Securing Graph Neural Networks in MLaaS: A Comprehensive Realization of Query-based Integrity Verification

TL;DR

This paper presents a novel query-based integrity verification method for GNNs in MLaaS, effectively detecting model-centric attacks with enhanced efficiency and robustness against knowledgeable adversaries.

Contribution

It introduces a comprehensive, query-based verification framework for GNNs in MLaaS, including randomized fingerprint nodes to counteract advanced attackers.

Findings

Detects five types of adversarial model-centric attacks

Achieves 2 to 4 times higher efficiency than baseline methods

Effective against attackers with prior knowledge of verification mechanisms

Abstract

The deployment of Graph Neural Networks (GNNs) within Machine Learning as a Service (MLaaS) has opened up new attack surfaces and an escalation in security concerns regarding model-centric attacks. These attacks can directly manipulate the GNN model parameters during serving, causing incorrect predictions and posing substantial threats to essential GNN applications. Traditional integrity verification methods falter in this context due to the limitations imposed by MLaaS and the distinct characteristics of GNN models. In this research, we introduce a groundbreaking approach to protect GNN models in MLaaS from model-centric attacks. Our approach includes a comprehensive verification schema for GNN's integrity, taking into account both transductive and inductive GNNs, and accommodating varying pre-deployment knowledge of the models. We propose a query-based verification technique, fortified with innovative node fingerprint generation algorithms. To deal with advanced attackers who know our mechanisms in advance, we introduce randomized fingerprint nodes within our design. The experimental evaluation demonstrates that our method can detect five representative adversarial model-centric attacks, displaying 2 to 4 times greater efficiency compared to baselines.