mlsanityData to 7 Oct 2026

Node-Level Membership Inference Attacks Against Graph Neural Networks

arXiv 2102.05429 ↗First posted 10 Feb 2021cs.CR cs.LGcited by 80

Not on the map. Why?

Cited by 24 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Many real-world data comes in the form of graphs, such as social networks and protein structure. To fully utilize the information contained in graph data, a new family of machine learning (ML) models, namely graph neural networks (GNNs), has been introduced. Previous studies have shown that machine learning models are vulnerable to privacy attacks. However, most of the current efforts concentrate on ML models trained on data from the Euclidean space, like images and texts. On the other hand, privacy risks stemming from GNNs remain largely unstudied. In this paper, we fill the gap by performing the first comprehensive analysis of node-level membership inference attacks against GNNs. We systematically define the threat models and propose three node-level membership inference attacks based on an adversary's background knowledge. Our evaluation on three GNN structures and four benchmark datasets shows that GNNs are vulnerable to node-level membership inference even when the adversary has minimal background knowledge. Besides, we show that graph density and feature similarity have a major impact on the attack's success. We further investigate two defense mechanisms and the empirical results indicate that these defenses can reduce the attack performance but with moderate utility loss.

Key facts. Cited by 80 papers in the map (data through 7 Oct 2026). Builds on 38 of its 55 references that are in the map. First posted on arXiv 10 Feb 2021.

Builds on

38 of 55 references.

References · 38

  1. 2017Attention Is All You Needcited by 59,932
  2. 2016Semi-Supervised Classification with Graph Convolutional Networkscited by 11,282
  3. 2017Graph Attention Networkscited by 8,854
  4. 2017Inductive Representation Learning on Large Graphscited by 6,284
  5. 2018How Powerful are Graph Neural Networks?cited by 4,355
  6. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  7. 2020Extracting Training Data from Large Language Modelscited by 2,144
  8. 2018The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networkscited by 847
  9. 2016Stealing Machine Learning Models via Prediction APIscited by 602
  10. 2018Exploiting Unintended Feature Leakage in Collaborative Learningcited by 509
  11. 2018ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Modelscited by 475
  12. 2018Adversarial Attacks on Neural Networks for Graph Datacited by 395
26 more
  1. 2020Label-Only Membership Inference Attackscited by 371
  2. 2018Adversarial Attack on Graph Structured Datacited by 300
  3. 2018Knockoff Nets: Stealing Functionality of Black-Box Modelscited by 285
  4. 2019Adversarial Attacks on Graph Neural Networks via Meta Learningcited by 261
  5. 2019The Secret Revealer: Generative Model-Inversion Attacks Against Deep Neural Networkscited by 241
  6. 2019Adversarial Attacks and Defenses in Images, Graphs and Text: A Reviewcited by 234
  7. 2019High Accuracy and High Fidelity Extraction of Neural Networkscited by 208
  8. 2019MemGuard: Defending against Black-Box Membership Inference Attacks via Adversarial Examplescited by 183
  9. 2018Machine Learning with Membership Privacy using Adversarial Regularizationcited by 177
  10. 2019Stolen Memories: Leveraging Model Memorization for Calibrated White-Box Membership Inferencecited by 168
  11. 2018Adversarial Attack and Defense on Graph Data: A Surveycited by 166
  12. 2020Backdoor Attacks to Graph Neural Networkscited by 126
  13. 2020Characteristic Functions on Graphs: Birds of a Feather, from Statistical Descriptors to Parametric Modelscited by 116
  14. 2018Stealing Hyperparameters in Machine Learningcited by 115
  15. 2020Stealing Links from Graph Neural Networkscited by 114
  16. 2018Adversarial Attacks on Node Embeddings via Graph Poisoningcited by 109
  17. 2020Quantifying Privacy Leakage in Graph Embeddingcited by 82
  18. 2021Membership Inference Attack on Graph Neural Networkscited by 81
  19. 2019Overlearning Reveals Sensitive Attributescited by 74
  20. 2019Attacking Graph-based Classification via Manipulating the Graph Structurecited by 53
  21. 2020Adversarial Attacks and Defenses on Graphs: A Review, A Tool and Empirical Studiescited by 42
  22. 2020A Survey of Adversarial Learning on Graphscited by 42
  23. 2020Model Extraction Attacks on Graph Neural Networks: Taxonomy and Realizationcited by 39
  24. 2018Differentially Private Data Generative Modelscited by 33
  25. 2017LOGAN: Membership Inference Attacks Against Generative Modelscited by 28
  26. 2017walk2friends: Inferring Social Links from Mobility Profilescited by 7

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 10; 2022: 21; 2023: 12; 2024: 21; 2025: 12; 2026: 4.

80 papers.

Sort:

By area:

  1. 2021Membership Inference Attacks on Machine Learning: A Surveycited by 306
  2. 2022A Comprehensive Survey on Trustworthy Graph Neural Networks: Privacy, Robustness, Fairness, and Explainabilitycited by 118
  3. 2022Membership Inference Attacks by Exploiting Loss Trajectorycited by 93
  4. 2022Trustworthy Graph Neural Networks: Aspects, Methods and Trendscited by 88
  5. 2022Membership Inference Attacks Against Text-to-image Generation Modelscited by 66
  6. 2024A Survey of Graph Neural Networks in Real world: Imbalance, Noise, Privacy and OOD Challengescited by 54
  7. 2021Adapting Membership Inference Attacks to GNN for Graph Classification: Approaches and Implicationscited by 50
  8. 2021Model Stealing Attacks Against Inductive Graph Neural Networkscited by 50
  9. 2022GAP: Differentially Private Graph Neural Networks with Aggregation Perturbationcited by 46
  10. 2022SSLGuard: A Watermarking Scheme for Self-supervised Learning Pre-trained Encoderscited by 43
  11. 2024Membership Inference Attacks Against In-Context Learningcited by 38
  12. 2021Membership Inference on Word Embedding and Beyondcited by 34
38 more
  1. 2021Releasing Graph Neural Networks with Differential Privacy Guaranteescited by 32
  2. 2021Property Inference Attacks Against GANscited by 32
  3. 2022Can't Steal? Cont-Steal! Contrastive Stealing Attacks Against Image Encoderscited by 30
  4. 2022Auditing Membership Leakages of Multi-Exit Networkscited by 26
  5. 2023A Survey on Privacy in Graph Neural Networks: Attacks, Preservation, and Applicationscited by 22
  6. 2022Group Property Inference Attacks Against Graph Neural Networkscited by 21
  7. 2022A Survey of Trustworthy Graph Learning: Reliability, Explainability, and Privacy Protectioncited by 20
  8. 2022Label-Only Membership Inference Attack against Node-Level Graph Neural Networkscited by 18
  9. 2022Membership Inference Attacks and Generalization: A Causal Perspectivecited by 17
  10. 2021Membership Inference Attacks Against Self-supervised Speech Modelscited by 16
  11. 2022Membership-Doctor: Comprehensive Assessment of Membership Inference Against Machine Learning Modelscited by 16
  12. 2023Unraveling Privacy Risks of Individual Fairness in Graph Neural Networkscited by 16
  13. 2023GrOVe: Ownership Verification of Graph Neural Networks using Embeddingscited by 16
  14. 2023On Strengthening and Defending Graph Reconstruction Attack with Markov Chain Approximationcited by 16
  15. 2023A Unified Framework of Graph Information Bottleneck for Robustness and Membership Privacycited by 14
  16. 2022Differentially Private Graph Classification with GNNscited by 12
  17. 2023ProGAP: Progressive Graph Neural Networks with Differential Privacy Guaranteescited by 12
  18. 2021Membership Inference Attacks on Knowledge Graphscited by 11
  19. 2023Preserving Node-level Privacy in Graph Neural Networkscited by 11
  20. 2024Model Inversion Attacks: A Survey of Approaches and Countermeasurescited by 11
  21. 2022Semi-Leak: Membership Inference Attacks Against Semi-supervised Learningcited by 10
  22. 2022SoK: Differential Privacy on Graph-Structured Datacited by 9
  23. 2023GraphGuard: Detecting and Counteracting Training Data Misuse in Graph Neural Networkscited by 8
  24. 2024Trained Without My Consent: Detecting Code Inclusion In Language Models Trained on Codecited by 8
  25. 2024Federated Graph Condensation with Information Bottleneck Principlescited by 8
  26. 2022Heterogeneous Graph Neural Network for Privacy-Preserving Recommendationcited by 6
  27. 2022On the Privacy Risks of Cell-Based NAS Architecturescited by 5
  28. 2024Understanding Data Importance in Machine Learning Attacks: Does Valuable Data Pose Greater Harm?cited by 5
  29. 2025Practical Bayes-Optimal Membership Inference Attackscited by 5
  30. 2025SoK: Data Reconstruction Attacks Against Machine Learning Models: Definition, Metrics, and Benchmarkcited by 5
  31. 2021Adversarial Attacks and Defenses for Social Network Text Processing Applications: Techniques, Challenges and Future Research Directionscited by 4
  32. 2025GRID: Protecting Training Graph from Link Stealing Attacks on GNN Modelscited by 4
  33. 2025Unlearning Inversion Attacks for Graph Neural Networkscited by 4
  34. 2023Unveiling the Role of Message Passing in Dual-Privacy Preservation on GNNscited by 3
  35. 2024Efficient Model-Stealing Attacks Against Inductive Graph Neural Networkscited by 3
  36. 2024Large Language Models for Link Stealing Attacks Against Graph Neural Networkscited by 3
  37. 2024Stealing Training Graphs from Graph Neural Networkscited by 3
  38. 2025Adversarial Attacks and Defenses on Graph-aware Large Language Models (LLMs)cited by 3

50 most cited of 80 All 80 (JSON)