GRAIN: Exact Graph Reconstruction from Gradients

2025-03-03

AI Summary

Gradient updates in federated learning remain vulnerable to graph structure inversion attacks, yet this privacy risk has not been systematically investigated for graph-structured data. Method: This paper introduces the first precise gradient inversion attack targeting Graph Neural Networks (GNNs), specifically GCN and GAT models, under the honest-but-curious threat model. It jointly reconstructs both subgraph topology and node features by exploiting the low-rank property of GNN gradients to efficiently recover local subgraphs, followed by stitching and filtering to reconstruct the full input graph. A novel evaluation metric is proposed to quantify reconstruction fidelity. Results: Evaluated on molecular, citation, and social network datasets, our method achieves up to 80% exact graph reconstruction—substantially outperforming baselines (which correctly localize only 20% of nodes). This reveals a previously unrecognized privacy vulnerability in graph federated learning and establishes a critical benchmark for developing effective defense mechanisms.

Technology Category

• Machine Learning: Graph-based Machine Learning
• Computer Vision: Adversarial Attacks & Robustness
• Data Mining & Knowledge Management: Graph Mining, Social Network Analysis & Community

Application Category

• Graph Algorithms and Modeling for the Web: Representation, reconstruction, and subgraph or motif discovery in Web-related graphs
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking
• Semantics and Knowledge: Scalable techniques for the creation, curation, publication, maintenance, and consumption of large, Web-based, structured, reusable, knowledge graphs and ontologies

Abstract

Federated learning claims to enable collaborative model training among multiple clients with data privacy by transmitting gradient updates instead of the actual client data. However, recent studies have shown the client privacy is still at risk due to the, so called, gradient inversion attacks which can precisely reconstruct clients' text and image data from the shared gradient updates. While these attacks demonstrate severe privacy risks for certain domains and architectures, the vulnerability of other commonly-used data types, such as graph-structured data, remain under-explored. To bridge this gap, we present GRAIN, the first exact gradient inversion attack on graph data in the honest-but-curious setting that recovers both the structure of the graph and the associated node features. Concretely, we focus on Graph Convolutional Networks (GCN) and Graph Attention Networks (GAT) -- two of the most widely used frameworks for learning on graphs. Our method first utilizes the low-rank structure of GNN gradients to efficiently reconstruct and filter the client subgraphs which are then joined to complete the input graph. We evaluate our approach on molecular, citation, and social network datasets using our novel metric. We show that GRAIN reconstructs up to 80% of all graphs exactly, significantly outperforming the baseline, which achieves up to 20% correctly positioned nodes.

Problem

• Exact reconstruction of graph data
• Privacy risks in federated learning
• Gradient inversion attacks on GCN and GAT

Innovation

• Exact gradient inversion attack
• Reconstructs graph structure and node features
• Utilizes low-rank structure of GNN gradients