# Graph-Level Label-Only Membership Inference Attack Against Graph Neural Networks
###### Abstract  
Graph neural networks (GNNs) are widely used for graph-structured data. However, GNNs are vulnerable to membership inference attacks (MIAs) in graph classification tasks, which determine whether a graph was in the training set, risking the leakage of sensitive data. Existing MIAs rely on prediction probability vectors, but they become ineffective when only prediction labels are available. We propose a Graph-level Label-Only Membership Inference Attack (GLO-MIA), which is based on the intuition that the target model's predictions on training data are more stable than those on testing data. GLO-MIA generates a set of perturbed graphs for the target graph by adding perturbations to its effective features and queries the target model with the perturbed graphs to obtain their prediction labels, which are then used to calculate the robustness score of the target graph. Finally, by comparing the robustness score with a predefined threshold, the membership of the target graph can be inferred correctly with high probability. Experimental evaluations on three datasets and four GNN models demonstrate that GLO-MIA achieves an attack accuracy of up to 0.825, outperforming baseline work by 8.5% and closely matching the performance of probability-based MIAs, even with only prediction labels. graph neural networks; membership inference attack; graph classification +
Footnote †: journal: Applied Sciences  
0000-0001-  
Membership inference attacks exploit the model's memorization of the training data, finding the differences in the model's output between the training data (members) and the testing data (non-members) to infer membership. In graph classification tasks, MIAs aim to infer the membership of the given graph. Existing MIAs usually utilize prediction probability vectors to infer membership. However, if GNNs only provide prediction labels rather than probability vectors, these MIAs become ineffective. The label-only scenarios for GNNs are widely prevalent and more practical for MIAs, for example, molecular activity or toxicity prediction systems only output binary labels (e.g., active/inactive, toxic/non-toxic), not probability vectors. Therefore, it is necessary to investigate whether there exists an MIA threat against GNNs in graph classification tasks when only prediction labels are available to the adversary, which, to the best of our knowledge, remains insufficiently explored. We propose a Graph-level Label-Only **M**embership **I**nference **A**ttack (GLO-MIA) against GNNs, revealing the vulnerability of GNNs to such threats. Specifically, given a target graph, GLO-MIA generates a set of perturbed graphs based on the target graph. Then, these perturbed graphs are used to query the target model to obtain their prediction labels. Next, the robustness score of the target graph is calculated based on these prediction labels. Finally, the robustness score of the target graph is compared with a predefined threshold. If it is greater than the threshold, the target graph is considered a member; otherwise, it is considered a non-member. In the label-only scenario, the adversary cannot use sufficient model information for membership inference, but the adversary can utilize a shadow dataset with a distribution similar to the target dataset to train a shadow model that mimics the behavior of the target model. GLO-MIA leverages the shadow model to determine the perturbation magnitude and threshold to distinguish members and non-members. Due to the diverse feature distributions and types of graph data, we propose a general perturbation method that applies small, uniformly sampled numerical values to the graph's effective features. The performance of GLO-MIA is evaluated on four GNN models and three datasets. The experimental results show that GLO-MIA achieves an accuracy of up to 0.825, surpassing the baseline work by up to 8.5%. Even using only prediction labels, GLO-MIA achieves performance close to that of probability-based MIAs.