Who Owns This Sample: Cross-Client Membership Inference Attack in Federated Graph Neural Networks

• URL: http://arxiv.org/abs/2507.19964v1
• Date: Sat, 26 Jul 2025 14:32:38 GMT
• Title: Who Owns This Sample: Cross-Client Membership Inference Attack in Federated Graph Neural Networks
• Authors: Kunhao Li, Di Wu, Jun Bai, Jing Xu, Lei Yang, Ziyi Zhang, Yiliao Song, Wencheng Yang, Taotao Cai, Yan Li,
• Abstract summary: We present the first systematic study of cross-client membership inference attacks (CC-MIA) against node classification tasks of federated GNNs.<n>Our attack targets sample-to-client attribution, a finer-grained privacy risk unique to federated settings.<n>Our findings highlight a new privacy threat in federated graph learning-client identity leakage through structural and model-level cues.
• Score: 15.801164432263183
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Graph-structured data is prevalent in many real-world applications, including social networks, financial systems, and molecular biology. Graph Neural Networks (GNNs) have become the de facto standard for learning from such data due to their strong representation capabilities. As GNNs are increasingly deployed in federated learning (FL) settings to preserve data locality and privacy, new privacy threats arise from the interaction between graph structures and decentralized training. In this paper, we present the first systematic study of cross-client membership inference attacks (CC-MIA) against node classification tasks of federated GNNs (FedGNNs), where a malicious client aims to infer which client owns the given data. Unlike prior centralized-focused work that focuses on whether a sample was included in training, our attack targets sample-to-client attribution, a finer-grained privacy risk unique to federated settings. We design a general attack framework that exploits FedGNNs' aggregation behaviors, gradient updates, and embedding proximity to link samples to their source clients across training rounds. We evaluate our attack across multiple graph datasets under realistic FL setups. Results show that our method achieves high performance on both membership inference and ownership identification. Our findings highlight a new privacy threat in federated graph learning-client identity leakage through structural and model-level cues, motivating the need for attribution-robust GNN design.

Related papers

• FedHERO: A Federated Learning Approach for Node Classification Task on Heterophilic Graphs [55.51300642911766]
  Federated Graph Learning (FGL) empowers clients to collaboratively train Graph neural networks (GNNs) in a distributed manner.<n>FGL methods usually require that the graph data owned by all clients is homophilic to ensure similar neighbor distribution patterns of nodes.<n>We propose FedHERO, an FGL framework designed to harness and share insights from heterophilic graphs effectively.
  arXiv  Detail & Related papers  (2025-04-29T22:23:35Z)
• Federated Graph Learning with Graphless Clients [52.5629887481768]
  Federated Graph Learning (FGL) is tasked with training machine learning models, such as Graph Neural Networks (GNNs) We propose a novel framework FedGLS to tackle the problem in FGL with graphless clients.
  arXiv  Detail & Related papers  (2024-11-13T06:54:05Z)
• Federated Graph Learning with Structure Proxy Alignment [43.13100155569234]
  Federated Graph Learning (FGL) aims to learn graph learning models over graph data distributed in multiple data owners. We propose FedSpray, a novel FGL framework that learns local class-wise structure proxies in the latent space. Our goal is to obtain the aligned structure proxies that can serve as reliable, unbiased neighboring information for node classification.
  arXiv  Detail & Related papers  (2024-08-18T07:32:54Z)
• Federated Face Forgery Detection Learning with Personalized Representation [63.90408023506508]
  Deep generator technology can produce high-quality fake videos that are indistinguishable, posing a serious social threat. Traditional forgery detection methods directly centralized training on data. The paper proposes a novel federated face forgery detection learning with personalized representation.
  arXiv  Detail & Related papers  (2024-06-17T02:20:30Z)
• Client-side Gradient Inversion Against Federated Learning from Poisoning [59.74484221875662]
  Federated Learning (FL) enables distributed participants to train a global model without sharing data directly to a central server. Recent studies have revealed that FL is vulnerable to gradient inversion attack (GIA), which aims to reconstruct the original training samples. We propose Client-side poisoning Gradient Inversion (CGI), which is a novel attack method that can be launched from clients.
  arXiv  Detail & Related papers  (2023-09-14T03:48:27Z)
• GNN4FR: A Lossless GNN-based Federated Recommendation Framework [13.672867761388675]
  Graph neural networks (GNNs) have gained wide popularity in recommender systems. Our framework achieves full-graph training with complete high-order structure information. In addition, we use LightGCN to instantiate an example of our framework and show its equivalence.
  arXiv  Detail & Related papers  (2023-07-25T16:55:17Z)
• Lumos: Heterogeneity-aware Federated Graph Learning over Decentralized Devices [19.27111697495379]
  Graph neural networks (GNNs) have been widely deployed in real-world networked applications and systems. We propose the first federated GNN framework called Lumos that supports supervised and unsupervised learning. Based on the constructed tree for each client, a decentralized tree-based GNN trainer is proposed to support versatile training.
  arXiv  Detail & Related papers  (2023-03-01T13:27:06Z)
• Model Inversion Attacks against Graph Neural Networks [65.35955643325038]
  We study model inversion attacks against Graph Neural Networks (GNNs) In this paper, we present GraphMI to infer the private training graph data. Our experimental results show that such defenses are not sufficiently effective and call for more advanced defenses against privacy attacks.
  arXiv  Detail & Related papers  (2022-09-16T09:13:43Z)
• Node-Level Membership Inference Attacks Against Graph Neural Networks [29.442045622210532]
  A new family of machine learning (ML) models, namely graph neural networks (GNNs), has been introduced. Previous studies have shown that machine learning models are vulnerable to privacy attacks. This paper performs the first comprehensive analysis of node-level membership inference attacks against GNNs.
  arXiv  Detail & Related papers  (2021-02-10T13:51:54Z)
• Stealing Links from Graph Neural Networks [72.85344230133248]
  Recently, neural networks were extended to graph data, which are known as graph neural networks (GNNs) Due to their superior performance, GNNs have many applications, such as healthcare analytics, recommender systems, and fraud detection. We propose the first attacks to steal a graph from the outputs of a GNN model that is trained on the graph.
  arXiv  Detail & Related papers  (2020-05-05T13:22:35Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.