Aug 2026· Proceedings of the 32nd ACM SIGKDD Conference on Knowledge Discovery and Data Mining V.2· 0 citations· 47 references
Computer Science
TL;DR
This work proposes GraphRP (Graph Reprogramming Protection), a proactive defense framework that repurposes Model Reprogramming for security, and proves a lower bound on the attacker's estimation error that increases with the structural sensitivity of the reprogramming noise.
Abstract
Graph Neural Networks (GNNs) serve as the backbone for high-stakes applications in Machine-Learning-as-a-Service (MLaaS). Still, their black-box deployment exposes them to Model Extraction (ME) attacks, in which adversaries steal intellectual property by querying APIs. Existing defenses suffer from a critical ''Euclidean bias'': they transfer image-based strategies (e.g., random noise) to graphs, ignoring the complex topological dependencies between nodes, which often results in severe utility degradation. Passive methods like watermarking also fail to prevent theft in real time. To bridge this gap, we propose GraphRP (Graph Reprogramming Protection), a proactive defense framework that repurposes Model Reprogramming for security. Unlike static perturbations, GraphRP introduces a Structure-Aware Gating Mechanism driven by learnable topological prototypes. This creates a dynamic ''structural firewall'' that selectively modulates the model's decision boundary: it preserves fidelity for benign queries residing on the training manifold, while maximizing the Fisher Information along the perturbation direction for adversarial queries. Under standard assumptions (bounded loss, optimal attacker, and local second-order approximation), we prove a lower bound on the attacker's estimation error that increases with the structural sensitivity of the reprogramming noise. Extensive experiments on both hard-label and soft-label ME attacks demonstrate that GraphRP significantly degrades attack effectiveness while preserving benign utility.
This research introduces a new graph adversarial attack protection approach termed evolutionary algorithm integration of neighbor importance estimate to tackle this issue and attains notably superior performance in comparison to alternative defense methodologies.
Hong Pan, Jingwei Guo, Liang Cheng et al.· International Journal of Mac...· 0 citations
Advanced Persistent Threats (APTs) increasingly employ “Living-off-the-Land” techniques, rendering traditional signature-based detection ineffective. While query-based threat hunting using system provenance graphs provides essential behavioral context, existing approaches, specifically Graph Neural Network (GNN) based methods, can suffer from a critical vulnerability to structural mimicry, where benign administrative tasks topologically resemble malicious campaigns. Large Language Models (LLMs) offer the deep semantic reasoning required to resolve this ambiguity, but applying them to raw enterprise logs is constrained by prohibitive latency, limited context, and data privacy constraints. In this paper, we propose a novel neuro-symbolic framework that bridges this gap via a highly efficient two-stage cascade architecture. First, a self-supervised contrastive Graph Isomorphism Network with Edge features (GINE) acts as a high-recall structural filter. Trained on a curated dataset of just 24,000 subgraphs, which is much smaller than those used by existing supervised learning-based approaches, our encoder learns robust representations resilient to graph noise and successfully eliminates 87% to over 99% of the benign structural mimics in our curated test sets. Second, the reduced candidate set is processed by a localized LLM utilizing deterministic artifact matching and constrained Chain-of-Thought (CoT) behavioral matching for semantic reasoning. Evaluated across diverse operating systems (Windows, Linux, FreeBSD) using our curated test sets from the DARPA TC3 and OpTC datasets, our framework achieves superior precision and F1-scores as compared to existing baseline systems. By combining the data efficiency of contrastive GNNs with the semantic depth of localized LLMs, we provide a scalable, highly accurate, and efficient threat-hunting solution.
Ali Shoukat, Rubina Akter, Hadis Karimipour et al.· IEEE Access· 0 citations
Large language models (LLMs) have recently advanced graph neural networks (GNNs) by enriching node representations with semantic information, giving rise to LLM-enhanced GNNs that achieve substantial performance gains. However, their vulnerability to privacy attacks, in which adversaries infer sensitive information from model outputs, remains largely underexplored. To bridge this gap, we present a systematic evaluation of privacy risks in LLM-enhanced GNNs through a unified framework consisting of five stages: (1) dataset preparation, (2) victim model training, (3) privacy attack, (4) risk assessment, and (5) defense analysis. Specifically, we conduct experiments on six real-world text-attributed graph datasets covering diverse domains. We consider six representative privacy attack methods targeting three fundamental threats, namely link, label, and membership inference, and construct 42 victim model configurations by combining multiple LLM-based feature enhancers with representative GNN backbones. Extensive experiments show that, despite their utility improvements, LLM-enhanced GNNs consistently exhibit increased vulnerability to privacy attacks compared to shallow text representation baselines. Further analysis reveals that semantic enrichment amplifies link-, label-, and membership-related signals in the embedding space, making them more exploitable by inference attacks. Finally, we evaluate differential privacy as a defense strategy and show that, while it can partially mitigate privacy risks, it introduces significant utility degradation, highlighting a fundamental privacy-utility trade-off in LLM-enhanced graph learning. Overall, this work provides a comprehensive understanding of privacy risks in LLM-enhanced GNNs and offers practical insights for developing more secure and trustworthy graph learning systems.
Longzhu He, Zekun Wen, Chaozhuo Li et al.· 0 citations
Background. The research investigates how data poisoning attacks during fine-tuning stages make modern neural networks extremely vulnerable to attacks. The industry now focuses on domain-specific datasets, which attackers use to create unequal market advantages through their ability to hide backdoors with minimal changes to data. The current protection methods fail to provide proper security because they cause major memory loss of essential information, while attackers can bypass their protection mechanisms by using complex semantic attacks against systems which operate in decentralized federated learning environments. The research develops a multi-loop protection system which protects the latent feature space through mathematical validation. The proposed method combines neural network retraining with reverse analysis of synaptic weight changes to detect compromised neurons at a high level of precision, which does not affect the model's performance when working with unaltered data. The research bases its theoretical structure on the concept which protects distributed infrastructures through multiple layers of defense. The system uses local stochastic filtering operations which run on client devices through DP-SGD differential privacy mechanisms before servers perform semantic auditing with explainable artificial intelligence (XAI) for protection. This is then followed by smart contract-based cryptographic verification of update processes. The experimental data shows the results of the study. The developed architecture shows strong performance through empirical testing, which used benchmark architectures that included convolutional neural networks (CNNs) and large language models (LLMs) for critical application systems. The proposed multi-loop filter implementation enables the Attack Success Rate to achieve a zero limit, while it maintains the model's ability to predict correctly for legitimate data. Research conclusions. The results obtained from a robust theoretical and algorithmic foundation for the transition from reactive anomaly detection methods to proactive topological protection of intelligent systems. The developed methodology guarantees the structural integrity of neural network models when transfer learning is applied in high-risk domains.
Oleksandr Kushnerov, S. Yevseiev, D. Tymofieiev et al.· Advanced Information Systems· 0 citations
This research addresses cyber risk by defending against backdoor attacks on Graph Neural Networks (GNNs). We propose the Explainable Complex System-Mitigation Triangular (ECSMT) Framework, which integrates Robust Training, Graph Regularization, and Data Sanitization into a lightweight, hardware-efficient defense layer. To evaluate structural generalizability, we conducted empirical evaluations across three distinct benchmark domains (AIDS, MUTAG, and PROTEINS) using a Graph Isomorphism Network (GIN) backbone. Under a baseline 5% backdoor subgraph trigger injection ratio, ECSMT achieves excellent utility retention, securing a Clean Accuracy (CA) of 97.33% (±0.62%) while reducing the Attack Success Rate (ASR) from 97.00% down to 69.45% on the primary AIDS benchmark. Cross-domain testing reveals that defensive efficacy is strongly constrained by dataset characteristics: small-scale datasets such as MUTAG suffer from persistent trigger concentration, while complex graph manifolds such as PROTEINS exhibit high levels of topological noise. Furthermore, mapping these technical outcomes into an enterprise asset framework yields a 61% expenditure compression at critical technological feeder locations and a 98.93% reduction in total systemic loss. This study indicates that the proposed triangular mitigation strategy offers a valuable, scalable blueprint for enhancing the technical resilience and prognostic economic modeling of critical infrastructure networks.
Sabah Ettahri, Sergio Pallas Enguita, Chung-Hao Chen et al.· Electronics· 0 citations
By integrating temporal graph construction, adversarial augmentation, and GCN classification, GraphGAN effectively models coordinated attack behaviors and mitigates class imbalance, providing a robust and topology-aware solution for intrusion detection in data-constrained environments.
Mohammad Arif Hossain, Yeahia Sarker, Md Jafrin Hossain et al.· 0 citations