Graph data contains rich node features and unique edge information, which
have been applied across various domains, such as citation networks or
recommendation systems. Graph Neural Networks (GNNs) are specialized for
handling such data and have shown impressive performance in many applications.
However, GNNs may contain of sensitive information and susceptible to privacy
attacks. For example, link stealing is a type of attack in which attackers
infer whether two nodes are linked or not. Previous link stealing attacks
primarily relied on posterior probabilities from the target GNN model,
neglecting the significance of node features. Additionally, variations in node
classes across different datasets lead to different dimensions of posterior
probabilities. The handling of these varying data dimensions posed a challenge
in using a single model to effectively conduct link stealing attacks on
different datasets. To address these challenges, we introduce Large Language
Models (LLMs) to perform link stealing attacks on GNNs. LLMs can effectively
integrate textual features and exhibit strong generalizability, enabling
attacks to handle diverse data dimensions across various datasets. We design
two distinct LLM prompts to effectively combine textual features and posterior
probabilities of graph nodes. Through these designed prompts, we fine-tune the
LLM to adapt to the link stealing attack task. Furthermore, we fine-tune the
LLM using multiple datasets and enable the LLM to learn features from different
datasets simultaneously. Experimental results show that our approach
significantly enhances the performance of existing link stealing attack tasks
in both white-box and black-box scenarios. Our method can execute link stealing
attacks across different datasets using only a single model, making link
stealing attacks more applicable to real-world scenarios.

利用大型语言模型在图神经网络中进行链接窃取攻击，通过多数据集微调实现攻击性能的显著提升，使得链接窃取攻击更适用于实际场景。

针对图神经网络的链接窃取攻击的大型语言模型

Large Language Models for Link Stealing Attacks Against Graph Neural  Networks

A graph neural network (GNN) is a type of neural network that is specifically
designed to process graph-structured data. Typically, GNNs can be implemented
in two settings, including the transductive setting and the inductive setting.
In the transductive setting, the trained model can only predict the labels of
nodes that were observed at the training time. In the inductive setting, the
trained model can be generalized to new nodes/graphs. Due to its flexibility,
the inductive setting is the most popular GNN setting at the moment. Previous
work has shown that transductive GNNs are vulnerable to a series of privacy
attacks. However, a comprehensive privacy analysis of inductive GNN models is
still missing. This paper fills the gap by conducting a systematic privacy
analysis of inductive GNNs through the lens of link stealing attacks, one of
the most popular attacks that are specifically designed for GNNs. We propose
two types of link stealing attacks, i.e., posterior-only attacks and combined
attacks. We define threat models of the posterior-only attacks with respect to
node topology and the combined attacks by considering combinations of
posteriors, node attributes, and graph features. Extensive evaluation on six
real-world datasets demonstrates that inductive GNNs leak rich information that
enables link stealing attacks with advantageous properties. Even attacks with
no knowledge about graph structures can be effective. We also show that our
attacks are robust to different node similarities and different graph features.
As a counterpart, we investigate two possible defenses and discover they are
ineffective against our attacks, which calls for more effective defenses.

通过针对归纳式图神经网络进行系统隐私分析，本文填补了以往对于归纳式图神经网络的全面隐私分析的空白，并通过对链接窃取攻击的分析，提出了后验攻击和组合攻击两种类型的攻击，发现归纳式图神经网络泄漏大量信息，使得攻击即使在没有关于图结构的先验知识的情况下，也能够有效进行；同时，研究了两种可能的防御方法并发现它们对攻击是无效的，因此需要更有效的防御机制。

对基于归纳图神经网络的链接窃取攻击

Link Stealing Attacks Against Inductive Graph Neural Networks

Graph data, such as chemical networks and social networks, may be deemed
confidential/private because the data owner often spends lots of resources
collecting the data or the data contains sensitive information, e.g., social
relationships. Recently, neural networks were extended to graph data, which are
known as graph neural networks (GNNs). Due to their superior performance, GNNs
have many applications, such as healthcare analytics, recommender systems, and
fraud detection. In this work, we propose the first attacks to steal a graph
from the outputs of a GNN model that is trained on the graph. Specifically,
given a black-box access to a GNN model, our attacks can infer whether there
exists a link between any pair of nodes in the graph used to train the model.
We call our attacks link stealing attacks. We propose a threat model to
systematically characterize an adversary's background knowledge along three
dimensions which in total leads to a comprehensive taxonomy of 8 different link
stealing attacks. We propose multiple novel methods to realize these 8 attacks.
Extensive experiments on 8 real-world datasets show that our attacks are
effective at stealing links, e.g., AUC (area under the ROC curve) is above 0.95
in multiple cases. Our results indicate that the outputs of a GNN model reveal
rich information about the structure of the graph used to train the model.

本研究提出了针对图神经网络的链路窃取攻击，并介绍了三个维度的威胁模型以及八种链路窃取攻击方法。在八个真实数据集上的实验表明，攻击是有效的，并揭示了 GNN 模型输出关于训练图结构的丰富信息，证明了在黑盒条件下，一些私密数据可以被窃取。