Who Owns This Sample: Cross-Client Membership Inference Attack in Federated Graph Neural Networks

TL;DR

This paper investigates a novel privacy risk in federated graph neural networks, demonstrating how an attacker can identify data ownership across clients, revealing client identities through structural and model cues.

Contribution

It introduces the first systematic cross-client membership inference attack framework for federated GNNs, highlighting a new privacy threat in decentralized graph learning.

Findings

High attack success rate in identifying client data ownership.

Effective inference across multiple graph datasets.

Reveals client identity leakage as a significant privacy concern.

Abstract

Graph-structured data is prevalent in many real-world applications, including social networks, financial systems, and molecular biology. Graph Neural Networks (GNNs) have become the de facto standard for learning from such data due to their strong representation capabilities. As GNNs are increasingly deployed in federated learning (FL) settings to preserve data locality and privacy, new privacy threats arise from the interaction between graph structures and decentralized training. In this paper, we present the first systematic study of cross-client membership inference attacks (CC-MIA) against node classification tasks of federated GNNs (FedGNNs), where a malicious client aims to infer which client owns the given data. Unlike prior centralized-focused work that focuses on whether a sample was included in training, our attack targets sample-to-client attribution, a finer-grained privacy risk unique to federated settings. We design a general attack framework that exploits FedGNNs' aggregation behaviors, gradient updates, and embedding proximity to link samples to their source clients across training rounds. We evaluate our attack across multiple graph datasets under realistic FL setups. Results show that our method achieves high performance on both membership inference and ownership identification. Our findings highlight a new privacy threat in federated graph learning-client identity leakage through structural and model-level cues, motivating the need for attribution-robust GNN design.