Graph in the Vault: Protecting Edge GNN Inference with Trusted Execution Environment

TL;DR

GNNVault is a novel secure deployment strategy for Graph Neural Networks on edge devices using Trusted Execution Environments, protecting model IP and data privacy with minimal accuracy loss.

Contribution

It introduces GNNVault, the first approach combining TEE with a partitioned GNN model to secure inference and private data on edge devices.

Findings

Protects GNN inference against link stealing attacks

Achieves negligible accuracy degradation (<2%)

Demonstrated with Intel SGX implementations

Abstract

Wide deployment of machine learning models on edge devices has rendered the model intellectual property (IP) and data privacy vulnerable. We propose GNNVault, the first secure Graph Neural Network (GNN) deployment strategy based on Trusted Execution Environment (TEE). GNNVault follows the design of 'partition-before-training' and includes a private GNN rectifier to complement with a public backbone model. This way, both critical GNN model parameters and the private graph used during inference are protected within secure TEE compartments. Real-world implementations with Intel SGX demonstrate that GNNVault safeguards GNN inference against state-of-the-art link stealing attacks with negligible accuracy degradation (<2%).