning: A Surveycited by 321
  2. 2022A Comprehensive Survey on Trustworthy Graph Neural Networks: Privacy, Robustness, Fairness, and Explainabilitycited by 118
  3. 2021Node-Level Membership Inference Attacks Against Graph Neural Networkscited by 84
  4. 2022Membership Inference Attacks Against Text-to-image Generation Modelscited by 69
  5. 2024A Survey of Graph Neural Networks in Real world: Imbalance, Noise, Privacy and OOD Challengescited by 54
  6. 2021Adapting Membership Inference Attacks to GNN for Graph Classification: Approaches and Implicationscited by 52
  7. 2022GAP: Differentially Private Graph Neural Networks with Aggregation Perturbationcited by 46
  8. 2022Membership Inference Attacks and Defenses in Neural Network Pruningcited by 45
  9. 2023GNNDelete: A General Strategy for Unlearning in Graph Neural Networkscited by 43
  10. 2021Membership Inference on Word Embedding and Beyondcited by 35
  11. 2021Property Inference Attacks Against GANscited by 33
  12. 2021Releasing Graph Neural Networks with Differential Privacy Guaranteescited by 32
38 more
  1. 2023A Survey on Privacy in Graph Neural Networks: Attacks, Preservation, and Applicationscited by 22
  2. 2022A Survey of Trustworthy Graph Learning: Reliability, Explainability, and Privacy Protectioncited by 20
  3. 2023Efficiently Forgetting What You Have Learned in Graph Representation Learning via Projectioncited by 20
  4. 2022Label-Only Membership Inference Attack against Node-Level Graph Neural Networkscited by 19
  5. 2021Pervasive AI for IoT applications: A Survey on Resource-efficient Distributed Artificial Intelligencecited by 18
  6. 2022Towards Private Learning on Decentralized Graphs with Local Differential Privacycited by 16
  7. 2022Private Graph Extraction via Feature Explanationscited by 16
  8. 2022Membership-Doctor: Comprehensive Assessment of Membership Inference Against Machine Learning Modelscited by 16
  9. 2023GrOVe: Ownership Verification of Graph Neural Networks using Embeddingscited by 16
  10. 2023A Unified Framework of Graph Information Bottleneck for Robustness and Membership Privacycited by 14
  11. 2024Scalable and Certifiable Graph Unlearning: Overcoming the Approximation Error Barriercited by 14
  12. 2023Distill to Delete: Unlearning in Graph Networks with Knowledge Distillationcited by 13
  13. 2021A Review of Anonymization for Healthcare Datacited by 12
  14. 2022Differentially Private Graph Classification with GNNscited by 12
  15. 2023ProGAP: Progressive Graph Neural Networks with Differential Privacy Guaranteescited by 12
  16. 2023A Survey of Graph Unlearningcited by 12
  17. 2021Membership Inference Attacks on Knowledge Graphscited by 11
  18. 2024Model Inversion Attacks: A Survey of Approaches and Countermeasurescited by 11
  19. 2022SoK: Differential Privacy on Graph-Structured Datacited by 10
  20. 2023GraphGuard: Detecting and Counteracting Training Data Misuse in Graph Neural Networkscited by 8
  21. 2024Federated Graph Condensation with Information Bottleneck Principlescited by 8
  22. 2025OpenGU: A Comprehensive Benchmark for Graph Unlearningcited by 8
  23. 2023Does Black-box Attribute Inference Attacks on Graph Neural Networks Constitute Privacy Risk?cited by 7
  24. 2023Poincar'e Differential Privacy for Hierarchy-Aware Graph Embeddingcited by 7
  25. 2024Mitigating Privacy Risk in Membership Inference by Convex-Concave Losscited by 6
  26. 2022Privacy and Transparency in Graph Machine Learning: A Unified Perspectivecited by 5
  27. 2023Training Differentially Private Graph Neural Networks with Random Walk Samplingcited by 5
  28. 2023VertexSerum: Poisoning Graph Neural Networks for Link Inferencecited by 5
  29. 2023Local Differential Privacy in Graph Neural Networks: a Reconstruction Approachcited by 5
  30. 2025Practical Bayes-Optimal Membership Inference Attackscited by 5
  31. 2025Seed-Induced Uniqueness in Transformer Models: Subspace Alignment Governs Subliminal Transfercited by 5
  32. 2023Independent Distribution Regularization for Private Graph Embeddingcited by 4
  33. 2024Provable Privacy Attacks on Trained Shallow Neural Networkscited by 4
  34. 2025GRID: Protecting Training Graph from Link Stealing Attacks on GNN Modelscited by 4
  35. 2025Robustness questions the interpretability of graph neural networks: what to do?cited by 4
  36. 2025Unlearning Inversion Attacks for Graph Neural Networkscited by 4
  37. 2025Black-Box Membership Inference Attack for LVLMs via Prior Knowledge-Calibrated Memory Probingcited by 4
  38. 2023Node Injection Link Stealing Attackcited by 3

50 most cited of 81 All 81 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2026Impact of Graph Structure on Membership-Inference Risk for Graph Neural Networks
  2. 2024Graph Neural Backdoor: Fundamentals, Methodologies, Applications, and Future Directions
  3. 2022Membership Inference Attacks and Generalization: A Causal Perspective
  4. 2024Identifying Backdoored Graphs in Graph Neural Network Training: An Explanation-Based Approach with Novel Metrics
  5. 2021Enhanced Membership Inference Attacks against Machine Learning Models
  6. 2024Effective backdoor attack on graph neural networks in link prediction tasks
  7. 2024GLiRA: Black-Box Membership Inference Attack via Knowledge Distillation
  8. 2026Inference Attacks Against Graph Generative Diffusion Models