Search papers, labs, and topics across Lattice.
The paper introduces CITED, a novel signature-based framework for defending against model extraction attacks (MEAs) on Graph Neural Networks (GNNs) at both the embedding and label levels. CITED generates a decision boundary-aware signature that is embedded into the GNN, enabling ownership verification without compromising downstream performance or requiring auxiliary models. Experiments demonstrate that CITED outperforms existing watermarking and fingerprinting techniques in defending against MEAs while maintaining efficiency.
Stop model extraction attacks on your GNNs without sacrificing accuracy: CITED uses a novel decision boundary signature to prove ownership at both the embedding and label levels.
Graph neural networks (GNNs) have demonstrated superior performance in various applications, such as recommendation systems and financial risk management. However, deploying large-scale GNN models locally is particularly challenging for users, as it requires significant computational resources and extensive property data. Consequently, Machine Learning as a Service (MLaaS) has become increasingly popular, offering a convenient way to deploy and access various models, including GNNs. However, an emerging threat known as Model Extraction Attacks (MEAs) presents significant risks, as adversaries can readily obtain surrogate GNN models exhibiting similar functionality. Specifically, attackers repeatedly query the target model using subgraph inputs to collect corresponding responses. These input-output pairs are subsequently utilized to train their own surrogate models at minimal cost. Many techniques have been proposed to defend against MEAs, but most are limited to specific output levels (e.g., embedding or label) and suffer from inherent technical drawbacks. To address these limitations, we propose a novel ownership verification framework CITED which is a first-of-its-kind method to achieve ownership verification on both embedding and label levels. Moreover, CITED is a novel signature-based method that neither harms downstream performance nor introduces auxiliary models that reduce efficiency, while still outperforming all watermarking and fingerprinting approaches. Extensive experiments demonstrate the effectiveness and robustness of our CITED framework. Code is available at: https://github.com/LabRAI/CITED.
