GENIE: Watermarking Graph Neural Networks for Link Prediction

TL;DR

GENIE introduces a novel watermarking scheme for Graph Neural Networks used in Link Prediction, ensuring ownership verification with high accuracy and robustness against various attacks in graph-based machine learning.

Contribution

This work is the first to develop a watermarking method specifically for GNNs in link prediction tasks, addressing a critical gap in ownership verification.

Findings

GENIE achieves over 99.99% verification probability.

It is robust against 11 watermark removal techniques and 3 model extraction attacks.

Validated across 4 architectures and 7 real-world datasets.

Abstract

Graph Neural Networks (GNNs) have become invaluable intellectual property in graph-based machine learning. However, their vulnerability to model stealing attacks when deployed within Machine Learning as a Service (MLaaS) necessitates robust Ownership Demonstration (OD) techniques. Watermarking is a promising OD framework for Deep Neural Networks, but existing methods fail to generalize to GNNs due to the non-Euclidean nature of graph data. Previous works on GNN watermarking have primarily focused on node and graph classification, overlooking Link Prediction (LP). In this paper, we propose GENIE (watermarking Graph nEural Networks for lInk prEdiction), the first-ever scheme to watermark GNNs for LP. GENIE creates a novel backdoor for both node-representation and subgraph-based LP methods, utilizing a unique trigger set and a secret watermark vector. Our OD scheme is equipped with Dynamic Watermark Thresholding (DWT), ensuring high verification probability (>99.99%) while addressing practical issues in existing watermarking schemes. We extensively evaluate GENIE across 4 model architectures (i.e., SEAL, GCN, GraphSAGE and NeoGNN) and 7 real-world datasets. Furthermore, we validate the robustness of GENIE against 11 state-of-the-art watermark removal techniques and 3 model extraction attacks. We also show GENIE's resilience against ownership piracy attacks. Finally, we discuss a defense strategy to counter adaptive attacks against GENIE.