Attack by Unlearning: Unlearning-Induced Adversarial Attacks on Graph Neural Networks

• URL: http://arxiv.org/abs/2603.18570v1
• Date: Thu, 19 Mar 2026 07:30:28 GMT
• Title: Attack by Unlearning: Unlearning-Induced Adversarial Attacks on Graph Neural Networks
• Abstract summary: Graph networks (GNNs) are widely used for learning from graph-structured data in domains like social networks, recommender systems, and financial platforms.<n>To comply with privacy regulations like CCPA, and PIPEDA, approximate graph unlearning has become an increasingly important component of trustworthy graph learning.<n>In this work, we show that such degradations can be amplified into adversarial attacks.
• Score: 29.541462621016013
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Graph neural networks (GNNs) are widely used for learning from graph-structured data in domains such as social networks, recommender systems, and financial platforms. To comply with privacy regulations like the GDPR, CCPA, and PIPEDA, approximate graph unlearning, which aims to remove the influence of specific data points from trained models without full retraining, has become an increasingly important component of trustworthy graph learning. However, approximate unlearning often incurs subtle performance degradation, which may incur negative and unintended side effects. In this work, we show that such degradations can be amplified into adversarial attacks. We introduce the notion of \textbf{unlearning corruption attacks}, where an adversary injects carefully chosen nodes into the training graph and later requests their deletion. Because deletion requests are legally mandated and cannot be denied, this attack surface is both unavoidable and stealthy: the model performs normally during training, but accuracy collapses only after unlearning is applied. Technically, we formulate this attack as a bi-level optimization problem: to overcome the challenges of black-box unlearning and label scarcity, we approximate the unlearning process via gradient-based updates and employ a surrogate model to generate pseudo-labels for the optimization. Extensive experiments across benchmarks and unlearning algorithms demonstrate that small, carefully designed unlearning requests can induce significant accuracy degradation, raising urgent concerns about the robustness of GNN unlearning under real-world regulatory demands. The source code will be released upon paper acceptance.

Related papers

• PEANUT: Perturbations by Eigenvector Alignment for Attacking Graph Neural Networks Under Topology-Driven Message Passing [7.3809340470076465]
  We propose PEANUT, a gradient-free, restricted black-box attack that injects virtual nodes to capitalize on a vulnerability in Graph Neural Networks (GNNs)<n>PEANUT is a injection based attack, which is widely considered to be more practical and realistic scenario than graph modification attacks.<n>Experiments on real-world datasets across three graph tasks demonstrate the effectiveness of our attack despite its simplicity.
  arXiv  Detail & Related papers  (2026-03-27T07:40:10Z)
• Unlearning Inversion Attacks for Graph Neural Networks [37.7189834578513]
  We introduce the graph unlearning inversion attack: given only black-box access to an unlearned GNN and partial graph knowledge, can an adversary reconstruct the removed edges?<n>We identify two key challenges: varying probability-similarity thresholds for unlearned versus retained edges, and the difficulty of locating unlearned edge endpoints, and address them with TrendAttack.<n>Experiments on four real-world datasets demonstrate that TrendAttack significantly outperforms state-of-the-art GNN membership inference baselines, exposing a critical privacy vulnerability in current graph unlearning methods.
  arXiv  Detail & Related papers  (2025-06-01T03:23:04Z)
• Unlearning Algorithmic Biases over Graphs [22.373465731963915]
  We take a fresh look at graph unlearning and leverage it as a bias mitigation tool.<n>We develop a training-free unlearning procedure that offers certifiable bias mitigation via a single-step Newton update on the model weights.<n>We then design structural unlearning methods endowed with principled selection mechanisms over nodes and edges informed by rigorous bias analyses.
  arXiv  Detail & Related papers  (2025-05-20T22:12:53Z)
• Prompt-based Unifying Inference Attack on Graph Neural Networks [24.85661326294946]
  We propose a novel Prompt-based unifying Inference Attack framework on Graph neural networks (GNNs)<n>ProIA retains the crucial topological information of the graph during pre-training, enhancing the background knowledge of the inference attack model.<n>It then utilizes a unified prompt and introduces additional disentanglement factors in downstream attacks to adapt to task-relevant knowledge.
  arXiv  Detail & Related papers  (2024-12-20T09:56:17Z)
• Provable Robustness of (Graph) Neural Networks Against Data Poisoning and Backdoor Attacks [50.87615167799367]
  We certify Graph Neural Networks (GNNs) against poisoning attacks, including backdoors, targeting the node features of a given graph.<n>Our framework provides fundamental insights into the role of graph structure and its connectivity on the worst-case behavior of convolution-based and PageRank-based GNNs.
  arXiv  Detail & Related papers  (2024-07-15T16:12:51Z)
• DFA-GNN: Forward Learning of Graph Neural Networks by Direct Feedback Alignment [57.62885438406724]
  Graph neural networks are recognized for their strong performance across various applications. BP has limitations that challenge its biological plausibility and affect the efficiency, scalability and parallelism of training neural networks for graph-based tasks. We propose DFA-GNN, a novel forward learning framework tailored for GNNs with a case study of semi-supervised learning.
  arXiv  Detail & Related papers  (2024-06-04T07:24:51Z)
• Unlink to Unlearn: Simplifying Edge Unlearning in GNNs [24.987140675476464]
  Unlearning in Graph Neural Networks (GNNs) has emerged as a prominent research frontier in academia. Our research focuses on edge unlearning, a process of particular relevance to real-world applications. We develop textbfUnlink to Unlearn, a novel method that facilitates unlearning exclusively through unlinking the forget edges from graph structure.
  arXiv  Detail & Related papers  (2024-02-16T13:58:23Z)
• GraphGuard: Detecting and Counteracting Training Data Misuse in Graph Neural Networks [69.97213941893351]
  The emergence of Graph Neural Networks (GNNs) in graph data analysis has raised critical concerns about data misuse during model training. Existing methodologies address either data misuse detection or mitigation, and are primarily designed for local GNN models. This paper introduces a pioneering approach called GraphGuard, to tackle these challenges.
  arXiv  Detail & Related papers  (2023-12-13T02:59:37Z)
• Model Inversion Attacks against Graph Neural Networks [65.35955643325038]
  We study model inversion attacks against Graph Neural Networks (GNNs) In this paper, we present GraphMI to infer the private training graph data. Our experimental results show that such defenses are not sufficiently effective and call for more advanced defenses against privacy attacks.
  arXiv  Detail & Related papers  (2022-09-16T09:13:43Z)
• GraphMI: Extracting Private Graph Data from Graph Neural Networks [59.05178231559796]
  We present textbfGraph textbfModel textbfInversion attack (GraphMI), which aims to extract private graph data of the training graph by inverting GNN. Specifically, we propose a projected gradient module to tackle the discreteness of graph edges while preserving the sparsity and smoothness of graph features. We design a graph auto-encoder module to efficiently exploit graph topology, node attributes, and target model parameters for edge inference.
  arXiv  Detail & Related papers  (2021-06-05T07:07:52Z)
• Information Obfuscation of Graph Neural Networks [96.8421624921384]
  We study the problem of protecting sensitive attributes by information obfuscation when learning with graph structured data. We propose a framework to locally filter out pre-determined sensitive attributes via adversarial training with the total variation and the Wasserstein distance.
  arXiv  Detail & Related papers  (2020-09-28T17:55:04Z)
• Adversarial Attacks on Graph Neural Networks via Meta Learning [4.139895092509202]
  We investigate training time attacks on graph neural networks for node classification perturbing the discrete graph structure. Our core principle is to use meta-gradients to solve the bilevel problem underlying training-time attacks.
  arXiv  Detail & Related papers  (2019-02-22T09:20:05Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.