CEGA: A Cost-Effective Approach for Graph-Based Model Extraction and Acquisition
Authors: Zebin Wang
Menghan Lin
Bolin Shen
Ken Anderson
Molei Liu
Tianxi Cai
Yushun Dong
Venue: ICML 2025 poster (2025)
Keywords: GNN Model Extraction
Cost Efficiency
Budget Limitation
Primary area: deep_learning->graph_neural_networks
TL;DR: This paper introduces CEGA, a novel Graph Neural Networks model extraction framework to efficiently select query nodes under strict budget constraints, exhibiting superior performance over alternatives.

Abstract: Graph Neural Networks (GNNs) have demonstrated remarkable utility across diverse applications, and their growing complexity has made Machine Learning as a Service (MLaaS) a viable platform for scalable deployment. However, this accessibility also exposes GNN to serious security threats, most notably model extraction attacks (MEAs), in which adversaries strategically query a deployed model to construct a high-fidelity replica. In this work, we evaluate the vulnerability of GNNs to MEAs and explore their potential for cost-effective model acquisition in non-adversarial research settings. Importantly, adaptive node querying strategies can also serve a critical role in research, particularly when labeling data is expensive or time-consuming. By selectively sampling informative nodes, researchers can train high-performing GNNs with minimal supervision, which is particularly valuable in domains such as biomedicine, where annotations often require expert input. To address this, we propose a node querying strategy tailored to a highly practical yet underexplored scenario, where bulk queries are prohibited, and only a limited set of initial nodes is available. Our approach iteratively refines the node selection mechanism over multiple learning cycles, leveraging historical feedback to improve extraction efficiency. Extensive experiments on benchmark graph datasets demonstrate our superiority over comparable baselines on accuracy, fidelity, and F1 score under strict query-size constraints. These results highlight both the susceptibility of deployed GNNs to extraction attacks and the promise of ethical, efficient GNN acquisition methods to support low-resource research environments. Our implementation is publicly available at [https://github.com/LabRAI/CEGA](https://github.com/LabRAI/CEGA).

A Cost-Effective Approach for Graph-Based Model Extraction and Acquisition
CEGA:
Zebin Wang'
Menghan Lin
Bolin Shen?
Ken Anderson
Molei Liu
Tianxi Cai
Yushun Dongà
Abstract
fidelity, and Fl score under strict query-size con- straints. These results highlight both the suscepti- bility of deployed GNNs to extraction attacks and the promise of cthical, efficient GNN acquisition methods to support low-resource research environ- ments. Our implementation is publicly available https:::p//......... / http://gt.ttuu..........aaa wat.m/.aaAAT...
Graph Neural Networks (GNNs) have demon- strated remarkable utility across diverse applica- tions, and their growing complexity has made Machine Learning as a Service (MLaaS) a vi- able platform for scalable deployment. How- ever, this accessibility also exposes GNN to se- rious security threats, most notably model ex- traction attacks (MEAs), in which adversaries strategically query a deployed model to construct a high-fidelity replica. In this work, we eval- uate the vulnerability of GNNs to MEAs and explore their potential for cost-effective model acquisition in adversaraalial research settings. Importantly, adaptive node querying strategies can also serve critical role in research, ularly when labeling data is expensive or time- consuming. By selectively sampling informa- tive nodes, researchers can train high-performing GNNs with minimal supervision, which is partic- ularly valuable domains such as biomedicine, where annotations often require expert input. To address this, propose node querying strat- egy tailored to a highly practical yet underex- plored scenario, where bulk queries are prohibited, and only a limited set of initial nodes avail- able. Our approach iteratively refines the node selection mechanism over multiple learning ey- cles, leveraging historical feedback improve extraction efficiency. Extensive experiments on benchmark graph datasets demonstrate our supe- riority over comparable baselines on accuracy,
1. Introduction
Graph Neural Networks (GNNs) have achieved remarkable performance in a variety of applications powered by graph learning, such as molecular graph structure analysis (Sun et al., 2022; Wang al., 2023; Zang al., 2023; Zhao et al., 2024), fraud detection (Qin et al., 2022: Cheng et al., 2024; Motie & Raahemi, 2024; Lou al., 2025), and healthcare diagnostics
partic-
et al., 2021; Lu & Uddin, 2021; Zafeiropoulos et al., 2023; Paul et al., 2024). How- ever, as GNNs grow in complexity and computational de- mands, training them from scratch becomes increasingly prohibitive due to rising computational costs (Abbahaddou et al., 2024; Kose et al., 2024). To address this, graph-based Machine Learning as Service (MLaaS) has emerged as cost-effective alternative, allowing users to access power- ful pre-trained GNN models via APIs provided by service providers (Liu et al., 2022; Wu et al., 2023a; 2024).
Nevertheless, despite the advantages of graph-based MLaaS, such an inference paradigm also exposes GNN models to serious security risks, with GNN-based model extraction attacks (MEAs) posing a particularly significant threat (Wu et al., 2023a; 2024). Specifically, the goal of a model ex- traction attacker is to replicate the functionality of a GNN model owned by the service provider (i.e., the target model) by strategically querying it and using the responses to con- struct local replica (i.e., the extracted model) (Shen et al., 2022: Wu et al., 2022). Such graph-based MEAS can lead to severe consequences such copyright violations and patent infringement, especially in high-stake applications. For example, in the pharmaceutical industry, GNNs are widely used to predict molecular-level drug-targed interac- tions (DTIs) (Wieder et al., 2020; Zhang et al., 2022; Tran et al., 2022). this context, graph-based MI provides
'Department of Biostatistics, T. H. Chan School of Pub- lie Health, Harvard University, Boston, Massachusetts, USA 'Department of Statistics, Florida State University, Tallahassce, Florida. USA 'Department of Computer Science, Florida State University, Tallahassee, Florida, USA 'Department of Biostatis- tics, Mailman School of Public Health, Columbia University, New York, New York, USA. Correspondence Tianxi Cai <tcai@ hsph.harvard.coo edu>> Yushun Dong <yd24f@fsu.com fsu.euu.
Proceedings of the ndnd International Conference Machine Learning, Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).

---

CEGA: A Cost-Effective Approach for Graph-Based Model Extraction and Acquisition
pharmaceutical companies with cost-effective and efficient platform for conducting related studies (Ahmedt-Aristee Aristizabal et al., 2021; Lu & Uddin, 2021; Vora et al., 2023). How- ever, MEAs targeting such GNNs pose a serious risk to proprietary data, threatening trade secrets and potentially enabling unauthorized redistribution and unfair competition. These concerns may ultimately result in substantial financial and reputational damage (Bessen & Meurer, 2008; Nealey et al., 2015; Armstrong, 2016). Consequently, appropriately understanding and managing the threat of MEAs against GNNs has become a pressing concern (Zhao et al., 2025).
(1) Stringent budget and query batch size constraints. First, excessive querying incurs substantial computational and financial costs under the pay-per-query basis, making large- scale extraction on well-trained MLaaS models economi- cally unfeasible (Hou et al., 2019; Gong et al., 2020; Wu et al., 2023b). Second, querying in bulky batches risks vio- lating MLaaS user agreements or triggering security alerts, as many providers implement monitoring mechanisms to identify and block potentially adversarial queries (Brundage et al., 2018; Juuti et al., 2019).
(2) Structural dependency between nodes. First, nodes can naturally exhibit various types of dependencies between each other in real-world graphs, depending on what types of semanties the edges encode (Zhou et al., 2020; Wu et al., 2021). Second, these dependencies across broad localized area in the graph topology can collectively influence the information that the extracted model can acquire (Ju et al., 2024; Kahn et al., 2025).
Beyond malicious uses, the research-driven acquisition of GNN functionality offers significant value, particularly for tailoring models to specialized downstream applications. A compelling example the analysis of knowledge graphs (KGs) constructed from electronic health records (EHRs), where nodes represent clinical concepts-suche as diagnoses, medications, and procedures and and edges capture relation- ships based on medical ontologies or empirical patterns of co-occurrence (Wang et al., 2014; Hong et al., 2021). In EHR-based KG research, deploying graph-based models for specific inference tasks within local health systems is often hampered by practical constraints, including the in- completeness of local database, limitations on data sharing across institutions, and heterogeneity in clinical practice pat- terns and patient populations, which can significantly limit model generalizability (Zhou et al., 2022; 2025). In such settings, effectively extracting and acquiring a well-trained target model developed on large-scale EHR data presents powerful alternative to the costly and often impractical process of training from scratch using local EHR data (Lin et al., 2023a; Gan et al., 2025). This strategy not only im- proves computational efficiency but also enables advanced applications such as non-linear statistical inference on clini- cal knowledge graphs and mntologyiinformed learning for downstream applications (Xu et al., 2023; Liu al., 2024).
Multiple research works have taken early steps to explore model extraction against GNNs for node-level graph learn- ing tasks (DeFazio & Ramesh, 2019; Shen et al., 2022; Wu et al., 2022). However, these studies overlook the practi- cal constraints on budget and batch size. More recently, several research works attempted to handle query budget limitations on MEAs (Shi et al., 2017; Liu et al., 2023; Karmakar & Basu, 2023). However, these approaches can hardly be generalized to graph learning tasks, as they often overlook the fact that GNNs can embed deeper information to the graph data during processing. even when certain fea- tures are absent filtered out from the input (Dong et al., 2025). Therefore, the study of addressing the two practical challenges above specifically tailored for node-level graph learning tasks remains nascent.
To address the aforementioned challenges, we propose a targeted approach for the extraction and acquisition of GNN functionality, termed Cost-Efficient Graph Acquisition (CEGA). Our framework is specifically designed to bal- ance effectiveness and efficiency in acquiring GNNs under realistic constraints. Without loss of generality, we focus on GNNs performing node classification, one of the most widely studied and fundamental tasks in node-level graph learning. Specifically, to overcome the challenge of budget and query batch size constraints, CEGA is designed incor- porate historical information from the initial and previous queries, starting with a very limited number of queries, in each of its iterations to improve its informativeness in node selection. To overcome the challenge of structural depen- dency between nodes, we prioritize nodes with high struc- tural centrality to ensure queries can capture information that aligns with the localized graph topology. Furthermore, we introduce a diversity metric to prevent query cluster- ing at the structural level and improve stability. Extensive
In response to the pressing need outlined above, it is es- sential to systematically investigate strategies for extracting and acquiring graph-based model functionality. On the one hand, such efforts enable rigorous assessment of the severity of MEA threats to MLaaS platforms and inform the develop- ment of robust defense mechanisms (Zhang & Zitnik, 2020; Mujkanovic et al., 2022: Ennadir et al., 2023; Dong et al., 2024; Cheng et al., 2025). On the other hand, they also support the efficiency and feasibility of research-oriented GNN acquisition, as demonstrated in recent work on sur- rogate learning and transfer-based GNN extraction (Huo et al., 2023; Oloulade et al., 2023). However, despite the urgency and potential impact of such research, designing systematic strategies for extracting and acquiring GNN func- tionality remains non-trivial task. In particular, we face two fundamental challenges:
2

---

CEGA: A Cost-Effective Approach for Graph-Based Model Extraction and Acquisition
empirical experiments on real-world benchmark datasets demonstrated the superiority of the proposed CEGA frame- work in extracting the target GNN models under realistic query constraints, delivering key practical significance over existing alternatives.
Background. Existing research works have rarely discussed GNN-based MEA contexts in real-world settings. In our paper, we expect to gain practical significance by consid- ering a realistic setup to extract GNNs. In our setting, we pose upper limits on (1) the initial query budget I, (2) the per-cycle query budget K, and (3) the overall budget B. Our setting is more realistic compared with existing ones that rely on simultaneous high-volume queries since excessive queries impose significant costs, and frequent large-scale queries are likely to alert the maintainers of the target model, We focus on node classification tasks, which are among the most widely studied problems in node-level graph learning, as previously investigated by (Dong et al., 2023; Luan et al., 2023; Zhang et al., 2023; Li et al., 2024).
In summary, the contributions of this paper are three-fold:
Novel Problem Formulation: We introduce the prob- lem of GNN Model Extraction With Limited Budgets specifically within the context of node-level graph learn- ing tasks. This formulation offers a more realistic and practical setting for GNN model extraction compared to prior work in model extraction.
Comprehensive Methodology Design:
We present novel framework for GNN model extraction and acqui- sition that dynamically identifies the most informative queries throughout the training process. Our approach in- tegrates guidance based on three complementary criteria: representativeness, uncertainty, and diversity, enabling efficient and effective query selection.
Goal of Acquisition. The researchers aim extract model fa that closely replicates the behavior of target GNN model ST using limited number of queries constrained by an initial query budget I, per-cycle query budget Ki and an overall query budget B. Here, the similarity in their behavior is generally measured by the ratio of the same input-output pairs.
Extensive Empirical Evaluation. We conduct com- prehensive experiments on real-world graph datasets to demonstrate the effectiveness of the proposed CEGA framework. Evaluation metrics include both model faith- fulness and downstream utility, showing CEGA's superi- ority over existing alternatives.
We then formulate the problem of GNN Model Extraction With Limited Budgets in Problem 1.
Problem 1. (GNN Model Extraction With Limited Bud- gets), Given a target GNN model fr and available prior knowledge (Xa, Ga), the objective is to achieve an extracted model Ja with behaviors being as similar to fT as possible for any given test node U E VT, while adhering to the con- straints of limited initial query budget I. per-cycle query budget k. and total query budget B.
2. Preliminaries
Notations. Suppose that we have a GNN model fT trained on the target graph GT = (Vr,Er}, where er denotes the edges of Gr. In the acquisition process, we assume knowledge to a pool of candidate nodes for querying, de- noted as Va. and respective graph structure, denoted Ga. We consider iterative node querying approach with I' learning cycles in total. We denote the initial query set as Vo. with budget I = Vol- On the ytth iterative eycle with E 21, r}. we use V,-1 to denote the collection of nodes queried in previous cycles, where Vo Ç Vi Ç 1/2 C ... S. V/ _ Va. In this cycle. we query x nodes from the can- didate set V/ V with capacity 7 = V. V The attributes of the nodes belonging to V. Va//a1 are denoted
3. Methodology
3.1. Overview
In this section, we introduce CEGA, an active sampling framework designed to extract and acquire GNN behaviors efficiently. CEGA employs a multilevel analysis strategy that iteratively selects informative nodes by leveraging prior heuristies derived from the initial query set Vo and the ? batches of previously queried nodes. these historical insights are summarized by an interim model fn-1, which guides the selection process in iteration
as X,-1= = [xx|" (2) x,, -"= }. where each x,", is an attribute vector with d-dimensions. For convenience, we denote the respective attribute of some node v E V. VVy-1
Specifically, CEGA is designed to conduct node selection by incorporating three key objectives: (1) Representativeness: The queried nodes should capture the structural essence of the graph, facilitating an accurate reconstruction of model behavior across the network. (2) Uncertainty: Nodes with high uncertainty, as indicated by historical predictions, are prioritized, as they likely reside near decision boundaries of the interim prediction model fa. (3) Diversity: To avoid excessive clustering, selected nodes should be diverse in their distribution across the graph, ensuring a comprehensive
as x x- The respective outcome for node in a model is denoted as ý. f(x("), ..) (o( a/2) (C)) where y. is probability vector of length C' representing the softmax scores for each class. Our notation system is compatible with existing works in the context of MEAS against GNNs, as highlighted by existing work such as (Wu et al., 2022; Shen et al., 2022; Wu et al., 2023a).
(v)
..... De J.
3

---

CEGA: A Cost-Effective Approach for Graph-Based Basphd Model Extraction and Acquisition
exploration of the underlying structure.
objective function as
To achieve these goals, CEGA is equipped with three ob- jectives, Li (v. Ga), (", G.). and C3 (v. Ga), evaluating the tendency of selecting a node v from the candidate set V in each querying cycle 7 Nodes are adaptively ranked and selected based on their combined ranking across these three criteria, ensuring an efficient and cost-effective querying strategy.
C = Σ - log (0g(0))7))
(2)
In (2), De. is the ith entry of 1=:-1= (--1(x For downstream tasks that are less sensitive to time and space complexity, we propose a theory-backed alternative ranking mechanism that measures a node's resilience in maintaining its predicted label under moderate Gaussian perturbation. In practice, we consider a series of pertur- bation 70) x.i.d <²0)=²I) where I E Rdddd is an identity matrix, and obtain the perturbed version of the attributes x denoted as
7-1 G.).
(0)
3.2. The Proposed Framework of CEGA
The CEGA framework begins by building a primitive ini- tial GNN-based prediction model so with I initial queried nodes. In each learning cycle, CEGA selects i. nodes with the highest comprehensive rank through an adaptive node se- lection method based on the representativeness, uncertainty, and diversity of the nodes. A new interim model fy involv- ing all nodes queried in the past and new nodes selected for query in the same cycle is trained as a summarization of existing historical information to guide further queries. We perform such cycles iteratively until the budget limit B is reached. Finally, we evaluate the performance of CEGA by training GNN models with queried nodes.
T = (x
(2) +
(1g-1) +-(0 1)..
We repeat the perturbation S times and obtain the perturb data T where E E [S]. For any node v, the respective
probability for T is denoted as J 807-1 = -x-1(x (v) +
(0) , 9a), where E [S]. The alternative objective function L Ga) is given as
Initialization. In CEGA, we randomly select I initial nodes from the node pool for acquisition Va. A random selection of initial nodes reduces systematic bias and ensures compa- rability between CEGA and other approaches mentioned in the existing literature (Cai et al., 2017; Zhang et al., 2021).
C2 9n)
(n)=))))) f=1
Σu
arg max (uu.r 5 }
where Fum-1 and F - are outputs of f--1, which takes the subgraph G. as an input. The rank of nodes based on their uncertainty on the prediction of the interim model f--1 in the yth cycle of CEGA is denoted as R.
Graph Etrueture-Based Analysis for Representativeness. To ensure that the queried nodes in each cycle are represen- tative of the overall graph structure, we rank nodes based on structural indices that capture their relative importance within the network. Among such indices, we specifically in- corporate PageRank (Page et al., 1999), where the objective function C is given as
In Section 3.3, we provide theoretical insights into the time and space complexity of CEGA to further justify its suitabil- ity to measure uncertainty in node selection. Furthermore, we present the theoretical guarantee for the existence of an appropriate perturbation parameter e involved in the alterna- tive approach. The parameter e is expected to be sufficiently large to capture the sensitivity of the interim model's predic- tions while remaining small enough to preserve the stability and effectiveness of the interim model.
1-5 N
Gw Ga) L(w)
(o,
+E
Σ #Ein(E))
(L)
In (1) = =|Va| represents the total number of nodes in the extraction subgraph Ga, in(v) represents the collection of nodes with edges pointing to node v, Lww) represents the number of outbound edges from node w, and represents a damping factor typically set at 0.85. The evaluation of 47 is inherently recursive in computation, relying on iterative processes to update the scores of the nodes given their neigh- borhood until convergence. The rank of nodes according to their representativeness in the yth cycle is denoted R1-
Distance- -assed Analysis for Diversity. Finally, we evalu- ate the diversity of a node in the pool V. VV,1 compared to the queried nodes Vz-1- To start, we apply the K-Means al algorithm for the embedding of queried nodes with K = C. where C' is the number of classes for the graph dataset. We then compare the embeddings of the nodes belong to VA (V,-1 with the clusters formed by the queried nodes to determine whether they align with a category that is over- represented in Vy-1. To do this, we measure the distance between some node v E V, V.AY,-I and the C' centroids. We assign node e to the class j E {1,2,
History-Based Analysis for Uncertainty. To evaluate the uncertainty of nodes in an interim GNN model f--1 on the classification task, we evaluate the entropy of the nodes in the pool V4 V/ as their sensitivity against changes in the attributes of its neighbors. In particular, we give the
2, ..., C} such that the
distance between its embedding & and the centroid C, is
4

---

CEGA: A Cost-Effective Approach for Graph-Based Model Extraction and Acquisition
minimized. Here, Eg is output of the interim model fĄ-1+ with the graph structure In serving necessary input. We then establish the objective function C3 Ga)
Algorithm The Proposed Framework of CEGA
Initialization: Query initial nodes Vo, where Vol = I,
from Va-
Train the initial model fo on {Vo, P.). for Cycle 7 from 1 do
1 (1+ 8,) (v, G.) PP(0.1) 1 11+571
+ (1-P) 1+ 1
if + (r 1)x < B then
(4)
Evaluate the representativeness score Ci, uncer- tainty score f32, and diversity score L3 for all candi- date nodes in Va 11--1. Obtain node ranks RJ, R2 and R3.. Select and query top-x nodes Vi via the adaptive selection method.
Here 5, is the minimal distance between the embedding E for node v and centroids C1, C22 ..., Cc, and we have
6, = min cE.........
|| Call2-
On the other hand, 22 represents the collection of queried nodes that belong to the same centroid C.. as node where
Set VA Vy-1 U Vo.
else
c' = arg min ||E, Coll2- CE (1.......
Set V4 = V--1-
end if
The number of nodes belong to Q, is denoted as 1- (+)),1(()) represents the min-max scaling function. is a hyperparameter subject to tuning. The rationale behind the setup of 43 is to guide the selection nodes from V. V that represent the embedding patterns of labels that un- derrepresented in the queried nodes. By using LJ, rank the nodes E Va V in the order R3.
Train the new interim model fy based on {Vy, Go and
f--1 for epochs.
end for
Return the nodes collection (Vi, V2, Vr
3.3. Theoretical Analysis
Adaptive Node Selection Method. Once we obtain the ranking of all candidate nodes according to the objective functions C C2, and L3. we compute a weighted average ranking of the nodes the three categories and query the top-s nodes Ve based this weighted average, as those nodes are expected guide further informative queries the target GNN model.
In this section, we summarize the theoretical results for CEGA's measurements with respect to the uncertainty of candidate nodes indicated by history-inspired interim mod- els. As outlined in Section 3.2, we address two core aspects: CEGA's efficiency in referring to the history guide and the existence of an appropriate perturbation parameter for the alternative. The detailed proofs are given in Appendix A.
The weighted average ranking for cycle y is expressed as
First, we provide a thorough analysis of the time and space complexity of CEGA's uncertainty measurement approach. Proposition 3.1 highlights the feasibility of our approach, indicating its sesource-friendie feature required for graph data with complex attributes and subgraph structure.
R = (1) + (2) + wa(7)RR3
The specifs weights W1, W2, and W3 are subject to adaptive optimization according to the principle, as inspired by (Cai et al., 2017), that the representativeness rank R. does not rely on the interim model f--1. while R2 and R3 rely on the f--1- The weight W1 is assigned higher value when 7 is small, reflecting the relatively poor performance of the interim model during the earlier stages of querying. As increases, we and W3 are progressively raised, resonat- ing the improved performance of the interim model in later querying cycles. The dynamic node selection ensures that the weights can fit CEGA's progressive querying process.
Proposition 3.1 (Evaluation of Complexity). Suppose that the base model of CEGA is I-layer GCN. Under the conditions such that
The number of nodes queried by CEGA in each cycle, indicated by K, @(1):
2. d > h- OC'), where d indicates the dimension of the attributes for the graph data, indicates the dimension of the node embeddings, and C indicates the number of classes the softmax score output.
Learning Guide Queries and Output. After obtaining queried nodes V., in the yth cycle, we train the new interim model fy based (V:y Gu} and the previous interim model f--1 for F epochs. The updated model f, then guides node selection for further queries in the (> + 1)th cycle. After completion of the querying cycles, CEGA returns the collection of queried nodes (V1, V22 ..., Vr.. We summarize the algorithmic routine of CEGA in Algorithm
CEGA's entropy- -based approach introduces additional time complexity OC +N log N) and spuce complexity of O(CN), building on the O(LN2d+ + LNd2) time com- plexity and O(N2 LNd) space complexity required for CEGA to compute embeddings and softmax scores via forward propagation for the analysis Section 3.2.
5

---

CEGA: A Cost-Effective Approach for Graph-Based Model Extraction and Acquisition
Remarks for Proposition 3.1. CEGA's entropy-based ap- proach provides superior scalability and adaptability for large, complex graph datasets, introducing minimal addi- tional time and space complexity beyond attribute propaga- tion through the interim model for emheddings and softmax scores. Notably, these added complexities are of signifi- cantly lower order than the training and forward propagation costs of the interim model.
complexity, and formality of node attributes, providing comprehensive basis for evaluating CEGA's performance. The dataset statistics are provided in Appendix B.I.
Training Protocol. In our experiment, we consider two models trained on the datasets of interest. The subgraph model is trained on { }a]. where the subgraph known to the extractors 9s satisfies G3 K. Gr. to establish the upper limit of performance that model extraction approaches can achieve in their respective task under assumptions. In the budgel-consiranee Mrl < [& in many practices, the model extraction task is conducted on a more restrictive but realistic scenario with budget constraints, as we have defined in Section 2. In response to the constraints, CEGA and the baseline models, as detailed in the following sections, progressively select and query the most informative nodes from the pool of candidate nodes for optimal performance. To show the superiority of CEGA, we compare the performance of all models tested under a budget-constrained setup and examine the performance incrementation of the full subgraph model over the budget-constrained model for each approach.
In Theorem 3.2, we show the existence of appropriate perturbation intensity e that is sufficiently small to maintain the overall stability of the history guide f.. This ensures the feasibility of cnrturbation-based alternative uncertainty evaluation in CEGA by guaranteeing that the approach can reliably capture prediction uncertainty from history with- out causing inconsistency in the interim model, even when random noise is applied to the node attributes.
model trained on { (vr, G.. where
Theorem 3.2 (Existence of Feasible Perturbation). Con- sider the perturbation scheme for the evaluation of node uncertainty under the interim GNN model Jn in CEGA, We show that there exists some perturbation intensity such that [xi, Gm) (x, Ga)llp holds the stability conditions, where x,, is the perturbation of x, where 8, xx, ~ ()) Specifically, for any Ç >>0 O, there exists some = e(C, 8) such that [],5 (x,, 9a) S,, 9all12 S < with probability at least 1 (6))
Evaluation Metries. We evaluate the accuracy and Fl score of budget-constrainet models built under nodes selectively queried by all the tested approaches. Furthermore, we eval- uate the faithfulness of these models to the target model fr, using fidelity as the metric. The measurements on accuracy, Fl score, and fidelity are further compared between the full subgraph model and the constt-co model to high- light the relative efficiency of the strategies tested. Finally, we evaluate the mean and standard deviation of accuracy, fidelity, and Fl score for budget-constrainee models trained on nodes queried using CEGA and its variants with certain components ablated. All empirical evaluations are based on consistent settings with commonly used ones. The query budget is set as the number of label classes for each graph dataset multiplied by a fixed factor, ranging from 2C' to 20C, following widely accepted prior work, such (Yang et al., 2016; Cai et al., 2017: Zhang et al., 2021).
4. Experimental Evaluation
In this section, we present in-depth experimental eval- uation of CEGA, addressing three key research questions: RQ1: How effective is CEGA in graph-based model extrac- tion and acquisition tasks compared to baseline methods on a fixed querying budget? RQ2: How well does CEGA re- cover the target model on limited query budget, as opposed to querying all nodes that can be queried? RQ3: What is the contribution of each evaluation module of CEGA to its overall performance?
4.1. Experimental Settings
Baselines. In our experiment, the performance of CEGA is compared against the Random baseline, where all the queried nodes are selected randomly from Va. Furthermore, we compare CEGA with the state-of-the-arr active learning (AL) techniques specially designed for GNN in a query-by- training process consistent with CEGA for fair comparison, including AGE (CCai et al., 2017)), GRAIN (NN-D), and GRAIN (ball-D) (Zhang et al., 2021). To ensure consistency, all baseline models adhere to the same query constraints initialization setup. Details on the hyperparameter setup for all baseline methods and the proposed framework CEGA are included in Appendix B.2.
Graph Learning Task and Datasets. We evaluate CEGA on the extraction task for graph-based node classification models, assuming that the extraction side has access to the attributes of the candidate nodes Va and the structure of subgraph Ga that involves Va. This setup is categorized as Attack 0 in MEA literature such as (Wu et al., 2022). Our experiments are conducted on widely used benchmark datasets: (1) Coauthorship networks where nodes are au- thors and edges represent collaboration, including Coauthor- CS and Coauthor-Physice (2) Co-purchase graphs with nodes as products and edges as items frequently purchased together, including Amazon- Crortute and Amazon- Photo, and (3) Academic citation and collaboration network, in- cluding Cora-Fulh Full and DBLP. These datasets vary in size,
6

---

CEGA: A Cost-Effective Approach for Graph-Based Model Extraction and Acquisition
Table Test accuracy, fidelity, and Fl score different datasets using 20C queried nodes. Dataset abbreviations: CoCS (Coauthor- Cora-Full, and DBLP. All numerical values are reported in
CoP (Coauthor- Phytiorrr, AmzC (Amazon- Compuuee,,,,,,rr),,,,. AmzP percentage. The best results are in bold.
CoCS
CoP
AmzC
AmzP
Coll
DBLP
Random
88.75 0.7
91.50 + 1.3
83.79 + 0.9
90.15 + 2.6
49.73 = 0.3
69.14 + 1.9
GRAIN(NN-D)
89.77 0.6
93.37 + 0.8
83.89 + 1.7
90.98 0.3
51.57
68.37 0.9
Accuracy
GRAIN(ball-D)
89,43 = 0.6
03.37
82.48 2.1
90.01
51.27
68.57 1.0
AGE
90.68 0.4
93.69 0.3
90.79
50.59
72.41 2.2
CEGA
90.57 0.5
93.90 - 0.4
85.98 0.4
91.95 0.3
52.74
73.29 + 0.9
Random
91.43 0.8
93.15 - 1.4
88.45 + 1.0
93.31 2.7
74.06 0.8
73.86 2.2
GRAIN(NN-D)
92.41 0.8
95.11
88.65 1 2.0
94.17 0.6
76.65
72.71 1.1
Fidelity
GRAIN(balI-D)
92.00 + 0.7
95.19 1.2
86.89 2.4
92.93 + 1.4
76.18 + 1.5
73.35 + 1.2
AGE
93.61 0.5
95.55 0.4
90.10 0.7
93.97
75.67 0.8
77.18 + 2.4
CEGA
93.40 1 0.6
95,83 1 0.5
90.81 1 0.4
95.33 1 0.5
77.90 1 0.9
78.50 1 0.9
Random
81.44 1.6
87.70 + 2.4
78.95
86.54 + 5.3
27.56 0.3
57.46 5.0
GRAIN(NN-D)
85.61 1.4
90.93 1.0
80.29 3.5
88.06 0.8
28.93 1.0
58.72
3.7
F1
GRAIN(ball-D)
85.38 1 0.9
90.97
1 1.4
74.47 5.9
86.99 2.0
28.62 111
60.87 3.5
AGE
87.65 0.4
91.58 0.5
78.37
+ 3.5
89.14 3.2
29.28 = 0.5
65.72 + 3.2
CEGA
87.41 = 0.5
91.78
0.7
82.57 + 1.4
90.06 = 0.6
31.20 = 0.8
67.35 + 1.5
GRAIN(NN-D)
GRAIN(ball-D)
Random
AGE
CEGA
Ace (%)
90
90
70
80
Test Acc
85
90
60
880
40
70
50
85
30
Test Fid (%)
95
90
80
85
90
88
70
Test Fl (%)
85
80
30
60
80
70
80
40
60
70-
120 210 300
40
100
20
200
112 160
560
980
1400
8
80
(a) CoCS
(b)
CoP
(c)
AmzC
(d) AmzP
(e) Cora Full
(I) DBLP
Figure 1. The trajectory of test accuracy, fidelity, and F1 score different datasets using 20 to 20C queried nodes. The performance trajectory CEGA is bolded green, showing significant superiority over alternatives across different number of queried nodes.
4.2. Evaluation on Budget-Constrained Model
on the fidelity of the budget-constrained subgraph model to the target model, while also considering accuracy and Fl score as supplementary metrics. To account for variability due randomized initialization, each method is evaluated five times, and the mean performance is reported.
To answer RQ1, we evaluate the performance of CEGA and various AL-based baseline methods on history- pro- gressive node querying all the 6 datasets under different labeling budget scenarios. We incrementally raise the query budget from 20 20C'. Our evaluation primarily focuses
Figure 1 presents the trajectory of measured metrics with

---

CEGA: A Cost-Effective Approach for Graph-Based Model Extraction and Acquisition
the extracted model trained with 2C to 20C' queried nodes. Table presents direct comparison between the perfor- mance of CEGA and the baseline models using 20C queried nodes in the 6 datasets of interest. We summarize the key ob- servations below: (1) From the perspective of comparative performance, CEGA consistently achieves significant im- provements in accuracy, fidelity, and Fl score across varying budget levels, demonstrating its capability to closely mimic the target model under stringent query budget constraints. CEGA also shows strong adaptability to the graph datasets being tested, which is considered one of its main advantages over the baselines. (2) From the perspective of the progres- sive nature of the models, as the budget increases from 2C to 10-15C, CEGA further extends its advantage over baseline methods among all the metries tested, particularly for the Amazon-Computee and Cora-Full datasets. This indicates that CEGA's node selection strategy effectively identifies the most informative nodes throughout the iterative query- ing process, leading to superior alignment with the target model as more queries become available.
20
CEGA
Random
AGE GRAIN(bal--D)
GRAINNN-D)
15-
Performunee Cap
10
Fid FI Acc Fid FI Ace Fid Fl Aoz Fid F1 Acc Fid Fl Acc Fl CoP
CoCS
AmzC
AmzP
Cora Full DBLP
Figure 2. Model performance gaps between bunset-constrained and full subgraph models, measured by accuracy, fidelity, and Fl score, across datasets. The gap indicates the negative impact of the budget constraints on the model performances. Therefore, lower gaps (i.e., less negative impact) are preferred.
Table 2. Ablation study results on fidclity for CEGA and variants with one evaluation module removed. Cen stands for Centrality, UnC stands for Uncertainty, Div stands for Diversity. The best results are bold.
4.3. Comparison between Full Subgraph Model and Budget-Constraine Model
CEGA
No Cen
No UnC
No Div
CoCS
93.4 0.6
93.2 0.2
91.9 0.5
93.4 + 0.6
To answer RQ2, we highlight the effectiveness of CEGA in detecting the most informative nodes by comparing the ac- curacy, fidelity, and F1 score recovery performance between the codett-constrained model and the full subgraph model, as specified in Section 4.1. Specifically, we define a perfor- mance gap as the performance discrepancy between the full subgraph model and budget-constrained models following different querying approaches.
CoP
95.8 + 0.5
94.9
3.3
95.7 = 0.5
AmzC
90.8 + 0.4
87.1 1.
90.7 = 0.7
AmzP
95.3 + 0.5
9.3
93.7 3.7=00 0.9
95.3 + 0.7
Full
77.9 0.9
75.3 0.6
74.9 1 0.9
78.3 1 1.1
DBLP
78.5 0.9
74.2 2.4
65.1 5.5
78.6 + 1.4
mance of the resulting models with only the two remaining modules involved with that of the full CEGA model. We evaluate budget-constrained models with query budget of 20C across all 6 datasets.
We visualize the performance gap measured by accuracy, fi- delity, and Fl score across all 6 datasets of interest in Figure 2. Further results on the performance gap are presented in Table 4 and discussed in Appendix B.3. We summarize the key observations below: (1) From the perspective of mea- surement, CEGA consistently exhibits lower performance gap across all the metrics tested (accuracy, fidelity, Fl score) compared to the baselines, indicating its superior ability to recover as much information as possible under stringent budget constraints. (2) From the perspective of adaptabil- ity, CEGA maintains consistently lower gap across all the datasets we tested by notifiable margin (e.g.. 1-2%) despite variations in node attributes and graph structures. This reveals that CEGA is more robust and effective than baselines in conducting model extraction and acquisition on graph data with different levels of intrinsic complexity.
Table 2 compares the mean fidelity and its variance between the original CEGA and the three ablation models in the 6 datasets of interest, while Figure shows a similar pat- ter for accuracy and F1 score is available in Appendix B.4. We summarize the key observations below: (1) From the perspective of model performance, CEGA demonstrates comparable to significantly better average performance than ablated models across different test datasets and metrics, particularly outperforming models where centrality or un- certainty is ablated by large margin. This highlights the pivotal rule of these two components in identifying infor- mative nodes for querying in early cycles. (2) From the perspective of consistency of estimates, CEGA provides more stable estimates across all metrics compared to the model with diversity ablated, especially for the Amazon- Computer and DBLP datasets. This reveals that the diversity component of CEGA plays a crucial role in later querying cycles by supporting performance stability.
4.4. Ablation Study
To answer RQ3, we perform an ablation study by system- atically removing the contribution of each one out of the 3 evaluation modules of CEGA. We then compare the perfor-
8

---

CEGA: A Cost-Effective Approach for Graph-Based Model Extraction and Acquisition
5. Related Work
and resemblance to the target model with a minimized query budget. To overcome this challenge, we develop CEGA by designing an adaptive node selection strategy that effectively queries the most informative nodes based on incremental history information accumulated in the training progress. We present a theoretical guarantee on the feasibility and efficiency of our approach in measuring the uncertainty of history- interim predictions for candidate nodes. Extensive experiments on real-world graph datasets demon- strate CEGA's superiority over state-of-the-art baselines across multiple key aspects. Looking ahead, two future directions warrant further exploration. First, our current framework is based on a transductive assumption, and we aim to extend the CEGA framework to inductive GNNs, fol- lowing previous investigation by (Shen al., 2022). Second, as suggested by (Guan et al., 2024), refining our approach by leveraging edge information, especially in the early query cycles when the number of selected nodes is small, could further improve CEGA's performance.
Query-Efficiens Model Extraction Attack. (Tramèr et al., 2016) pioneered the study of MEA with high-fidelity extrac- tion towards target black-box MLaaS models. (Pal et al., 2020) applies active learning techniques that dynamically adjust query selection based on self-feedback to extract deep classifiers in the domain of image and text, showing that querying 10% to 30% of samples from the dataset can yield a high-fidelity extraction model. Recent work shows that budget-sensitive MEA is feasible even for the data-free setting, where the attacks are performed without any in- distribution data (Lin et al., 2023b). Another proposed way to obtain better query efficiency in MEA is to simultane- ously train two clone models with the same samples and force them to learn from mismatching samples (Rosenthal et al., 2023). (Dai et al., 2023) employs clustering- baased data reduction to minimize information redundancy in the query pool and realize query efficiency for the task of MEA in NLP. However, all these works query-efficient MEA fail to consider rraph-based model extraction.
A Acknowledgements
Model Extraction Attack in Graph Learning. (Oliynyk et al., 2023) systematizes MEA on multiple model types, summarizes defense strategies based on available resources, and highlights an upward trend of popularity of literature on the attacks towards and defense for ML models. Recently, the research interest has pivoted towards the application of MEA on graph-related models. (DeFazio & Ramesh, 2019) first consider an adversarial model extraction approach for graph-structured dataset. (Wu et al.. 2022) provides com- prehensive analysis of GNN-based MEAS under various categories based on the attacker's knowledge of target graph structure and node attributes. (Shen et al., 2022) claims a significant contribution by proposing an inductive model structure that allows the attack graph to add new nodes to the existing model without the necessity of retraining. This development overcomes a major limitation of the prevalent GCN-based transductive approach (Kipf& & Welling, 2017) that requires model retraining with the introduction of new attacking or testing node. Generally, the GNN- MEAS can be divided into two primary categories, distinguished by the attacker's knowledge of the target model's 's graph structure (Oliynyk et al., 2023). Go beyond existing pub- lications, our work addresses serious concern regarding the efficiency and budget limitation in model extraction on graph learning by subsequently improving the practicality.
Y.D. acknowledges funding in part by Start-Up Grant and FYAP (First Year Assistant Professor) Grant from Florida State University, Tallahassee, FL, USA.
Impact Statement
We introduce CEGA (Cost-Efficient Graph Acquisition), a framework to deploy model extraction and acquisition on Graph Neural Networks (GNNs) under realistic constraints of limited query budgets and structural complexity.
For practitioners in high-stakes fields, CEGA formalizes the problem of GNN Model Extraction With Limited Budgets, laying a foundation for the development of practical de- fenses against GNN-based model extraction attacks (MEAs) against Machine Learning as Service (MLaaS).
For researchers, CEGA reveals its non-adversarial potential of GNN extraction and acquisition in domains where expert labeling is prohibitively expensive and large-scale training is impractical. Ethical model acquisition offers a viable path to democratize high- beghhperformance GNNs and adapt them to specialized downstream tasks.
We emphasize the responsible use of CEGA, its insights should be used to strengthen MLaaS security and advocate ethical research under limited resources.
6. Conclusion
References
In this paper, we introduce CEGA, a cost-effective frame- work specialized in node querying for graph-based model ex- traction. In particular, we formulate and study the problem of budget-constrained model extraction on graphs, where the objective is to maximize the extracted model's performance
Abbahaddou, Y., Ennadir, S., Lutzeyer, J. F., Vazirgiannis, M., and Boström, H. Bounding the expected robustness of graph neural networks subject to node feature attacks.

---

CEGA: A Cost-Effective Approach for Graph-Based Model Extraction and Acquisition
In The Twelfth International Conference on Learning Representations, 2024. URL https::/p//// /ttp:////peeeeeeeeeeeememee fest/Eoru?20 wdD.dddCuuSstttt
Dong, Y., Wang, S., Ma, J., Liu, N., and Li, J. Inter- preting unfairness in graph neural networks via training node attribution. Proceedings of the AAAI Conference on Artificial Intelligence, 37:7441-7449, 06 2023. doi: 10.1609/aaai v3716.25905.
Ahmedt-Aristizaber D., Armin, M. A., Denman, S., Fookes, C., and Petersson, I.. Graph-based deep learning for medical diagnosis and analysis: Past, present and future. Sensors (Basel), 21(14):47-58, 2021. doi: 10.3900 s21144758.
Dong. Y., Zhang, B., Lei, Z., Zou, N., and Li, J. Idea: A flexible framework of certified unlearning for graph neural networks. In KDD '24: Proceeding of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pp. 621 621-630, 2024. doi: https://doi.org/10.
Armstrong, M. Trade secret protection the pharma indus- try. Pharmaceutical Patent Analyst, 5(5):285-288, 2016. doi: htpps//tbo.orr/10.41555pppppp 2016000000000
1145/3637588.3677722
Dong, Y., Soga, P., He, Y., Wang, S., and Li, J. Graph neural networks are more than filters: Revisiting and bench- marking from a spectral perspective. In The Thirteenth International Conference on Learning Representations, 2025. URL https: i id-nWoOX5hh19.
Bessen, J. and Meurer, M. The private costs of patent litigation. Boston University School of Law Working Paper No 07-08, 2nd Annual Conference on Empirical Legal Studies Paper, pp. 1-43, 2008.
https::/openrerieer /oppnrevieeeeeeeeeeoeeeeeereeeee net/ forum?
Blakely, D., Lanchantin, J., and Qi, Y. Time and space plexity of graph convolutional networks, 2021. Accessed: Dec 31, 2021.
Ennadir, S., Abbahaddou, Y., Vazirgiannis, M., and Boström, H. A simple and yet fairly effective defense for graph neu- ral networks. In The Second Workshop on New Frontiers in Adversarial Machine Learning, 2023. URL https: / //openeeveww net forum? Cdd I
Brundage, M., Avin, S., Clark, J., Toner, H., Eckersley, P., Garfinkel, B., Dafoe, A., Scharre, P., Zeitzoff, T., Filar, B., Anderson, H., Roff, H., Allen, G. C., Steinhardt, J., Flynn, C., hEigeartaigh, S. Ó., Beard, S., Belfield, H., Farquhar, S., Lyle, C., Crootof, R., Evans, O., Page, M., Bryson, J. Yampolskiy, R., and Amodei, D. The malicious use of artificial intelligence: Forecasting, prevention, and mitigation. arXiv preprint arXiv:1802.07228, 2018.
Gan, Z., Zhou, D., Rush, E., Panickan, V. A., Ho, Y.-L.. Ostrouchovm, G., Xu, Z., Shen, S., Xiong, X., Greco, K. F., Hong, C., Bonzel, C.-L., Wen, J., Costa, L., Cai, T., Begoli, E., Xia, Z., Gaziano, J. M., Liao, Katherine, P., Cho, K., Cai, T., and Lu, J. Arch: Large-scale knowledge graph via aggregated narrative codified health records analysis. Journal of Biomedical Informaticx, 162: 104761, 2025. doi: https://doi.org oot.ooiiorr/0...o. 10..100/1...i.224.10000
Cai, H., Zheng, V. W., and Chang, K. C.-C. Active learning for graph embedding. arXiv preprint arXiv: / 050055 2017.
Cheng, Y., Guo, J., Long, S., WU, Y., Sun, M., and Zhang, R. Advanced financial fraud detection using gnn-el model. In 2024 International Conference on Computers, Infor- mation Processing and Advanced Education (CIPAE), pp. 453 460, 2024. doi: 10. N0.109/CCPAAE6442222244424 000088.
Gong, X., Wang, Q., Chen, Y., Yang, W., and Jiang, X. Model extraction attacks and defenses on cloud-based ma- chine learning models. IEEE Communications Magazine, 58(12):83-89 2020. doi: 10. 10010//0MM.00002000000
Guan, F., Zhu, T., Tong, H., and Zhou, W. A realistic model extraction attack against graph neural networks. Knowledge Systems, 300:112144, 2024. ISSN 0950-77511. doi: https://bbi.ogg/0..011jj...kkk 112144.
Cheng, Z., Shen, B., Sha, T., Gao, Y., Li, S., and Dong, Y. Atom: A framework of detecting query-based model ex- traction attacks for graph neural networks. arXiv preprint 1666, 2025.
Dai, C., Lv, M., Li, K., and Zhou, W. Meaeq: Mount model extraction attacks with efficient queries. In The 2023 Con- ference on Empirical Methods in Natural Language Pro- cessing, 2023. URL https:/ Eorum?id-D972Ea https:://ppereee http//ppeeevveeeee/e/ ew n
Hong, C., Rush, E., Liu, M., Zhou, D., Sun, J., Sonabend, A., Castro, V. M., Schubert, P., Panickan, V. A., Cai, T., Costa,
L., He, Z., Link, N., Hauster, R., Gaziano. J. M., Murphy, S. N., Ostrouchov, G., Ho, Y.L.., Begoli, E.,, Lu, J., Cho, K., Liao, K. Cai, T., and Program, V. M. V. Clinical knowledge extraction via sparse embedding regression (keser) with multi-center large scale electronic health record data. npj Digital Medicine, 4(151):1-11, 2021. doi: http://dao..ogg/1...138184144444 000.00000004040022222000
DeFazio, D. and Ramesh, A. Adversarial model ex- traction on graph neural networks. arXiv preprint 1o2.v:19/2.07721, 2019.
10

---

CEGA: A Cost-Effective Approach for Graph-Based Model Extraction and Acquisition
Hou, J., Qian, J., Wang, Y., Li, X.-Y., Du, H., and Chen, L. MI defense: Against prediction api threats in cloud- based machine learning service. In 2019 IEEE/ACM 27th International Symposium on Quality of Service (IWQoS),
Lin, J., Wan, Y., Xu. and Qi, X. Semantic graph neural network with multi-measure learning for semi-supervised classification. In Engineering Applications of Artificial Intelligence, volume 140, pp. 109647, 2025. doi: htips: www...............a........ 2tt.pppa...22211044444444 109647.
pp. 1-10, 2019. doi: 10. 10.11455 111111366285333290909
Huo, C., Jin, D., Li, Y., He, D., Yang, Y.-B., and Wu, L. T2- gnn: graph neural networks for graphs with incomplete features and structure via teacher-student distillation. In AAAI 23//2/2/32///AAAAT" 23: P Proceedings of the Thirty- Seventh AAAI Conference on Artificial Intelligence and Phirty-Fifth Conference on Innovative Applications of Ar- tificial Intelligence and Thirteenth Symposium on Educa- tional Advances in Artificial Intelligence. pp. 4339-4346, 2023. doi: https://doi.org/ wt...ooo//.....///aa...... 1609/aai. v3714.2555.
Lin, Y.. Lu, K.,, Yu, S.. Cai, T., and Marinka, Z. Multimodal learning on graphs for disease relation extraction. Journal of Biomedical Informatics, 143:104415, 2023a. doi: https: //doi.org/ 10. 1...10161........ (016//.jbi.2033 104415.
Lin, Z., Xu, K., Fang, C., Zheng, H., Ahmed Jaheezud- din, A., and Shi, J. Quda: Query-limited data-free model extraction. In Proceedings of the 2023 ACM Asia Conference on Computer and Communications Secu- rity, ASIA CCS '23, pp- 913-924, New York, NY, USA, 2023b. Association for Computing Machinery. ISBN 9798400700989, doi: 10.1 00.14455579856.3599333
Ju, W., Mao, Z. Yi, S., Qin, Y., Gu, Y., Xiao, Z., Shen, J.. Qiao, Z., and Zhang, M. Cluster-guided contrastive class-imbalanced graph classification. arXiv preprint arXiv:2412. 2024.
Liu, S., Cai, T., and Li, X. Representation-ennannce neural knowledge integration with application to large- scale medical ontology learning. arXiv preprint arXiv:2410.07454 2024.
Juuti, M., Szyller, S., Marchal, S., and Asokan, N. Prada: Protecting against dnn model stealing attacks. In 2019 IEEE European Symposium on Security and Privacy (Eu- roS&P), pp. 512-527, 2019.
Liu, X., Wu, B., Yuan, X., and Yi, X. Leia: A lightweight cryptographic neural network inference system at the edge. IEEE Transactions Information Forensics and Security, 17:237-252, 2022. doi: N0.1109/TFS.202.. 3138611.
Kahn, A. E., Szymula, K., Loman, S., Haggerty, E. B., Nyema, N., Aguirre, G. K., and Bassett, D. S. Network structure influences the strength of learned neural repre- sentations. Nature Communications, 16(994), 2025.
Liu, Y., Luo, J., Yang, Y., Wang, X., Gheisari, M., and Luo, F. Shrewdattack: Low cost high accuracy model extraction. Entropy (Basel), 25:282, 2023.
Karmakar, P. and Basu, D. Marich, a query-efficient distri- butionally equivalent model extraction attack. In Thirty- seventh Conference on Neural Information Processing Systems, 2023. URL https: wwwpr/ewee.eeeeeeeeeeeeeeeee.eee /ntte/ forum. id=bAI21VEMM..
Lou, C., Wang, Y., Li, J., Qian, Y., and Li, X. Graph neural network for fraud detection via context encod- ing and adaptive aggregation. Expert Systems with Applications, 261:125473, 2025. ISSN 0957-4174. doi: URL https://oo..ogg///...od////..... scteenee/arrtaaee/a////////7///2
Kipf, T. N. and Welling, M. Semi-supervised classi- fication with graph convolutional networks. In In- ternational Conference on Learning Representations, 2017. URL /ettps://operreeee http///eerreeeeeeeeeeeeoemmm nett/orum? id SJ4Jyyy
Lu, H. and Uddin, S. A weighted patient network-bascd framework for predicting chronic diseases using graph neural networks. Scientific Reports, 11(22607::--12, 2021.
Kose, H. T. Nunez-Yanez, J., Piechocki, R., and Pope, J. A survey of computationally efficient graph neural networks for reconfigurable systems. Information, 15(7):377, 2024.
Luan, S., Hua, C., Xu, M., Lu, Q., Zhu, J., Chang, X.-W., Fu, J., Leskovec, J., and Precup, D. When do graph neural networks help with node classification? investigating the homophily principle on node distinguishability. In Thirty- seventh Conference Neural Information Processing Systems, 2023. URL https: openreview .nt// forum? dtt.idd===kmmm32323
doi: https://doi.ooom wtw/ 10.333900mmm1110000777
Li, X., Fan, Z., Huang, F,, Hu, X., Deng, Y., Wang, L., and Zhao, X. Graph neural network with curriculum learning for imbalanced node classification. Neu- rocomputing, 574:127229, 2024. ISSN 0925-2312. doi: https//bbboogg....oo///mmmmm....
URL httpe::/www.sciencediicccc com/ ccience//rriccee//////2222222222
Motie, S. and Raahemi, B. Financial fraud detection using graph neural networks: A systematic review. Expert

---

CEGA: A Cost-Effective Approach for Graph-Based Model Extraction and Acquisition
Systems with Applications, 240(C): 2024. doi:
Shen, Y., He, X., Han, Y., and Zhang, Y. Model stealing attacks against inductive graph neural networks. 2022 IEEE Symposium on Security and Privacy (SP), pp. 1175- 1192, 2022.
Mujkanovic, F., Geisler, S., Günnemann, S., and Bojchevski, A. Are defenses for graph neural networks robust? In Oh A. H., Agarwal, A., Belgrave, D., and Cho, K. (eds.), Advances in Neural Information Processing Systems, 2022. URL httpt::///// openreview httpe/viieinneeeeeeeeeee ner/forum? 1d=yCJVkELVTSQ.
Shi, Y., Sagduyu, Y., and Grushin, A. How steal machine learning classifier with deep learning. In 2017 IEEE International Symposium on Technologies for Homeland Security (IST), pp. 1-5, 2017. doi: 10.
Nealey, T., Daignault, R. M., and Cai, Y. Trade secrets in life science and pharmaceutical companies. Cold Spring Harbor Perspectives in Medicine, 5(4):a020982, 2015. doi: https://doi.or/// wttpoooo////11..110 1ttp://0.0000/sppppppccaaa000000
Sun, R., Dai, H., and Yu, A. W. Does GNN pretraining help molecular representation? In Oh, A. H., Agarwal, A., Belgrave, D., and Cho, K. Information Processing Systems, 2022. URL https:
in Neural
Oliynyk, D., Mayer, R., and Rauber, A. know what you trained last summer: A survey on stealing machine learn- ing models and defences. ACM Computing Surveys, 55: 1-41, 2023.
/ //openreviww net
Tramèr, F., Zhang, F., Juels, A., Reiter, M. K., and Risten- part, T. Stealing machine learning models via prediction apis. Proceedings of the 25th USENIX Security Sympo- sium, August 10-12, 2016 in Austin, TX, 2016.
Oloulade, B. M., Gao, J., Chen, J., Al-Sabri, R., and Wu, Z. Cancer drug response prediction with surrogate modeling- based graph neural architecture search. Bioinformat- ics, 39(8)bbaa4478, 2023. doi: https://doi.org// 1093/ bioinformatics/haa447...
Tran, H. N. T., Thomas, J. and Ahamed Hassain Malim, N. H. Deepne: a framework for drug-target interaction prediction with graph neural networks. Peerl., 10:e13163, 2022.
Page, L.., Brin, S., Motwani, R., and Winograd, T. The pagerank citation ranking: Bringing order to the web. Technical Report 1999-66, Stanford InfoLab, Novem- ber 1999. URL http: //ippbbs..bb.//pp/ stanford. edu: 8090 / 422/ / Previous number SIDL-WP-1999-01
Vora, L. K., Gholap, A. D., Jetha, K., Thakur, R. R. S., Solanki, H. K., and Chavda, V. P. Artificial intelligence in pharmaceutical technology and drug delivery design. Pharmaceutics, 15(7):1916, 2023.
Pal, S., Gupta, Y., Shukla, A., Kanade, A., Shevade, S., and Ganapathy, V. Activethief: Model extraction using active learning and unannotated public data. Proceedings of the AAAI Conference Artificial Intelligence, 34(01): 865-872, 2020. doi: 10. 10.160//aai..ooo 10.160%/aaii.v3441.....
Wang, Y., Li, Z., and Barati Farimani, A. Graph Neural Networks for Molecules, pp. 21-66. Springer Interna- tional Publishing, 2023. ISBN https://doi.org/100 http://00...gg//111100////333333 0100000000007773---1333-1------1
doi:
Wang. Z., Zhang, J., Feng. J., and Chen, Z. Knowledge graph embedding by translating on hyperplanes. Twenty- Eighth AAAI Conference on Artificial Intelligence, 28(1): 1112-1119, 2014. doi: https:/doi.orr//Ie htt.//oo..o///11.16//aaiaii. 1609/ v28i1. 8870.
Paul, S. G., Saha, A., Hasan, M. Z., Noori, S. R. H., and Moustafa, A. A systematic review of graph neural net- applications: Recent advances,
work in healthcare- trends, and future directions. IEEE Access, 12:15145- 15170, 2024. doi: AL.100/AACESSS2224..33355
Wieder, O., Kohlbacher, S., Kuenemann, M., Garon, A., Ducrot, P., Seidel, T., and Langer, T. A compact review of molecular property prediction with graph neural networks. Drug Discovery Today: Technologies, 37:1-12, 2020.
Qin, 7.,, Liu, Y., He, Q., and Ao, X. Explainable graph- based fraud detection via neural meta-graph search. In Proceedings of the 31 ACM International Conference on Information & Knowledge Management, CIKM '22. pp- 4418, New York, NY, USA, 2022. Association for Computing Machinery. ISBN 978 9781450392366 doi: 10. 1145/351 1 808.355759 URI. https::t//// /ttp:://ddooooooo .rg/ 11..1115351188..33 3557598.
Wu, B., Yang. X., Pan, S., and Yuan, X. Model extraction attacks on graph neural networks: Taxonomy and real- isation. ASIA CCS '22: Proceedings of the 2022 ACM on Asia Conference on Computer and Communications Security, pp. 337-350, 2022.
Rosenthal, J., Enouen, E., Pham, H. V., and Tan, L. Dis- guide: Disagreement-guided data-free model extrac- tion. Proceedings of the AAAI Conference on Arti- ficial Intelligence, 37(8):61149963 Jun. 2023, doi: 10. a0.1660/aaai.. v37.8/2261.7
Wu, B., Zhang, H., Yang, X., Wang. S., Xue, M., Pan, S., and Yuan, X. Graphguard: Detecting and counteracting training data misuse in graph neural networks. arXiv preprint arXiv:2312.0788 2023a.
12

---

http///ii.rr/10..1166016 CEGA: A Cost-Effective Approach for Graph-Based Model Extraction and Acquisition
Wu, B., Yuan, X., Wang, S., Li, Q., Xue, M., and Pan, S. Securing Graph Neural Networks in MLaaS: A Compre- hensive Realization of Query-based Integrity Verification In 2024 JEEE Symposiun on Security and Privacy (SP),
Zhang, Y., Xu, Y., and Zhang, Y. A graph neural network node classification application model with enhanced node association. Applied Sciences, 13(12):7150 2023. doi: http:/ddi..rrgr1...339///p/..p
pp. 2534-2552, Los Alamitos, CA, USA, 2024. IEEE Computer Society. doi: 00.10099/5542233224400000011 URL https: /doi:://doo.. /ttpppoii...eecompppterooroceee org/10. 0tw.11199/5542323 2024 00110.
Zhang, Z., Chen, L.,, Zhong, F., Wang, D., Jiang, J., Zhang, S., Jiang. H., Zheng, M., and Li, X. Graph neural network approaches for drug-targel interactions. Current Opinion in Structural Biology, 73:102327, 2022. doi: https://doi. 2021. 100.111/.bbbi222110222222 org/10. 10....1/...bbiii.......
Wu, w. Zhang, J., Wei, V. Chen, X., Zheng, Z., King, I., and Lyu, M. R. Practical and efficient model extraction of sentiment analysis apis. In 2023 IEEE/ACM 45th Inter- national Conference on Software Engineering (ICSE), pp. 536, 2023b. doi: 10. CAA.CCEE46669.222.0000
Zhao, B., Xu, W., Guan, J., and Zhou, S. Molecular property prediction based graph structure learning. Bioinfor- matics, b0te), 2024. doi: https://dii.rr//10.0033 bioinformattiss/raae00...
Wu, Z., Pan, S., Chen, F., Long, G., Zhang, C., and Yu, P. S. A comprehensive survey on graph neural networks. IEEE Transactions on Neural Networks and Learning Systems, 32(1):4-24, 2021. doi: 1oi:10.1109/0 2020.2978386.
Zhao, K., Li, L., Ding, K., Gong, N. Z., Zhao, Y., and Dong, Y. A survey of model extraction attacks and defenses in distributed computing environments. arXiv preprint 2XKi:2502.16066 2025.
Zhou, D., Gan, Z., Shi, X., Patwari, A., Rush, E., Bonzel, C.- L., Panickan, V. A., Hong, C., Ho, Y.-L., Cai, T., Costa, L.., Li, X., Castro, V. M., Murphy, S. N., Brat, G., Weber, G., Avillach, P., Gaziano, J. M., Cho, K., Liao, K. P., Lu, J., and Cai, T. Multiview incomplete knowledge graph integration with application to cross-institutiin ehr data harmonization. Journal of Biomedical Informatics, 133: 104147, 2022. doi: 104147.
Xu, Z., Gan, Z., Zhou, D., Shen, S., Lu, J., and Cai, T. Inference of dependency knowledge graph for electronic health records. arXiv preprint arXiv:2312156611 2023.
Yang, Z. Cohen, W. W., and Salakhutdinov, R. Revisit- ing semi-supervised learning with graph embeddings. In ICML''6: Proceedings of the 33rd International Confer- ence on International Conference on Machine Learn- ing, volume 48 of ICML'I6, pp. 40-48, 2016. doi: http://booorrr1100555/////359000
Zhou, D., Tong, H., Wang. L.,, Liu, S., Xiong, X., Gan, Z., Griffier, R., Hejblum, B., Liu, Y.-C., Hong, C., Bonzel, C.- L., Cai, t., Pan, K., Ho, Y.-L., Costa, L., Panickan, V. A., Gaziano, J. M., Mandl, K., Jouhet, V., Thiebaut, R., Xia, Z., Cho, K., Liao, K., and Cai, T. Representation learn- ing to advance multi-institutionn studies with electronic health record data. arXiv preprint arXiv:2502.08547, 2025.
Zafeiropoulos, N., Bitilis, P., Tsekouras, G. E., and Kotis, K. Graph neural networks for parkinson's 's disease monitoring and alerting. Sensors (Basel), 23(23):8936, 2023. doi: 10.3390/s23218933.
Zang, X., Zhao, X., and Tang, B. Hierarchical molecular graph supe-suu learning for property prediction. Communications Chemistry, 6(34), 2023.
Zhou, J., Cui, G., Hu, S., Zhang, Z. Yang, C., Liu, Z., Wang, I.,, Li, C., and Sun, M. Graph neural networks: A review of methods and applications. Al Open, 1:57-81, 2020. doi:
Zhang, W., Yang, Z., Wang, Y., Shen, Y., Li, Y., Wang, L., and Cui, B. Grain: improving data efficiency of graph neural networks via diversified in fluence maximization. Proceedings the VLDB Endowment, 14(1 1):2473-2482, 2021.
Zhang, X. and Zitnik, M. Gnnguard: Defending graph neu- ral networks against adversarial attacks. In Larochelle, H., Ranzato, M., Hadsell, R., Balcan, M., and Lin, H. (eds.), Advances in Neural Information Processing Systems, volume 33, pp. 9263-9275. Curran Associates, Inc., 2020. URL htttpss//pproceedngg.ceem cc ce/paper (paaerr_fieee/ppppr///////11 39943998accaaleee44444eaooaadd pdf.
13

---

CEGA: A Cost-Effective Approach for Graph-Based Based Model Extraction and Acquisition
A. Proofs to Theoretical Analysis
In this section, we provide the proof to the theoretical contribution of CEGA.
Proof to Proposition 3.1: Before we calculate the complexity of the yth cycle of CEGA, we need to conduct the forward step of f- to obtain the softmax scores for each nodes of interest that used in the subsequent procedures of CEGA. (Blakely et al., 2021) shows that the forward step for an L-layer GCN has time complexity O(LN"d + LNd") and space complexity O(N² Ldd + d. The output takes OCCN + Nh) space and is shared among the following tasks. Here, h is the dimension of the embeddings.
For CEGA's entropy-based based approach to evaluate the uncertainty based on historical information, the space is required for O(Cn-11) softmax scores. Our task is to calculate the entropy of the (1) nodes, which involves the computation of I1) Sorting the nodes involves O 1 log 11) time complexity and ( space usage.
For the more resource-consuming perturbation- redo the perturbation. For each time we take the perturbation, we prepare the perturbed attributes for the nodes in Ga, which takes ((Ne) space and has ((Nd) time consumption. As we pass the perturbed attributes forward through the GNN model and calculate the softmax scores for the perturbed scores, the time complexity is O(LN2d + LNd)). For each time we redo the perturbation, the output takes (CCN) space, and a time complexity of OCCn,-1) is required to compare the labels derived from the perturbed softmax score and the original score. The output is stored in vector with ( dimensions, where the space for temporarily perturbed attributes and softmax scores can be released after each perturbation. We redo the perturbation procedure S times and sort the nodes based on C3 with - log Ry-1) time complexity.
alternative, we first consider the complexity involved each time
Taking summations on all the procedures implies that the additional time complexity is O(Cn,-1 + n log -1) 1 for CEGA's -nasep approach. For the perturbation-base alternative, the additional time complexity is O(SNd + SLN + SLN + SCn,-1 + n4-1 log n Given all the assumptions of Proposition 1. we summarize that the time complexity are O(CN + V log and O(SLN2 + SLN respectively. Under a similar step of calculation, we have that the space complexity of CEGA's entropy- based approach and the perturbation- based alternative are O(CN) and O(N2 Lal + LNd), respectively.
Proof to Theorem 3.2: In the proof, we consider generic GNN network. Taking the GCN model (Kipf & Welling, 2017) as an example, we have that
=o(=(((()X()))
(
1/2 AD-1 The last layer before the output is conducted by the softmax procedure. For one specific node T, we consider a generic two-layer GNN model
Here S(A) = 1-1
1/2,
(1) g7
w x, + (!)) Σ x)): MEN,
(2) = Woutg." (1) + b; G, = softmaxx (?)))
(5)
Here W!)) and w!!) represents the weights assigned to the self-attention term and the neighborhood for the node T, specifically, Nr represents the neighborhood of the node r. Substituting the node attributes x, x, indicates that
(1)
(W!ll x
(
x
(2))
Wootg
W ou (1) + bj D softmax(g!2))
(6)
MEN,
Aggregating (5) and (6) indicates that
|3 32112 5 Coo.s [|g! o6 S Coofel W out porllllls! -g(")))'") -
< Canfe C, W ont || W ||||lx - -xrl12 + Csoft Cr Wone| W/ 112
(x, (x,- x Σ WEN,
Here Czoft and C, denotes the Lipschitz constant for softmax function and the activation function (-.), respectively. The norms [ Wottll Il. || | and || || ||, are bounded from above given that the estimation function is bounded after one step of model fitting. For simplicity, we re-arrange the terms and form the inequality such that
|| s21l2 S mm ml|xx- x- + +12
Σ NEN.
(x, xx) 2
14

---

CEGA: A Cost-Effective Approach for Graph-Based Model Extraction and Acquisition
for some positive constants M1, 1/2 inequality, which implies that
xc. Given that Xx X2 (N(0, for any la Ny, we can apply Hoeffding's
x1) 21) S exp (-2 W
t2
P
Xp
We then select
S
6= min
MIV (1/() 1/2 V 2|N, log
where we guarantee that the difference of the outcome label probability has an upper bound with a large probability.
B. Supplementary Results and Discussion
In this section, elaborate the discussion of the additional results of the experiment based implementation of CEGA, which is available at http://gttthabb.ctaaaaaaataaaaat
to a series of widely studied benchmark graph datasets.
B.1. Datasets
Dataset
#Nodes
#Edges
#Features
#Classes
AmzComputer
13,752
491,722
767
10
AmzPhoto
7,650
238,163
745
8
CoauthorCS
18,333
163,788
6,805
15
Phystsos
34,493
495,924
8,415
5
Cora Full
19,793
126,842
8,710
70
DBLP
17,716
105,734
1,639
5
Table Dataset statistics
Table 3 presents the statistics of six benchmark datasets used in study, covering range of node, edge, feature, and class distributions. Amazon-Compute and Amazon-Photo are e-commerce co- purchhhhae networks characterized by dense connectivity. Coauthor-CS and Coauthor-Plysics represent academic collaboration graphs with larger number of features. Cora Full and DBLP are citation network datasets where nodes represent academic papers and edges denote citation relationships. Cora Full spans diverse machine learning subfields with 70 classes, while DBLP focuses on computer science publications with five broad research categories. These datasets provide diverse graph structures and feature distributions for evaluating model performance.
B.2. Setup of Hyperparameters
Setup of GNN Model Extraction We follow the Attack framework of (Wu al., 2022) to perform GNN model extraction. Initially, we train a target model, fr. for 1000 epochs with a learning rate of 1e-3, which provides predictions for surrogate model training. If training and test sets are not provided, we randomly select 60% of the nodes for training and use the remaining 40% for testing. This serves as the initial setup; however, following the Attack 0 framework, these masks are later adjusted based on whether the nodes are subject to queries for extraction.
Setup Node Selection Models For our experiments, we randomly set the candidate node pool V, comprising 10% of the nodes graphs with fewer classes, including Amazon-Computee Amazon-Phoot Coauthor- Coauthor-Physin and DBLP. For graph with significantly higher number of classes (e.g., Cora-Full, which has 70 classes), the pool includes 25% of the nodes. Our setup inspired by widely accepted works, such (Wu al., 2022; Shen et al., 2022). In the initialization step, we randomly select 2 nodes from each class across all the tested datasets, resulting in total of 2C nodes, where C' is the number of classes. In practice, this procedure remains feasible as the extractors can attain partial knowledge of the class distribution through domain expertise or external sources, especially when such knowledge offers strategic advantages in building a high-fidelity extracted model. For the remaining budget, we employ different node selection methods, with the total budget capped 20C'.
15

---

CEGA: A Cost-Effective Approach for Graph-Based Model Extraction and Acquisition
For the baseline node selection methods, hyperparameters are follows. In GRAIN (Ball-D), the radius is fixed 0.005 for all datasets, while in GRAIN (NN-D), is set to 1. For AGE, we adopt the time-sensitive parameter setting, where Tt Beta(1, ne), with n4, increasing as iterations progress, defined as 1.05 0.95'. Here, t denotes the number of iterations. The parameters and Bt are set d; = 5s 1-nk
For our proposed method, in cycle 7, CEGA queries x: = node and trains a 2-layer GCN model with (V+. Ga} for E = 1 epoch. In the analysis for node diversity, we set the weight p = 0.8 to ensure that the order R3 is designed to prioritize the nodes associated with underrepresented prediction labels. For the weighted average ranking mechanism, we set
wi (7) = a1 + AT= w2(1) = 02 + - A wa(n) = a3 - -
We design this weighting approach under the heuristics such that the subgraph structure is the most important information when the information gathered in the history is not accurate enough to guide further queries. As the number of queries increases, the contribution from history information becomes more prominent, and diversity concerns need to considered more seriously. In practice, we the initial weight coefficients aq a2 0g 0.2, the measurement of the initial weight gap between Ri and R2 as A 0.6, the measurement of the curvature for the weight changes À 0.3. The CEGA hyperparameters (a1, Q22, 03, A, X) are applied uniformly across all the tested graph datasets mitigate potential concerns of tuning bias.
After the node selection process, we train a 2-layer GCN with a hidden dimension of 16. The model is optimized with a learning rate 1e-3 and trained for 1000 epochs. For AGE, we apply a warm-up period of 400 epochs. All experiments are conducted on two NVIDIA RTX 6000 Ada GPUs. Model performance is evaluated for node selections ranging from 2C to 20C, with evaluations performed at every C. Selected nodes trained for 1000 epochs using learning rate of le-3.
B.3. Model Performance Gap
Table Performance gaps between hudget-constrained models and subgraph models, measured by Accuracy, Fidelity, and F1, across various datasets. The best results are in bold.
CoCS
CoP
AmzC
AmzP
Cora Full
DBLP
Random
2.68 0.6
3,47 + 1.0
3.60 = 1.1
2.07 = 1.6
1.71 +
12.24 + 1.3
GRAIN(NN-D)
1.69 + 0.6
1.87 + 0.8
3.41 + 1.1
1.56 + 0.4
-0.09 + 1.1
13.14 + 1.0
Accuracy
GRAIN(balI-D)
2.02 + 0.6
1.93 + 1.0
4.78 = 1.3
2.58 + 1.2
0.04 + 1.0
12.98 + 1.2
AGE
0.78 4 0.4
1.56 + 0.3
2.33
0.9
1.39 4 1.8
0.90 0.4
8.98 + 2.0
CEGA
0.91 + 0.4
1.39 + 0.4
1.19 + 0.8
0.58
+ 0.3
-1.36 + 0.2
7.79 + 1.1
Random
3.20 4 0.7
4.20 + 1.0
4.24 + 1.2
2.34 + 1.6
3.84 + 0.5
14.85 + 1.7
GRAIN(NN-D)
2.26 + 0.7
2.49 + 1.0
4.01 = 1.4
1.74 + 0.6
1.34 + 1.7
16.11 + 1.2
Fidelity
GRAIN(ball-D)
2.61 1: 0.7
2.50 + 1.2
5.77 + 1.7
3.06 1 1.4
1.68 4: 1.2
15.52 + 1.4
AGE
1.02 + 0.4
2.07 + 0.4
2.70 = 1.0
1.77
2.31 0.7
11.50 + 2.2
CEGA
1.25 1 0.5
1.84 1 0.5
1.69 + 0.8
0.56 - 0.5
0.06 + 0.4
9.98 1:: 1.2
Random
6.72 + 1.6
5.44 + 1.8
4.61 + 2.8
3.69 + 3.5
0.49 + 0.3
19.78 + 5.4
GRAIN(NN-D)
2.77 1 1.5
2.69 1.1
4.00 1 1.2
2.87 1 0.8
-0.97 + 1.0
19.10 1 4.0
F1
GRAIN(ball-D)
3.04 + 1.3
2.75 + 1.5
8.53 5.3
3.85 + 1.7
-0.93 + 0.3
16.95 + 3.7
AGE
0.84 1 0.6
2.13 1 0.5
4.57 5.1
1.30 1: 1.6
-1.12
11.93 + 2.9
CEGA
1.09 + 0.7 1.89
0.6 0.86 + 2.8 0.80 + 0.7
-3.43 0.5 10.02 1.0
Table 4 quantifies the performance gap between budget-constrained models and subgraph models across various datasets, using Accuracy, Fidelity, and Fl as evaluation metrics. A smaller gap indicates a more effective node selection strategy, with negative values suggesting cases where the budget-constrained model outperforms the subgraph model. Notably,
16

---

CEGA: A Cost-Effective Approach for Graph-Bass Based Model Extraction and Acquisition
CEGA
CECE
CEGA
Commalty Abazd Biverayy Ailad
Conrary Adtead
Uheatdaoy Allaad Devenity Altend
Dicrrty Alland
Score
COO5
CoP
AnOC
APMP
Coru Coll
DELP
COCS
CoP
ABOC
AmnP
Cora, Full
DBLP
Coc.5
CaP
AmaC
Amul
Cara Fall
DRLP
Figure 3. Ablation study results on accuracy (left), fidelity (middle), and Fl score (right) for CEGA and variants with one of the three node evaluation modules removed.
CEGA almost outperforms the benchmark models across all three metries, demonstrating its effectiveness in maintaining model performance under stringent budget constraints. Additionally, this table provides detailed numerical insights that complement the trends illustrated Figure 2.
B.4. Ablation Study
To address RQ3, an ablation study is conducted where we implement two of the three analyses proposed in Section 3.2. Specifically, we compare the original CEGA model against three variants: (1) CEGA with Centrality Module Ablated: variant removing the centrality-based selection mechanism, which expect evaluate the contribution of the subgraph model structure to the selection of nodes to be queried; (2) CEGA with Uncertainty Module Ablated: A variant removing the contribution of prediction uncertainty under the guidance of history information, which we expect to evaluate the contribution of history information extracted from previous queries; (3) CEGA with Diversity Module Ablated: A variant removing the contribution that enhances the diversity of the selected nodes, which we expect to evaluate the contribution of node diversity in providing a more stable estimation with a smaller variation across different random initialization setups. The setup of our ablation study follows the standard of the most recent works on GNN node classification tasks, such (Lin et al., 2025). In practice, set the respective cycle-specific weight w/ (7) 0, as specified in (7), among all y 21, ..., p} for the specific index i (1.
The results of the ablation study, as shown in Figure 3, are consistent across all three performance metrics, namely accuracy, fidelity, and Fl score. This indicates that the ablation study yields stable findings regardless of the evaluation criterion. This alignment reinforces the robustness of our proposed approach and suggests that each module contributes meaningfully to the overall performance of the model.
17


Reviews:
[{"review_id": "mR4RdlW8fX", "reviewer": "Reviewer_E9DY", "summary": "This paper explores the vulnerability of Graph Neural Networks (GNNs) to Model Extraction Attacks (MEAs), particularly in scenarios with limited query budgets and initialization nodes. The authors propose a novel node querying strategy that incrementally refines the selection of nodes over multiple learning cycles, using historical information to enhance extraction efficiency.The paper makes three main contributions: it introduces a novel problem formulation for Model Extraction Attacks (MEAs) against GNNs with limited query budgets, focusing on node-level graph learning tasks; proposes the CEGA framework, which identifies the most beneficial queries during training by considering representativeness, uncertainty, and diversity; and provides extensive experiments on real-world datasets, demonstrating that CEGA outperforms existing methods in terms of fidelity, utility, and key performance metrics.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your comprehensive and thoughtful feedback towards the CEGA work. We sincerely appreciate the time and expertise you dedicated to carefully reviewing our manuscript. We would like to provide some further insights to our paper regarding your comments to fully address the potential concerns.\n\n> **Reviewer**: The node selection strategy proposed by CEGA considers the representativeness, uncertainty, and diversity of nodes, thereby avoiding excessive concentration on certain nodes.\n\n**Authors**: We thank you for highlighting the key understanding of CEGA. The major motivation for us to impose diversity in CEGA's node selection strategy is precisely to prevent over-concentration on particular subsets of the graph, which often consist of nodes sharing the same label. Avoiding such concentration patterns not only improves the fidelity of extracted model on classifying nodes belonging to underrepresented label categories, but also enhances the stability of CEGA across different initialization and expected knowledge from the adversaries side. \n\n> **Reviewer**: Theorem 3.1 analyzes the temporal and spatial complexity of the CEGA method. \n\n**Authors**: We appreciate your correct understanding of the theoretical complexity analysis. As raised by Reviewers oxao and JNMU, we acknowledge the necessity to make a clearer evaluation of both the theoretical and practical computation complexity of CEGA. In the next version of our manuscript, we will reorganize the presentation of Theorem 3.1 and related discussion in real-world MLaaS setup. We are open to further suggestions with you on refining the study of the computation complexity of CEGA.\n\n> **Reviewer**: The experiment used six common graph datasets. By comparing with benchmark methods such as Random, GRAIN, and AGE, the superiority of the CEGA method has been verified. The article evaluated the performance of various methods under different query constraints by testing different query budgets from 2C to 20C nodes. The article also conducted ablation experiments to analyze the contribution of each module to overall performance by removing certain evaluation modules of CEGA.\n\n**Authors**: We thank you for your detailed and accurate summary of our experimental setup. Your expertise-based recognition of our effort to maintain consistency with widely accepted common practice in the respective field is highly appreciated. As discussed with Reviewers oxao and JNMU, our evaluation step is carefully designed to align with standards adopted throughout GNN-based MEA literature. We will prepare further clear justification on the CEGA evaluation setup as suggested by Reviewers oxao and JNMU, and we are open to incorporating any additional suggestion you may have that could enhance the comprehensiveness of our evaluation.\n\n> **Reviewer**: Most existing research has overlooked budget constraints in practical applications, while CEGA proposes a more practical attack method by introducing limitations on the number of queries and query nodes per round. Current research mainly focuses on the overall information or local structure of the graph, while CEGA introduces a comprehensive consideration of historical information and structural centrality, making attacks more efficient on actual complex graph structures.\n\n**Authors**: We thank you for the effort you put into understanding CEGA's main contributions correctly. After a careful review of prior literature we cited in our paper, your comment captures our intent to fix a critical gap that remains in the GNN-based MEA literature by explicitly addressing realistic query budget constraints based on a history-based query-by-learning scheme while considering GNN-specific potential obstacles such as complexity on graph structure. As also noted in our discussion with Reviewer oxao, achieving consistently high performance across diverse datasets under such constraints remains a highly meaningful attempt for our community, and we are glad that your feedback naturally reveals your gentle but firm acknowledgment of such contribution.\n\n**Overall Responses by Authors**: We thank you once again for your thoughtful engagement and positive comments to our paper. We are fully committed to making the paper more solid and comprehensive in the next version as per the feedback received from Reviewers oxao and JNMU. We welcome any further discussion with you and will respond promptly to any of your follow-up questions.", "claims_and_evidence": "This article claims that although graph neural networks (GNNs) have demonstrated superior performance in many applications, they are vulnerable to model extraction attacks (MEAs) in machine learning as a service (MLaaS) environments.Attackers can steal the functionality of GNN models by strategically querying the target model, thereby replicating high fidelity models. Such attacks can lead to serious consequences, such as copyright and patent infringement, especially in the pharmaceutical industry where GNNs are widely used for predicting drug molecule target interactions. If these GNN models are extracted, it may threaten the trade secrets of pharmaceutical companies, leading to unauthorized redistribution and unfair competition, ultimately causing significant financial and reputational losses.", "methods_and_evaluation_criteria": "The article used six commonly used graph datasets (such as Coauthor CS, Amazon Computer, Cora Full, DBLP, etc.), which cover various application scenarios from collaborative networks, product recommendations to academic citations. Tested on different datasets, CEGA demonstrated strong adaptability and robustness in various situations.The node selection strategy proposed by CEGA considers the representativeness, uncertainty, and diversity of nodes, thereby avoiding excessive concentration on certain nodes。", "theoretical_claims": "Theorem 3.1 analyzes the temporal and spatial complexity of the CEGA method. The theorem states that the entropy calculation of the CEGA method introduces a time complexity of O (CN+N log N) and a space complexity of O (CN), where C is the number of categories and N is the number of nodes in the graph. This is based on the node selection and graph propagation process in the CEGA framework, and derives the time and space complexity.\nTheorem 3.2 raises the issue of the existence of disturbance intensity ϵ. Specifically, when measuring the uncertainty of candidate nodes, there exists an appropriate disturbance intensity ϵ that ensures the stability of the model is not compromised after disturbance. This means that the CEGA method can ensure the effectiveness of the model when considering node disturbances, while not introducing excessive errors.", "experimental_designs_or_analyses": "The experiment used six common graph datasets (Coauthor CS, Amazon Computer, Cora Full, DBLP, etc.). These datasets cover various application scenarios, from collaborative networks to product recommendation systems, with broad representativeness.By comparing with benchmark methods such as Random, GRAIN (an active learning method based on neural networks), and AGE (another active learning method), the superiority of the CEGA method has been verified. The article evaluated the performance of various methods under different query constraints by testing different query budgets (from 2C to 20C nodes).The article also conducted ablation experiments to analyze the contribution of each module to overall performance by removing certain evaluation modules of CEGA, such as structural centrality, uncertainty, and diversity.", "relation_to_broader_scientific_literature": "One of the biggest innovations of the article is the proposal of the budget constrained MEA problem. Most existing research has overlooked budget constraints in practical applications, while CEGA proposes a more practical attack method by introducing limitations on the number of queries and query nodes per round.Current research mainly focuses on the overall information or local structure of the graph, while CEGA introduces a comprehensive consideration of historical information and structural centrality, making attacks more efficient on actual complex graph structures.", "essential_references_not_discussed": "No", "other_strengths_and_weaknesses": "originality：The paper proposes the CEGA (Cost Efficient Graph Attack) framework, which combines budget constraints and structural complexity, providing new ideas for efficient and low-cost model extraction in practical applications. This method has high originality in GNN security research.In addition, the paper innovatively improves attack efficiency by introducing multiple node selection criteria (representativeness, uncertainty, and diversity).\nsignificance：The paper provides a meaningful framework for conducting GNN model extraction attacks on service (MLaaS) platforms, which can help protect systems using GNN in high-risk areas such as drug discovery, financial fraud detection, and healthcare from the threat of model leakage.\nclarity：The structure of the paper is clear, first introducing the potential threats and challenges of GNN in practical applications, and then elaborating on the design principles, methods, and experimental evaluation of the CEGA framework in detail. The experimental part fully validated the effectiveness of the method and analyzed the contribution of each module through ablation experiments, ensuring the verifiability and reliability of the method.", "other_comments_or_suggestions": "No", "questions_for_authors": "No", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "jPX5lWOod6", "reviewer": "Reviewer_oxao", "summary": "The paper proposes a method for model extraction attack, in the setting where the number of prediction queries is extremely tight. \nNode predictions are queries in different rounds and based on three criteria: representativeness,  uncertainty, and diversity.\nFor the entropy-based approach, time and space complexities are computed. The experiments show that the method is effective in marginally improving the metrics.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your valuable feedback. We provide a point-to-point reply below to address the mentioned questions and concerns.\n\n> **Reviewer**: The improvements are often marginal, and sometimes significant. I'm not sure if the contribution is sufficient for an ICML paper. Moreover, most improvements are marginal.\n\n**Authors**: We thank you for raising this concern. We highlight the primary technical contribution of CEGA as achieving a highly challenging task of achieving strong and consistent performance in terms of saving query nodes while achieving high-fidelity model extraction. Such an advantage is especially evident in **Amazon_Computer**, **Cora_Full**, and **DBLP**, as shown in the trajectories at **Figure 1**. In contrast, AGE and GRAIN both show limitations on instability, with AGE underperforming on **Amazon_Photo** and **Cora_Full**, and GRAIN struggling on **Coauthor_CS**, **Amazon_Computer**, and **DBLP**. As a remark, many published papers in related fields have not achieved significantly superior performance across all the tested datasets, such as [1][2][3], with some underperforming against benchmarks by a larger margin than how CEGA has performed. We believe that CEGA makes a meaningful contribution to the further advancement of our community by introducing a practical and underexplored problem supported by comprehensive and stable empirical results. We are confident that our work can guide future efforts in research question formulation, method development, and theoretical analysis in the area of GNN security and democratization.\n\n[1] Graph Attention Networks, Veličković et al., ICLR 2018.\n\n[2] GNN-FiLM: Graph Neural Networks with Feature-wise Linear Modulation, Brockschmidt, ICML 2020.\n\n[3] Directional Message Passing for Molecular Graphs, Gasteiger et al., ICLR 2020.\n\n> **Reviewer**: In Tab. 1, in the 1st column the proposed method's metric is mistakenly in bold font, please correct it.\n\n**Authors**: We appreciate your attention to detail. We acknowledge and appreciate your suggestion to apply bold fonts only to the best performance for each task and will synchronize the new standard in the next version of our manuscript. We hope that our commitment addresses your concerns about the clarity of our work.\n\n> **Reviewer**: I have questions and doubts about the discussion of Sec. \"History-Based Analysis for Uncertainty\". The variable \n is generated from a normal distribution, which are added to the node attributes. Why doing so is referred to as \"permutation\" in the manuscript?\n \n**Authors**: We thank you for pointing this out. We agree that the term *permutation* is not precise enough. In the next version of our manuscript, we will replace this terminology with *perturbation*, which more accurately describes the application of a random Gaussian oscillation to the node attributes. This procedure allows us to evaluate the nodes' uncertainty regarding classification labels evaluated by the history-inspired interim model $f_{\\mathrm{T}}$ under attribute variation. We hope our committed edits will address your concern about the clarity of our terminology.\n \n> **Reviewer**: Although the time/space complexity is important, but in my opinion it shouldn't be presented as a theorem nor does it count as a contribution.\n\n**Authors**: We appreciate your feedback and understand your concern about presenting CEGA's time and space complexity as a standalone theorem. In our next version, we will no longer treat the results of our computation on CEGA's time/space complexity as a theorem. We hope our committed edits will address your concern about the arrangement of contents covered in the manuscript.\n\n> **Reviewer**: The writing and notation were ambiguous to me throughout the paper.\n\n**Authors**: We thank you for the feedback regarding the writing and notation of our manuscript. We are eager to know about the specific locations that make you feel the ambiguity in our writing and notation hinders the understanding of our work. We are open to further discussion on notation consistency and the overall clarity of our current manuscript, and we hope that more specific feedback from you in this aspect will further improve the quality of our work.", "claims_and_evidence": "The improvements are often marginal, and sometimes significant.\nNot included in score: In Tab. 1, in the 1st column the proposed method's metric is mistakenly in bold font, please correct it.", "methods_and_evaluation_criteria": "I have questions and doubts about  the discussion of Sec. \"History-Based Analysis for Uncertainty\".\nThe variable $\\tao$ is generated from a normal distribution, which are added to the node attributes. Why doing so is referred to as \"permutation\" in the manuscript? \n\nIn summary, although the paper shows that the 3 introduced criteria lead to marginal improvement, I'm not sure if the contribution is sufficient for an ICML paper. Moreover, most improvements are marginal.", "theoretical_claims": "The computation and space complexity of the entropy-based approach is computed and is presented as a theorem. \nAlthough the time/space complexity is important, but in my opinion it shouldn't be presented as a theorem nor does it count as a contribution.", "experimental_designs_or_analyses": "The approach is empirically validated.", "relation_to_broader_scientific_literature": "-", "essential_references_not_discussed": "-", "other_strengths_and_weaknesses": "The writing and notation were ambiguous to me throughout the paper.", "other_comments_or_suggestions": "-", "questions_for_authors": "-", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "rg4EXtJEop", "reviewer": "Reviewer_JNMU", "summary": "This paper introduces CEGA for model extraction attacks against GNNs with limited query budgets. The authors address practical constraints in real-world attack scenarios by designing a node querying strategy that incrementally refines node selection over multiple learning cycles. CEGA integrates three key considerations: representativeness (selecting nodes that capture graph structure), uncertainty (prioritizing nodes near decision boundaries), and diversity (ensuring comprehensive exploration). Experiments on six benchmark datasets demonstrate that CEGA outperforms baseline approaches in terms of accuracy, fidelity, and F1 score under strict query-size constraints. The authors provide theoretical guarantees for their approach and highlight the vulnerability of GNNs to extraction attacks despite resource limitations.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your valuable feedback. We provide a point-to-point reply below.\n\n**Response to Review on Claims**: Thank you for pointing this out. We would like to clarify that the *cost-effectiveness* we attribute to CEGA refers to two major aspects. First, CEGA shows its ability to **achieve high fidelity to $f_{\\mathrm{T}}$ using fewer queried nodes**, which we show in **Figure 1**. In pay-per-query settings, this translates into considerable cost savings for those who aim to replicate an expensive target model under a limited budget. Second, CEGA shows computational efficiency as being **1.5\\~4x more efficient** in terms of running time across most tested cases and datasets than AGE, which delivers competitive performance with CEGA on **CoCS** and **CoP**. This observation aligns with CEGA's theoretical efficiency, as we presented in **Section 3.3**.\n\n**Response to Review on Evaluation**: We thank you for your constructive feedback. First, we agree on the importance of assessing CEGA's cost-effectiveness in a simulated real-world setting involving modeled constraints. Our current evaluation setup for CEGA is adaptable for such a setting, as an evaluation on a different number of nodes selected by CEGA or benchmark models can be assessed by modifying the right cutoff for the trajectories in **Figure 1**. We will thoroughly evaluate CEGA's performance and time complexity under simulated real-world MLaaS settings in the next version of our manuscript.\n\n**Response to Experimental Design \\#1**: We thank you for your thoughtful feedback. To maintain consistency with common practice in the field, we follow the setup of numerous widely accepted works on MEAs against GNNs, notably [1] and [2]. Heuristically, we want to show CEGA's effectiveness in selecting informative nodes with **partial knowledge** to the target graph that contains **sufficient information** for MEA tasks. We use 25% for Cora-Full due to its significantly higher number of classes. We will provide detailed justification for our MEA framework setup and conduct additional experiments under varying attack node pool sizes in our next version.\n\n[1] Model Extraction Attacks on Graph Neural Networks: Taxonomy and Realisation, Wu et al., ASIA CCS 2022.\n\n[2] Model Stealing Attacks against Inductive Graph Neural Networks, Shen et al., IEEE Symposium on Security and Privacy, 2022.\n\n**Response to Experimental Design \\#2**: We thank you for pointing this out. In our practice, we follow the heuristics outlined in **Section 3.2** and design a setup as specified in **Equation (7)**. Specifically, we use **grid search**, which is commonly used in high-impact work on GNN evaluation [1], to find the best combination of hyperparameters for CEGA, namely initial weights $\\alpha_1$, $\\alpha_2$, $\\alpha_3$, weight gap $\\Delta$, and weight change curvature $\\lambda$, under this setup. To ensure generalizability, we apply the same set of hyperparameters across all 6 datasets. We will include further details on our tuning process in our next version.\n\n[1] Pitfalls of Graph Neural Network Evaluation, Shchur et al., arXiv:1811.05868, 2018.\n\n**Response to Other Weakness \\#1**: We thank you for raising this point. We would like to clarify that ensuring even class distribution for the initial query is a widely accepted common practice in the field, originating from fundamental contributions to GNN research [1] and continuously adopted by subsequent works we use as benchmarks [2][3]. In practice, it is reasonable to assume that the adversaries can attain partial knowledge of the class distribution through domain expertise in fields like *Drug-Target Interaction* or external sources such as *accounts outside the target network*. They will focus on obtaining such knowledge if they believe it brings them long-term monetary or strategic advantages based on a high-fidelity extracted model.\n\n[1] Revisiting Semi-supervised Learning with Graph Embeddings, Yang et al., ICML 2016.\n\n[2] Active Learning for Graph Embedding, Cai et al., arXiv:1705.05085, 2017.\n\n[3] GRAIN: Improving Data Efficiency of Graph Neural Networks via Diversified Influence Maximization, Zhang et al., VLDB 2021.\n\n**Response to Other Weakness \\#2**: We thank you for pointing this out. Our ablation study setup stated in **Section 4.4** that removes the contribution of one out of the three modules, namely *representativeness*, *uncertainty*, and *diversity*, follows the settings of the most recent works on GNN node classification tasks [1]. In conclusion,\n\n1. CEGA outperforms nearly all the ablated models in most datasets, specifically models with only (1) a combination of only representativeness and diversity and (2) a combination of only uncertainty and diversity. \n2. CEGA provides more stable estimates across most datasets and metrics compared to the model that combines only representativeness and uncertainty.\n\n[1] Semantic GNN with Multi-Measure Learning for Semi-Supervised Classification, Lin et al., EAAI 2025.", "claims_and_evidence": "The paper's primary claims regarding CEGA's superiority over baseline methods are generally well-supported by comprehensive experimental evidence. The authors demonstrate this through extensive comparisons on six different benchmark datasets, showing consistently better performance for CEGA across accuracy, fidelity, and F1 score metrics. The performance gap analysis between budget-constrained and full subgraph models further strengthens their claims.\n\nHowever, the claim that CEGA achieves \"cost-effective\" attacks would be stronger with a direct efficiency comparison (e.g., computational cost, time complexity in practice) against baseline methods, beyond just the theoretical complexity analysis provided.", "methods_and_evaluation_criteria": "The proposed methodology is logically sound and well-suited for the problem. The three-component node selection strategy addresses key challenges in model extraction with limited budgets. The evaluation criteria appropriately measure both the performance of the extracted model and its similarity to the target model.\n\nThe benchmark datasets represent diverse graph structures and applications, providing a robust testbed. However, the evaluation would be stronger with more real-world MLaaS settings where API rate limits and costs are explicitly modeled, rather than simply using node count as a proxy for query budget.", "theoretical_claims": "I reviewed the two main theoretical claims (Theorems 3.1 and 3.2) and their proofs in Appendix B. Theorem 3.1 on complexity evaluation appears correct, leveraging established complexity results for GCN operations. The proof appropriately breaks down computational components and aggregates them to derive the overall complexity. Theorem 3.2 on the existence of a feasible permutation parameter ε is also sound. The proof uses Hoeffding's inequality to establish probabilistic bounds on the perturbation's effect, ensuring stability in the model's predictions. Both proofs support the practical feasibility of the proposed approach, especially for the uncertainty evaluation component.", "experimental_designs_or_analyses": "The experimental design is generally robust. However, I identified several limitations:\n\n1. The attack node pool is restricted to 10% of nodes (25% for Cora-Full), which may not reflect real-world knowledge constraints.\n\n2. Hyperparameter selection process isn't fully detailed, raising questions about potential tuning bias.", "relation_to_broader_scientific_literature": "No", "essential_references_not_discussed": "No", "other_strengths_and_weaknesses": "Other weaknesses:\n\n1. The initial query selection (2 nodes per class) assumes prior knowledge of class distribution, which may be unrealistic in practical attack scenarios.\n\n2. The ablation study removes one component at a time, but doesn't explore interactions between components (e.g., combining only representativeness and uncertainty)", "other_comments_or_suggestions": "see above", "questions_for_authors": "see above", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: All reviewers positively evaluated the paper. For example, Reviewer JNMU states that the "proposed methodology is logically sound and well-suited for the problem" and "benchmark datasets represent diverse graph structures and applications, providing a robust testbed". The reviewers also acknowledge the importance of model extraction attacks, especially with a focus on practical scenarios with limited budget. For example, Reviewer E9DY praised the "new ideas for efficient and low-cost model extraction". Reviewer oxao initially has some concerns, but they increased their score after the rebuttal by the authors. Weaknesses raised by the other reviewers have either been sufficiently addressed or are only minor. Therefore, I recommend acceptance.
Decision: Accept (poster)