mlsanityData to 14 Oct 2026

Watermarking Graph Neural Networks based on Backdoor Attacks

arXiv 2110.11024 ↗First posted 21 Oct 2021cs.LG cs.CRcited by 25

Not on the map. Why?

Abstract (arXiv)

Graph Neural Networks (GNNs) have achieved promising performance in various real-world applications. Building a powerful GNN model is not a trivial task, as it requires a large amount of training data, powerful computing resources, and human expertise in fine-tuning the model. Moreover, with the development of adversarial attacks, e.g., model stealing attacks, GNNs raise challenges to model authentication. To avoid copyright infringement on GNNs, verifying the ownership of the GNN models is necessary. This paper presents a watermarking framework for GNNs for both graph and node classification tasks. We 1) design two strategies to generate watermarked data for the graph classification task and one for the node classification task, 2) embed the watermark into the host model through training to obtain the watermarked GNN model, and 3) verify the ownership of the suspicious model in a black-box setting. The experiments show that our framework can verify the ownership of GNN models with a very high probability (up to 99%) for both tasks. Finally, we experimentally show that our watermarking approach is robust against a state-of-the-art model extraction technique and four state-of-the-art defenses against backdoor attacks.

Key facts. Cited by 25 papers in the map (data through 14 Oct 2026). Builds on 40 of its 83 references that are in the map. First posted on arXiv 21 Oct 2021.

Builds on

40 of 83 references.

References · 40

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
  3. 2016Semi-Supervised Classification with Graph Convolutional Networkscited by 11,361
  4. 2017Graph Attention Networkscited by 8,923
  5. 2017Inductive Representation Learning on Large Graphscited by 6,320
  6. 2018How Powerful are Graph Neural Networks?cited by 4,393
  7. 2019A Comprehensive Survey on Graph Neural Networkscited by 2,919
  8. 2020Knowledge Distillation: A Surveycited by 1,603
  9. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,340
  10. 2019Energy and Policy Considerations for Deep Learning in NLPcited by 1,254
  11. 2014How transferable are features in deep neural networks?cited by 1,225
  12. 2016Practical Black-Box Attacks against Machine Learningcited by 903
28 more
  1. 2018Hierarchical Graph Representation Learning with Differentiable Poolingcited by 787
  2. 2020TUDataset: A collection of benchmark datasets for learning with graphscited by 728
  3. 2013Speech Recognition with Deep Recurrent Neural Networkscited by 669
  4. 2016Stealing Machine Learning Models via Prediction APIscited by 619
  5. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 580
  6. 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 456
  7. 2018Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooringcited by 357
  8. 2018Knockoff Nets: Stealing Functionality of Black-Box Modelscited by 292
  9. 2017Embedding Watermarks into Deep Neural Networkscited by 248
  10. 2019Detecting AI Trojans Using Meta Neural Analysiscited by 199
  11. 2021Does Knowledge Distillation Really Work?cited by 190
  12. 2019Anti-Money Laundering in Bitcoin: Experimenting with Graph Convolutional Networks for Financial Forensicscited by 164
  13. 2020Entangled Watermarks as a Defense against Model Extractioncited by 149
  14. 2021Graph Unlearningcited by 138
  15. 2020Backdoor Attacks to Graph Neural Networkscited by 128
  16. 2020Data-Free Model Extractioncited by 124
  17. 2020Graph Backdoorcited by 112
  18. 2015A Primer on Neural Network Models for Natural Language Processingcited by 76
  19. 2021A survey of deep neural network watermarking techniquescited by 73
  20. 2021SoK: How Robust is Image Classification Deep Neural Network Watermarking? (Extended Version)cited by 69
  21. 2020Model Watermarking for Image Processing Networkscited by 56
  22. 2020A Systematic Review on Model Watermarking for Neural Networkscited by 52
  23. 2021Red Alarm for Pre-trained Models: Universal Vulnerability to Neuron-Level Backdoor Attackscited by 49
  24. 2021Graph-Free Knowledge Distillation for Graph Neural Networkscited by 46
  25. 2021Explainability-based Backdoor Attacks Against Graph Neural Networkscited by 42
  26. 2019Februus: Input Purification Defense Against Trojan Attacks on Deep Neural Network Systemscited by 27
  27. 2019Forget Me Not: Reducing Catastrophic Forgetting for Domain Adaptation in Reading Comprehensioncited by 27
  28. 2020Watermarking Graph Neural Networks by Random Graphscited by 25

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2022: 1; 2023: 2; 2024: 9; 2025: 6; 2026: 7.

25 papers.

Sort:

By area:

  1. 2022Black-box Dataset Ownership Verification via Backdoor Watermarkingcited by 65
  2. 2024A Survey of Graph Neural Networks in Real world: Imbalance, Noise, Privacy and OOD Challengescited by 54
  3. 2023GrOVe: Ownership Verification of Graph Neural Networks using Embeddingscited by 16
  4. 2023Defenses in Adversarial Machine Learning: A Surveycited by 14
  5. 2024Safety in Graph Machine Learning: Threats and Safeguardscited by 11
  6. 2024BAN: Detecting Backdoors Activated by Adversarial Neuron Noisecited by 8
  7. 2026CREDIT: Certified Ownership Verification of Deep Neural Networks Against Model Extraction Attackscited by 5
  8. 2024Graph Neural Backdoor: Fundamentals, Methodologies, Applications, and Future Directionscited by 4
  9. 2024PreGIP: Watermarking the Pretraining of Graph Neural Networks for Deep Intellectual Property Protectioncited by 3
  10. 2024Efficient Model-Stealing Attacks Against Inductive Graph Neural Networkscited by 3
  11. 2024GENIE: Watermarking Graph Neural Networks for Link Predictioncited by 3
  12. 2025Watermarking Graph Neural Networks via Explanations for Ownership Protectioncited by 3
13 more
  1. 2025Intellectual Property in Graph-Based Machine Learning as a Service: Attacks and Defensescited by 3
  2. 2026CITED: A Decision Boundary-Aware Signature for GNNs Towards Model Extraction Defensecited by 3
  3. 2025ADAGE: Active Defenses Against GNN Extractioncited by 2
  4. 2024NoiseAttack: An Evasive Sample-Specific Multi-Targeted Backdoor Attack Through White Gaussian Noisecited by 1
  5. 2025WGLE:Backdoor-free and Multi-bit Black-box Watermarking for Graph Neural Networkscited by 1
  6. 2025Safeguarding Multimodal Knowledge Copyright in the RAG-as-a-Service Environmentcited by 1
  7. 2026Robust LLM Watermarking with Minimal Semantic Distortion for IP Protectioncited by 1
  8. 2024Watermarking Recommender Systemscited by 0
  9. 2025Robust GNN Watermarking via Implicit Perception of Topological Invariantscited by 0
  10. 2026BadImplant: Injection-based Multi-Targeted Graph Backdoor Attackcited by 0
  11. 2026COPYCOP: Ownership Verification for Graph Neural Networkscited by 0
  12. 2026A Robust Watermark-based Fingerprint Framework for GNNs Ownership Verificationcited by 0
  13. 2026Dagger: Decoupling-based Model Stealing Attack against Graph Neural Networkscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026GraphIP-Bench: How Hard Is It to Steal a Graph Neural Network, and Can We Stop It?
  2. 2023OVLA: Neural Network Ownership Verification using Latent Watermarks
  3. 2025Persistence of Backdoor-based Watermarks for Neural Networks: A Comprehensive Evaluation
  4. 2023Towards Robust Model Watermark via Reducing Parametric Vulnerability
  5. 2021Detect and remove watermark in deep neural networks via generative adversarial networks
  6. 2021Anti-Neuron Watermarking: Protecting Personal Data Against Unauthorized Neural Networks
  7. 2023Towards Traitor Tracing in Black-and-White-Box DNN Watermarking with Tardos-based Codes
  8. 2025A Game Between the Defender and the Attacker for Trigger-based Black-box Model Watermarking