Abstract:Many data mining tasks rely on graphs to model relational structures among individuals (nodes). Since relational data are often sensitive, there is an urgent need to evaluate the privacy risks in graph data. One famous privacy attack against data analysis models is the model inversion attack, which aims to infer sensitive data in the training dataset and leads to great privacy concerns. Despite its success in grid-like domains, directly applying model inversion attacks on non-grid domains such as graph leads to poor attack performance. This is mainly due to the failure to consider the unique properties of graphs. To bridge this gap, we conduct a systematic study on model inversion attacks against Graph Neural Networks (GNNs), one of the state-of-the-art graph analysis tools in this paper. First, in the white-box setting where the attacker has full access to the target GNN model, we present GraphMI to infer the private training graph data. Specifically in GraphMI, a projected gradient module is proposed to tackle the discreteness of graph edges and preserve the sparsity and smoothness of graph features; a graph auto-encoder module is used to efficiently exploit graph topology, node attributes, and target model parameters for edge inference; a random sampling module can finally sample discrete edges. Furthermore, in the hard-label black-box setting where the attacker can only query the GNN API and receive the classification results, we propose two methods based on gradient estimation and reinforcement learning (RL-GraphMI). With the proposed methods, we study the connection between model inversion risk and edge influence and show that edges with greater influence are more likely to be recovered. Extensive experiments over several public datasets demonstrate the effectiveness of our methods. We also evaluate our attacks under two defenses: one is the well-designed differential private training, and the other is graph preprocessing. Our experimental results show that such defenses are not sufficiently effective and call for more advanced defenses against privacy attacks.

Privacy-preserving Neural Networks for Smart Manufacturing

The Secret Revealer: Generative Model-Inversion Attacks Against Deep Neural Networks

NetGuard: Protecting Commercial Web APIs from Model Inversion Attacks Using GAN-generated Fake Samples

Industrial Scale Privacy Preserving Deep Neural Network

A GAN-Based Defense Framework Against Model Inversion Attacks.

Devil in Disguise: Breaching Graph Neural Networks Privacy through Infiltration

Adversarial Attacks on Neural-Network-Based Soft Sensors: Directly Attack Output

Inference Attack and Privacy Security of Data-driven Industrial Process Monitoring Systems

Are Neuromorphic Architectures Inherently Privacy-preserving? An Exploratory Study

BrainLeaks: On the Privacy-Preserving Properties of Neuromorphic Architectures against Model Inversion Attacks

Privacy Leakage on DNNs: A Survey of Model Inversion Attacks and Defenses

Information Fingerprint for Secure Industrial Big Data Analytics.

Model Inversion Attacks: A Survey of Approaches and Countermeasures

Privacy-Preserving Intrusion Detection using Convolutional Neural Networks

Model Inversion Attacks Against Graph Neural Networks

Secure Deep Neural Network Models Publishing Against Membership Inference Attacks Via Training Task Parallelism

Re-thinking Model Inversion Attacks Against Deep Neural Networks

GraphMI: Extracting Private Graph Data from Graph Neural Networks

Membership Privacy Evaluation in Deep Spiking Neural Networks

Layer-Wise Security Protection for Deep Neural Networks in Industrial Cyber Physical Systems

Isolation and Induction: Training Robust Deep Neural Networks against Model Stealing Attacks