# Graph-Level Label-Only Membership Inference Attack Against Graph Neural Networks
## 2 Background
### Graph Neural Networks  
Graph neural networks (GNNs) are a class of neural networks specifically designed to handle graph-structured data. They take the node feature matrix and the graph topology structure as inputs to learn the representation of a single node or the entire graph. Most of the existing GNNs utilize the message passing mechanism. By iteratively performing the \"aggregate-update\" operation, node embeddings are generated. After \(l\) aggregation iterations, the node representation captures the information of \(l\)-hop neighbors. The \(l\)th layer of a GNN can be expressed as follows:  
\[H_{i}^{(l)}=\text{UPDATE}\Big{(}\text{AGGREGATE}\Big{(}H_{i}^{(l-1)},\Big{\{} H_{j}^{(l-1)}\Big{|}j\in N(i)\Big{\}}\Big{)}\Big{)} \tag{1}\]  
where \(H_{i}^{(l)}\) represents the embedding of node \(v_{i}\) at the \(l\)th layer, \(N(i)\) denotes the set of neighbors of node \(v_{i}\), \(\text{AGGREGATE}(\cdot)\) aggregates information from node \(v_{i}\) and its neighbors, and \(\text{UPDATE}(\cdot)\) applies a nonlinear transformation to the aggregated information. The differences among GNN models primarily lie in the implementation strategies of these two functions. We select four GNNs, including Graph Convolutional Network (GCN) [3], Graph Attention Network (GAT) [12], SAmple and aggreGatE (GraphSAGE) [13], and Graph Isomorphism Network (GIN) [6].  
GCN employs symmetric normalization, and the node embedding is represented as follows:  
\[H_{i}^{(l)}=\sigma\Big{(}\widetilde{D}^{-\frac{1}{2}}\widetilde{A}\widetilde{ D}^{-\frac{1}{2}}H^{(l-1)}W^{(l-1)}\Big{)} \tag{2}\]  
where \(\widetilde{A}=A+l\) and \(\widetilde{D}_{ii}=\sum_{j}\widetilde{A}_{ij}\). The embedding of each node aggregates as a weighted average of the node itself and its neighboring nodes; \(\sigma\) is the activation function, which generates new embeddings from the aggregated results.  
GAT employs an attention mechanism, and the node embedding is represented as follows:  
\[H_{i}^{(l)}=\sigma\Bigg{(}\sum_{j\in N(i)\cup i}\alpha_{ij}^{(l)}W^{(l)}H_{j}^ {(l-1)}\Bigg{)} \tag{3}\]  
where \(\alpha_{ij}\) represents the attention coefficient between node pairs, indicating the strength of the connection between nodes.  
GraphSAGE characterizes the central node by aggregating information from a fixed number of randomly sampled neighbor nodes. It supports various aggregation methods, including mean aggregation, LSTM-based aggregation, and max-pooling aggregation. In our work, we employ mean aggregation, and the node embedding is represented as follows:  
\[H_{i}^{(l)}=\sigma\Big{(}W^{(l)}\cdot\text{MEAN}\Big{(}H_{i}^{(l-1)},\Big{\{} H_{j}^{(l-1)}\Big{|}j\in N(i)\Big{\}}\Big{)}\Big{)} \tag{4}\]where MEAN\((\cdot)\) denotes the mean aggregation function.  
GIN is based on graph isomorphism testing, and its aggregation method preserves the strict distinguishability of neighbor features. The current node embedding is summed with the aggregation results and then passed through a multilayer perceptron (MLP):  
\[H_{i}^{(l)}=\text{MLP}\left(\left(1+\epsilon^{(l)}\right)H_{i}^{(l-1)}+\sum_{j \in N(i)}H_{j}^{(l-1)}\right) \tag{5}\]  
where \(\epsilon\) is a learnable parameter used to adjust the weight of the central node.  
After obtaining the final node embeddings, GNNs can perform tasks such as node classification, link prediction, and graph classification. This paper focuses on graph classification, where GNNs aggregate all node embeddings into a single graph-level embedding \(H_{G}\) using a readout layer, represented as follows:  
\[H_{G}=\text{READOUT}(\{H_{i}^{(l)}|i\in G\}) \tag{6}\]  
where READOUT\((\cdot)\) represents a readout function.