Inference Attacks Against Graph Generative Diffusion Models

TL;DR

This paper reveals privacy vulnerabilities in graph generative diffusion models by demonstrating effective black-box inference attacks, including graph reconstruction, property inference, and membership inference, and proposes defenses to mitigate these risks.

Contribution

It introduces novel inference attacks against graph diffusion models and proposes defense mechanisms, highlighting privacy risks and mitigation strategies in this emerging field.

Findings

Inference attacks outperform baselines significantly.

Effective defenses balance privacy and utility.

Attacks work across multiple graph models and datasets.

Abstract

Graph generative diffusion models have recently emerged as a powerful paradigm for generating complex graph structures, effectively capturing intricate dependencies and relationships within graph data. However, the privacy risks associated with these models remain largely unexplored. In this paper, we investigate information leakage in such models through three types of black-box inference attacks. First, we design a graph reconstruction attack, which can reconstruct graphs structurally similar to those training graphs from the generated graphs. Second, we propose a property inference attack to infer the properties of the training graphs, such as the average graph density and the distribution of densities, from the generated graphs. Third, we develop two membership inference attacks to determine whether a given graph is present in the training set. Extensive experiments on three different types of graph generative diffusion models and six real-world graphs demonstrate the effectiveness of these attacks, significantly outperforming the baseline approaches. Finally, we propose two defense mechanisms that mitigate these inference attacks and achieve a better trade-off between defense strength and target model utility than existing methods. Our code is available at https://zenodo.org/records/17946102.