WGLE:Backdoor-free and Multi-bit Black-box Watermarking for Graph Neural Networks

• URL: http://arxiv.org/abs/2506.08602v1
• Date: Tue, 10 Jun 2025 09:12:00 GMT
• Title: WGLE:Backdoor-free and Multi-bit Black-box Watermarking for Graph Neural Networks
• Authors: Tingzhi Li, Xuefeng Liu,
• Abstract summary: We propose WGLE, a novel black-box watermarking paradigm for Graph Neural Networks (GNNs)<n>WGLE embeds the watermark encoding the intended information without introducing incorrect mappings that compromise the primary task.<n>Results show that WGLE achieves 100% ownership verification accuracy, an average fidelity of 0.85%, comparable against potential attacks, and low embedding overhead.
• Score: 2.3612692427322313
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Graph Neural Networks (GNNs) are increasingly deployed in graph-related applications, making ownership verification critical to protect their intellectual property against model theft. Fingerprinting and black-box watermarking are two main methods. However, the former relies on determining model similarity, which is computationally expensive and prone to ownership collisions after model post-processing such as model pruning or fine-tuning. The latter embeds backdoors, exposing watermarked models to the risk of backdoor attacks. Moreover, both methods enable ownership verification but do not convey additional information. As a result, each distributed model requires a unique trigger graph, and all trigger graphs must be used to query the suspect model during verification. Multiple queries increase the financial cost and the risk of detection. To address these challenges, this paper proposes WGLE, a novel black-box watermarking paradigm for GNNs that enables embedding the multi-bit string as the ownership information without using backdoors. WGLE builds on a key insight we term Layer-wise Distance Difference on an Edge (LDDE), which quantifies the difference between the feature distance and the prediction distance of two connected nodes. By predefining positive or negative LDDE values for multiple selected edges, WGLE embeds the watermark encoding the intended information without introducing incorrect mappings that compromise the primary task. WGLE is evaluated on six public datasets and six mainstream GNN architectures along with state-of-the-art methods. The results show that WGLE achieves 100% ownership verification accuracy, an average fidelity degradation of 0.85%, comparable robustness against potential attacks, and low embedding overhead. The code is available in the repository.

Related papers

• GraphBridge: Towards Arbitrary Transfer Learning in GNNs [65.01790632978962]
  GraphBridge is a novel framework to enable knowledge transfer across disparate tasks and domains in GNNs.<n>It allows for the augmentation of any pre-trained GNN with prediction heads and a bridging network that connects the input to the output layer.<n> Empirical validation, conducted over 16 datasets representative of these scenarios, confirms the framework's capacity for task- and domain-agnostic transfer learning.
  arXiv  Detail & Related papers  (2025-02-26T15:57:51Z)
• GENIE: Watermarking Graph Neural Networks for Link Prediction [5.1323099412421636]
  Graph Neural Networks (GNNs) have become invaluable intellectual property in graph-based machine learning.<n> Watermarking is a promising OD framework for Deep Neural Networks, but existing methods fail to generalize to GNNs due to the non-Euclidean nature of graph data.<n>In this paper, we propose GENIE, the first-ever scheme to watermark GNNs for Link Prediction (LP)<n>Our scheme is equipped with Dynamic Watermark Thresholding (DWT), ensuring high verification probability (>99.99%) while addressing practical issues in existing watermarking schemes.
  arXiv  Detail & Related papers  (2024-06-07T10:12:01Z)
• OCGEC: One-class Graph Embedding Classification for DNN Backdoor Detection [18.11795712499763]
  This study proposes a novel one-class classification framework called One-class Graph Embedding Classification (OCGEC) OCGEC uses GNNs for model-level backdoor detection with only a little amount of clean data. In comparison to other baselines, it achieves AUC scores of more than 98% on a number of tasks.
  arXiv  Detail & Related papers  (2023-12-04T02:48:40Z)
• BOURNE: Bootstrapped Self-supervised Learning Framework for Unified Graph Anomaly Detection [50.26074811655596]
  We propose a novel unified graph anomaly detection framework based on bootstrapped self-supervised learning (named BOURNE) By swapping the context embeddings between nodes and edges, we enable the mutual detection of node and edge anomalies. BOURNE can eliminate the need for negative sampling, thereby enhancing its efficiency in handling large graphs.
  arXiv  Detail & Related papers  (2023-07-28T00:44:57Z)
• GrOVe: Ownership Verification of Graph Neural Networks using Embeddings [13.28269672097063]
  Graph neural networks (GNNs) have emerged as a state-of-the-art approach to model and draw inferences from large scale graph-structured data. Prior work has shown that GNNs are prone to model extraction attacks. We present GrOVe, a state-of-the-art GNN model fingerprinting scheme.
  arXiv  Detail & Related papers  (2023-04-17T19:06:56Z)
• Model Inversion Attacks against Graph Neural Networks [65.35955643325038]
  We study model inversion attacks against Graph Neural Networks (GNNs) In this paper, we present GraphMI to infer the private training graph data. Our experimental results show that such defenses are not sufficiently effective and call for more advanced defenses against privacy attacks.
  arXiv  Detail & Related papers  (2022-09-16T09:13:43Z)
• Source Free Unsupervised Graph Domain Adaptation [60.901775859601685]
  Unsupervised Graph Domain Adaptation (UGDA) shows its practical value of reducing the labeling cost for node classification. Most existing UGDA methods heavily rely on the labeled graph in the source domain. In some real-world scenarios, the source graph is inaccessible because of privacy issues. We propose a novel scenario named Source Free Unsupervised Graph Domain Adaptation (SFUGDA)
  arXiv  Detail & Related papers  (2021-12-02T03:18:18Z)
• Watermarking Graph Neural Networks based on Backdoor Attacks [10.844454900508566]
  We present a watermarking framework for Graph Neural Networks (GNNs) for both graph and node classification tasks. Our framework can verify the ownership of GNN models with a very high probability (around $100%$) for both tasks.
  arXiv  Detail & Related papers  (2021-10-21T09:59:59Z)
• Graph Backdoor [53.70971502299977]
  We present GTA, the first backdoor attack on graph neural networks (GNNs) GTA departs in significant ways: it defines triggers as specific subgraphs, including both topological structures and descriptive features. It can be instantiated for both transductive (e.g., node classification) and inductive (e.g., graph classification) tasks.
  arXiv  Detail & Related papers  (2020-06-21T19:45:30Z)
• Alleviating the Inconsistency Problem of Applying Graph Neural Network to Fraud Detection [78.88163190021798]
  We introduce a new GNN framework, $mathsfGraphConsis$, to tackle the inconsistency problem. Empirical analysis on four datasets indicates the inconsistency problem is crucial in a fraud detection task. We also released a GNN-based fraud detection toolbox with implementations of SOTA models.
  arXiv  Detail & Related papers  (2020-05-01T21:43:58Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.