  Many real-world data comes in the form of graphs, such as social networks and
protein structure. To fully utilize the information contained in graph data, a
new family of machine learning (ML) models, namely graph neural networks
(GNNs), has been introduced. Previous studies have shown that machine learning
models are vulnerable to privacy attacks. However, most of the current efforts
concentrate on ML models trained on data from the Euclidean space, like images
and texts. On the other hand, privacy risks stemming from GNNs remain largely
unstudied.
  In this paper, we fill the gap by performing the first comprehensive analysis
of node-level membership inference attacks against GNNs. We systematically
define the threat models and propose three node-level membership inference
attacks based on an adversary's background knowledge. Our evaluation on three
GNN structures and four benchmark datasets shows that GNNs are vulnerable to
node-level membership inference even when the adversary has minimal background
knowledge. Besides, we show that graph density and feature similarity have a
major impact on the attack's success. We further investigate two defense
mechanisms and the empirical results indicate that these defenses can reduce
the attack performance but with moderate utility loss.
