Robust GNN Watermarking via Implicit Perception of Topological Invariants

TL;DR

This paper introduces InvGNN-WM, a novel GNN watermarking method that leverages the model's perception of graph invariants for robust, trigger-free ownership verification without impacting task performance.

Contribution

The paper proposes a new watermarking technique based on implicit topological invariants, offering robustness against common model modifications and enabling black-box verification.

Findings

Outperforms trigger-based baselines in accuracy and robustness.

Remains effective under pruning, fine-tuning, and quantization.

Plain knowledge distillation weakens the watermark, but KD with watermark loss restores it.

Abstract

Graph Neural Networks (GNNs) are valuable intellectual property, yet many watermarks rely on backdoor triggers that break under common model edits and create ownership ambiguity. We present InvGNN-WM, which ties ownership to a model's implicit perception of a graph invariant, enabling trigger-free, black-box verification with negligible task impact. A lightweight head predicts normalized algebraic connectivity on an owner-private carrier set; a sign-sensitive decoder outputs bits, and a calibrated threshold controls the false-positive rate. Across diverse node and graph classification datasets and backbones, InvGNN-WM matches clean accuracy while yielding higher watermark accuracy than trigger- and compression-based baselines. It remains strong under unstructured pruning, fine-tuning, and post-training quantization; plain knowledge distillation (KD) weakens the mark, while KD with a watermark loss (KD+WM) restores it. We provide guarantees for imperceptibility and robustness, and we prove that exact removal is NP-complete.