arXiv cs.AI· Kaixiang Zhao, Bolin Shen, Yuyang Dai, Shayok Chakraborty, Yushun Dong·· 11 小时前AI 评分31
GraphIP-Bench：偷走一个图神经网络有多难，我们能阻止吗？
GraphIP-Bench: How Hard Is It to Steal a Graph Neural Network, and Can We Stop It?
AI 导读
研究者提出统一基准 GraphIP-Bench，在单一黑盒协议下同时评估 GNN 模型窃取与防御，集成 12 种提取攻击、12 种防御、10 个公开图、3 种 GNN 骨干和 3 类图学习任务。
正文 · 原文
Abstract:Graph neural networks (GNNs) deployed as cloud services can be *stolen* through *model-extraction attacks*, which train a surrogate from query responses to reproduce the target's behaviour, and a growing line of ownership defenses tries to prevent or trace such theft. The title of this paper asks two questions: *how hard is it to steal a GNN?*, and *can we stop it?* Prior work cannot answer either, because experiments use inconsistent datasets, threat models, and metrics. We introduce *GraphIP-Bench*, a unified benchmark which evaluates both sides under a single black-box protocol. It integrates twelve extraction attacks, twelve defenses spanning watermarking, output-perturbation, and query-pattern-detection families, ten public graphs covering homophilic, heterophilic, and large-scale regimes, three GNN backbones, and three graph-learning tasks, and it reports fidelity, task utility, ownership verification, and computational cost on shared splits, queries, and budgets. We further add a joint attack-and-defense track which runs every attack on every defended target and measures watermark verification on the resulting surrogate, which exposes the protection that a defense retains after extraction. The empirical picture is short: stealing a GNN is easy at medium query budgets and most defenses do not change this; several watermarks verify reliably on the protected model but lose most of their verification signal on the extracted surrogate, which exposes a gap that single-model evaluations miss; and heterophilic graphs are systematically harder to steal, while a cross-architecture mismatch between target and surrogate reduces but does not prevent extraction. We release *GraphIP-Bench* with reproducible scripts and configurations, and integrate the attacks and defenses into the PyGIP library.
| Comments: | Accepted at NeurIPS 2026. Code: this https URL |
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI); Machine Learning (cs.LG) |
| Cite as: | arXiv:2605.12827 [cs.CR] |
| (or arXiv:2605.12827v3 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2605.12827 arXiv-issued DOI via DataCite |
Submission history
From: Kaixiang Zhao [view email]
[v1]
Tue, 12 May 2026 23:49:45 UTC (936 KB)
[v2]
Mon, 25 May 2026 19:09:13 UTC (767 KB)
[v3]
Wed, 4 Nov 2026 18:21:51 UTC (765 KB)
来源：arXiv cs.AI · arxiv.org