CITED: A Decision Boundary-Aware Signature for GNNs Towards Model Extraction Defense

TL;DR

CITED is a novel signature-based framework for verifying ownership of GNNs against model extraction attacks, effective on both embedding and label levels without harming model performance.

Contribution

It introduces the first ownership verification method for GNNs that works on multiple output levels and outperforms existing watermarking techniques.

Findings

CITED effectively verifies GNN ownership against extraction attacks.

The framework maintains downstream GNN performance.

CITED demonstrates robustness and outperforms prior watermarking methods.

Abstract

Graph neural networks (GNNs) have demonstrated superior performance in various applications, such as recommendation systems and financial risk management. However, deploying large-scale GNN models locally is particularly challenging for users, as it requires significant computational resources and extensive property data. Consequently, Machine Learning as a Service (MLaaS) has become increasingly popular, offering a convenient way to deploy and access various models, including GNNs. However, an emerging threat known as Model Extraction Attacks (MEAs) presents significant risks, as adversaries can readily obtain surrogate GNN models exhibiting similar functionality. Specifically, attackers repeatedly query the target model using subgraph inputs to collect corresponding responses. These input-output pairs are subsequently utilized to train their own surrogate models at minimal cost. Many techniques have been proposed to defend against MEAs, but most are limited to specific output levels (e.g., embedding or label) and suffer from inherent technical drawbacks. To address these limitations, we propose a novel ownership verification framework CITED which is a first-of-its-kind method to achieve ownership verification on both embedding and label levels. Moreover, CITED is a novel signature-based method that neither harms downstream performance nor introduces auxiliary models that reduce efficiency, while still outperforming all watermarking and fingerprinting approaches. Extensive experiments demonstrate the effectiveness and robustness of our CITED framework. Code is available at: https://github.com/LabRAI/CITED.