A study of graph neural networks for link prediction on vulnerability to membership attacks

D. Shaikhelislamov ; K. Lukyanov ; N. Severin ; M. Drobyshevskiy ; I. Makarov ; D. Turdakov

Zapiski Nauchnykh Seminarov POMI, Investigations on applied mathematics and informatics. Part II–2, Tome 530 (2023), pp. 113-127

Résumé

Graph neural networks (GNNs) have shown great promise in a variety of tasks involving graph data, including recommendation systems. However, as GNNs become more widely adopted in practical applications, concerns have arisen about their vulnerability to adversarial attacks. These attacks can lead to biased recommendations, potentially causing economic losses and safety risks. In this work, we consider an industrial application of recommendation systems for transport logistics and study their vulnerability to membership inference attacks. The dataset represents real train flows in Russia, published in the ETIS project. Experiments with three popular GNN architectures show that all of them can be successfully attacked even when the adversary has minimal background knowledge. Specifically, an attacker with access to only 1-2% of the actual data can successfully train their own GNN model to infer the membership of a shipper-consignee association in the training set with an accuracy over 94%. Our study also confirms that overfitting is the primary factor that influences the attack performance of recommendation systems.

Bibliographie

[1] J. Chen, X. Lin, Z. Shi, and Y. Liu, “Link prediction adversarial attack via iterative gradient attack”, IEEE Transactions on Computational Social Systems, 7:4 (2020), 1081–1094 | DOI

[2] J. Chen, Z. Shi, Y. Wu, X. Xu, and H. Zheng, Link prediction adversarial attack, 2018, arXiv: 1810.01110

[3] H. Dai, H. Li, T. Tian, X. Huang, L. Wang, J. Zhu, and L. Song, “Adversarial attack on graph structured data”, International conference on machine learning, PMLR, 2018, 1115–1124

[4] S. Guo, Y. Lin, N. Feng, C. Song, and H. Wan, “Attention based spatial-temporal graph convolutional networks for traffic flow forecasting”, Proceedings of the AAAI conference on artificial intelligence, 33 (2019), 922–929 | DOI

[5] L. Hamilton, W., R. Ying, and J. Leskovec, “Inductive representation learning on large graphs”, Proceedings of International Conference on NIPS (Red Hook, NY, USA), Curran Associates Inc, 2017, 1025–1035

[6] D. Harris and S. L. Harris, Digital design and computer architecture, Morgan Kaufmann, 2010

[7] X. He, R. Wen, Y. Wu, M. Backes, Y. Shen, and Y. Zhang, Node-level membership inference attacks against graph neural networks, 2021, arXiv: 2102.05429

[8] H. Hu, Z. Salcic, L. Sun, G. Dobbie, P. S. Yu, and X. Zhang, “Membership inference attacks on machine learning: A survey”, ACM Computing Surveys (CSUR), 54 (2022), 11s, 1–37 | MR

[9] L. Huang, Y. Ma, S. Wang, and Y. Liu, “An attention-based spatiotemporal lstm network for next poi recommendation”, IEEE Transactions on Services Computing, 14:6 (2019), 1585–1597 | DOI

[10] T. N. Kipf and M. Welling, Semi-supervised classification with graph convolutional networks, 2016, arXiv: 1609.02907

[11] M. Kula, Metadata embeddings for user and item cold-start recommendations, 2015, arXiv: 1507.08439

[12] T. J. Lakshmi and S. D. Bhavani, “Link prediction measures in various types of information networks: a review”, 2018 IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining (ASONAM), IEEE, 2018, 1160–1167

[13] W. Lin, S. Ji, and B. Li, “Adversarial attacks on link prediction algorithms based on graph neural networks”, Proceedings of the 15th ACM Asia Conference on Computer and Communications Security, 2020, 370–380 | DOI

[14] G. Liu, X. Huang, and X. Yi, “Adversarial label poisoning attack on graph neural networks via label propagation”, Computer Vision–ECCV 2022, Proceedings (Tel Aviv, Israel, October 23–27, 2022), v. V, Springer, 2022, 227–243

[15] J. Ma, S. Ding, and Q. Mei, “Towards more practical adversarial attacks on graph neural networks”, Advances in neural information processing systems, 33 (2020), 4756–4766 | MR

[16] I. Makarov and O. Gerasimova, “Link prediction regression for weighted co-authorship networks”, Proceedings of the 15th International Work-Conference on Artificial Neural Networks, IWANN'19 (Universitat Politecnica de Catalunya, July 12–14, 2019), Springer, Berlin, Germany, 2019, 667–677

[17] I. Makarov and O. Gerasimova, “Predicting collaborations in co-authorship network”, Proceedings of the 14th IEEE International Workshop on Semantic and Social Media Adaptation and Personalization, SMAP'19 (Cyprus University of Technology, June 09–10, 2019), IEEE, New York, USA, 2019, 1–6

[18] I. Makarov, D. Kiselev, N. Nikitinsky, and L. Subelj, “Survey on graph embeddings and their applications to machine learning problems on graphs”, PeerJ Computer Science, 2021, e357, 1–62 | Zbl

[19] I. Makarov, K. Korovina, and D. Kiselev, “Jonnee: Joint network nodes and edges embedding”, IEEE Access, 9 (2021), 144646–144659 | DOI

[20] I. Makarov, A. Savchenko, A. Korovko, L. Sherstyuk, N. Severin, D. Kiselev, A. Mikheev, and D. Babaev, “Temporal network embedding framework with causal anonymous walks representations”, PeerJ Computer Science, 8 (2022), e858, 27 pp. | DOI

[21] H. Nguyen, L.-M. Kieu, T. Wen, and C. Cai, “Deep learning methods in transportation domain: a review”, IET Intelligent Transport Systems, 12:9 (2018), 998–1004 | DOI

[22] X. Ning and G. Karypis, “Slim: Sparse linear methods for top-n recommender systems”, 2011 IEEE 11th ICDM, IEEE, 2011, 497–506

[23] I. E. Olatunji, W. Nejdl, and M. Khosla, “Membership inference attack on graph neural networks”, 2021 Third IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications, IEEE, 2021, 11–20

[24] E. Szimba, M. Kraft, J. Ihrig, A. Schimke, O. Schnell, Y. Kawabata, S. Newton, T. Breemersch, R. Versteegh, J. Meijeren, H. Jin-Xue, C. de stasio, and F. Fermi, Etisplus database content and methodology

[25] J. Tang, J. Li, Z. Gao, and J. Li, “Rethinking graph neural networks for anomaly detection”, ICML, PMLR, 2022, 21076–21089

[26] S. Truex, L. Liu, M. E. Gursoy, L. Yu, and W. Wei, Towards demystifying membership inference attacks, 2018, arXiv: 1807.09173

[27] P. Veličković, Graph attention networks, G. Cucurull, A. Casanova, A. Romero, P. Lio, and Y. Bengio, 2017

[28] B. Wang, T. Zhou, M. Lin, P. Zhou, A. Li, M. Pang, C. Fu, H. Li, and Y. Chen, Evasion attacks to graph neural networks via influence function, 2020, arXiv: 2009.00203 | Zbl

[29] S. Wang, J. Cao, and P. Yu, “Deep learning for spatio-temporal data mining: A survey”, IEEE transactions on knowledge and data engineering, 2020 | Zbl

[30] B. Wu, X. Yang, S. Pan, and X. Yuan, “Adapting membership inference attacks to gnn for graph classification: approaches and implications”, 2021 IEEE International Conference on Data Mining (ICDM), IEEE, 2021, 1421–1426

[31] K. Xu, H. Chen, S. Liu, P.-Y. Chen, T.-W. Weng, M. Hong, and X. Lin, Topology attack and defense for graph neural networks: An optimization perspective, 2019, arXiv: 1906.04214 | MR

[32] H. Zhang, B. Wu, X. Yang, C. Zhou, S. Wang, X. Yuan, and S. Pan, “Projective ranking: A transferable evasion attack method on graph neural networks”, Proceedings of the 30th ACM International Conference on Information Knowledge Management, 2021, 3617–3621

[33] H. Zhang, B. Wu, X. Yuan, S. Pan, H. Tong, and J. Pei, Trustworthy graph neural networks: Aspects, methods and trends, 2022, arXiv: 2205.07424

[34] Z. Zhang, J. Jia, B. Wang, and N. Z. Gong, “Backdoor attacks to graph neural networks”, Proceedings of the 26th ACM Symposium on Access Control Models and Technologies, 2021, 15–26 | DOI

[35] H. Zheng, H. Xiong, J. Chen, H. Ma, and G. Huang, Motif-backdoor: Rethinking the backdoor attack on graph neural networks via motifs, 2022, arXiv: 2210.13710