How does Graph Structure Modulate Membership-Inference Risk for Graph Neural Networks?

TL;DR

This paper investigates how graph structure influences membership inference risks in GNNs, revealing that edge access and training graph construction significantly affect privacy leakage and model generalization.

Contribution

It formalizes node-level membership inference in GNNs, analyzes the impact of graph construction and edge access, and evaluates differential privacy limitations in graph models.

Findings

Snowball sampling harms generalization compared to random sampling.

Access to inference-time edges reduces membership advantage and improves test accuracy.

Differential privacy bounds are limited due to broken exchangeability in graph splits.

Abstract

Graph neural networks (GNNs) have become the standard tool for encoding data and their complex relationships into continuous representations, improving prediction accuracy in several machine learning tasks like node classification and link prediction. However, their use in sensitive applications has raised concerns about the potential leakage of training data. Research on privacy leakage in GNNs has largely been shaped by findings from non-graph domains, such as images and tabular data. We emphasize the need of graph specific analysis and investigate the impact of graph structure on node level membership inference. We formalize MI over node-neighbourhood tuples and investigate two important dimensions: (i) training graph construction and (ii) inference-time edge access. Empirically, snowball's coverage bias often harms generalisation relative to random sampling, while enabling inter-train-test edges at inference improves test accuracy, shrinks the train-test gap, and yields the lowest membership advantage across most of the models and datasets. We further show that the generalisation gap empirically measured as the performance difference between the train and test nodes is an incomplete proxy for MI risk: access to edges dominates-MI can rise or fall independent of gap changes. Finally, we examine the auditability of differentially private GNNs, adapting the definition of statistical exchangeability of train-test data points for graph based models. We show that for node level tasks the inductive splits (random or snowball sampled) break exchangeability, limiting the applicability of standard bounds for membership advantage of differential private models.