Watermarking Graph Neural Networks via Explanations for Ownership Protection
Not on the map. Why?
Abstract (arXiv)
Graph Neural Networks (GNNs) are widely deployed in industry, making their intellectual property valuable. However, protecting GNNs from unauthorized use remains a challenge. Watermarking offers a solution by embedding ownership information into models. Existing watermarking methods have two limitations: First, they rarely focus on graph data or GNNs. Second, the de facto backdoor-based method relies on manipulating training data, which can introduce ownership ambiguity through misclassification and vulnerability to data poisoning attacks that can interrupt the backdoor mechanism. Our explanation-based watermarking inherits the strengths of backdoor-based methods (e.g., black-box verification) without data manipulation, eliminating ownership ambiguity and data dependencies. In particular, we watermark GNN explanations such that these explanations are statistically distinct from others, so ownership claims must be verified through statistical significance. We theoretically prove that, even with full knowledge of our method, locating the watermark is NP-hard. Empirically, our method demonstrates robustness to fine-tuning and pruning attacks. By addressing these challenges, our approach significantly advances GNN intellectual property protection.
Key facts. Cited by 3 papers in the map (data through 7 Oct 2026). Builds on 48 of its 73 references that are in the map. First posted on arXiv 9 Jan 2025.
Builds on
48 of 73 references.
References · 48
- 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,160
- 2016Semi-Supervised Classification with Graph Convolutional Networkscited by 11,282
- 2017Graph Attention Networkscited by 8,854
- 2017Inductive Representation Learning on Large Graphscited by 6,284
- 2020Knowledge Distillation: A Surveycited by 1,578
- 2018Graph Neural Networks: A Review of Methods and Applicationscited by 1,571
- 2019Simplifying Graph Convolutional Networkscited by 1,470
- 2022Model soups: averaging weights of multiple fine-tuned models improves accuracy without increasing inference timecited by 1,366
- 2016Pruning Filters for Efficient ConvNetscited by 1,129
- 2018Pitfalls of Graph Neural Network Evaluationcited by 994
- 2016Revisiting Semi-Supervised Learning with Graph Embeddingscited by 970
- 2019GNNExplainer: Generating Explanations for Graph Neural Networkscited by 735
36 more
- 2019GraphSAINT: Graph Sampling Based Inductive Learning Methodcited by 618
- 2020Masked Label Prediction: Unified Message Passing Model for Semi-Supervised Classificationcited by 500
- 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 429
- 2020Parameterized Explainer for Graph Neural Networkcited by 423
- 2018Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooringcited by 334
- 2017Certified Defenses for Data Poisoning Attackscited by 288
- 2020GraphLIME: Local Interpretable Model Explanations for Graph Neural Networkscited by 209
- 2019AliGraph: A Comprehensive Graph Neural Network Platformcited by 152
- 2017Adversarial Frontier Stitching for Remote Neural Network Watermarkingcited by 110
- 2019DAWN: Dynamic Adversarial Watermarking of Neural Networkscited by 94
- 2020Certified Robustness of Graph Neural Networks against Adversarial Structural Perturbationcited by 57
- 2019Attacking Graph-based Classification via Manipulating the Graph Structurecited by 53
- 2021Model Stealing Attacks Against Inductive Graph Neural Networkscited by 50
- 2021Copy, Right? A Testing Framework for Copyright Protection of Deep Learning Modelscited by 44
- 2022Certified Neural Network Watermarks with Randomized Smoothingcited by 39
- 2024Explanation as a Watermark: Towards Harmless and Multi-bit Model Ownership Verification via Watermarking Feature Attributioncited by 35
- 2019Data Poisoning Attack against Knowledge Graph Embeddingcited by 34
- 2020WAFFLE: Watermarking in Federated Learningcited by 34
- 2021On Fast Adversarial Robustness Adaptation in Model-Agnostic Meta-Learningcited by 29
- 2021A Hard Label Black-box Adversarial Attack Against Graph Neural Networkscited by 26
- 2019BlackMarks: Blackbox Multibit Watermarking for Deep Neural Networkscited by 25
- 2021Watermarking Graph Neural Networks based on Backdoor Attackscited by 25
- 2022FedTracker: Furnishing Ownership Verification and Traceability for Federated Learning Modelcited by 25
- 2023Rethinking White-Box Watermarks on Deep Learning Models under Neural Structural Obfuscationcited by 20
- 2023False Claims against Model Ownership Resolutioncited by 17
- 2023GrOVe: Ownership Verification of Graph Neural Networks using Embeddingscited by 16
- 2020Efficient, Direct, and Restricted Black-Box Graph Evasion Attacks to Any-Layer Graph Neural Networks via Influence Functioncited by 14
- 2023Turning Strengths into Weaknesses: A Certified Robustness Inspired Attack Framework against Graph Neural Networkscited by 11
- 2022Bandits for Structure Perturbation-based Black-box Attacks to Graph Neural Networks with Theoretical Guaranteescited by 9
- 2023When Federated Learning meets Watermarking: A Comprehensive Overview of Techniques for Intellectual Property Protectioncited by 6
- 2024Identifying Backdoored Graphs in Graph Neural Network Training: An Explanation-Based Approach with Novel Metricscited by 6
- 2020Semi-Supervised Node Classification on Graphs: Markov Random Fields vs. Graph Neural Networkscited by 5
- 2024FedGMark: Certifiably Robust Watermarking for Federated Graph Learningcited by 5
- 2024Efficient and Robust Continual Graph Learning for Graph Classification in Biologycited by 3
- 2021High-Robustness, Low-Transferability Fingerprinting of Neural Networkscited by 1
- 2024Heterogeneous Entity Representation for Medicinal Synergy Predictioncited by 1
Built on by
Citing papers per year: 2025: 1; 2026: 2.
3 papers.