SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Eli Chien*
UIUC & GaTech  
ichien3@illinois.edu  
ichien6@gatech.edu
Wei-Ning Chen*
Stanford University wnchen@stanford.edu
Chao Pan*
UIUC
chaopan2@illinois.edu
Pan Li
GaTech panli@gatech.edu
Ayfer Ozgur
Stanford University aozgur@stanford.edu
Olgica Milenkovic
UIUC milenkov@illinois.edu
Graph Neural Networks (GNNs) have proven to be highly effective in solving real-world learning problems that involve graph-structured data. However, GNNs can also inadvertently expose sensitive user information and interactions through their model predictions. To address these privacy concerns, Differential Privacy (DP) protocols are employed to control the trade-off between provable privacy protection and model utility. Applying standard DP approaches to GNNs directly is not advisable due to two main reasons. First, the prediction of node labels, which relies on neighboring node attributes through graph convolutions, can lead to privacy leakage. Second, in practical applications, the privacy requirements for node attributes and graph topology may differ. In the latter setting, existing DP-GNN models fail to provide multigranular trade-offs between graph topology privacy, node attribute privacy, and GNN utility. To address both limitations, we propose a new framework termed Graph Differential Privacy (GDP), specifically tailored to graph learning. GDP ensures both provably private model parameters as well as private predictions. Additionally, we describe a novel unified notion of graph dataset adjacency to analyze the properties of GDP for different levels of graph topology privacy. Our findings reveal that DP-GNNs, which rely on graph convolutions, not only fail to meet the requirements for multigranular graph topology privacy but also necessitate the injection of DP noise that scales at least linearly with the maximum node degree. In contrast, our proposed Differentially Private Decoupled Graph Convolutions (DPDGCs) represent a more flexible and efficient alternative to graph convolutions that still provides the necessary guarantees of GDP. To validate our approach, we conducted extensive experiments on seven node classification benchmarking and illustrative synthetic datasets. The results demonstrate that DPDGCs significantly outperform existing DP-GNNs in terms of privacy-utility trade-offs. Our code is publicly available<sup>2</sup>.
Graph learning methods, such as Graph Neural Networks (GNNs) [1-5], are indispensable learning tools due to the ubiquity of graph-structured data and their importance in solving real-world problems
$^{2}$ https://github.com/thupchnsky/dp-gnn
Private (X,Y)	Non-private (X,Y)
k=0	(new)	No privacy
k=1	(new)	Edge-level
k	(new)	(new)
k=n	Node-level	(new)
(a)
(b)
(d)
(e)
Figure 1: Top: (a) Illustration of a training graph dataset. In the example, the graph involves 6 nodes and does not contain self-loops. Nodes 5 and 6 are left unlabeled in the training dataset  $\mathcal{D}$ . (b) An illustration of our novel notion of  $k$ -neighbor-level graph dataset adjacency, with/without node attributes privacy. Red colors indicate entries that are to be replaced in the adjacent dataset  $\mathcal{D}'$  with respect to a node  $r$ . (c) All possible combinations of graph topology and node attribute privacy requirements under our  $k$ -neighbor definition. Bold letters indicate settings not covered by prior literature. Bottom: Illustration of a (d) standard graph convolution and (e) our decoupled graph convolution design. For decoupled graph convolution, we concatenate the node embedding  $\mathbf{Z}$  with node feature  $\mathbf{X}$  to obtain the final prediction. See Figure 2 for a more detailed description of the DPDGC model. Note that the required noise for standard graph convolution is independent of  $k$ , and hence cannot leverage the intrinsic privacy-utility trade-off in  $k$ -neighbor level adjacency.
arising in recommendation systems [6], bioinformatics [7] and fraud detection [8]. Graph datasets, which typically comprise records of users (i.e., node attributes) and their interaction patterns (i.e., graph topology), often contain sensitive information. For example, financial graph datasets contain sensitive financial records and transfer logs between accounts [9, 10]. Online review system graphs comprise information about customer identities and co-purchase records [11].
Given the sensitive nature of graph datasets, it is paramount to ensure that learned models do not reveal information about user attributes or interactions. Unprotected learning models can inadvertently leak information about the training data even if the data itself is not disclosed to the public [12]. Differential privacy (DP) has been used as the gold standard for rigorous quantification of "privacy leakage" of a learning algorithm, as it ensures that the output of a training algorithm remains indistinguishable from that of "adjacent" datasets [13]. Classical DP approaches focus on DP guarantees for model weights (i.e., DP-SGD [14]) when only node attributes are present. This suffices to ensure DP of model predictions for standard classification settings when no graph structure is available. In such settings, the prediction of a user is merely a function of model weights and its own attributes. This assumption does not hold for graph learning methods in general, since graph convolution, by coupling node attributes and topology information, also leverages information from neighboring users at the prediction stage. Furthermore, in practice, there are usually different privacy level requirements for node attributes and graph topology. For example, customer identities can be more sensitive compared to co-purchase records in an online review system. A fine-grained trade-off between graph topology privacy, node attribute privacy, and GNN utility is a necessary consideration overlooked by prior literature. These require rethinking how to achieve adequate DP for GNNs.
Our contributions. We perform a formal analysis of Graph Differential Privacy (GDP), ensuring that both the GNN weights and node predictions are DP. The key idea of GDP is to protect the privacy of all nodes at the prediction step except those nodes whose labels are to be predicted, as users who want to know their own predictions must have access to their own data. While this requirement sounds straightforward, it leads to challenges in the analysis due to the interaction between the graph structure and node attributes. To account for different degrees of graph topology and node attribute privacy, we introduce the notion of  $k$ -neighbor-level adjacency which generalizes the notion of graph dataset adjacency (see Figure 1 (a-c)). It not only unifies previous edge- and node-level adjacency
definitions [15, 16] but also allows for different granularities of privacy protection for the graph topology. Our notion of  $k$ -neighbor-level adjacency can be used to establish the trade-offs among graph topology privacy, node attribute privacy, and model utility.
The GDP analysis to follow demonstrates that the standard graph convolution operation has two fundamental drawbacks. First, it can be shown that the required DP noise level for a standard graph convolution does not decay even when there are no privacy constraints on the graph topology. Hence, the standard graph convolution design fails to exploit the fine-grained trade-off pertaining to graph topology privacy. Second, the required DP noise variance for standard graph convolutions grows at least linearly with the maximum node degree [17], which leads to suboptimal utility. To mitigate these drawbacks, we propose the Differentially Private Decoupled Graph Convolution (DPDGC) design that provably enables the aforementioned trade-off and makes DP noise variance independent of the maximum node degree. Our key idea is to prevent direct neighborhood aggregation of (potentially transformed) node features so that the GDP guarantee can be improved via the DP composition theorem (see Figure 1 (e)). This insight sheds new light on the benefits of decoupled graph convolutions, and may lead to further advances in GDP-aware designs. We conclude by demonstrating excellent privacy-utility trade-offs of DPDGC for different GDP settings via extensive experiments on seven node classification benchmarking datasets and synthetic datasets generated using the contextual stochastic block model (cSBM) [18, 19].
Missing proofs and details are relegated to the Appendix due to space limitations.
DP for neural networks and classical graph privacy analysis. Providing rigorous privacy guarantees for ML methods is a problem of significant interest [20-23], where DP gradient descent algorithms and their variants were studied in [14]. On the other hand, classical graph analysis with DP guarantees has been extensively studied previously. For example, problems of releasing graphs or their statistics with DP guarantees were examined in [24] and [25]. In a different setting, [26] investigated the problem of estimating degree distributions with DP guarantees, while [27] studied DP PageRank algorithms. The interested reader is referred to the survey [28] for a more comprehensive list of references.
DP-GNNs. Several attempts were made to establish formal GNN privacy guarantees via DP. [29] propose a strategy achieving edge DP by privatizing the graph structure (i.e., perturbing the topology) before feeding it into GNNs. [15] describe a node DP approach for training general GNNs via extensions of DP-SGD, while [30] suggests to combine DP PageRank with DP-SGD GNN training. These approaches can only guarantee DP model weights and fail to provide DP model predictions. [31] study GNNs for graph classification instead of node classification. [32] propose node-level private GNNs via the Private Aggregation of Teacher Ensembles framework [33], which is a different setting than ours. [17] are the first to point out the importance of ensuring DP of GNN predictions, and to propose the GAP model for this purpose. Still, their work did not include a formal GDP analysis nor a study of the benefits of decoupled graph convolution designs.
Notation. We reserve bold-font capital letters (e.g., S) for matrices and bold-font lowercase letters (e.g., s) for vectors. We use  $\mathbf{S}_i$  to denote the  $i^{th}$  row of  $\mathbf{S}$ ,  $\mathbf{S}_{\backslash r}$  to denote the submatrix of  $\mathbf{S}$  excluding its  $r^{th}$  row and  $\mathbf{S}_{ij}$  to denote the entry of  $\mathbf{S}$  in the  $i^{th}$  row and  $j^{th}$  column. Furthermore,  $\mathcal{G} = (\mathcal{V}, \mathcal{E})$  stands for a directed graph with node set  $\mathcal{V} = [n]$  of size  $n$  and edge set  $\mathcal{E}$ . For simplicity, we assume that the graphs do not have self-loops. Standardly, we use  $\mathbf{A}$  to denote the corresponding adjacency matrix. Without loss of generality, we also assume a labeling such that the first  $m$  nodes are labeled  $([m])$  and the remaining  $[n] \setminus [m]$  nodes are subjects of our prediction. The feature matrix is denoted by  $\mathbf{X} \in \mathbb{R}^{n \times F}$ , where  $F$  stands for the feature vector dimension. For a  $C$ -class node classification problem, the training labels are summarized in  $\mathbf{Y} \in \{0, 1\}^{m \times C}$ , where each row of  $\mathbf{Y}$  is a one-hot vector. We reserve  $\| \cdot \|$  for the  $\ell_2$  norm and  $\| \cdot \|_F$  for the Frobenius norm. We use  $\| \cdot \|$  for concatenation. Throughout the paper, we let  $\mathcal{M}(v; \mathcal{D})$  stand for the (graph) learning algorithm that leverages  $\mathcal{D}$  to generate label predictions for a node  $v$  in  $[n] \setminus [m]$ . We assume the graph model outputs both its learned weights  $\mathbf{W}$  and its label prediction  $\widehat{\mathbf{Y}}_v$  (i.e.,  $(\widehat{\mathbf{Y}}_v, \mathbf{W}) = \mathcal{M}(v; \mathcal{D}))$ .
Node classification. We focus on the transductive node classification problem. The training data is of the form  $\mathcal{D} = (\mathbf{X},\mathbf{Y},\mathbf{A})$ , and this information is reused at the inference stage. Due to data reusing, it is important to specify which node  $v$  is subject to prediction in the graph learning mechanism  $\mathcal{M}(v;\mathcal{D})$ . Requiring that all of  $\mathcal{D}$  is private inevitably leads to noninformative predictions. It is therefore reasonable to only protect the information of  $\mathcal{D}$  pertaining to the node that is not subject to prediction. We refer interested readers to Appendix I for discussion on how our analysis generalizes to inductive settings.
3.1 Differential Privacy (DP)
We start with a formal definition of  $(\varepsilon, \delta)$ -differential privacy (DP) [13].
Definition 3.1 (Differential Privacy). For  $\varepsilon, \delta \geq 0$ , a randomized algorithm  $\mathcal{A}$  satisfies a  $(\varepsilon, \delta)$ -DP condition if for all adjacent datasets  $\mathcal{D}, \mathcal{D}'$  that differ in one record, and all  $\mathcal{S}$  in the range of  $\mathcal{A}$ ,
$$
\Pr \left(\mathcal {A} (\mathcal {D}) \in \mathcal {S}\right) \leq e ^ {\varepsilon} \Pr \left(\mathcal {A} \left(\mathcal {D} ^ {\prime}\right) \in \mathcal {S}\right) + \delta .
$$
Note that the standard DP definition does not depend on the choice of nodes to be predicted. Yet, such a dependence is critical for the graph learning setting and constitutes the key difference between Definition 3.1 and our definition of GDP in Section 4. We also make use of Rényi DP in order to facilitate privacy accounting. A given  $(\alpha, \gamma)$ -Rényi DP guarantee can be converted to a  $(\varepsilon, \delta)$ -DP guarantee via the conversion lemma [34-36] (see also Appendix F).
Definition 3.2 (Rényi Differential Privacy). Consider a randomized algorithm  $\mathcal{A}$  that takes  $\mathcal{D}$  as its input. The algorithm  $\mathcal{A}$  is said to be  $(\alpha, \gamma)$ -Rényi DP if for every pair of adjacent datasets  $\mathcal{D}$  and  $\mathcal{D}'$ , one has  $D_{\alpha}(\mathcal{A}(\mathcal{D})||\mathcal{A}(\mathcal{D}')|) \leq \gamma$ , where  $D_{\alpha}(\cdot ||\cdot)$  denotes the Rényi divergence of order  $\alpha$ :
$$
D _ {\alpha} (X | | Y) = \frac {1}{\alpha - 1} \log \left(\mathbb {E} _ {x \sim Q} \left[ \left(\frac {P (x)}{Q (x)}\right) ^ {\alpha} \right]\right), w i t h X \sim P a n d Y \sim Q.
$$
4 Graph Differential Privacy
We provide next a formal definition of Graph Differential Privacy (GDP). Recall that in this case keeping the entire training data  $\mathcal{D}$  private (as in standard DP definition, i.e., Definition 3.1) is problematic since it inevitably leads to noninformative model predictions. This follows since in such a setting the prediction  $\hat{\mathbf{Y}}_v$  fully depends on  $\mathcal{D}$ . This is unlike the case for standard classification where the test label predictions are formed via access to additional test data that is not subject to privacy constraints. Our key idea is to protect the privacy of all but the node  $v$  being predicted, as users who query their own predictions should clearly have access to their own features and neighbors.
We start by describing our notion of  $k$ -neighbor-level adjacent graph datasets. Throughout the remainder of the paper, we use  $r$  to denote the replaced node.
Definition 4.1 ( $k$ -neighbor-level adjacency). Two graph datasets  $\mathcal{D}$  and  $\mathcal{D}'$  are said to be  $k$ -neighbor-level adjacent, which is denoted by  $\mathcal{D} \stackrel{N_k}{\sim} \mathcal{D}'$ , if  $\mathcal{D}'$  can be obtained by replacing: 1) the  $r^{th}$  node feature  $\mathbf{X}_r$  with  $\mathbf{X}_r' \in \mathbb{R}^d$ , 2) the  $r^{th}$  node label  $\mathbf{Y}_r$  with  $\mathbf{Y}_r' \in \{0,1\}^C$ , for  $r \in [m]$ , and 3) replacing  $k$  entries in  $r^{th}$  row and column of  $\mathbf{A}$  respectively excluding  $\mathbf{A}_{rr}$ .
Our Definition 4.1 unifies previous graph dataset adjacency notions such as edge- and node-level adjacency. For example, if we drop 1), 2) (i.e., keep the node attributes unchanged), and set  $k = 1$  for replacement in a row only, our Definition 4.1 recovers that of edge-level adjacency [29]. If  $k = n$ , we recover the definition of node-level adjacency [15, 17, 37, 38]. Edge-level adjacency may be too weak of a privacy concept since it does not protect the privacy of node attributes. At the same time, node-level adjacency may also be too restrictive since it allows arbitrary replacement of an entire node neighborhood. In practice, there are cases where node features and labels carry more sensitive information when compared to the graph topology. It is desirable to allow practitioners to decide the granularity of privacy for the graph structure  $\mathbf{A}$  while maintaining the privacy of  $\mathbf{X}$  and  $\mathbf{Y}$ . This motivates our new and extended  $k$ -neighbor-level adjacency definition. Note that the parameter  $k$  serves as a new graph-specific privacy parameter similar to, but independent of,  $\epsilon$  and  $\delta$  in DP. Our  $k$ -neighbor definition can shed light on how a private graph learning design relies on the privacy of  $\mathbf{A}$  controlled by the parameter  $k$  and is discussed in more detail in Section 5. We also provide a
Figure 2: Illustration of the GAP and DPDGC (top) architectures and their corresponding information flow (bottom). Green modules indicate DP-MLPs trained with a DP-optimizer [14]. Blue modules are non-trainable modules. We use red frames to point to designs with DP guarantees (i.e., DP-Emb and PMA [17]). Trainable weights are denoted by  $\mathbf{W}^{(A)}$  and  $\mathbf{b}$  for the DP-Emb module. The black dashed arrow indicates modules that are pretrained separately and the outputs are cached.
detailed discussion on the privacy meaning of  $k$  in Appendix J. In practice, the parameter  $k$  also offers a unique trade-off between utility and graph structure privacy while preserving the same privacy guarantees of the node features  $\mathbf{X}$  and labels  $\mathbf{Y}$  (i.e., it is independent of the DP parameters  $\epsilon, \delta$ ).
We now provide our formal definition of Graph Differential Privacy (GDP). Unless otherwise specified, we use the superscript  $^{\prime}$  to refer to entities with respect to the adjacent dataset  $\mathcal{D}'$ .
Definition 4.2 (Graph Differential Privacy). A graph model  $\mathcal{M}$  is said to be edge (node,  $k$ -neighbor)  $(\alpha, \gamma)$ -GDP if for any  $v \in [n] \setminus [m]$ , for all  $\mathcal{D} \stackrel{E}{\sim} \mathcal{D}'$  ( $\mathcal{D} \stackrel{N}{\sim} \mathcal{D}'$ ,  $\mathcal{D} \stackrel{N_k}{\sim} \mathcal{D}'$ ), such that  $r \neq v$ , one has:  $D_{\alpha}(\mathcal{M}(v; \mathcal{D})||\mathcal{M}(v; \mathcal{D}')| \leq \gamma$ , where  $r$  is the index of the replaced node in the dataset pair  $\mathcal{D}$ ,  $\mathcal{D}'$ .
The key difference between our definition and that of standard DP is that instead of requiring the Rényi divergence bound to hold for all possible  $(\mathcal{D},\mathcal{D}^{\prime})$  pairs, we only require it to hold for pairs for which the replaced node  $r$  does not require prediction (i.e.,  $r\neq v$ ). This is crucial since in this case, the Rényi divergence has to be bounded for different sets of adjacent graph dataset pairs that depend on  $v$ . At a high level, Definition 4.2 ensures that even if an adversary obtains the trained weights and the predictions of node  $v$ , it cannot infer information about the remaining nodes.
5 Graph learning methods with GDP guarantees
We first perform the GDP analysis for GAP [17], the state-of-the-art DP-GNN with standard graph convolution design in Section 5.1. In the same section, issues with standard graph convolutions under  $k$ -neighbor GDP settings are discussed as well. We then proceed to introduce Differentially Private Decoupled Graph Convolution (DPDGC), a model with the decoupled graph convolution design that resolves all issues with GDP guarantees. DPDGC is motivated by the LINKX model [39] which offers excellent performance on heterophilic graphs in a non-private setting. These models are depicted in Figure 2, with the pseudocodes available in Appendix L. All missing formal statements and proofs are relegated to Appendix B-E. We also defer the analysis of the simper edge GDP scenario to Appendix G and formal GDP guarantees to Appendix H.
5.1 GDP guarantees of GAP and issues of standard graph convolution
GAP training and inference. We first describe the training process of GAP depicted in Figure 2. GAP first pretrains the node feature encoder DP-MLP $_X$  separately from the DP-optimizer. The row-normalized node embedding  $\mathbf{H}^{(0)}$  is generated and cached after the pretraining of DP-MLP $_X$ . Then the privatized  $L$  multi-hop results  $\{\mathbf{H}^{(l)}\}_{l=0}^{L}$  are generated by applying the PMA module [17]. The intermediate node embedding  $\mathbf{Z}$  constructed by the concatenation of  $\{\mathbf{H}^{(l)}\}_{l=0}^{L}$  is then cached.
Finally, a node classifier DP-MLP  $f$  is trained with input  $\mathbf{Z}$ . At the inference stage, node predictions are obtained by the cached embedding  $\mathbf{Z}$  with the trained DP-MLP  $f$ .
Node and  $k$ -neighbor GDP. We assume that the out-degree (column-sum) of  $\mathbf{A}$  is bounded from above by  $D$ . Note that prior works [15, 17] also require this assumption. To meet this constraint in practice, preprocessing of the form of graph subsampling is needed, which causes additional data distortion. The first step of proving tight GDP guarantees for GAP is to ensure the cached embedding  $\mathbf{Z}$  to be DP, except for the replaced node  $r$ . We start with describing the PMA [17] module:
$$
\text {I n p u t :} \mathbf {H} ^ {(l)} \in \mathbb {R} ^ {n \times h}; \quad \text {O u t p u t :} \mathbf {H} ^ {(l + 1)} = \text {r o w - n o r m a l i z a t i o n} (\mathbf {A H} ^ {(l)} + \mathbf {N}), \tag {1}
$$
where  $\mathbf{N} \in \mathbb{R}^{n \times h}$  is a Gaussian noise matrix whose entries are i.i.d. zero mean Gaussian random variables with standard deviation  $s$ .
Theorem 5.1. For any  $\alpha > 1$  and  $\mathcal{D} \stackrel{N}{\sim} \mathcal{D}'$  (or  $\mathcal{D} \stackrel{N_k}{\sim} \mathcal{D}'$ ), assume the trained parameter  $\mathbf{W}^{(X)}$  of  $DP-MLP_X$  in GAP satisfies  $D_{\alpha}(\mathbf{W}^{(X)}||\mathbf{W}^{(X)'}') \leq \gamma_1$  and that both  $\mathbf{A}$ ,  $\mathbf{A}'$  have out-degree bounded by  $D$ . Let the replaced node index be  $r$  and let  $\mathbf{Z}_{\backslash r}$  be the matrix  $\mathbf{Z}$  with the  $r^{th}$  row excluded. Then the embedding  $\mathbf{Z}$  in GAP satisfies  $D_{\alpha}(\mathbf{Z}_{\backslash r}||\mathbf{Z}_{\backslash r}'') \leq \gamma_1 + \frac{4DL\alpha}{2s^2}$ .