English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Tools annual

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Tools monthly

Global: Zendy Plus monthly

Presents the access of premium content as premium feature

Premium Content

Global: Zendy Plus annual

Global: Zendy Free Plan

Graph Neural Networks (GNNs), inspired by Convolutional Neural Networks(CNNs), aggregate the message of nodes' neighbors and structure information toacquire expressive representations of nodes for node classification, graphclassification, and link prediction. Previous studies have indicated that GNNsare vulnerable to Membership Inference Attacks (MIAs), which infer whether anode is in the training data of GNNs and leak the node's private information,like the patient's disease history. The implementation of previous MIAs takesadvantage of the models' probability output, which is infeasible if GNNs onlyprovide the prediction label (label-only) for the input.  In this paper, we propose a label-only MIA against GNNs for nodeclassification with the help of GNNs' flexible prediction mechanism, e.g.,obtaining the prediction label of one node even when neighbors' information isunavailable. Our attacking method achieves around 60\% accuracy, precision, andArea Under the Curve (AUC) for most datasets and GNN models, some of which arecompetitive or even better than state-of-the-art probability-based MIAsimplemented under our environment and settings. Additionally, we analyze theinfluence of the sampling method, model selection approach, and overfittinglevel on the attack performance of our label-only MIA. Both of those factorshave an impact on the attack performance. Then, we consider scenarios whereassumptions about the adversary's additional dataset (shadow dataset) and extrainformation about the target model are relaxed. Even in those scenarios, ourlabel-only MIA achieves a better attack performance in most cases. Finally, weexplore the effectiveness of possible defenses, including Dropout,Regularization, Normalization, and Jumping knowledge. None of those fourdefenses prevent our attack completely.

Label-Only Membership Inference Attack against Node-Level Graph Neural Networks