Graph-Fraudster: Adversarial Attacks on Graph Neural Network-Based Vertical Federated Learning

Abstract

Graph neural network (GNN) has captured wide attention due to its capability of graph representation learning for graph-structured data. However, the distributed data silos limit the performance of GNN. Vertical federated learning (VFL), an emerging technique to process distributed data, successfully makes GNN possible to handle the distributed graph-structured data. Despite the prosperous development of vertical federated graph learning (VFGL), the robustness of VFGL against the adversarial attack has not been explored yet. Although numerous adversarial attacks against centralized GNNs are proposed, their attack performance is challenged in the VFGL scenario. To the best of our knowledge, this is the first work to explore the adversarial attack against VFGL. A query-efficient hybrid adversarial attack framework is proposed to significantly improve the centralized adversarial attacks against VFGL, denoted as NA 2 , short for Neuron-based Adversarial Attack. Specifically, a malicious client manipulates its local training data to improve its contribution in a stealthy fashion. Then a shadow model is established based on the manipulated data to simulate the behavior of the server model in VFGL. As a result, the shadow model can improve the attack success rate of various centralized attacks with a few queries. Extensive experiments on five real-world benchmarks demonstrate that NA 2 improves the performance of the centralized adversarial attacks against VFGL, achieving state-of-the-art performance even under potential adaptive defense where the defender knows the attack method. Additionally, we provide interpretable experiments of the effectiveness of NA 2 via sensitive neurons identification and visualization of t-SNE. The code and datasets are available at https://github.com/hgh0545/NA2.

Federated Graph Neural Networks: Overview, Techniques, and Challenges

“…FedVGCN [97] transfers homomorphic encrypted intermediate results between two clients to complete node feature space with the semihonest server creating encryption key pairs and doing FL aggregation. Graph-Fraudster [98] studies the adversarial attacks on the local raw data and node embedding. It proves that the DP mechanism and top-k mechanism are two possible defenses to the attacks.…”

Vertical Federated Learning: Taxonomies, Threats, and Prospects

“…Security attacks demonstrated against VFL include backdoor attacks introduced during the training phase to compromise the integrity of the model [59], and adversarial example attacks occurred solely during the inference phase [60]. The active participant and passive participants have different levels of threats to the VFL due to their differing knowledge and control capabilities over the VFL.…”

“…Chen et al proposed an AE attack against graph VFL in the inference phase, namely graph fraudster [60]. Firstly, a malicious participant is randomly selected from all passive participants.…”

Exploring metadiscourse in university lectures in Hong Kong

“…FedGNN present a distributed machine learning paradigm that facilitates collaborative training of GNNs among multiple parties, ensuring the privacy of their sensitive data. In recent years, extensive research has been conducted on FedGNN, with a particular focus on addressing security concerns [15,16,17,18]. Among these concerns, poisoning attacks have garnered significant attention, encompassing both data poisoning attacks and model poisoning attacks.…”

“…Currently, the majority of attacks on FedGNN primarily concentrate on data poisoning attacks. Chen et al [15] proposed adversarial attacks on vertical federated learning, utilizing adversarial perturbations on global node embeddings based on gradient leakage from pairwise nodes. Additionally, Xu et al [16] investigated centralized and distributed backdoor attacks on FedGNN.…”