# Graph-Level Label-Only Membership Inference Attack Against Graph Neural Networks
## 5 Experiments
### The Impact of Perturbation Magnitude  
In this section, we analyze the impact of the perturbation magnitude on GLO-MIA. In GLO-MIA, the perturbation magnitude is controlled by adjusting the scaler size. We evaluate the performance of GLO-MIA under the different scaler sizes. The results are  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Dataset** & **Model** & **Ours** & **CELoss** & **Mentr** \\ \hline DD & GAT & 0.717 & 0.595 & **0.721** \\  & GraphSAGE & 0.746 & 0.682 & **0.785** \\  & GCN & 0.728 & 0.606 & **0.731** \\  & GIN & 0.736 & 0.629 & **0.751** \\ ENZYMES & GAT & 0.798 & 0.816 & **0.877** \\  & GraphSAGE & **0.845** & 0.725 & 0.844 \\  & GCN & 0.809 & 0.685 & **0.829** \\  & GIN & 0.832 & 0.701 & **0.834** \\ PROTEINS\_full & GAT & **0.688** & 0.621 & 0.678 \\  & GraphSAGE & **0.677** & 0.540 & 0.656 \\  & GCN & **0.679** & 0.516 & 0.641 \\  & GIN & **0.697** & 0.548 & 0.672 \\ \hline \hline \end{tabular}
\end{table}
Table 3: Comparison of AUC between GLO-MIA and two probability-based MIAs (CELoss: cross-entropy-based MIA, Mentr: modified prediction entropy-based MIA).  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Dataset** & **Model** & **Ours** & **CELoss** & **Mentr** \\ \hline DD & GAT & 0.717 & 0.595 & **0.721** \\  & GraphSAGE & 0.746 & 0.682 & **0.785** \\  & GCN & 0.728 & 0.606 & **0.731** \\  & GIN & 0.736 & 0.629 & **0.751** \\ ENZYMES & GAT & 0.798 & 0.816 & **0.877** \\  & GraphSAGE & **0.845** & 0.725 & 0.844 \\  & GCN & 0.809 & 0.685 & **0.829** \\  & GIN & 0.832 & 0.701 & **0.834** \\ PROTEINS\_full & GAT & **0.688** & 0.621 & 0.678 \\  & GraphSAGE & **0.677** & 0.540 & 0.656 \\  & GCN & **0.679** & 0.516 & 0.641 \\  & GIN & **0.697** & 0.548 & 0.672 \\ \hline \hline \end{tabular}
\end{table}
Table 2: Comparison of attack accuracy between GLO-MIA and the gap attack.  
Figure 2: Visualization of Table 3.  
shown in Figure 3, where the x-axis represents scaler size and the y-axis represents attack accuracy. The red and blue lines represent the attack accuracy of the gap attack and GLO-MIA, respectively. From the figure, we observe that as the size of the scaler increases, the attack accuracy initially improves and then declines.  
To analyze this phenomenon, we further plot the robustness score distributions of members and non-members of the ENZYMES dataset with scaler sizes of 0.1, 1.5, and 15.0, as shown in Figure 4. The red and blue bars represent the robustness scores of members and non-members, respectively. We observe that when the perturbation is too small (s = 0.1), the model predictions are not effectively disturbed, resulting in highly overlapping robustness score distributions of members and non-members, and the attack accuracy remains similar to that of the gap attack. When the perturbation is effective (s = 1.5), the robustness scores of non-members decrease significantly, while members maintain relatively high robustness, leading to a clear distinction between the two distributions. At this point, the attack accuracy of GLO-MIA outperforms the baseline by approximately 5%. However, when the perturbation is too large (s = 15.0), both members and non-members are misclassified, causing their distributions to overlap again and significantly reducing the attack performance even below that of the gap attack (s = 20.0).  
The experimental results demonstrate that the choice of perturbation magnitude is a critical factor for the performance of GLO-MIA, and suitable perturbations can effectively enhance the distinguishability of members and non-members.