mlsanityData to 14 Oct 2026

Stealing Training Graphs from Graph Neural Networks

arXiv 2411.11197 ↗First posted 17 Nov 2024cs.LG cs.CRcited by 3

On the map: Diffusion models → Flow matching, time series and science

Abstract (arXiv)

Graph Neural Networks (GNNs) have shown promising results in modeling graphs in various tasks. The training of GNNs, especially on specialized tasks such as bioinformatics, demands extensive expert annotations, which are expensive and usually contain sensitive information of data providers. The trained GNN models are often shared for deployment in the real world. As neural networks can memorize the training samples, the model parameters of GNNs have a high risk of leaking private training data. Our theoretical analysis shows the strong connections between trained GNN parameters and the training graphs used, confirming the training graph leakage issue. However, explorations into training data leakage from trained GNNs are rather limited. Therefore, we investigate a novel problem of stealing graphs from trained GNNs. To obtain high-quality graphs that resemble the target training set, a graph diffusion model with diffusion noise optimization is deployed as a graph generator. Furthermore, we propose a selection method that effectively leverages GNN model parameters to identify training graphs from samples generated by the graph diffusion model. Extensive experiments on real-world datasets demonstrate the effectiveness of the proposed framework in stealing training graphs from the trained GNN.

Key facts. Cited by 3 papers in the map (data through 14 Oct 2026). Placed in Flow matching, time series and science, one of 14 directions in Diffusion models. Builds on 45 of its 75 references that are in the map. First posted on arXiv 17 Nov 2024.

Builds on

45 of 75 references.

Closest ancestors · 3

Same direction, newest first

  1. 2022Fast Graph Generation via Spectral Diffusion16 Nov
  2. 2022DiGress: Discrete Denoising diffusion for graph generation29 Sep
  3. 2022Equivariant Diffusion for Molecule Generation in 3D31 Mar

Other references · 42

  1. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 30,186
  2. 2020Denoising Diffusion Probabilistic Modelscited by 21,076
  3. 2016Semi-Supervised Classification with Graph Convolutional Networkscited by 11,361
  4. 2020Score-Based Generative Modeling through Stochastic Differential Equationscited by 9,122
  5. 2022Hierarchical Text-Conditional Image Generation with CLIP Latentscited by 6,585
  6. 2017Inductive Representation Learning on Large Graphscited by 6,320
  7. 2018How Powerful are Graph Neural Networks?cited by 4,393
  8. 2016Deep Learning with Differential Privacycited by 2,728
  9. 2022Imagen Video: High Definition Video Generation with Diffusion Modelscited by 1,778
  10. 2019Simplifying Graph Convolutional Networkscited by 1,477
  11. 2018Graph Convolutional Neural Networks for Web-Scale Recommender Systemscited by 1,138
  12. 2022eDiff-I: Text-to-Image Diffusion Models with an Ensemble of Expert Denoiserscited by 931
30 more
  1. 2019Graph Neural Networks for Social Recommendationcited by 714
  2. 2022Recipe for a General, Powerful, Scalable Graph Transformercited by 713
  3. 2019Gradient Descent Maximizes the Margin of Homogeneous Neural Networkscited by 320
  4. 2019A Fair Comparison of Graph Neural Networks for Graph Classificationcited by 244
  5. 2020Few-Shot Learning via Learning the Representation, Provablycited by 214
  6. 2020XGNN: Towards Model-Level Explanations of Graph Neural Networkscited by 211
  7. 2018Fr'echet ChemNet Distance: A metric for generative models for molecules in drug discoverycited by 194
  8. 2023On the Importance of Noise Scheduling for Diffusion Modelscited by 194
  9. 2020Directional convergence and alignment in deep learningcited by 178
  10. 2020Graph-Bert: Only Attention is Needed for Learning Graph Representationscited by 177
  11. 2020Say No to the Discrimination: Learning Fair Graph Neural Networks with Limited Sensitive Attribute Informationcited by 168
  12. 2021Spherical Message Passing for 3D Graph Networkscited by 168
  13. 2020A Semi-supervised Graph Attentive Network for Financial Fraud Detectioncited by 151
  14. 2022A Comprehensive Survey on Trustworthy Graph Neural Networks: Privacy, Robustness, Fairness, and Explainabilitycited by 118
  15. 2020Stealing Links from Graph Neural Networkscited by 115
  16. 2022A Survey of Knowledge Graph Reasoning on Graph Types: Static, Dynamic, and Multimodalcited by 106
  17. 2021Node-Level Membership Inference Attacks Against Graph Neural Networkscited by 84
  18. 2020Quantifying Privacy Leakage in Graph Embeddingcited by 82
  19. 2021Towards Self-Explainable Graph Neural Networkcited by 75
  20. 2023Diffusion-Based Adversarial Sample Generation for Improved Stealthiness and Controllabilitycited by 66
  21. 2019Lexicographic and Depth-Sensitive Margins in Homogeneous and Non-Homogeneous Deep Modelscited by 53
  22. 2021GraphMI: Extracting Private Graph Data from Graph Neural Networkscited by 50
  23. 2023Unnoticeable Backdoor Attacks on Graph Neural Networkscited by 45
  24. 2020Model Extraction Attacks on Graph Neural Networks: Taxonomy and Realizationcited by 40
  25. 2024Rethinking Graph Backdoor Attacks: A Distribution-Preserving Perspectivecited by 22
  26. 2024Decoding Time Series with LLMs: A Multi-Agent Framework for Cross-Domain Annotationcited by 21
  27. 2024LLM and GNN are Complementary: Distilling LLM for Multimodal Graph Learningcited by 17
  28. 2020Efficient, Direct, and Restricted Black-Box Graph Evasion Attacks to Any-Layer Graph Neural Networks via Influence Functioncited by 14
  29. 2023A Unified Framework of Graph Information Bottleneck for Robustness and Membership Privacycited by 14
  30. 2023Transitivity-Preserving Graph Representation Learning for Bridging Local Connectivity and Role-based Similaritycited by 14

Built on by

Cited by year

Citing papers per year: 2025: 3.

3 papers.

  1. 2025Unlearning Inversion Attacks for Graph Neural Networkscited by 4
  2. 2025Intellectual Property in Graph-Based Machine Learning as a Service: Attacks and Defensescited by 3
  3. 2025ADAGE: Active Defenses Against GNN Extractioncited by 2

Similar, not cited

Close in wording, no citation either way

  1. 2024DM4Steal: Diffusion Model For Link Stealing Attack On Graph Neural Networks
  2. 2025Graph Defense Diffusion Model
  3. 2023GraphGuard: Detecting and Counteracting Training Data Misuse in Graph Neural Networks
  4. 2026GraphIP-Bench: How Hard Is It to Steal a Graph Neural Network, and Can We Stop It?
  5. 2025Graph Unlearning: Efficient Node Removal in Graph Neural Networks
  6. 2024IDEA: A Flexible Framework of Certified Unlearning for Graph Neural Networks
  7. 2024Diffusing to the Top: Boost Graph Neural Networks with Minimal Hyperparameter Tuning
  8. 2026Inference Attacks Against Graph Generative Diffusion Models