# Graph-Level Label-Only Membership Inference Attack Against Graph Neural Networks
## 3 Related Work  
In this section, we discuss the related work on membership inference attacks (MIAs).  
In recent years, various privacy attacks have been instantiated on graph neural networks (GNNs), which can be generally categorized into four types based on the adversary's targets: Model stealing attacks aim to obtain a substitute model that has similar predictions to the target model [14; 15]. Property inference attacks aim to reveal sensitive data properties [16; 17]. Graph reconstruction attacks aim to reconstruct the structure of the target graph [16; 18; 19]. Membership inference attacks aim to determine whether any given data record was used in the training of the target model [7; 8; 9; 10; 11].  
Membership inference attacks are generally categorized into two types: training-based MIAs and threshold-based MIAs. Training-based MIAs use shadow models and shadow datasets to construct attack features and train an attack model to infer membership. Threshold-based MIAs compare scores (e.g., maximum confidence and prediction cross-entropy) with a predefined threshold to infer the membership of data. In the field of traditional machine learning, extensive research on membership inference attacks has been conducted [20; 21; 22; 23; 24; 25].  
Membership inference attacks on GNNs have attracted increasing attention. MIAs on GNNs include node-level [7; 11], link-level [26], and graph-level MIAs [9; 10]. Node-level MIAs determine the membership of a node. Link-level MIAs focus on determining whether a link between two nodes exists in the training graph. Graph-level MIAs identify the membership of an entire graph.  
In graph-level MIAs, the adversary usually utilizes the difference in the output distribution of the target model between members and non-members. [PERSON] et al. [9] proposed the first graph-level black-box MIA in graph classification tasks, leveraging the model's prediction probability vectors to construct attack features and training a binary classifier. They also introduced multiple types of probability-based metrics to assess membership privacy leakage. [PERSON] et al. [10] proposed combining one-hot class labels with prediction probability vectors as attack features to train the attack model. Furthermore, they utilized a class-dependent threshold to implement the attack based on modified prediction entropy. However, existing MIAs rely on the model providing prediction probability vectors and cannot be implemented when the model only outputs prediction labels.  
Research on label-only membership inference attacks on graphs is still insufficient, but in non-graph domains, several studies have explored label-only MIAs [23, 24, 27, 28, 29]. In the graph domain, [PERSON] et al. [11] utilized the fixed properties of a node, the prediction correctness of the target model, the node's features and neighborhood information to construct attack features, training an attack model to identify the membership of the node. However, graph-level label-only MIAs remain insufficiently explored. Therefore, we propose GLO-MIA, the first label-only membership inference attack against graph classification tasks.