Rethinking Generative Reconstruction Attacks against Graph Neural Network Models
2026-06-29 • Artificial Intelligence
Artificial IntelligenceMachine Learning
AI summaryⓘ
The authors studied how Graph Neural Networks (GNNs), which analyze complex graph data, can accidentally leak private information. They created two new methods for attackers to reconstruct sensitive graph data from the model's outputs and inner data. Testing on multiple datasets showed that these attacks can create accurate graph copies even when only limited access is allowed. They also showed these attacks still work well with fewer queries and that adding noise to the data isn't always enough to stop leaks.
Graph Neural NetworksGraph DataPrivacy AttacksModel Inversion AttackGraph ReconstructionBlack-box AttackGenerator-Discriminator TechniqueLaplacian NoiseData PrivacyBenchmark Datasets
Authors
Adebayo Keji, Sayanton Dibbo
Abstract
The application of graph data in numerous disciplines raises the need for gathering and analyzing huge volumes of data, some of which is private and sensitive. The non-Euclidean nature of the graph data makes the analysis computationally challenging, leading to the use of Graph Neural Networks (GNNs) in the age of AI. GNNs may inadvertently leak sensitive data they are trained on, which raises serious data security issues, including the model inversion attack. In this study, we analyze GNNs' vulnerabilities by introducing two novel graph inversion (i.e., reconstruction) attacks: graph-label conditioned (GLC) attack and embedding-label conditioned (ELC) attack, utilizing targetmodel predictions and their intermediate representations, respectively. We perform a comprehensive analysis of our introduced privacy attacks and compare them with existing baselines across three benchmark graph datasets (i.e., NCI1, PROTEINS, and AIDS) and four graph distributional/structural metrics (i.e., FGD, EGD, MMD, and GKS). Our work demonstrates that an adversary can use the generator-discriminator technique to reconstruct high-quality graphs in real-world black-box attack scenarios against GNNs. Additionally, we present a variant of our attacks (Ours--) with 50% reduced queries, achieving good or comparable reconstruction attack performance. In addition, we show that GNNs are highly vulnerable to privacy attacks, varying Laplacian noise-scales.