WATERMARKING GRAPH NEURAL NETWORKS VIA EXPLANATIONS FOR OWNERSHIP PROTECTION

Authors: Jane Downer, Ren Wang, Binghui Wang
Primary area: alignment, fairness, safety, privacy, and societal considerations
Keywords: Watermarking, GNNs, Ownership, Verification, Ownership Verification, Explanation, Graph

Abstract:
Graph Neural Networks (GNNs) are the mainstream method to learn pervasive graph data and are widely deployed in industry, making their intellectual property valuable. However, protecting GNNs from unauthorized use remains a challenge. Watermarking, which embeds ownership information into a model, is a potential solution. However, existing watermarking methods have two key limitations: First, almost all of them focus on non-graph data, with watermarking GNNs for complex graph data largely unexplored. Second, the de facto backdoor-based watermarking methods pollute training data and induce ownership ambiguity through intentional misclassification. Our explanation-based watermarking inherits the strengths of backdoor-based methods (e.g., robust to watermark removal attacks), but avoids data pollution and eliminates intentional misclassification. In particular, our method learns to embed the watermark in GNN explanations such that this unique watermark is statistically distinct from other potential solutions, and ownership claims must show statistical significance to be verified.  We theoretically prove that, even with full knowledge of our method, locating the watermark is an NP-hard problem.  Empirically, our method manifests robustness to removal attacks like fine-tuning and pruning.  By addressing these challenges, our approach marks a significant advancement in protecting GNN intellectual property.

Decision: reject
Reviewer scores: 5, 5, 5, 5

Reviews and discussion:
<thread>
creation date:
1730655701345

thread_type:
official_review

<thread_object>
creator: reviewer_bm1q

<content>
summary:
The paper proposes a graph neural network watermarking method that embeds ownership information into the explanations of predictions. During the training process, the node classification loss maintains the model's classification accuracy, while the watermark embedding loss ensures that the feature explanations of the watermarked subgraphs align with the watermark pattern. After training, the model owner can claim its ownership by the similarity between the explanations and the watermark pattern. The author proves that it is an NP-hard problem for attackers to find the watermarked subgraphs. The method mitigates the impact of intentional misclassification compared to traditional backdoor-based watermarking techniques. Experiments on three datasets in node classification task illustrate the effectiveness of ownership verification and its robustness to pruning and fine-tuning.

strengths:
The paper first introduces node feature explanations into GNN watermarking and demonstrates the potential of model explanations for applications in the GNN watermarking domain. By embedding the watermark within GNN prediction explanations rather than in the training data, the method mitigates risks associated with data pollution and misclassification.

weaknesses:
1. Several prior methods have been proposed in the area of GNN watermarking, such as [1] and [2]. It is important to consider experiments that compare the watermark accuracy and downstream task performance of these methods.
2. The paper highlights the robustness of the method against pruning and fine-tuning. Given that adversaries may attempt model extraction attacks, as described in [3], it is advisable to address the robustness against such extraction attacks.

[1] Zhao, Xiangyu, Hanzhou Wu, and Xinpeng Zhang. "Watermarking graph neural networks by random graphs." 2021 9th International Symposium on Digital Forensics and Security (ISDFS). IEEE, 2021.

[2]Xu, Jing, et al. "Watermarking graph neural networks based on backdoor attacks." 2023 IEEE 8th European Symposium on Security and Privacy (EuroS&P). IEEE, 2023.

[3]Shen, Yun, et al. "Model stealing attacks against inductive graph neural networks." 2022 IEEE Symposium on Security and Privacy (SP). IEEE, 2022.

questions:
1. How does the model perform without watermarking? It would be helpful to compare the classification accuracy on downstream tasks before and after embedding the watermark.
2. The explanation method GraphLIME is applied only to the node classification task in the paper. Can this watermarking method be extended to other downstream tasks in graph-based applications?
</content>
</thread_object>

</thread>
<thread>
creation date:
1730756182429

thread_type:
official_review

<thread_object>
creator: reviewer_7pbz

<content>
summary:
This paper aims to inject watermarks to graph neural networks, in order to serve as a verification strategy to protect the ownership of the graph neural network. In order to achieve the goal, the authors investigate a new methodology of graph model explanation.

strengths:
1. The paper studies a novel problem for GNN ownership verification. 
2. The proposed method is interesting and the empirical results demonstrate the effectiveness. 
3. The authors conduct serious robustness evaluation of the proposed methodology.

weaknesses:
**Concerns Regarding the Presentation**\
From Section 3, the paper uses too many math notations and equations, but didn't provide sufficient explanation and clarification. This make the paper not very easy to follow. For example, the GNN explanation part in Section 3.2, it is hard to see how someone can use it to explain the GNN prediction. Moreover, the switch from Lasso to Ridge Regression will make the give weights to all features. I am not sure how to find important features based on the Ridge Regression output. 

**Concerns Regarding the Threat Model**\
The threat model discussed in this paper appears to lack sufficient justification. Specifically:
1. It is unclear why or under what circumstances “the adversary does not know the location of the watermarked subgraphs, but knows the shape and number of the subgraphs.” In practice, if the adversary is not the model trainer, they may have limited knowledge about the watermark.
2. The authors also mention that the model ownership verifier cannot access the protected model. It’s not immediately clear why the verifier would be unable to access the model parameters. Try to imagine, if an artist who owns a painting work sues another party for copyright infringement, it would be unusual for the artist to prevent the judges from examining their original artworks.

questions:
Plz see the weakness.
</content>
</thread_object>

</thread>
<thread>
creation date:
1731050753355

thread_type:
official_review

<thread_object>
creator: reviewer_k1gl

<content>
summary:
This paper proposes a graph explanation-based watermarking method. The watermarks are set as specific explanations and are trained into the protected model by backdoor techniques. During verification, explanations of watermarked data will be compared with the ground-truth explanations to determine the ownership. In empirical evaluations, authors demonstrate the performance of the proposed watermarking method from different views, e.g., effectiveness, uniqueness, robustness, and undetectability.

strengths:
It is novel to utilize explanation as 'poisoned labels' of watermarked data, which will not negatively influence the performance of GNNs.

weaknesses:
The major concern is how verifiers could get the explanations via black-box access to the protected model during the black-box verification. If I read carefully enough, the explanation of GraphLIME can only be obtained under white-box settings with node embeddings or other model parameters. How is the query efficient if they can be obtained via black-box access? I welcome discussion from authors and will consider raising the score if the answer is appropriate.

questions:
Please refer to weaknesses.
</content>
</thread_object>

</thread>
<thread>
creation date:
1731078756007

thread_type:
official_review

<thread_object>
creator: reviewer_ub6g

<content>
summary:
In this paper, the authors propose to watermarking GNNs via the explanations of GNNs. Their theory indicates that locating the watermark is an NP-hard problem and the experiments demonstrate that the proposed attack is robust to current defenses.

strengths:
1 This motivation of the paper is clear.

2 The experiments are quite solid.

3 The soundness of the proposed method is good.

weaknesses:
1 Although the authors claim that the proposed method can avoid data pollution and eliminates intentional misclassification. However, compared to the traditional methods, it requires a more tight threat model: the training process of target models. It is not always accessible to all scenarios.

2 In Figure 2, the results indicate that fine-tuning fails to remove the effectiveness of the embedded watermark. However, as far as I know, the effectiveness of the fine-tuning attack is closely related to the detailed setting of the learning rate, A larger learning rate might attack the proposed method.

3 In this paper, the authors only narrows the attack in the node classfication. It is only a sub-task in the graph community. I am not sure whether the attack is general enough to be applied to another task, such as edge classification.

questions:
1 As far as I know, GNNs is only one type of models for node classification, how about more powerful models such as graph transformers?

2 In Table 1, the authors only show the accuracy after inserting watermark. How about accuracy with performing watermarking? Those data is needed to demonstrate the stealthiness of the attack.
</content>
</thread_object>

</thread>
<thread>
creation date:
1731460318913

thread_type:
public_comment

<thread_object>
creator: ~yiming_li1

<content>
title:
Alert for Potential Plagiarism: Highly similar to our work without proper reference and discussions

comment:
**Summary**: This paper proposed to watermark the explanations of Graph Neural Networks (GNN) to protect the copyright of GNNs. Specifically, this paper utilized GraphLIME to generate the explanations and embed the watermark into them via a dual-objective loss function. This paper further provided a theoretical analysis of the difficulty of locating the watermark.


**Soundness**: fair

**Presentation**: fair

**Contribution**: Poor



**Strengths**

1. The studied problem is of great significance and sufficient interest to ICLR audiences.
2. The main idea is easy to follow to a large extent.
3. The authors try to provide theoretical analyses of their method, which should be encouraged.



**Weaknesses**

1. This paper is very similar to [1] (initially submitted to S&P 2024 on December 7, 2023 and released on arXiv in May 8, 2024, link: https://arxiv.org/abs/2405.04825) in various aspects. It appears to be a straightforward implementation of [1] on Graph Neural Networks. However, it seems that the authors intentionally omit the reference to [1] and exaggerate their contributions by not citing [1].  The authors should provide a detailed discussion of the differences and originality of this paper compared with [1]. Otherwise, this paper might be regarded as plagiarism. The resemblances are outlined below.
   1. These two papers share **the same motivation** that existing backdoor-based watermarking methods are harmful and ambiguous.
   2. These two papers share **the same insight** to embed the watermark into the explanation of the neural network.
   3. These two papers share **nearly the same method** to embed the watermark. [1] proposed to utilize a LIME-based method, while this paper leverages GraphLIME (which is an extension of LIME in GNN).
   4. Both papers utilize **ridge regression** to calculate the explanations.
   5. Both papers use **hypothesis-based methods** for ownership verification.  [1] utilized the chi2-test while this paper uses the z-test.
2. This paper uses Z-test for ownership verification and the follow-up analyses, based on matching indices. However, Z-test can be used only when the variable follows the Gaussian distribution (https://en.wikipedia.org/wiki/Z-test). However, to the best of our knowledge, the matching indice (MI) follows a multinomial distribution instead of the Gaussian distribution. In this case, it is not appropriate to use the Z test. Even if the author tries to claim that the distribution of MI approaches the Gaussian distribution under the central limit theorem, the author needs to verify its correctness through the Normality Test.
3. Missing some important baselines [2, 3]. This paper also lacks an empirical comparison with these baselines.
4. The experiments on the robustness are inadequate. There is no discussion about the resistance to potential adaptive attacks. For example, the adversaries can design a strong adaptive attack by including the proposed method as a regularization and conducting overwirte attacks.



References:

1. Explanation as a Watermark: Towards Harmless and Multi-bit Model Ownership Verification via Watermarking Feature Attribution. NDSS, 2025.
2. Revisiting Black-box Ownership Verification for Graph Neural Networks. S&P, 2024.
3. Watermarking Graph Neural Networks by Random Graphs. ISDFS, 2021.


**Questions**
1. Clarify the differences and novelty of this paper compared with [1].
2. Provide empirical comparisons with existing baseline methods.

---
**Alert for Potential Plagiarism**

We have good reasons to believe that the core methodology of this paper was ported over from our NDSS'25 paper (Explanation as a Watermark: Towards Harmless and Multi-bit Model Ownership Verification via Watermarking Feature Attribution). The authors exaggerate their contribution in this submission by deliberately not citing our NDSS paper. In general, our paper provides a general watermarking method that can be used for both image classification and text generation. This paper is just an implementation of our paper in graph classification, although we did not do GNN experiments in our paper.

Although this paper was accepted in September 2024, and I know ICLR has a 3-month concurrent work policy. However, our work was uploaded to arxiv in early May this year (https://arxiv.org/abs/2405.04825), not to mention that it had already been reviewed by two conferences (SP, CCS). This paper is not only similar to ours in the general direction but also completely plagiarizes our technology. We believe that the original intention of the concurrent work policy is to protect authors from missing comparative work due to objective reasons, rather than to protect malicious plagiarism due to subjective intention. 

I urge the authors to explain this issue and provide a proper and comprehensive illustration and comparison of our work.
</content>
</thread_object>

</thread>
<thread>
creation date:
1732483017549

thread_type:
official_comment

<thread_object>
creator: area_chair_hf3v

<content>
comment:
Dear reviewers,

Thanks for serving as a reviewer. As the discussion period comes to a close and the authors have submitted their rebuttals, I kindly ask you to take a moment to review them and provide any final comments.

If you have already updated your comments, please disregard this message.

Thank you once again for your dedication to the OpenReview process.

Best,

Area Chair
</content>
</thread_object>

</thread>


Metareview:
metareview:
The paper proposes a watermarking method for GNN based on the explanations on graphs. During the training, the work adds an additional watermarking embedding loss to ensure the explanations' features of the watermarked subgraphs aligning with the water pattern. Then the model owners can use the similarity between the model's explanations and the watermark pattern to claim their ownership. Experiments and theoretical analysis demonstrate their effectiveness of ownership verification and robustness to pruning and fine-tuning. 

Strength:
1. The proposed method based on GNN's explanation is interesting and effective under their evaluation.

Weaknesses:
1. The experiment settings are limited and may be wired considering its threat model.

2. The work cannot work under a model extraction attack.

3. The writing for its method needs to be more clear.

As all reviewers are worried about the method's scope and effectiveness, I think this author should add more before this paper is accepted. I would like to propose some new comments for the authors of this paper:

1. I think the watermarking scenarios for GNN can only be valid when the GNN is complex or the training dataset is really large. Therefore, I suggest you conduct your experiments at least in the OGBN dataset. I think fine-tuning a small GNN trained on Pubmed, Photo, CS or MUTAG is not realistic, as they can be retrained easily with only a few minutes.

2. More complex GNNs should be considered, more commonly used GNNs like GAT, GCNII, APPNP, or even ResGCN should be considered to enhance the paper's impacts.

3. Add more experiments on other tasks like Graph classification.