Inferring Sensitive Attributes from Knowledge Graph Embeddings: Attack and Defense Strategies

• URL: http://arxiv.org/abs/2605.19644v1
• Date: Tue, 19 May 2026 10:28:46 GMT
• Title: Inferring Sensitive Attributes from Knowledge Graph Embeddings: Attack and Defense Strategies
• Abstract summary: We investigate the privacy risks associated with Knowledge Graphs (KGs) based reasoning.<n>We focus on attribute inference attacks where adversaries attempt to deduce sensitive user attributes from seemingly non-sensitive outputs.<n>We propose and evaluate a framework that mitigates these privacy risks by applying post processing sanitization techniques to KGE outputs.
• Score: 0.0
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Knowledge Graphs (KGs) are a powerful representation of linked data, offering flexibility, semantic richness, and support for knowledge enrichment and reasoning. They help data owners organize and exploit heterogeneous data to provide insightful services (e.g., recommendations), yet real-world KGs are often incomplete, hiding true facts or missing valuable insights. Knowledge graph embedding techniques are commonly used to infer valuable missing information. However, reasoning over KGs can inadvertently expose sensitive user information, even when such data is not explicitly stored. In this work, we investigate the privacy risks associated with KGE-based reasoning, focusing on attribute inference attacks where adversaries attempt to deduce sensitive user attributes from seemingly non-sensitive outputs. We propose and evaluate a framework that mitigates these privacy risks by applying post processing sanitization techniques to KGE outputs. Preliminary results demonstrate the effectiveness of these attacks on the outputs of KGE models, and explore the trade-off between recommendation quality and privacy protection when applying randomization based approaches, highlighting the need to experiment with more advanced techniques in future work to address this issue.

Related papers

• Benchmarking Knowledge-Extraction Attack and Defense on Retrieval-Augmented Generation [50.87199039334856]
  Retrieval-Augmented Generation (RAG) has become a cornerstone of knowledge-intensive applications.<n>Recent studies show that knowledge-extraction attacks can recover sensitive knowledge-base content through maliciously crafted queries.<n>We introduce the first systematic benchmark for knowledge-extraction attacks on RAG systems.
  arXiv  Detail & Related papers  (2026-02-10T01:27:46Z)
• Taipan: A Query-free Transfer-based Multiple Sensitive Attribute Inference Attack Solely from Publicly Released Graphs [4.838500914184325]
  We introduce textbfTaipan, the first query-free transfer-based attack framework for multiple sensitive attribute inference attacks on graphs.<n>Experiments on diverse real-world graph datasets demonstrate that Taipan consistently achieves strong attack performance across same-distribution settings.<n>Our findings underscore the urgent need for more robust multi-attribute privacy-preserving graph publishing methods and data-sharing practices.
  arXiv  Detail & Related papers  (2026-02-06T13:37:24Z)
• DATABench: Evaluating Dataset Auditing in Deep Learning from an Adversarial Perspective [70.77570343385928]
  We introduce a novel taxonomy, classifying existing methods based on their reliance on internal features (IF) (inherent to the data) versus external features (EF) (artificially introduced for auditing)<n>We formulate two primary attack types: evasion attacks, designed to conceal the use of a dataset, and forgery attacks, intending to falsely implicate an unused dataset.<n>Building on the understanding of existing methods and attack objectives, we further propose systematic attack strategies: decoupling, removal, and detection for evasion; adversarial example-based methods for forgery.<n>Our benchmark, DATABench, comprises 17 evasion attacks, 5 forgery attacks, and 9
  arXiv  Detail & Related papers  (2025-07-08T03:07:15Z)
• A False Sense of Privacy: Evaluating Textual Data Sanitization Beyond Surface-level Privacy Leakage [77.83757117924995]
  We propose a new framework that evaluates re-identification attacks to quantify individual privacy risks upon data release.<n>Our approach shows that seemingly innocuous auxiliary information can be used to infer sensitive attributes like age or substance use history from sanitized data.
  arXiv  Detail & Related papers  (2025-04-28T01:16:27Z)
• Generating Privacy-Preserving Personalized Advice with Zero-Knowledge Proofs and LLMs [0.6906005491572401]
  We propose a framework that integrates zero-knowledge proof technology, specifically zkVM, with large language models (LLMs)<n>This integration enables privacy-preserving data sharing by verifying user traits without disclosing sensitive information.
  arXiv  Detail & Related papers  (2025-02-10T13:02:00Z)
• MaSS: Multi-attribute Selective Suppression for Utility-preserving Data Transformation from an Information-theoretic Perspective [10.009178591853058]
  We propose a formal information-theoretic definition for this utility-preserving privacy protection problem. We design a data-driven learnable data transformation framework that is capable of suppressing sensitive attributes from target datasets. Results demonstrate the effectiveness and generalizability of our method under various configurations.
  arXiv  Detail & Related papers  (2024-05-23T18:35:46Z)
• Ungeneralizable Examples [70.76487163068109]
  Current approaches to creating unlearnable data involve incorporating small, specially designed noises. We extend the concept of unlearnable data to conditional data learnability and introduce textbfUntextbfGeneralizable textbfExamples (UGEs) UGEs exhibit learnability for authorized users while maintaining unlearnability for potential hackers.
  arXiv  Detail & Related papers  (2024-04-22T09:29:14Z)
• Adversarial Robustness of Representation Learning for Knowledge Graphs [7.5765554531658665]
  This thesis argues that state-of-the-art Knowledge Graph Embeddings (KGE) models are vulnerable to data poisoning attacks. Two novel data poisoning attacks are proposed that craft input deletions or additions at training time to subvert the learned model's performance at inference time. The evaluation shows that the simpler attacks are competitive with or outperform the computationally expensive ones.
  arXiv  Detail & Related papers  (2022-09-30T22:41:22Z)
• Unlearning Protected User Attributes in Recommendations with Adversarial Training [10.268369743620159]
  Collaborative filtering algorithms capture underlying consumption patterns, including the ones specific to particular demographics or protected information of users. These encoded biases can influence the decision of a recommendation system towards further separation of the contents provided to various demographic subgroups. In this work, we investigate the possibility and challenges of removing specific protected information of users from the learned interaction representations of a RS algorithm.
  arXiv  Detail & Related papers  (2022-06-09T13:36:28Z)
• Information Obfuscation of Graph Neural Networks [96.8421624921384]
  We study the problem of protecting sensitive attributes by information obfuscation when learning with graph structured data. We propose a framework to locally filter out pre-determined sensitive attributes via adversarial training with the total variation and the Wasserstein distance.
  arXiv  Detail & Related papers  (2020-09-28T17:55:04Z)
• Mining Implicit Entity Preference from User-Item Interaction Data for Knowledge Graph Completion via Adversarial Learning [82.46332224556257]
  We propose a novel adversarial learning approach by leveraging user interaction data for the Knowledge Graph Completion task. Our generator is isolated from user interaction data, and serves to improve the performance of the discriminator. To discover implicit entity preference of users, we design an elaborate collaborative learning algorithms based on graph neural networks.
  arXiv  Detail & Related papers  (2020-03-28T05:47:33Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.