Watermarking Graph Neural Networks via Explanations for Ownership Protection

TL;DR

This paper introduces an explanation-based watermarking method for Graph Neural Networks that embeds ownership information into explanations, avoiding data manipulation and enhancing robustness against attacks.

Contribution

It proposes a novel explanation-based watermarking technique for GNNs that ensures ownership verification without data manipulation and proves its NP-hardness for locating the watermark.

Findings

Watermarking GNN explanations is statistically distinct and verifiable.

The method is robust against fine-tuning and pruning attacks.

Locating the watermark is NP-hard even with full knowledge of the method.

Abstract

Graph Neural Networks (GNNs) are widely deployed in industry, making their intellectual property valuable. However, protecting GNNs from unauthorized use remains a challenge. Watermarking offers a solution by embedding ownership information into models. Existing watermarking methods have two limitations: First, they rarely focus on graph data or GNNs. Second, the de facto backdoor-based method relies on manipulating training data, which can introduce ownership ambiguity through misclassification and vulnerability to data poisoning attacks that can interrupt the backdoor mechanism. Our explanation-based watermarking inherits the strengths of backdoor-based methods (e.g., black-box verification) without data manipulation, eliminating ownership ambiguity and data dependencies. In particular, we watermark GNN explanations such that these explanations are statistically distinct from others, so ownership claims must be verified through statistical significance. We theoretically prove that, even with full knowledge of our method, locating the watermark is NP-hard. Empirically, our method demonstrates robustness to fine-tuning and pruning attacks. By addressing these challenges, our approach significantly advances GNN intellectual property protection.