Privacy Auditing of Multi-domain Graph Pre-trained Model under Membership Inference Attacks

AI summary

Overview

Research area: Privacy and security of graph machine learning, specifically membership inference attacks (MIAs) against multi-domain graph pre-trained models (a foundation-model-style paradigm for graph neural networks).

Technical level: Intermediate. Readers should be comfortable with graph neural networks, self-supervised pre-training objectives (contrastive learning and link prediction), and the standard shadow-model formulation of membership inference. The three proposed mechanisms are described with equations but are conceptually approachable.

Scope: The paper defines a node-level membership inference threat model for multi-domain graph pre-trained encoders, proposes a three-component attack framework called Mgp-Mia, and evaluates it against four pre-trained victim models on five benchmark graph datasets.

What This Paper Is About

Multi-domain graph pre-training trains a single GNN across graphs from many domains so it generalizes well to downstream tasks — but that same generalization makes it hard to tell whether any particular node was in the training data. The authors ask whether an attacker who only sees a released pre-trained encoder (and one shadow graph from a single domain) can still infer node membership, and they show that existing graph MIA methods largely fail in this setting. The paper's goal is to build an attack that works anyway, and thereby to measure the privacy risk that publishing these pre-trained models creates.

Key Contributions

1. The first privacy audit of multi-domain graph pre-trained models under MIAs. The authors state this is the first work to investigate the problem, and they formally characterize why existing graph MIAs transfer poorly: enhanced generalization reduces overfitting, shadow datasets are unrepresentative across domains, and embedding outputs carry weaker membership signals than logits.

2. A membership signal amplification mechanism. Machine unlearning is repurposed as an attack aid: a selective, controllable unlearning step (guided by a teacher similarity score) deliberately increases overfitting on the remaining data, strengthening the membership signal in the target model.

3. An incremental shadow model construction mechanism. Rather than training a shadow model from scratch, the attacker fine-tunes the unlearned model on a limited shadow graph, using a Fisher Information Matrix-based regularizer so the shadow model approximates the target's overfitting behavior without domain-aligned shadow data.

4. A similarity-based inference mechanism and empirical validation. Attack features are built from the similarity between a target node's embedding and its positive and negative samples, fed to a two-layer MLP attack model. Extensive experiments across four pre-trained victims and five datasets demonstrate the effectiveness of Mgp-Mia.

Main Findings

• Existing graph MIAs are structurally unsuited to this setting. In toy experiments on the Cora dataset with MDGPT (link prediction) and SAMGPT (contrastive learning) as victims, PCA visualizations of output embeddings show weak separability between members and non-members, and perturbed-edge experiments show member embeddings are not more stable than non-member embeddings, particularly for link-prediction-based methods.

• Mgp-Mia leads on link-prediction-based victims (MDGPT, BRIDGE). On Cora with MDGPT, Mgp-Mia reaches 81.79 ± 0.94 ACC and 83.99 ± 0.87 F1, versus the strongest baseline GPIA at 72.20 ± 16.41 ACC and 76.41 ± 15.07 F1 — an improvement of 9.6% accuracy and 7.5% F1, even though GPIA uses real member and non-member samples that Mgp-Mia does not. Accuracy and F1 gains reach up to 10.8% and 16.3% on other datasets.

• Mgp-Mia leads on contrastive-learning-based victims (GCOPE, SAMGPT). On GCOPE it achieves the highest accuracy and F1 in all cases except the Computers dataset, where GPIA slightly leads (GCOPE/Computers: GPIA 90.00 ± 22.36 ACC and 93.33 ± 14.91 F1 versus Mgp-Mia 84.80 ± 1.43 ACC and 86.35 ± 0.84 F1) — again, GPIA uses privileged access to real member and non-member nodes. On SAMGPT it is best on every dataset, improving over the closest baseline by 26.6% accuracy and 25.0% F1 on Cora, and by over 20% in both metrics on Computers. SAMGPT results include 99.91 ± 0.20 ACC on Cora and 98.83 ± 1.17 ACC on CiteSeer.

• Both proposed components are necessary. Ablations on MDGPT and SAMGPT over Cora, CiteSeer, and PubMed show that removing the incremental shadow model construction (Mgp-Mia w/o IL) causes a substantial drop, and removing unlearning (Mgp-Mia w/o UL) causes a further drop; the paper reports that the incremental learning module provides "substantial intrinsic gains" while unlearning adds additional benefit. Numeric values for the ablation are presented only in Figure 5/6 and are not given as numbers in the text.

• The attack is insensitive to its main regularization hyperparameter. The hyperparameter α, which controls Fisher-based regularization strength during incremental learning, is reported as producing stable performance across a wide range of values, with the optimal setting nearly the same across datasets. Specific α values are not reported in the main text.

• Stated cost profile. Total time complexity is reported as O((E₁·n_unlearn + E₂·n_train + m)·L·f·d), scaling linearly with graph size and embedding dimension. All experiments were run on a single NVIDIA V100 GPU and repeated 5 times.

Methodology in Plain English

1. Set up a realistic attacker. The adversary is white-box with respect to the released model — it knows the architecture, parameters, and training algorithm — but has no access to the original training process or the full multi-domain dataset. Instead it holds one shadow graph from a domain similar to the node being attacked. Datasets are split in half: nodes in one half are members, nodes in the other half are non-members.

2. Deliberately make the model overfit again. Because multi-domain pre-training suppresses overfitting, the attack first "unlearns" a random subgraph of the shadow graph. A few epochs of fine-tuning produce an augment model; comparing node-to-neighbor similarities between the original target and this augment model identifies which nodes are disproportionately memorized. Those differences define a teacher signal, and fine-tuning the target toward that signal yields the unlearned model — capacity is freed and remaining data gets memorized more strongly, so members stand out more.

3. Build a shadow model cheaply. A Fisher Information Matrix estimated from the shadow training split measures which parameters matter to the task. The unlearned model is then fine-tuned on the shadow training graph with a penalty (strength α) that keeps important parameters close to their unlearned values, producing a shadow model that mimics the target's overfitting behavior using only limited shadow data.

4. Turn embeddings into attackable features. Self-supervised objectives pull positive pairs together and push negative pairs apart, so the attack measures cosine similarity between each node's embedding and m randomly chosen positive samples and m negative samples. These similarity vectors, paired with member/non-member labels from the shadow train/test split, form the attack dataset.

5. Train and apply the attack model. A two-layer MLP with latent dimension 256 is trained on those features with cross-entropy loss, then used to predict membership for nodes in the real target model. Six adapted baselines (Embed-MIA, Grad-MIA, NLO-MIA, GLO-MIA, GE-MIA, GPIA) are compared using Accuracy and F1.

Why This Matters

The paper shows that releasing a multi-domain graph pre-trained encoder — a practice the paper frames as common because pre-trained models are costly to produce and publicly shared to support graph foundation model development — can leak whether specific nodes were in the pre-training data. Unlike prior graph MIAs, the attack works without domain-aligned shadow data and without logits, which are two of the more convenient assumptions earlier methods relied on.

• Graph foundation model release pipelines: developers publishing pre-trained GNN encoders can use this attack as a privacy audit before release.
• Sensitive graph domains: citation and co-purchase networks are used in this paper, and the same risk applies to any graph where node membership is itself sensitive (e.g., user–item or interaction graphs).
• Privacy-preserving training and unlearning research: the paper shows machine unlearning can be inverted into an attack amplifier, which is directly relevant to how unlearning methods are evaluated for safety.
• Regulatory and compliance auditing: membership inference success rates are a measurable proxy for "was my data used to train this model," which maps onto data-subject access and deletion requests.

Industry relevance. Any organization that pre-trains on multi-source graph data and then distributes the encoder inherits the risk this paper quantifies. The attack's stated linear-time complexity and its ability to operate with a single domain-aligned shadow graph and an embedding-only API make it practical under constraints that resemble real model-release conditions. Note that defense mechanisms are not evaluated in the reported content.

Future Directions

• Defenses against the attack. The paper audits vulnerability but does not report or evaluate defenses such as differentially private pre-training or similarity-perturbing embedding releases.
• Extending beyond node-level membership. The paper targets node-level membership inference, following prior work; whole-graph and edge-level membership in the multi-domain setting are not analyzed.
• Stronger threat-model realism. The current attacker is white-box and needs a shadow graph from a similar distribution to the target node; whether the attack degrades gracefully with no domain-aligned shadow graph, or under black-box query access, is not reported.
• Broadening victim coverage and reproducibility of diagnostics. Only four victim models (MDGPT, BRIDGE, GCOPE, SAMGPT) on five datasets are evaluated; the pre-attack separability and robustness diagnostics are reported only for Cora with MDGPT and SAMGPT.

Target Audience

Privacy and security researchers working on machine learning attacks, especially those studying membership inference; researchers and engineers building graph foundation models or multi-domain graph pre-training systems who need to assess release-time privacy risk; and practitioners of machine unlearning who want to understand the dual-use properties of unlearning. The paper is most useful to readers already familiar with GNN architectures and the shadow-model MIA pipeline.

Authors’ abstract

Multi-domain graph pre-training has emerged as a pivotal technique in developing graph foundation models. While it greatly improves the generalization of graph neural networks, its privacy risks under membership inference attacks (MIAs), which aim to identify whether a specific instance was used in training (member), remain largely unexplored. However, effectively conducting MIAs against multi-domain graph pre-trained models is a significant challenge due to: (i) Enhanced Generalization Capability: Multi-domain pre-training reduces the overfitting characteristics commonly exploited by MIAs. (ii) Unrepresentative Shadow Datasets: Diverse training graphs hinder the obtaining of reliable shadow graphs. (iii) Weakened Membership Signals: Embedding-based outputs offer less informative cues than logits for MIAs. To tackle these challenges, we propose MGP-MIA, a novel framework for Membership Inference Attacks against Multi-domain Graph Pre-trained models. Specifically, we first propose a membership signal amplification mechanism that amplifies the overfitting characteristics of target models via machine unlearning. We then design an incremental shadow model construction mechanism that builds a reliable shadow model with limited shadow graphs via incremental learning. Finally, we introduce a similarity-based inference mechanism that identifies members based on their similarity to positive and negative samples. Extensive experiments demonstrate the effectiveness of our proposed MGP-MIA and reveal the privacy risks of multi-domain graph pre-training.