ML Security PapersInference Attacks Against Graph Generative Diffusion Models
Xiuling Wang 1, Xin Huang 1, Guibo Luo 2, Jianliang Xu 1
Published on arXiv
2601.03701
Model Inversion Attack
OWASP ML Top 10 — ML03
Membership Inference Attack
OWASP ML Top 10 — ML04
Key Finding
All three attack types significantly outperform baseline approaches across three types of graph generative diffusion models and six real-world graph datasets in a black-box setting.
GRA/PIA/MIA (Graph Reconstruction, Property Inference, Membership Inference Attacks)
Novel technique introduced
Graph generative diffusion models have recently emerged as a powerful paradigm for generating complex graph structures, effectively capturing intricate dependencies and relationships within graph data. However, the privacy risks associated with these models remain largely unexplored. In this paper, we investigate information leakage in such models through three types of black-box inference attacks. First, we design a graph reconstruction attack, which can reconstruct graphs structurally similar to those training graphs from the generated graphs. Second, we propose a property inference attack to infer the properties of the training graphs, such as the average graph density and the distribution of densities, from the generated graphs. Third, we develop two membership inference attacks to determine whether a given graph is present in the training set. Extensive experiments on three different types of graph generative diffusion models and six real-world graphs demonstrate the effectiveness of these attacks, significantly outperforming the baseline approaches. Finally, we propose two defense mechanisms that mitigate these inference attacks and achieve a better trade-off between defense strength and target model utility than existing methods. Our code is available at https://zenodo.org/records/17946102.
Key Contributions
- Graph reconstruction attack that recovers structurally similar training graphs from generated graph outputs of diffusion models
- Property inference attack inferring training graph statistics (average density, density distribution) from generated graphs
- Two membership inference attacks for graph generative diffusion models, plus two defense mechanisms achieving better utility-privacy trade-offs than baselines
🛡️ Threat Analysis
The graph reconstruction attack reconstructs training graphs structurally similar to the private training data from model outputs — direct training data reconstruction. The property inference attack recovers statistical properties (density distribution) of training graphs, also fitting ML03's scope of recovering private training data characteristics from a trained generative model.
The paper explicitly develops two membership inference attacks to determine whether a specific graph was present in the training set — textbook ML04 applied to graph generative diffusion models.