Defending against Model Extraction for GNNs with Model Reprogramming

2026-08-11

AI Summary

This work addresses the vulnerability of Graph Neural Networks (GNNs) in Machine Learning as a Service (MLaaS) settings to model extraction attacks, where existing defenses struggle to balance utility and real-time performance due to their neglect of graph structural dependencies. To overcome this limitation, the authors propose GraphRP, a novel framework that introduces model reprogramming into GNN security for the first time. GraphRP employs a structure-aware gating mechanism and learnable topological prototypes to construct a dynamic structural firewall capable of differentially responding to benign and malicious queries. Theoretical analysis grounded in Fisher information maximization and local second-order approximation guarantees the defense’s efficacy. Experimental results demonstrate that GraphRP substantially reduces attack success rates under both hard-label and soft-label extraction attacks while preserving high-fidelity performance on legitimate queries.

Abstract

Graph Neural Networks (GNNs) serve as the backbone for high-stakes applications in Machine-Learning-as-a-Service (MLaaS). Still, their black-box deployment exposes them to Model Extraction (ME) attacks, in which adversaries steal intellectual property by querying APIs. Existing defenses suffer from a critical ''Euclidean bias'': they transfer image-based strategies (e.g., random noise) to graphs, ignoring the complex topological dependencies between nodes, which often results in severe utility degradation. Passive methods like watermarking also fail to prevent theft in real time. To bridge this gap, we propose GraphRP (Graph Reprogramming Protection), a proactive defense framework that repurposes Model Reprogramming for security. Unlike static perturbations, GraphRP introduces a Structure-Aware Gating Mechanism driven by learnable topological prototypes. This creates a dynamic ''structural firewall'' that selectively modulates the model's decision boundary: it preserves fidelity for benign queries residing on the training manifold, while maximizing the Fisher Information along the perturbation direction for adversarial queries. Under standard assumptions (bounded loss, optimal attacker, and local second-order approximation), we prove a lower bound on the attacker's estimation error that increases with the structural sensitivity of the reprogramming noise. Extensive experiments on both hard-label and soft-label ME attacks demonstrate that GraphRP significantly degrades attack effectiveness while preserving benign utility.

Problem

• Model Extraction
• Graph Neural Networks
• Machine-Learning-as-a-Service
• Intellectual Property Theft
• Topological Dependencies

Innovation

• Graph Neural Networks
• Model Extraction Defense
• Model Reprogramming
• Structure-Aware Gating
• Fisher Information