WGLE:Backdoor-free and Multi-bit Black-box Watermarking for Graph Neural Networks

TL;DR

WGLE introduces a backdoor-free, multi-bit watermarking method for GNNs that leverages layer-wise distance differences, enabling secure ownership verification with high accuracy and robustness without backdoors.

Contribution

This paper presents WGLE, a novel multi-bit black-box watermarking scheme for GNNs based on LDDE, avoiding backdoors and enabling efficient ownership verification.

Findings

Achieves 100% ownership verification accuracy.

Maintains an average fidelity degradation of 1.41%.

Demonstrates robustness against potential attacks.

Abstract

Graph Neural Networks (GNNs) are increasingly deployed in real-world applications, making ownership verification critical to protect their intellectual property against model theft. Fingerprinting and black-box watermarking are two main methods. However, the former relies on determining model similarity, which is computationally expensive and prone to ownership collisions after model post-processing. The latter embeds backdoors, exposing watermarked models to the risk of backdoor attacks. Moreover, both previous methods enable ownership verification but do not convey additional information about the copy model. If the owner has multiple models, each model requires a distinct trigger graph. To address these challenges, this paper proposes WGLE, a novel black-box watermarking paradigm for GNNs that enables embedding the multi-bit string in GNN models without using backdoors. WGLE builds on a key insight we term Layer-wise Distance Difference on an Edge (LDDE), which quantifies the difference between the feature distance and the prediction distance of two connected nodes in a graph. By assigning unique LDDE values to the edges and employing the LDDE sequence as the watermark, WGLE supports multi-bit capacity without relying on backdoor mechanisms. We evaluate WGLE on six public datasets across six mainstream GNN architectures, and compare WGLE with state-of-the-art GNN watermarking and fingerprinting methods. WGLE achieves 100% ownership verification accuracy, with an average fidelity degradation of only 1.41%. Additionally, WGLE exhibits robust resilience against potential attacks. The code is available in the repository.