Graph learning protects privacy while resisting harmful fake data attacks
Trust-But-Verify: Poisoning-Resilient Locally Private Graph Learning Protocols
Machine Learning
Summary
Graph learning helps computers understand connections between data points, like social networks, while keeping users' personal information private. The authors found that attackers can add bad data to confuse the system, making it less useful. To fix this, they designed a new method called VERITAS that checks which users can be trusted before using their data. This approach helps keep the learning accurate and private, even when under attack. Their tests show VERITAS works well across different datasets and privacy settings.
local differential privacygraph learningdata poisoningnode featuresadjacency informationtrust verificationbilateral attestationdenoisinggraph neural networksdecentralized learning
Authors
Longzhu He, Li Sun, Hao Peng, Ruijie Wang, Raymond Chi-Wing Wong, Sen Su
Abstract
Built upon local differential privacy (LDP), locally private graph learning protocols have emerged as an important paradigm for decentralized graph learning, balancing privacy protection and learning utility. Under such protocols, each user locally perturbs their node features and adjacency information before transmission, ensuring formal privacy guarantees without original data leaving the device. However, the inherently open participation nature renders these protocols critically vulnerable to data poisoning attacks, where adversaries inject carefully crafted malicious nodes to corrupt neighborhood aggregation and degrade downstream utility. Despite the severity of this threat, effective defenses in this setting remain largely unexplored. In this paper, we propose VERITAS, a poisoning-resilient locally private graph learning protocol built on a trust-but-verify paradigm. By introducing a verification list encoding graded peer trust levels, VERITAS jointly privatizes node features and graph structure on the user side, while exploiting bilateral attestation asymmetry on the server side to identify and prune malicious nodes. Concretely, VERITAS comprises four synergistic stages: (1) local data perturbation, (2) attestation-driven malicious node pruning, (3) utility restoration via dual denoising, and (4) robust private graph learning. Extensive experiments on four real-world benchmark datasets across multiple LDP mechanisms and GNN architectures demonstrate that VERITAS effectively defends against data poisoning attacks and significantly improves downstream graph learning utility under rigorous privacy guarantees.