Prompt-based Unifying Inference Attack on Graph Neural Networks

TL;DR

This paper introduces ProIA, a prompt-based inference attack framework on GNNs that retains graph topology and adapts to various attack scenarios, revealing privacy risks in pre-trained models.

Contribution

ProIA is a novel framework that unifies inference attacks on GNNs by preserving graph topology and employing adaptable prompts for different attack types.

Findings

ProIA significantly improves attack success rates.

ProIA demonstrates high adaptability across attack scenarios.

Extensive experiments validate ProIA's effectiveness.

Abstract

Graph neural networks (GNNs) provide important prospective insights in applications such as social behavior analysis and financial risk analysis based on their powerful learning capabilities on graph data. Nevertheless, GNNs' predictive performance relies on the quality of task-specific node labels, so it is common practice to improve the model's generalization ability in the downstream execution of decision-making tasks through pre-training. Graph prompting is a prudent choice but risky without taking measures to prevent data leakage. In other words, in high-risk decision scenarios, prompt learning can infer private information by accessing model parameters trained on private data (publishing model parameters in pre-training, i.e., without directly leaking the raw data, is a tacitly accepted trend). However, myriad graph inference attacks necessitate tailored module design and processing to enhance inference capabilities due to variations in supervision signals. In this paper, we propose a novel Prompt-based unifying Inference Attack framework on GNNs, named ProIA. Specifically, ProIA retains the crucial topological information of the graph during pre-training, enhancing the background knowledge of the inference attack model. It then utilizes a unified prompt and introduces additional disentanglement factors in downstream attacks to adapt to task-relevant knowledge. Finally, extensive experiments show that ProIA enhances attack capabilities and demonstrates remarkable adaptability to various inference attacks.