GraphToxin: Reconstructing Full Unlearned Graphs from Graph Unlearning

TL;DR

GraphToxin is a novel attack method that can fully reconstruct unlearned graphs from GNNs, exposing privacy vulnerabilities and challenging current unlearning defenses.

Contribution

We introduce GraphToxin, the first full graph reconstruction attack on graph unlearning, with a curvature matching module for precise recovery and evaluation under various scenarios.

Findings

GraphToxin successfully recovers deleted data and links.

Existing defenses are largely ineffective against GraphToxin.

The attack demonstrates significant privacy risks in current graph unlearning methods.

Abstract

Graph unlearning has emerged as a promising solution to comply with "the right to be forgotten" regulations by enabling the removal of sensitive information upon request. However, this solution is not foolproof. The involvement of multiple parties creates new attack surfaces, and residual traces of deleted data can still remain in the unlearned graph neural networks (GNNs). These vulnerabilities can be exploited by attackers to recover the supposedly erased samples, thereby undermining the intended functionality of graph unlearning. In this work, we propose GraphToxin, the first full graph reconstruction attack against graph unlearning. Specifically, we introduce a novel curvature matching module to provide fine-grained guidance for unlearned graph recovery. We demonstrate that GraphToxin can successfully subvert the regulatory guarantees expected from graph unlearning, it can recover not only a deleted individual's information and personal links but also sensitive content from their connections, thereby posing substantially more detrimental threats. Furthermore, we extend GraphToxin to multiple-node removal under both white-box and black-box settings, showcasing its practical feasibility and potential to cause considerable harm. We highlight the necessity of worst-case analysis and propose a systematic evaluation framework to assess attack performance under both random and worst-case node removal scenarios. Our extensive experiments demonstrate the effectiveness and flexibility of GraphToxin. Notably, existing defense mechanisms are largely ineffective against this attack or even amplify its performance in some cases. Given the severe privacy risks posed by GraphToxin, our work underscores the urgent need for more effective and robust defenses.