Can Subgraph Explanations Be Weaponized to Steal Graph Neural Networks?

• URL: http://arxiv.org/abs/2605.30470v1
• Date: Thu, 28 May 2026 18:41:20 GMT
• Title: Can Subgraph Explanations Be Weaponized to Steal Graph Neural Networks?
• Abstract summary: We present the first model extraction attack specifically designed for graph classification under strict black-box constraints.<n>Our method uses model explanation outputs to guide Monte Carlo edge sensitivity estimation toward decision boundaries.
• Score: 22.75551953213643
• License: http://creativecommons.org/licenses/by-nc-sa/4.0/
• Abstract: Graph Machine Learning as a Service (GMLaaS) platforms increasingly implement explainability interfaces to meet regulatory transparency requirements. However, this transparency creates exploitable vulnerabilities for model extraction attacks. We present the first model extraction attack specifically designed for graph classification under strict black-box constraints where the attacker observes only discrete class labels and binary explanation masks (no probability scores, gradients, or confidence values). Our method (1) uses model explanation outputs to guide Monte Carlo edge sensitivity estimation toward decision boundaries, with Hoeffding concentration guarantees on estimation accuracy and (2) exploits explanation subgraphs to efficiently narrow the boundary search space. Extensive experiments on benchmark graph datasets across multiple domains demonstrate our method's superiority over comparable baselines. These findings demonstrate that such explainability interfaces create exploitable attack surfaces, informing both defensive mechanisms and policy frameworks for explainable AI mandates. The implementation code is provided in https://github.com/LabRAI/XSTEAL/.

Related papers

• Defending against Model Extraction for GNNs with Model Reprogramming [57.82196268649236]
  Graph Neural Networks (GNNs) serve as the backbone for high-stakes applications in Machine-Learning-as-a-Service (ML)<n>Still, their black-box deployment exposes them to Model Extraction (ME) attacks.<n>Existing defenses suffer from a critical ''Euclidean bias''<n>We propose GraphRP, a proactive defense framework that repurposes Model Reprogramming for security.
  arXiv  Detail & Related papers  (2026-08-11T23:20:15Z)
• Explainable Attention-Guided Stacked Graph Neural Networks for Malware Detection [2.6436521007616114]
  We propose a novel stacking ensemble framework for graph-based malware detection and explanation.<n>Our framework improves classification performance while providing insightful interpretations of malware behavior.
  arXiv  Detail & Related papers  (2025-08-13T13:33:02Z)
• How Explanations Leak the Decision Logic: Stealing Graph Neural Networks via Explanation Alignment [9.329315232799814]
  Graph Neural Networks (GNNs) have become essential tools for analyzing graph-structured data in domains such as drug discovery and financial analysis.<n>Recent advances in explainable GNNs have addressed this need by revealing important subgraphs that influence predictions.<n>This paper investigates how such explanations potentially leak critical decision logic that can be exploited for model stealing.
  arXiv  Detail & Related papers  (2025-06-03T17:11:05Z)
• A method for the systematic generation of graph XAI benchmarks via Weisfeiler-Leman coloring [4.187844916497259]
  Graph neural networks have become the de facto model for learning from structured data.<n>Several explainable AI techniques for graphs have been developed to address this major issue.<n>Current graph-XAI benchmarks are limited to simplistic synthetic datasets or a few real-world tasks curated by domain experts.<n>We propose a method to automate the construction of graph XAI benchmarks from generic graph classification datasets.
  arXiv  Detail & Related papers  (2025-05-18T14:19:52Z)
• BetaExplainer: A Probabilistic Method to Explain Graph Neural Networks [1.798554018133928]
  Graph neural networks (GNNs) are powerful tools for conducting inference on graph data.<n>Many interpretable GNN methods exist, but they cannot quantify uncertainty in edge weights.<n>We proposed BetaExplainer which addresses these issues by using a sparsity-inducing prior to mask unimportant edges.
  arXiv  Detail & Related papers  (2024-12-16T16:45:26Z)
• Masked Graph Autoencoder with Non-discrete Bandwidths [40.55565847640106]
  Masked graph autoencoders have emerged as a powerful graph self-supervised learning method that has yet to be fully explored. In this paper, we unveil that the existing discrete edge masking and binary link reconstruction strategies are insufficient to learn topologically informative representations. We propose a novel, informative, and effective topological masked graph autoencoder using bandwidth masking and a layer-wise bandwidth prediction objective.
  arXiv  Detail & Related papers  (2024-02-06T08:57:49Z)
• Privacy-Preserved Neural Graph Similarity Learning [99.78599103903777]
  We propose a novel Privacy-Preserving neural Graph Matching network model, named PPGM, for graph similarity learning. To prevent reconstruction attacks, the proposed model does not communicate node-level representations between devices. To alleviate the attacks to graph properties, the obfuscated features that contain information from both vectors are communicated.
  arXiv  Detail & Related papers  (2022-10-21T04:38:25Z)
• Model Inversion Attacks against Graph Neural Networks [65.35955643325038]
  We study model inversion attacks against Graph Neural Networks (GNNs) In this paper, we present GraphMI to infer the private training graph data. Our experimental results show that such defenses are not sufficiently effective and call for more advanced defenses against privacy attacks.
  arXiv  Detail & Related papers  (2022-09-16T09:13:43Z)
• Reinforced Causal Explainer for Graph Neural Networks [112.57265240212001]
  Explainability is crucial for probing graph neural networks (GNNs) We propose a reinforcement learning agent, Reinforced Causal Explainer (RC-Explainer) RC-Explainer generates faithful and concise explanations, and has a better power to unseen graphs.
  arXiv  Detail & Related papers  (2022-04-23T09:13:25Z)
• GraphMI: Extracting Private Graph Data from Graph Neural Networks [59.05178231559796]
  We present textbfGraph textbfModel textbfInversion attack (GraphMI), which aims to extract private graph data of the training graph by inverting GNN. Specifically, we propose a projected gradient module to tackle the discreteness of graph edges while preserving the sparsity and smoothness of graph features. We design a graph auto-encoder module to efficiently exploit graph topology, node attributes, and target model parameters for edge inference.
  arXiv  Detail & Related papers  (2021-06-05T07:07:52Z)
• Learn to Propagate Reliably on Noisy Affinity Graphs [69.97364913330989]
  Recent works have shown that exploiting unlabeled data through label propagation can substantially reduce the labeling cost. How to propagate labels reliably, especially on a dataset with unknown outliers, remains an open question. We propose a new framework that allows labels to be propagated reliably on large-scale real-world data.
  arXiv  Detail & Related papers  (2020-07-17T07:55:59Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.