Gradient Inversion Attack on Graph Neural Networks

TL;DR

This paper introduces a novel attack method called Graph Leakage from Gradients (GLG) that can accurately reconstruct private node features and graph structures from gradients in graph neural network federated learning, exposing privacy vulnerabilities.

Contribution

The paper presents the first comprehensive study of gradient inversion attacks on GNNs, analyzing their effectiveness in reconstructing private graph data and proposing the GLG attack method.

Findings

GLG achieves high accuracy in reconstructing node features.

GLG effectively recovers graph structure from gradients.

The attack's success varies with different GNN models and settings.

Abstract

Graph federated learning is of essential importance for training over large graph datasets while protecting data privacy, where each client stores a subset of local graph data, while the server collects the local gradients and broadcasts only the aggregated gradients. Recent studies reveal that a malicious attacker can steal private image data from the gradient exchange of neural networks during federated learning. However, the vulnerability of graph data and graph neural networks under such attacks, i.e., reconstructing both node features and graph structure from gradients, remains largely underexplored. To answer this question, this paper studies the problem of whether private data can be reconstructed from leaked gradients in both node classification and graph classification tasks and proposes a novel attack named Graph Leakage from Gradients (GLG). Two widely used GNN frameworks are analyzed, namely GCN and GraphSAGE. The effects of different model settings on reconstruction are extensively discussed. Theoretical analysis and empirical validation demonstrate that, by leveraging the unique properties of graph data and GNNs, GLG achieves more accurate reconstruction of both nodal features and graph structure from gradients.