Intellectual Property in Graph-Based Machine Learning as a Service: Attacks and Defenses
Not on the map. Why?
Abstract (arXiv)
Graph-structured data, which captures non-Euclidean relationships and interactions between entities, is growing in scale and complexity. As a result, training state-of-the-art graph machine learning (GML) models have become increasingly resource-intensive, turning these models and data into invaluable Intellectual Property (IP). To address the resource-intensive nature of model training, graph-based Machine-Learning-as-a-Service (GMLaaS) has emerged as an efficient solution by leveraging third-party cloud services for model development and management. However, deploying such models in GMLaaS also exposes them to potential threats from attackers. Specifically, while the APIs within a GMLaaS system provide interfaces for users to query the model and receive outputs, they also allow attackers to exploit and steal model functionalities or sensitive training data, posing severe threats to the safety of these GML models and the underlying graph data. To address these challenges, this survey systematically introduces the first taxonomy of threats and defenses at the level of both GML model and graph-structured data. Such a tailored taxonomy facilitates an in-depth understanding of GML IP protection. Furthermore, we present a systematic evaluation framework to assess the effectiveness of IP protection methods, introduce a curated set of benchmark datasets across various domains, and discuss their application scopes and future challenges. Finally, we establish an open-sourced versatile library named PyGIP, which evaluates various attack and defense techniques in GMLaaS scenarios and facilitates the implementation of existing benchmark methods. The library resource can be accessed at: https://labrai.github.io/PyGIP. We believe this survey will play a fundamental role in intellectual property protection for GML and provide practical recipes for the GML community.
Key facts. Cited by 3 papers in the map (data through 14 Oct 2026). Builds on 136 of its 237 references that are in the map. First posted on arXiv 27 Aug 2025.
Builds on
136 of 237 references.
References · 136
- 2017Graph Attention Networkscited by 8,923
- 2017Inductive Representation Learning on Large Graphscited by 6,320
- 2018How Powerful are Graph Neural Networks?cited by 4,393
- 2019A Comprehensive Survey on Graph Neural Networkscited by 2,919
- 2016node2vec: Scalable Feature Learning for Networkscited by 1,918
- 2019Simplifying Graph Convolutional Networkscited by 1,477
- 2019SuperGlue: Learning Feature Matching with Graph Neural Networkscited by 1,443
- 2018Graph Convolutional Neural Networks for Web-Scale Recommender Systemscited by 1,138
- 2018Link Prediction Based on Graph Neural Networkscited by 832
- 2019Graph WaveNet for Deep Spatial-Temporal Graph Modelingcited by 829
- 2016Stealing Machine Learning Models via Prediction APIscited by 619
- 2020Adaptive Graph Convolutional Recurrent Network for Traffic Forecastingcited by 530
38 more
- 2020Graph Neural Networks in Recommender Systems: A Surveycited by 494
- 2017Representation Learning on Graphs: Methods and Applicationscited by 457
- 2018GraphRNN: Generating Realistic Graphs with Deep Auto-regressive Modelscited by 413
- 2020Graph Structure Learning for Robust Graph Neural Networkscited by 371
- 2023A critical look at the evaluation of GNNs under heterophily: Are we really making progress?cited by 343
- 2021Membership Inference Attacks on Machine Learning: A Surveycited by 321
- 2018Knockoff Nets: Stealing Functionality of Black-Box Modelscited by 292
- 2020Wiki-CS: A Wikipedia-Based Benchmark for Graph Neural Networkscited by 260
- 2018Modeling polypharmacy side effects with graph convolutional networkscited by 237
- 2019Efficient Graph Generation with Graph Recurrent Attention Networkscited by 234
- 2022ADBench: Anomaly Detection Benchmarkcited by 232
- 2023Language is All a Graph Needscited by 220
- 2017struc2vec: Learning Node Representations from Structural Identitycited by 215
- 2020Iterative Deep Graph Learning for Graph Neural Networks: Better and Robust Node Embeddingscited by 214
- 2023NodeFormer: A Scalable Graph Structure Learning Transformer for Node Classificationcited by 210
- 2019Position-aware Graph Neural Networkscited by 203
- 2020GNNGuard: Defending Graph Neural Networks against Adversarial Attackscited by 195
- 2018Adversarial Attack and Defense on Graph Data: A Surveycited by 167
- 2018PRADA: Protecting against DNN Model Stealing Attackscited by 165
- 2020Graph Clustering with Graph Neural Networkscited by 163
- 2021GraphSMOTE: Imbalanced Node Classification on Graphs with Graph Neural Networkscited by 147
- 2022Data Augmentation for Deep Graph Learning: A Surveycited by 133
- 2022ROLAND: Graph Learning Framework for Dynamic Graphscited by 132
- 2022A Comprehensive Survey on Trustworthy Graph Neural Networks: Privacy, Robustness, Fairness, and Explainabilitycited by 118
- 2022Pre-training Enhanced Spatial-temporal Graph Neural Network for Multivariate Time Series Forecastingcited by 117
- 2020Heterogeneous Graph Neural Networks for Malicious Account Detectioncited by 96
- 2022Trustworthy Graph Neural Networks: Aspects, Methods and Trendscited by 89
- 2019Learning the Graphical Structure of Electronic Health Records with Graph Convolutional Transformercited by 88
- 2018Model Reconstruction from Model Explanationscited by 86
- 2016Yelp Dataset Challenge: Review Rating Predictioncited by 84
- 2021Node-Level Membership Inference Attacks Against Graph Neural Networkscited by 84
- 2021Protecting Intellectual Property of Language Generation APIs with Lexical Watermarkcited by 84
- 2020Quantifying Privacy Leakage in Graph Embeddingcited by 82
- 2023GIT-Mol: A Multi-modal Large Language Model for Molecular Science with Graph, Image, and Textcited by 82
- 2021Membership Inference Attack on Graph Neural Networkscited by 81
- 2021Graph Representation Learning in Biomedicinecited by 80
- 2022I Know What You Trained Last Summer: A Survey on Stealing Machine Learning Models and Defencescited by 75
- 2021Mitigating Membership Inference Attacks by Self-Distillation Through a Novel Ensemble Architecturecited by 67
50 most cited of 136 All 136 (JSON)
Built on by
Citing papers per year: 2025: 1; 2026: 2.
3 papers.