Robust GNN Watermarking via Implicit Perception of Topological Invariants

Jipeng Li; Yanning Shen

cs.LGOct 29, 2025

Robust GNN Watermarking via Implicit Perception of Topological Invariants

Authors: Jipeng Li, Yanning Shen

Organizations: Department of Electrical and Computer Engineering, University of California, Davis, Davis, CA 95616, USA · Department of Electrical Engineering and Computer Science, University of California, Irvine, Irvine, CA 92697, USA

Abstract

Graph Neural Networks (GNNs) represent valuable intellectual property, yet watermarks based on out-of-distribution triggers can weaken under pruning, fine-tuning, and distillation. We present InvGNN-WM, which links ownership verification to graph-invariant prediction. By supervising a shared GNN backbone to predict normalized algebraic connectivity on owner-private carrier graphs, InvGNN-WM enables calibrated multi-bit black-box verification through either an auxiliary scalar endpoint or a fixed owner-side decoder of ordinary task logits. We provide conditional guarantees for task-loss control, decision preservation, and key separation, and prove NP-completeness of the exact-removal decision problem for a restricted class of monotone separable decoders. Experiments on node- and graph-classification benchmarks demonstrate high watermark fidelity with small changes in task performance. The task-logit deployment achieves higher detection rates than PreGIP-adapted in matched comparisons and retains detection under the evaluated extraction and retraining budgets. Watermark-assisted distillation further enables owner-side recovery using private verification material.

Figures & tables

Variant	WM-ACC	Probe $R^{2}$	Fresh-head WM-ACC
Full InvGNN-WM	$89.8\pm 0.0$	$0.61\pm 0.04$	$79.2\pm 1.1$
Stop-gradient	$86.7\pm 0.0$	$0.28\pm 0.05$	$60.2\pm 0.0$
Separate WM encoder	$94.3\pm 1.1$	$0.24\pm 0.04$	$56.3\pm 0.0$
Task-only	$50.0\pm 0.0$	$0.25\pm 0.04$	$58.6\pm 0.0$

Table 1: Shared-backbone information on PROTEINS–GIN. A fresh frozen-backbone readout predicts the normalized invariant on pseudo-carriers and decodes held-out owner carriers. Both WM accuracies are percentages.

Dataset–backbone	Method	Task ACC	AUROC	TPR: clean / FT-100 / KD
PROTEINS–GIN	PreGIP-adapted	$72.2\pm 2.4$	0.989	0.84 / 0.76 / 0.61
	InvGNN-WM, auxiliary	$72.5\pm 2.6$	0.998	0.99 / 0.88 / –
	InvGNN-WM, task-logit	$72.3\pm 2.3$	0.997	0.98 / 0.92 / 0.74
NCI1–GIN	PreGIP-adapted	$77.9\pm 1.6$	0.993	0.90 / 0.83 / 0.67
	InvGNN-WM, auxiliary	$78.3\pm 1.6$	0.999	1.00 / 0.96 / –
	InvGNN-WM, task-logit	$78.0\pm 1.6$	0.999	1.00 / 0.97 / 0.82

Table 2: Matched supervised comparison. Task ACC (%), detection AUROC, and TPR at

\alpha=10^{-6}

with separately calibrated detectors and a common 128-query budget. TPR uses 300 independent owner instances per row; Appendix R.8 gives Wilson TPR and bootstrap AUROC CIs. FT-100 uses 100 clean-task epochs. A dash denotes an unavailable scalar-endpoint audit after output-only KD.

Interface	Attack	Task ACC (%)	WM-ACC (%)	Match count $T$
Auxiliary	None	$72.5\pm 2.6$	$89.8\pm 0.0$	$115\pm 0$
	Literal endpoint deletion	$72.5\pm 2.6$	Unavailable
	Random head reset	72.5	49.2	63
	Head-only randomization, 100 epochs	72.4	51.6	66
	Pseudo-carrier attack	$72.1\pm 2.7$	$78.4\pm 1.1$	100
	Output-only KD, 100 epochs	72.1	Unavailable

Table 3: Stronger attacks on PROTEINS–GIN. Both interfaces use

m=128

\tau=94

, and seeds

41/42/43

. Entries without intervals are three-seed means; match counts are rounded means. “Unavailable” denotes an absent scalar endpoint. Mean counts alone do not establish individual-seed pass rates.

Backbone	Method	Task ROC-AUC (%)	WM-ACC / TPR	Train (min)	Memory (GB)	Audit (ms)
GIN	Task-only	$76.2\pm 0.7$	–	37.3	4.8	–
GIN	Task-logit	$75.9\pm 0.7$	88.3 / 0.96	42.8	5.3	81
GPS	Task-only	$77.4\pm 0.6$	–	66.3	9.1	–
GPS	Task-logit	$77.0\pm 0.6$	91.1 / 0.98	75.3	9.9	118

Table 4: OGBG-MOLHIV utility, detection, and per-run cost. Utility, WM-ACC, and costs use three seeds (100 epochs on one A100). TPR pools 300 independently trained watermarked models per backbone at

\alpha=10^{-6}

; Appendix R.5 gives its

95\%

Wilson CIs. WM-ACC is a percentage; memory is peak usage, and audit latency covers 128 queries.

Appendix figures & tables21 assets

Supplementary material from the paper’s appendix.

Appendix

Edit	Task ACC (%)	WM-ACC (%)
None	$72.5\pm 2.6$	$89.8\pm 0.0$
Pruning (40%)	$71.6\pm 2.8$	$92.4\pm 1.1$
Fine-tuning (20 epochs)	$73.1\pm 2.5$	$93.8\pm 3.4$
KD (temperature $2$ )	$72.0\pm 2.7$	$81.3\pm 0.0$
Quantization (4-bit)	$72.1\pm 2.7$	$90.4\pm 3.0$

Appendix

Table 5: Common-edit results on PROTEINS–GIN (mean

\pm

95% CI over three seeds). These are the InvGNN-WM results from the cross-method comparison in Table 9 . The KD row evaluates a callable scalar audit path; output-only extraction with no such endpoint is evaluated separately in Table 3 .

Figure 1: WM-ACC vs. invariant perturbation. Carriers are perturbed with increasing $\Delta\tilde{\lambda}_{2}$ ; marker colors and shapes indicate whether the invariant is (i) preserved, (ii) marginal, or (iii) broken. Observation. WM-ACC is high when $\tilde{\lambda}_{2}$ is preserved and decreases under larger invariant perturbations; the strongest plotted perturbations yield WM-ACC below $50\%$ . Scope. The plot describes the evaluated perturbations to carrier graphs; it does not establish robustness to arbitrary parameter edits or endpoint deletion.

Figure 2: Score-feedback search proxy ( $m{=}128$ , target $\alpha{=}10^{-6}$ ). The strategies are random search, best-score mutation, and score-threshold search. Whiskers show the reported $95\%$ hierarchical-bootstrap intervals for repeated attempts. Observation. Across the two plotted nominal budgets, success rates are higher at the larger budget, and the score-guided heuristic has the highest reported rate at both. Scope. These outcomes describe a proxy with privileged owner-carrier score feedback; the horizontal axis is a search-budget parameter, not a count of fresh black-box model calls.

$m$	$\varepsilon_{\mathrm{err}}$	$\tau$	Match count $T$	$T-\tau$
64	0.171	54	$59\pm 4$	$+5$
96	0.231	74	$88\pm 3$	$+14$
128	0.267	94	$115\pm 3$	$+21$
192	0.310	133	$174\pm 2$	$+41$

Appendix

Table 6: Carrier-count diagnostic on PROTEINS–GIN. Owner match counts are means with two-sided

95\%

Student

t

CIs across seeds

41/42/43

. Means, CI half-widths, and gaps are rounded separately to integers. Thresholds and gaps use the stated rule at a common

\alpha=10^{-6}

and

\widehat{c}_{\mathrm{dep}}=4(7.6\times 10^{-4})

Swap cap	KS $\delta$	Task ACC (%)	WM-ACC (%)	$\hat{\rho}_{0}$	Measured $\alpha$ ( $10^{7}$ trials)
5	0.05	72.6 $\pm$ 2.6	88.0 $\pm$ 12.3	$9.1\times 10^{-4}$	$<10^{-6}$
25	0.10	72.5 $\pm$ 2.6	89.6 $\pm$ 1.1	$8.2\times 10^{-4}$	$<10^{-7}$
50	0.10	72.5 $\pm$ 2.6	89.8 $\pm$ 0.0	$7.6\times 10^{-4}$	$<10^{-7}$
50	0.20	72.4 $\pm$ 2.7	89.1 $\pm$ 0.0	$7.1\times 10^{-4}$	$<10^{-7}$

Appendix

Table 7: Carrier generation thresholds (PROTEINS–GIN).

Method	Task ACC (%)	WM-ACC (%)	$\kappa_{\mathrm{marg}}$	Time / carrier (ms)
Exact eigensolver	$72.5\pm 2.6$	$89.8\pm 0.0$	$0.382$	$0.08$
Iterative approximation ( $K=10$ )	$72.4\pm 2.7$	$88.8\pm 1.1$	$0.371$	$0.05$

Appendix

Table 8: Exact vs. approximate computation of

\lambda_{2}

on PROTEINS–GIN. All runs use the same carriers and backbone.

Dataset–Backbone	Edit	Metric	TRIG	NAT	EXPL	InvGNN-WM
Cora–GCN	None	Task	$86.8\pm 0.9$	$86.9\pm 0.9$	$86.7\pm 1.0$	$87.0\pm 0.8$
	None	W-A	$97.7\pm 3.4$	$96.4\pm 1.1$	$93.0\pm 0.0$	$99.0\pm 1.1$
	Pruning 40%	Task	$85.9\pm 1.2$	$86.0\pm 1.2$	$85.5\pm 1.3$	$86.4\pm 1.0$
	Pruning 40%	W-A	$93.8\pm 0.0$	$92.7\pm 1.1$	$88.3\pm 0.0$	$97.1\pm 3.0$
	Fine-tuning	Task	$87.1\pm 0.9$	$87.2\pm 0.9$	$86.9\pm 1.1$	$87.3\pm 0.8$
	Fine-tuning	W-A	$96.9\pm 0.0$	$95.3\pm 0.0$	$91.9\pm 6.2$	$98.2\pm 1.1$

Appendix

Table 9: Robustness of watermarking methods under common edits. For each dataset–backbone and edit, two rows report test Task ACC (%) and carrier WM-ACC (%), abbreviated as W-A (mean

\pm

95% CI over three seeds). The InvGNN-WM results on PROTEINS–GIN are also summarized in Table 5 .

Method	Before adaptive attack		After adaptive attack
Method	Task ACC	WM-ACC	Task ACC	WM-ACC
TRIG	$72.8\pm 2.6$	$95.1\pm 3.0$	$72.0\pm 2.7$	$61.5\pm 1.1$
NAT	$72.6\pm 2.7$	$94.8\pm 1.1$	$71.9\pm 2.8$	$58.6\pm 0.0$
EXPL	$72.4\pm 2.8$	$90.6\pm 0.0$	$71.7\pm 2.9$	$55.2\pm 1.1$
InvGNN-WM	$72.5\pm 2.6$	$89.8\pm 0.0$	$72.1\pm 2.7$	$78.4\pm 1.1$

Appendix

Table 10: Watermark-aware adaptive attack on PROTEINS–GIN. For each watermarking method we report test Task ACC (%) and WM-ACC (%) before and after the adaptive attack.

Model	ACC (%)	Prec (%)	Rec (%)
GCN classifier	$51.3$	$52.1$	$50.2$

Appendix

Table 11: Carrier vs. non-carrier detection on PROTEINS–GIN. The table reports test accuracy (ACC), precision (Prec), and recall (Rec) for the carrier class on the binary classification task described in Section N.3 .

$\tau^{\prime}$	$\alpha(\tau^{\prime})$	$\beta_{\mathrm{fn}}(\tau^{\prime})$
$\tau^{\ast}-2=92$	$7.8\times 10^{-5}$	$0.000$
$\tau^{\ast}-1=93$	$1.6\times 10^{-5}$	$0.000$
$\tau^{\ast}=94$	$6.0\times 10^{-8}$	$0.000$
$\tau^{\ast}+1=95$	$3.0\times 10^{-8}$	$3.5\times 10^{-3}$
$\tau^{\ast}+2=96$	$1.0\times 10^{-8}$	$1.1\times 10^{-2}$

Appendix

Table 12: Threshold-sweep point estimates for the PROTEINS–GIN auxiliary-head detector. The positive checkpoint pool comprises Clean and FT20 conditions. The entries are diagnostic estimates, not confidence intervals or condition-specific success guarantees.

Invariant	Task ACC (%)	WM-ACC (%)	$\kappa_{\mathrm{marg}}$
$\tilde{\lambda}_{2}$ (ours)	$72.5\pm 2.6$	$89.8\pm 0.0$	$0.382$
Spectral radius (normalized)	$72.1\pm 2.7$	$87.5\pm 0.0$	$0.351$
Triangle count (normalized)	$71.9\pm 2.8$	$84.4\pm 0.0$	$0.315$

Appendix

Table 13: Invariant choice on PROTEINS–GIN (same carriers/backbone). Each row reports Task ACC, WM-ACC, and robustness margin

\kappa_{\mathrm{marg}}

Dataset–Backbone	SS	COS	TRIG	NAT	EXPL	OURS
Cora GCN	87.2 $\pm$ 0.8 49.5 $\pm$ 1.1	85.5 $\pm$ 1.2 86.2 $\pm$ 1.1	86.8 $\pm$ 0.9 97.7 $\pm$ 3.4	86.9 $\pm$ 0.9 96.4 $\pm$ 1.1	86.7 $\pm$ 1.0 93.0 $\pm$ 0.0	87.0 $\pm$ 0.8 99.0 $\pm$ 1.1
Cora GraphSAGE	84.0 $\pm$ 1.0 50.0 $\pm$ 0.0	82.1 $\pm$ 1.5 83.9 $\pm$ 1.1	83.9 $\pm$ 1.1 97.1 $\pm$ 1.1	83.8 $\pm$ 1.2 96.9 $\pm$ 0.0	83.7 $\pm$ 1.1 92.4 $\pm$ 1.1	83.8 $\pm$ 1.0 98.4 $\pm$ 3.4
Cora SGC	87.0 $\pm$ 0.9 51.3 $\pm$ 1.1	85.2 $\pm$ 1.3 85.9 $\pm$ 0.0	86.5 $\pm$ 1.0 96.9 $\pm$ 0.0	86.6 $\pm$ 1.0 96.4 $\pm$ 1.1	86.7 $\pm$ 1.1 92.7 $\pm$ 1.1	86.2 $\pm$ 1.0 98.7 $\pm$ 1.1
PubMed GCN	88.6 $\pm$ 0.9 49.7 $\pm$ 4.5	86.4 $\pm$ 1.4 87.5 $\pm$ 0.0	87.9 $\pm$ 1.0 96.9 $\pm$ 0.0	87.8 $\pm$ 1.1 96.6 $\pm$ 1.1	85.7 $\pm$ 1.5 94.3 $\pm$ 10.7	88.1 $\pm$ 1.0 98.7 $\pm$ 1.1
PubMed GraphSAGE	91.2 $\pm$ 0.8 51.3 $\pm$ 1.1	89.0 $\pm$ 1.0 88.0 $\pm$ 12.3	90.1 $\pm$ 0.8 96.4 $\pm$ 1.1	90.0 $\pm$ 0.9 96.1 $\pm$ 0.0	91.3 $\pm$ 0.9 94.0 $\pm$ 1.1	90.7 $\pm$ 0.8 98.2 $\pm$ 1.1
PubMed SGC	88.8 $\pm$ 0.9 50.3 $\pm$ 1.1	86.7 $\pm$ 1.3 87.0 $\pm$ 1.1	88.1 $\pm$ 1.0 96.9 $\pm$ 0.0	88.0 $\pm$ 1.1 96.4 $\pm$ 1.1	85.3 $\pm$ 1.6 93.8 $\pm$ 0.0	87.7 $\pm$ 1.1 98.7 $\pm$ 1.1

Appendix

Table 14: Full comparison (node-level datasets). Each cell shows test Task ACC (%) on the first line and WM-ACC on private carriers (%) on the second line (mean

\pm

95% CI; three seeds). Best Task ACC per row excluding SS is in bold ; the best WM-ACC per row is teal bold.

Method	PROTEINS–GIN	PROTEINS–GraphSAGE	NCI1–GIN	NCI1–GraphSAGE
SS	73.1 $\pm$ 2.5 W-A: 50.0 $\pm$ 0.0	72.8 $\pm$ 2.6 W-A: 51.0 $\pm$ 3.0	78.7 $\pm$ 1.5 W-A: 50.5 $\pm$ 1.1	75.5 $\pm$ 1.8 W-A: 49.5 $\pm$ 1.1
COS	71.0 $\pm$ 3.0 W-A: 82.0 $\pm$ 0.0	70.5 $\pm$ 3.1 W-A: 81.5 $\pm$ 1.1	76.2 $\pm$ 2.1 W-A: 83.6 $\pm$ 0.0	73.1 $\pm$ 2.4 W-A: 84.1 $\pm$ 1.1
TRIG	72.8 $\pm$ 2.6 W-A: 95.1 $\pm$ 3.0	71.9 $\pm$ 2.8 W-A: 94.5 $\pm$ 0.0	77.8 $\pm$ 1.8 W-A: 94.8 $\pm$ 1.1	74.8 $\pm$ 2.0 W-A: 97.4 $\pm$ 1.1
NAT	72.6 $\pm$ 2.7 W-A: 94.8 $\pm$ 1.1	71.8 $\pm$ 2.9 W-A: 94.0 $\pm$ 1.1	77.6 $\pm$ 1.9 W-A: 94.3 $\pm$ 1.1	74.7 $\pm$ 2.1 W-A: 96.9 $\pm$ 0.0
EXPL	72.4 $\pm$ 2.8 W-A: 90.6 $\pm$ 0.0	71.7 $\pm$ 3.0 W-A: 89.8 $\pm$ 0.0	77.9 $\pm$ 1.9 W-A: 91.4 $\pm$ 0.0	74.9 $\pm$ 2.0 W-A: 92.2 $\pm$ 0.0
OURS	72.5 $\pm$ 2.6 W-A: 89.8 $\pm$ 0.0	72.6 $\pm$ 2.6 W-A: 95.8 $\pm$ 4.5	78.3 $\pm$ 1.6 W-A: 97.7 $\pm$ 0.0	75.2 $\pm$ 1.8 W-A: 98.2 $\pm$ 1.1

Appendix

Table 15: Full comparison (graph-level datasets; transposed). Each cell shows test Task ACC (%) on the first line and WM-ACC on private carriers (%), abbreviated as W-A , on the second (mean

\pm

95% CI; three seeds). Best Task ACC per column excluding SS is in bold ; the best WM-ACC per column is teal bold.

Dataset–Backbone	SS	COS	TRIG	NAT	EXPL	OURS
Cora–GCN	87.2 $\pm$ 0.8 W-A: 49.5 $\pm$ 1.1	85.5 $\pm$ 1.2 W-A: 86.2 $\pm$ 1.1	86.8 $\pm$ 0.9 W-A: 97.7 $\pm$ 3.4	86.9 $\pm$ 0.9 W-A: 96.4 $\pm$ 1.1	86.7 $\pm$ 1.0 W-A: 93.0 $\pm$ 0.0	87.0 $\pm$ 0.8 W-A: 99.0 $\pm$ 1.1
PubMed–GCN	88.6 $\pm$ 0.9 W-A: 49.7 $\pm$ 4.5	86.4 $\pm$ 1.4 W-A: 87.5 $\pm$ 0.0	87.9 $\pm$ 1.0 W-A: 96.9 $\pm$ 0.0	87.8 $\pm$ 1.1 W-A: 96.6 $\pm$ 1.1	85.7 $\pm$ 1.5 W-A: 94.3 $\pm$ 10.7	88.1 $\pm$ 1.0 W-A: 98.7 $\pm$ 1.1
AmazonPhoto–GCN	91.3 $\pm$ 0.6 W-A: 49.2 $\pm$ 0.0	89.5 $\pm$ 1.1 W-A: 88.3 $\pm$ 0.0	90.8 $\pm$ 0.7 W-A: 97.9 $\pm$ 1.1	90.7 $\pm$ 0.8 W-A: 97.4 $\pm$ 1.1	90.9 $\pm$ 0.8 W-A: 94.8 $\pm$ 1.1	91.1 $\pm$ 0.6 W-A: 99.2 $\pm$ 0.0
PROTEINS–GIN	73.1 $\pm$ 2.5 W-A: 50.0 $\pm$ 0.0	71.0 $\pm$ 3.0 W-A: 82.0 $\pm$ 0.0	72.8 $\pm$ 2.6 W-A: 95.1 $\pm$ 3.0	72.6 $\pm$ 2.7 W-A: 94.8 $\pm$ 1.1	72.4 $\pm$ 2.8 W-A: 90.6 $\pm$ 0.0	72.5 $\pm$ 2.6 W-A: 89.8 $\pm$ 0.0
NCI1–GIN	78.7 $\pm$ 1.5 W-A: 50.5 $\pm$ 1.1	76.2 $\pm$ 2.1 W-A: 83.6 $\pm$ 0.0	77.8 $\pm$ 1.8 W-A: 94.8 $\pm$ 1.1	77.6 $\pm$ 1.9 W-A: 94.3 $\pm$ 1.1	77.9 $\pm$ 1.9 W-A: 91.4 $\pm$ 0.0	78.3 $\pm$ 1.6 W-A: 97.7 $\pm$ 0.0

Appendix

Table 16: Benchmark comparison (representative backbones). Each cell shows test Task ACC (%) on the first line and WM-ACC on private carriers (%), abbreviated as W-A on the second line (mean

\pm

95% CI; three seeds). Best Task ACC per row excluding SS is in bold ; the best WM-ACC per row is teal bold. Full results for all dataset–backbone settings are in Appendix Q .

Figure 3: Common-edit watermark accuracy on PROTEINS–GIN. Points and error bars show the four edited conditions in Table 5 , using the same means and nominal 95% Student

t

intervals as the cross-method comparison. The dashed line is the threshold-equivalent reference

\tau/m=73.4375\%

; all three seeds pass each displayed edit.

Dataset–backbone	Match count $T$	Threshold $\tau^{\ast}$	Mean gap
PROTEINS–GIN	$115\pm 0$	94	$+21$
NCI1–GIN	$125\pm 0$	94	$+31$
Cora–GCN	$127\pm 1$	94	$+33$

Appendix

Table 17: Match-count diagnostic. Means, count-CI half-widths, and gaps are rounded to integers. The pooled-null threshold is

\tau^{\ast}=94

. In

10^{7}

null trials no false positives were observed; the zero-event resolution is

10^{-7}

. This observation is not a population upper confidence bound.

Layers / Res. / epochs / $\bar{\beta}$	$\widehat{\mu}_{\mathrm{PL}}$	Ratio	Bound	$\Delta\mathcal{L}_{\mathrm{task}}$	Task / WM-ACC
4 / no / 100 / 0.8	0.42	0.61	0.0128	0.009	72.5 / 89.8
8 / no / 100 / 0.8	0.16	1.09	–	0.026	70.9 / 85.2
8 / yes / 100 / 0.8	0.30	0.78	0.0128	0.012	72.0 / 88.5
4 / yes / 300 / 0.8	0.31	1.02	–	0.018	71.7 / 84.9
4 / yes / 100 / 2.0	0.39	1.34	–	0.061	69.8 / 96.1

Appendix

Table 18: PL-sensitivity on PROTEINS–GIN. “Res.” denotes residual connections. The final column gives Task ACC / WM-ACC (%). “Bound” is a plug-in reference value; a dash denotes a setting outside the reported local regime, not a zero observed loss change.

Construction	Carrier-vs-task ACC (%)	Key balance $p$	Empirical FPR	Time (s)
Full WL + local KS + spectral KS	51.3	0.49	$<10^{-7}$	52.4
Without WL	54.9	0.50	$2.4\times 10^{-7}$	35.4
Without degree/clustering KS	69.8	0.57	$1.8\times 10^{-5}$	21.7
Without spectral-radius KS	60.7	0.55	$4.6\times 10^{-6}$	28.9
Erdos–Renyi carriers	99.1	0.79	$8.4\times 10^{-2}$	1.4
Full protocol without size cap	52.6	0.50	$<10^{-7}$	176.3

Appendix

Table 19: Carrier construction on PROTEINS–GIN. The

<10^{-7}

entries express finite-null display limits rather than population upper confidence bounds. The Erdos–Renyi row changes our carrier construction; it does not evaluate the security of PreGIP, which uses a different pair-consistency statistic.

Software / source record	Recorded version	Stated license
PyTorch	2.2.2	BSD-3-Clause
PyTorch Geometric	2.5.3	MIT
torch-scatter	2.1.2	MIT
torch-sparse	0.6.18	MIT
torch-cluster	1.6.3	MIT
torch-spline-conv	1.2.2	MIT

Appendix

Table 20: Recorded software assets and upstream licenses. Versions are those reported for the experimental environment; links identify the upstream release or versioned documentation. CUDA is subject to NVIDIA’s license agreement.

Dataset	Method	Clean	FT-100	KD
PROTEINS	PreGIP-adapted	$252/300$ $[0.7943,0.8771]$	$228/300$ $[0.7086,0.8048]$	$183/300$ $[0.5537,0.6635]$
	InvGNN-WM, auxiliary	$297/300$ $[0.9710,0.9966]$	$264/300$ $[0.8383,0.9120]$	–
	InvGNN-WM, task-logit	$294/300$ $[0.9571,0.9908]$	$276/300$ $[0.8837,0.9457]$	$222/300$ $[0.6876,0.7864]$
NCI1	PreGIP-adapted	$270/300$ $[0.8608,0.9291]$	$249/300$ $[0.7834,0.8683]$	$201/300$ $[0.6149,0.7208]$
	InvGNN-WM, auxiliary	$300/300$ $[0.9874,1.0000]$	$288/300$ $[0.9314,0.9770]$	–
	InvGNN-WM, task-logit	$300/300$ $[0.9874,1.0000]$	$291/300$ $[0.9440,0.9841]$	$246/300$ $[0.7726,0.8593]$

Appendix

Table 21: Pooled TPR counts and Wilson intervals for Table 2 . Each cell gives

K/300

on the first line and its two-sided

95\%

Wilson interval on the second. All backbones are GIN. A dash denotes an unavailable audit.

Dataset	Method	AUROC	$95\%$ CI
PROTEINS	PreGIP-adapted	$0.989$	$[0.9828,0.9946]$
	InvGNN-WM, auxiliary	$0.998$	$[0.9950,1.0000]$
	InvGNN-WM, task-logit	$0.997$	$[0.9916,1.0000]$
NCI1	PreGIP-adapted	$0.993$	$[0.9883,0.9972]$
	InvGNN-WM, auxiliary	$0.999$	$[0.9955,1.0000]$
	InvGNN-WM, task-logit	$0.999$	$[0.9956,1.0000]$

Appendix

Table 22: Clean detection AUROC and

95\%

intervals for Table 2 . All backbones are GIN. Intervals use the hierarchical paired-owner percentile bootstrap with 2,000 replicates.

Robust Watermarking

Robust watermarking embeds or verifies ownership and provenance signals that survive editing, compression, model changes, and deliberate removal.

See all 207 papers

Sep 4, 2026

A Robust Watermark-based Fingerprint Framework for GNNs Ownership Verification

The high training cost of Graph Neural Networks (GNNs) has raised growing concerns regarding model ownership infringement, such as model stealing and unauthorized misuse. To verify model ownership and prevent significant economic losses, two groups of GNN Ownership Verification (OV) methods have been proposed: watermark-based methods and fingerprint-based methods. However, these methods typically face three limitations: (1) the performance degradation of protected models caused by out-of-distribution (OOD) watermark graphs with respect to the training set; (2) the unrealistic assumption that surrogate models have been trained on a watermark-containing training set; and (3) over-reliance on specific output levels for fingerprint extraction. In this paper, we propose a Robust watErMArk-based fingeRprint frameworK for GNNs, named REMARK. REMARK first generates carefully crafted in-distribution watermark graphs that maximize output differences between GNN models, thus mitigating OOD-induced performance degradation. REMARK then extracts robust fingerprints from these output differences to verify GNN ownership, thereby removing the assumptions that surrogate models must be trained on a watermark-containing dataset or expose specific output levels. Extensive experiments across widely used real-world datasets and GNN architectures demonstrate that REMARK achieves state-of-the-art OV accuracy and robustness while preserving the utility of protected models.

Han Zhang, Yan Wang, Guanfeng Liu +3

Macquarie University, Sydney, Australia · Nanyang Technological University, Singapore

Graph Neural Networks Robust Watermarking

Ask PDF

May 6, 2026

COPYCOP: Ownership Verification for Graph Neural Networks

Given two GNNs that output node embeddings, how can we determine if they were trained independently? An adversary could have trained one GNN specifically to mimic the other GNN's embeddings. To obscure this relationship between the GNNs, the adversarial GNN might then transform its output embeddings. The two GNNs could have different architectures, weights, and embedding dimensions, and the adversary can transform the embeddings. Despite these stringent conditions, our algorithm (named CopyCop) can identify such copycat GNNs, unlike existing watermarking and fingerprinting methods. We also provide theoretical guarantees for CopyCop. Finally, experiments on 14 datasets and 5 GNN architectures demonstrate that CopyCop is accurate and robust against a broad class of adversarial attacks and transformations. Code is available at: https://anonymous.4open.science/r/CopyCop-Graph-Ownership-Verification-8143/README.md

Rahul Nandakumar, Deepayan Chakrabarti

McCombs School of Business University of Texas at Austin Austin, TX

Graph Neural Networks

Ask PDF

Jun 7, 2024

GENIE: Watermarking Graph Neural Networks for Link Prediction

The rapid adoption, usefulness, and resource-intensive training of Graph Neural Network (GNN) models have made them an invaluable intellectual property in graph-based machine learning. However, their wide-spread adoption also makes them susceptible to stealing, necessitating robust Ownership Demonstration (OD) techniques. Watermarking is a promising OD framework for deep neural networks, but existing methods fail to generalize to GNNs due to the non-Euclidean nature of graph data. Existing works on GNN watermarking primarily focus on node and graph classification, overlooking Link Prediction (LP). In this paper, we propose GENIE (watermarking Graph nEural Networks for lInk prEdiction), the first scheme to watermark GNNs for LP. GENIE creates a novel backdoor for both node-representation and subgraph-based LP methods, utilizing a unique trigger set and a secret watermark vector. Our OD scheme is equipped with Dynamic Watermark Thresholding (DWT), ensuring high verification probability while addressing practical issues in existing OD schemes. We extensively evaluate GENIE across 4 diverse model architectures (i.e., SEAL, GCN, GraphSAGE and NeoGNN), 7 real-world datasets and 21 watermark removal techniques and demonstrate its robustness to watermark removal and ownership piracy attacks. Finally, we discuss adaptive attacks against GENIE and a defense strategy to counter it. The codebase and related artifacts are publicly available at our Project Page.

Venkata Sai Pranav Bachina, Aaryan Ajay Sharma, Ankit Gangwal +1

IIIT Hyderabad, India

Graph Neural Networks Robust Watermarking

Ask PDF

Abstract

Robust Watermarking

Explore similar work

A Robust Watermark-based Fingerprint Framework for GNNs Ownership Verification

COPYCOP: Ownership Verification for Graph Neural Networks

GENIE: Watermarking Graph Neural Networks for Link Prediction