LinkTeller：通过影响分析从图神经网络中恢复私有边
LinkTeller: Recovering Private Edges from Graph Neural Networks via Influence Analysis
摘要：
图结构化数据具有丰富的节点特征和边信息，已经实现了一些成功的应用，例如推荐系统和流量预测。然而，这些高维特征和高阶邻接信息通常是异构的，并在实践中由不同的数据持有人。给定这样的垂直数据分区（例如，一个数据持有者将仅拥有节点特征或边缘信息），由于隐私问题，不同的数据持有者必须开发有效的联合训练协议，而不是直接向彼此传送数据。在本文中，我们专注于边缘隐私，并考虑一个训练场景，其中具有节点特征的Bob首先将训练节点特征发送给拥有邻接信息的Alice。然后，Alice将使用联合信息训练图神经网络（GNN），并发布推理API。在推理过程中，Bob能够提供测试节点功能并查询API以获得测试节点的预测。在这种情况下，我们首先提出了一个隐私攻击LinkTeller通过影响力分析推断的私人边缘信息由爱丽丝通过设计对抗性查询鲍勃。然后，我们的经验表明，LinkTeller能够恢复大量的私人边缘，优于现有的基线。为了进一步评估隐私泄漏，我们采用了现有的差分私有图卷积网络（DP GCN）训练算法，并提出了一个新的DP GCN机制LapGraph。我们发现，这些DP GCN机制并不总是弹性对LinkTeller经验下温和的隐私保证（$\varepsilon>5$）。我们的研究将为未来设计更有弹性的隐私保护GCN模型的研究提供指导;同时，深入了解GCN模型实用性和对潜在隐私攻击的鲁棒性之间的权衡。
英文摘要：
Graph structured data have enabled several successful applications such as recommendation systems and traffic prediction, given the rich node features and edges information. However, these high-dimensional features and high-order adjacency information are usually heterogeneous and held by different data holders in practice. Given such vertical data partition (e.g., one data holder will only own either the node features or edge information), different data holders have to develop efficient joint training protocols rather than directly transfer data to each other due to privacy concerns. In this paper, we focus on the edge privacy, and consider a training scenario where Bob with node features will first send training node features to Alice who owns the adjacency information. Alice will then train a graph neural network (GNN) with the joint information and release an inference API. During inference, Bob is able to provide test node features and query the API to obtain the predictions for test nodes. Under this setting, we first propose a privacy attack LinkTeller via influence analysis to infer the private edge information held by Alice via designing adversarial queries for Bob. We then empirically show that LinkTeller is able to recover a significant amount of private edges, outperforming existing baselines. To further evaluate the privacy leakage, we adapt an existing algorithm for differentially private graph convolutional network (DP GCN) training and propose a new DP GCN mechanism LapGraph. We show that these DP GCN mechanisms are not always resilient against LinkTeller empirically under mild privacy guarantees ($\varepsilon>5$). Our studies will shed light on future research towards designing more resilient privacy-preserving GCN models; in the meantime, provide an in-depth understanding of the tradeoff between GCN model utility and robustness against potential privacy attacks.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
