Dagger: Decoupling-based Model Stealing Attack against Graph Neural Networks
Dagger steals GNN models from hard-label APIs with higher fidelity and far fewer queries.
Dagger is a two-phase model-stealing attack on graph neural networks served as black-box MLaaS APIs that return only hard labels and hide the backbone. Phase 1 pretrains a surrogate with decoupled information propagation and manifold-level node mixup; phase 2 freezes the encoder and fine-tunes a class-balanced head without further victim queries. Across four benchmark graphs and four GNN backbones, it reports up to 18.16% higher fidelity while using 12.23 times fewer queries than the strongest baseline.
- Threat model uses hard labels, unknown backbones, and tight query budgets.
- Decoupled propagation handles sparse subgraphs and isolated nodes.
- Class-balanced fine-tuning fixes imbalance without extra victim queries.
- Reports up to 18.16% higher fidelity and 12.23× fewer queries.
From the original article
1 min read at arxiv.orgAs Graph Neural Networks (GNNs) are widely deployed as Machine Learning-as-a-Service (MLaaS) APIs, model stealing attacks have emerged as a critical security threat. By querying a victim model's black-box API, an adversary can construct a functionally equivalent surrogate model, compromising proprietary intellectual property and downstream security.
By Ying Song · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.