mlsanityData to 7 Oct 2026

Model Stealing Attacks Against Inductive Graph Neural Networks

arXiv 2112.08331 ↗First posted 15 Dec 2021cs.CR cs.LGcited by 50

Not on the map. Why?

Abstract (arXiv)

Many real-world data come in the form of graphs. Graph neural networks (GNNs), a new family of machine learning (ML) models, have been proposed to fully leverage graph data to build powerful applications. In particular, the inductive GNNs, which can generalize to unseen data, become mainstream in this direction. Machine learning models have shown great potential in various tasks and have been deployed in many real-world scenarios. To train a good model, a large amount of data as well as computational resources are needed, leading to valuable intellectual property. Previous research has shown that ML models are prone to model stealing attacks, which aim to steal the functionality of the target models. However, most of them focus on the models trained with images and texts. On the other hand, little attention has been paid to models trained with graph data, i.e., GNNs. In this paper, we fill the gap by proposing the first model stealing attacks against inductive GNNs. We systematically define the threat model and propose six attacks based on the adversary's background knowledge and the responses of the target models. Our evaluation on six benchmark datasets shows that the proposed model stealing attacks against GNNs achieve promising performance.

Key facts. Cited by 50 papers in the map (data through 7 Oct 2026). Builds on 72 of its 98 references that are in the map. First posted on arXiv 15 Dec 2021.

Builds on

72 of 98 references.

References · 72

  1. 2016Semi-Supervised Classification with Graph Convolutional Networkscited by 11,282
  2. 2017Graph Attention Networkscited by 8,854
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  4. 2017Inductive Representation Learning on Large Graphscited by 6,284
  5. 2014Neural Machine Translation by Jointly Learning to Align and Translatecited by 4,530
  6. 2018How Powerful are Graph Neural Networks?cited by 4,355
  7. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  8. 2019A Comprehensive Survey on Graph Neural Networkscited by 2,906
  9. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  10. 2020Extracting Training Data from Large Language Modelscited by 2,144
  11. 2016node2vec: Scalable Feature Learning for Networkscited by 1,913
  12. 2018Graph Neural Networks: A Review of Methods and Applicationscited by 1,571
38 more
  1. 2014DeepWalk: Online Learning of Social Representationscited by 1,543
  2. 2018Pitfalls of Graph Neural Network Evaluationcited by 994
  3. 2019Strategies for Pre-training Graph Neural Networkscited by 964
  4. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  5. 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
  6. 2018Hierarchical Graph Representation Learning with Differentiable Poolingcited by 786
  7. 2019Heterogeneous Graph Attention Networkcited by 732
  8. 2015Image-based Recommendations on Styles and Substitutescited by 702
  9. 2015Distillation as a Defense to Adversarial Perturbations against Deep Neural Networkscited by 675
  10. 2016Stealing Machine Learning Models via Prediction APIscited by 602
  11. 2018ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Modelscited by 475
  12. 2019Self-Attention Graph Poolingcited by 421
  13. 2019Federated Machine Learning: Concept and Applicationscited by 409
  14. 2018Adversarial Attacks on Neural Networks for Graph Datacited by 395
  15. 2018Deep Learning on Graphs: A Surveycited by 393
  16. 2020Label-Only Membership Inference Attackscited by 371
  17. 2018Adversarial Attack on Graph Structured Datacited by 300
  18. 2018Knockoff Nets: Stealing Functionality of Black-Box Modelscited by 285
  19. 2019White-box vs Black-box: Bayes Optimal Strategies for Membership Inferencecited by 265
  20. 2019Adversarial Attacks on Graph Neural Networks via Meta Learningcited by 261
  21. 2016Molecular Graph Convolutions: Moving Beyond Fingerprintscited by 238
  22. 2018Modeling polypharmacy side effects with graph convolutional networkscited by 237
  23. 2019Adversarial Attacks and Defenses in Images, Graphs and Text: A Reviewcited by 234
  24. 2020Iterative Deep Graph Learning for Graph Neural Networks: Better and Robust Node Embeddingscited by 212
  25. 2019High Accuracy and High Fidelity Extraction of Neural Networkscited by 208
  26. 2019Topology Attack and Defense for Graph Neural Networks: An Optimization Perspectivecited by 196
  27. 2017Graph Embedding Techniques, Applications, and Performance: A Surveycited by 188
  28. 2019MemGuard: Defending against Black-Box Membership Inference Attacks via Adversarial Examplescited by 183
  29. 2018Adversarial Attack and Defense on Graph Data: A Surveycited by 166
  30. 2018PRADA: Protecting against DNN Model Stealing Attackscited by 159
  31. 2020Membership Leakage in Label-Only Exposurescited by 156
  32. 2019Thieves on Sesame Street! Model Extraction of BERT-based APIscited by 136
  33. 2021Interpreting and Unifying Graph Neural Networks with An Optimization Frameworkcited by 131
  34. 2020Backdoor Attacks to Graph Neural Networkscited by 126
  35. 2018Stealing Hyperparameters in Machine Learningcited by 115
  36. 2020Stealing Links from Graph Neural Networkscited by 114
  37. 2020Graph Backdoorcited by 112
  38. 2018Adversarial Attacks on Node Embeddings via Graph Poisoningcited by 109

50 most cited of 72 All 72 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 8; 2023: 14; 2024: 13; 2025: 9; 2026: 6.

50 papers.

Sort:

By area:

  1. 2022A Comprehensive Survey on Trustworthy Graph Neural Networks: Privacy, Robustness, Fairness, and Explainabilitycited by 118
  2. 2022I Know What You Trained Last Summer: A Survey on Stealing Machine Learning Models and Defencescited by 75
  3. 2024Risk Taxonomy, Mitigation, and Assessment Benchmarks of Large Language Model Systemscited by 63
  4. 2024A Survey of Graph Neural Networks in Real world: Imbalance, Noise, Privacy and OOD Challengescited by 54
  5. 2022SSLGuard: A Watermarking Scheme for Self-supervised Learning Pre-trained Encoderscited by 43
  6. 2022Can't Steal? Cont-Steal! Contrastive Stealing Attacks Against Image Encoderscited by 30
  7. 2023A Survey on Privacy in Graph Neural Networks: Attacks, Preservation, and Applicationscited by 22
  8. 2023No Privacy Left Outside: On the (In-)Security of TEE-Shielded DNN Partition for On-Device MLcited by 21
  9. 2023GrOVe: Ownership Verification of Graph Neural Networks using Embeddingscited by 16
  10. 2023On Strengthening and Defending Graph Reconstruction Attack with Markov Chain Approximationcited by 16
  11. 2022Machine Learning with Confidential Computing: A Systematization of Knowledgecited by 13
  12. 2024Safety in Graph Machine Learning: Threats and Safeguardscited by 11
38 more
  1. 2025HateBench: Benchmarking Hate Speech Detectors on LLM-Generated Content and Hate Campaignscited by 10
  2. 2025CEGA: A Cost-Effective Approach for Graph-Based Model Extraction and Acquisitioncited by 9
  3. 2023Bucks for Buckets (B4B): Active Defenses Against Stealing Encoderscited by 8
  4. 2024A Fast, Performant, Secure Distributed Training Framework For Large Language Modelcited by 8
  5. 2023Does Black-box Attribute Inference Attacks on Graph Neural Networks Constitute Privacy Risk?cited by 7
  6. 2024Rethinking the impact of noisy labels in graph classification: A utility and privacy perspectivecited by 5
  7. 2022Finding MNEMON: Reviving Memories of Node Embeddingscited by 4
  8. 2022Privacy of Autonomous Vehicles: Risks, Protection Methods, and Future Directionscited by 4
  9. 2023A Plot is Worth a Thousand Words: Model Information Stealing Attacks via Scientific Plotscited by 4
  10. 2023SecurityNet: Assessing Machine Learning Vulnerabilities on Public Modelscited by 4
  11. 2023FDINet: Protecting against DNN Model Extraction via Feature Distortion Indexcited by 3
  12. 2024RobWE: Robust Watermark Embedding for Personalized Federated Learning Model Ownership Protectioncited by 3
  13. 2024Efficient Model-Stealing Attacks Against Inductive Graph Neural Networkscited by 3
  14. 2024GENIE: Watermarking Graph Neural Networks for Link Predictioncited by 3
  15. 2024Large Language Models for Link Stealing Attacks Against Graph Neural Networkscited by 3
  16. 2025Watermarking Graph Neural Networks via Explanations for Ownership Protectioncited by 3
  17. 2026Connect the Dots: Knowledge Graph-Guided Crawler Attack on Retrieval-Augmented Generation Systemscited by 3
  18. 2026CITED: A Decision Boundary-Aware Signature for GNNs Towards Model Extraction Defensecited by 3
  19. 2023A Comprehensive Study of Privacy Risks in Curriculum Learningcited by 2
  20. 2024Link Stealing Attacks Against Inductive Graph Neural Networkscited by 2
  21. 2024On the Validity of Traditional Vulnerability Scoring Systems for Adversarial Attacks against LLMscited by 2
  22. 2025ADAGE: Active Defenses Against GNN Extractioncited by 2
  23. 2025Intellectual Property in Graph-Based Machine Learning as a Service: Attacks and Defensescited by 2
  24. 2023GNNBleed: Inference Attacks to Unveil Private Edges in Graphs with Realistic Access to GNN Modelscited by 1
  25. 2025WGLE:Backdoor-free and Multi-bit Black-box Watermarking for Graph Neural Networkscited by 1
  26. 2025Attacks and Defenses Against LLM Fingerprintingcited by 1
  27. 2025A Systematic Study of Model Extraction Attacks on Graph Foundation Modelscited by 1
  28. 2022Model Extraction Attack against Self-supervised Speech Modelscited by 0
  29. 2023Exploring Machine Learning Privacy/Utility trade-off from a hyperparameters Lenscited by 0
  30. 2023Generated Graph Detectioncited by 0
  31. 2023Model Stealing Attack against Graph Classification with Authenticity, Uncertainty and Diversitycited by 0
  32. 2024Stealing the Invisible: Unveiling Pre-Trained CNN Models through Adversarial Examples and Timing Side-Channelscited by 0
  33. 2024Query-Efficient Adversarial Attack Against Vertical Federated Graph Learningcited by 0
  34. 2025Data-Free Model-Related Attacks: Unleashing the Potential of Generative AIcited by 0
  35. 2026COPYCOP: Ownership Verification for Graph Neural Networkscited by 0
  36. 2026Can Subgraph Explanations Be Weaponized to Steal Graph Neural Networks?cited by 0
  37. 2026TEE-X: TEE-aware Acceleration Framework for Large Vision Models at the Edgecited by 0
  38. 2026Dagger: Decoupling-based Model Stealing Attack against Graph Neural Networkscited by 0