mlsanityData to 14 Oct 2026

Who Owns This Sample: Cross-Client Membership Inference Attack in Federated Graph Neural Networks

arXiv 2507.19964 ↗First posted 26 Jul 2025cs.LGcited by 0

Not on the map. Why?

Abstract (arXiv)

Graph-structured data is prevalent in many real-world applications, including social networks, financial systems, and molecular biology. Graph Neural Networks (GNNs) have become the de facto standard for learning from such data due to their strong representation capabilities. As GNNs are increasingly deployed in federated learning (FL) settings to preserve data locality and privacy, new privacy threats arise from the interaction between graph structures and decentralized training. In this paper, we present the first systematic study of cross-client membership inference attacks (CC-MIA) against node classification tasks of federated GNNs (FedGNNs), where a malicious client aims to infer which client owns the given data. Unlike prior centralized-focused work that focuses on whether a sample was included in training, our attack targets sample-to-client attribution, a finer-grained privacy risk unique to federated settings. We design a general attack framework that exploits FedGNNs' aggregation behaviors, gradient updates, and embedding proximity to link samples to their source clients across training rounds. We evaluate our attack across multiple graph datasets under realistic FL setups. Results show that our method achieves high performance on both membership inference and ownership identification. Our findings highlight a new privacy threat in federated graph learning-client identity leakage through structural and model-level cues, motivating the need for attribution-robust GNN design.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 34 of its 59 references that are in the map. First posted on arXiv 26 Jul 2025.

Builds on

34 of 59 references.

References · 34

  1. 2016Semi-Supervised Classification with Graph Convolutional Networkscited by 11,361
  2. 2017Graph Attention Networkscited by 8,923
  3. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,669
  4. 2017Inductive Representation Learning on Large Graphscited by 6,320
  5. 2018Federated Optimization in Heterogeneous Networkscited by 2,987
  6. 2019A Comprehensive Survey on Graph Neural Networkscited by 2,919
  7. 2018Pitfalls of Graph Neural Network Evaluationcited by 1,007
  8. 2016Revisiting Semi-Supervised Learning with Graph Embeddingscited by 976
  9. 2020Tackling the Objective Inconsistency Problem in Heterogeneous Federated Optimizationcited by 906
  10. 2018How To Backdoor Federated Learningcited by 765
  11. 2020Ensemble Distillation for Robust Model Fusion in Federated Learningcited by 682
  12. 2018Exploiting Unintended Feature Leakage in Collaborative Learningcited by 520
22 more
  1. 2020iDLG: Improved Deep Leakage from Gradientscited by 382
  2. 2018Analyzing Federated Learning through an Adversarial Lenscited by 351
  3. 2017Deep Gaussian Embedding of Graphs: Unsupervised Inductive Learning via Rankingcited by 335
  4. 2018Beyond Inferring Class Representatives: User-Level Privacy Leakage From Federated Learningcited by 246
  5. 2021Federated Graph Classification over Non-IID Graphscited by 114
  6. 2021Node-Level Membership Inference Attacks Against Graph Neural Networkscited by 84
  7. 2021Membership Inference Attack on Graph Neural Networkscited by 81
  8. 2020Locally Private Graph Neural Networkscited by 64
  9. 2021Adapting Membership Inference Attacks to GNN for Graph Classification: Approaches and Implicationscited by 52
  10. 2022Federated Graph Neural Networks: Overview, Techniques and Challengescited by 52
  11. 2021GraphMI: Extracting Private Graph Data from Graph Neural Networkscited by 50
  12. 2022Privately Fine-Tuning Large Language Models with Differential Privacycited by 39
  13. 2024Membership Inference Attacks and Defenses in Federated Learning: A Surveycited by 31
  14. 2022Auditing Membership Leakages of Multi-Exit Networkscited by 27
  15. 2020Federated Learning with Sparsification-Amplified Privacy and Adaptive Optimizationcited by 26
  16. 2022Label-Only Membership Inference Attack against Node-Level Graph Neural Networkscited by 19
  17. 2022Watermarking in Secure Federated Learning: A Verification Framework Based on Client-Side Backdooringcited by 17
  18. 2023FedDefender: Client-Side Attack-Tolerant Federated Learningcited by 12
  19. 2019RoadTagger: Robust Road Attribute Inference with Graph Neural Networkscited by 11
  20. 2024Robust Federated Learning Mitigates Client-side Training Data Distribution Inference Attackscited by 11
  21. 2023Simplifying Distributed Neural Network Training on Massive Graphs: Randomized Partitions Improve Model Aggregationcited by 7
  22. 2024Gradient Inversion Attack on Graph Neural Networkscited by 4

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2022More is Better (Mostly): On the Backdoor Attacks in Federated Graph Neural Networks
  2. 2024A Federated Parameter Aggregation Method for Node Classification Tasks with Different Graph Network Structures
  3. 2024Federated Graph Condensation with Information Bottleneck Principles
  4. 2023Turning Privacy-preserving Mechanisms against Federated Learning
  5. 2021Efficient passive membership inference attack in federated learning
  6. 2022Perfectly Accurate Membership Inference by a Dishonest Central Server in Federated Learning
  7. 2025An Out-Of-Distribution Membership Inference Attack Approach for Cross-Domain Graph Attacks
  8. 2026Evaluating Differential Privacy Against Membership Inference in Federated Learning: Insights from the NIST Genomics Red Team Challenge