CITED: A Decision Boundary-Aware Signature for GNNs Towards Model Extraction Defense

Bolin Shen; Md Shamim Seraj; Zhan Cheng; Shayok Chakraborty; Yushun Dong

cs.LGFeb 23, 2026

CITED: A Decision Boundary-Aware Signature for GNNs Towards Model Extraction Defense

Authors: Bolin Shen, Md Shamim Seraj, Zhan Cheng, Shayok Chakraborty, Yushun Dong

Organizations: Department of Computer Science, Florida State University, Tallahassee, Florida, United States · Department of Mathematics, University of Wisconsin, Madison, Wisconsin, United States

Abstract

Graph neural networks (GNNs) have demonstrated superior performance in various applications, such as recommendation systems and financial risk management. However, deploying large-scale GNN models locally is particularly challenging for users, as it requires significant computational resources and extensive property data. Consequently, Machine Learning as a Service (MLaaS) has become increasingly popular, offering a convenient way to deploy and access various models, including GNNs. However, an emerging threat known as Model Extraction Attacks (MEAs) presents significant risks, as adversaries can readily obtain surrogate GNN models exhibiting similar functionality. Specifically, attackers repeatedly query the target model using subgraph inputs to collect corresponding responses. These input-output pairs are subsequently utilized to train their own surrogate models at minimal cost. Many techniques have been proposed to defend against MEAs, but most are limited to specific output levels (e.g., embedding or label) and suffer from inherent technical drawbacks. To address these limitations, we propose a novel ownership verification framework CITED which is a first-of-its-kind method to achieve ownership verification on both embedding and label levels. Moreover, CITED is a novel signature-based method that neither harms downstream performance nor introduces auxiliary models that reduce efficiency, while still outperforming all watermarking and fingerprinting approaches. Extensive experiments demonstrate the effectiveness and robustness of our CITED framework. Code is available at: https://github.com/LabRAI/CITED.

Figures & tables

Model	Method	Cora	CiteSeer	PubMed	Photo	Computers	CS	Physics
GCN	GrOVe	$80.37\pm 0.90$	$68.97\pm 0.55$	$80.73\pm 0.87$	$92.80\pm 0.20$	$84.70\pm 0.89$	$\mathbf{91.27\pm 0.57}$	$89.23\pm 1.36$
	RandomWM	$80.10\pm 0.44$	$68.60\pm 0.44$	$80.63\pm 0.50$	$92.87\pm 0.96$	$83.50\pm 2.72$	$90.73\pm 0.31$	$90.40\pm 2.51$
	BackdoorWM	$77.97\pm 0.60$	$68.07\pm 0.40$	$79.27\pm 0.49$	$91.40\pm 0.35$	$81.60\pm 1.11$	$90.20\pm 0.61$	$90.57\pm 0.80$
	SurviveWM	$80.13\pm 1.02$	$68.10\pm 1.47$	$80.60\pm 0.66$	$91.60\pm 0.53$	$84.87\pm 1.90$	$90.83\pm 0.85$	$91.33\pm 0.85$
	CITED	$\mathbf{82.30\pm 0.16}$	$\mathbf{72.03\pm 0.41}$	$\mathbf{81.97\pm 0.12}$	$\mathbf{93.50\pm 0.08}$	$\mathbf{86.63\pm 0.24}$	${89.23\pm 0.12}$	$\mathbf{94.47\pm 0.12}$
GAT	GrOVe	$82.00\pm 0.62$	$69.40\pm 1.30$	$79.63\pm 0.85$	$91.30\pm 1.30$	$84.93\pm 1.71$	$\mathbf{90.60\pm 0.44}$	$90.93\pm 1.10$

Table 1: Performance evaluation of all defense methods on the original task, reported in terms of accuracy. All numerical values are in percentage. The best results are highlighted in bold .

Metric	Method	Cora	CiteSeer	PubMed	Photo	Computers	CS	Physics
$\text{ARUC}^{\text{emb}}$	GrOVe	$55.87\pm 0.47$	$63.09\pm 1.71$	$37.09\pm 0.69$	$64.31\pm 1.00$	$65.09\pm 1.20$	$57.38\pm 2.13$	$48.04\pm 1.12$
$\text{ARUC}^{\text{emb}}$	CITED	$62.20\pm 0.63$	$66.51\pm 1.14$	$62.76\pm 1.95$	$65.62\pm 1.52$	$65.80\pm 1.23$	$70.76\pm 1.76$	$61.71\pm 1.24$
$\text{ARUC}^{\text{label}}$	RandomWM	$16.51\pm 4.65$	$20.53\pm 1.04$	$15.04\pm 2.51$	$12.47\pm 4.15$	$17.47\pm 8.64$	$15.40\pm 9.33$	$24.98\pm 2.11$
	BackdoorWM	$32.84\pm 23.2$	$15.27\pm 12.4$	$16.13\pm 1.04$	$8.800\pm 3.11$	$19.07\pm 5.77$	$15.40\pm 12.5$	$16.13\pm 13.5$
	SurviveWM	$20.53\pm 1.41$	$18.44\pm 1.82$	$19.78\pm 2.04$	$33.73\pm 5.19$	$4.400\pm 6.22$	$37.22\pm 3.08$	$18.84\pm 10.3$
	CITED	$47.07\pm 11.3$	$59.29\pm 3.51$	$58.16\pm 4.0$	$45.07\pm 8.48$	$37.20\pm 8.09$	$41.82\pm 3.46$	$51.71\pm 5.84$

Table 2: Ownership verification performance of CITED compared to baselines at different output levels. Larger values indicate better effectiveness. The best results are highlighted in bold .

Figure 1: Performance of different defense models

f_{D}

on the downstream task as the number of embedded ownership verification flags increases.

Figure 2: Left: Inference time comparison between CITED and GrOVe at the embedding level across varying datasets. Right: ARUC of our proposed signature for ownership verification.

Method	$\textbf{ARUC}^{\text{emb}}$	$\textbf{ARUC}^{\text{label}}$
$\text{CITED}_{\text{M}}$	$69.67\pm 2.11$	$42.00\pm 6.15$
$\text{CITED}_{\text{T}}$	$70.73\pm 1.95$	$53.60\pm 16.0$
$\text{CITED}_{\text{H}}$	$66.00\pm 1.14$	$16.40\pm 6.29$
$\text{CITED}_{\!\!\!\tiny\begin{array}[]{l}\text{M}\text{+T}\text{+H}\end{array}}$	$\mathbf{71.07\pm 1.15}$	$\mathbf{54.87\pm 3.50}$

Table 3: Effectiveness of individual components of the signature score , including boundary margin (M), boundary thickness (T), and heterogeneity (H), as well as their combined effect, evaluated at both the embedding level and the label level.

Appendix figures & tables20 assets

Supplementary material from the paper’s appendix.

Appendix

	#Nodes	#Edges	#Attributes	#Classes
Cora	2,708	5,429	1,433	7
CiteSeer	3,327	4,723	3,703	6
PubMed	19,717	88,648	500	3
Amazon-Photo	13,752	491,722	767	10
Amazon-Computers	7,650	238,162	745	8
Coauthor-CS	18,333	163,788	6,805	15

Appendix

Table 4: Statistics of the adopted real-world graph datasets.

Panel of Figure 3 — Figure 3: Performance of different defense models $f_{D}$ on the downstream task as the number of embedded ownership verification indicators increases.

Panel of Figure 4 — Figure 4: ARUC performance of our proposed signature for ownership verification.

Metric	Method	Cora	CiteSeer	PubMed	Photo	Computers	CS	Physics
$\text{ARUC}^{\text{emb}}$	GrOVe	$41.51\pm 1.64$	$48.96\pm 2.99$	$29.22\pm 1.41$	$52.18\pm 5.04$	$49.16\pm 3.55$	$52.38\pm 0.94$	$45.00\pm 0.33$
$\text{ARUC}^{\text{emb}}$	CITED	$63.02\pm 0.91$	$58.58\pm 1.44$	$60.91\pm 0.31$	$63.11\pm 2.09$	$64.62\pm 2.61$	$59.62\pm 1.66$	$60.71\pm 1.78$
$\text{ARUC}^{\text{label}}$	RandomWM	$13.80\pm 0.75$	$30.47\pm 8.01$	$29.13\pm 12.8$	$22.00\pm 15.6$	$19.07\pm 1.04$	$39.78\pm 9.46$	$28.60\pm 0.00$
	BackdoorWM	$25.91\pm 0.69$	$24.16\pm 1.85$	$20.82\pm 2.51$	$22.98\pm 3.40$	$12.20\pm 10.3$	$18.40\pm 10.5$	$21.02\pm 3.17$
	SurviveWM	$17.09\pm 7.67$	$23.02\pm 6.95$	$11.29\pm 0.53$	$18.38\pm 7.23$	$30.76\pm 12.6$	$35.00\pm 15.5$	$20.96\pm 5.55$
	CITED	$46.22\pm 5.15$	$59.76\pm 2.48$	$52.69\pm 3.54$	$31.16\pm 4.55$	$33.60\pm 8.70$	$35.60\pm 5.71$	$40.51\pm 5.34$

Appendix

Table 5: Ownership verification performance of CITED compared to baselines at different output levels. Larger values indicate better effectiveness.

Method	Cora	CiteSeer	PubMed	Photo	Computers	CS	Physics
GrOVe	$73.04\pm 0.42$	$79.70\pm 3.09$	$57.63\pm 2.36$	$92.44\pm 6.33$	$88.30\pm 1.86$	$90.52\pm 3.04$	$98.52\pm 1.27$
CITED	$100.0\pm 0.00$	$100.0\pm 0.00$	$100.0\pm 0.00$	$100.0\pm 0.00$	$100.0\pm 0.00$	$100.0\pm 0.00$	$100.0\pm 0.00$
RandomWM	$25.04\pm 2.72$	$50.52\pm 4.82$	$49.33\pm 21.4$	$16.30\pm 11.5$	$29.33\pm 2.88$	$70.52\pm 12.2$	$57.04\pm 5.87$
BackdoorWM	$50.22\pm 4.40$	$59.41\pm 13.4$	$39.11\pm 5.03$	$50.07\pm 7.67$	$27.56\pm 27.4$	$34.22\pm 30.8$	$38.96\pm 7.12$
SurviveWM	$41.63\pm 18.7$	$54.96\pm 26.6$	$24.59\pm 1.47$	$26.07\pm 14.9$	$48.59\pm 23.2$	$46.96\pm 24.1$	$34.67\pm 4.12$
CITED	$93.93\pm 8.28$	$99.85\pm 0.21$	$98.52\pm 2.10$	$75.70\pm 10.14$	$85.33\pm 10.16$	$85.48\pm 7.82$	$85.48\pm 8.35$

Appendix

Table 6: Effectiveness of each verification method under AUC. Larger AUC values indicate stronger separation between surrogate and independent models.

Method	CiteSeer		PubMed		Amazon-Photo
Method	$\text{ARUC}^{\text{emb}}$	$\text{ARUC}^{\text{label}}$	$\text{ARUC}^{\text{emb}}$	$\text{ARUC}^{\text{label}}$	$\text{ARUC}^{\text{emb}}$	$\text{ARUC}^{\text{label}}$
$\text{CITED}_{\text{M}}$	$71.60\pm 1.77$	$60.93\pm 8.46$	$65.20\pm 3.96$	$66.27\pm 3.72$	$72.73\pm 1.11$	$44.53\pm 3.31$
$\text{CITED}_{\text{T}}$	$73.60\pm 0.43$	$70.33\pm 2.03$	$68.20\pm 3.71$	$66.80\pm 2.32$	$72.73\pm 1.43$	$45.73\pm 4.98$
$\text{CITED}_{\text{H}}$	$73.13\pm 1.06$	$44.93\pm 5.74$	$65.20\pm 2.73$	$61.40\pm 6.21$	$69.00\pm 1.42$	$52.87\pm 4.66$
$\textbf{CITED}_{\text{M+T+H}}$	$73.00\pm 2.20$	$71.53\pm 7.41$	$68.40\pm 3.69$	$69.87\pm 2.07$	$72.53\pm 1.24$	$52.27\pm 5.53$

Appendix

Table 7: Effectiveness of individual components of the signature score , including margin (M), thickness (T), and heterogeneity (H), as well as their combination. We report ARUC at both the embedding and label levels across six datasets.

Model	Method	Cora	CiteSeer	PubMed	Photo	Computers	CS	Physics
GCN	GrOVe	$80.18\pm 0.81$	$66.07\pm 0.35$	$80.10\pm 1.02$	$90.93\pm 0.12$	$82.19\pm 0.97$	$87.49\pm 1.03$	$88.05\pm 0.79$
	RandomWM	$79.83\pm 0.45$	$65.90\pm 0.57$	$79.94\pm 0.29$	$90.81\pm 0.88$	$79.13\pm 3.60$	$86.79\pm 0.93$	$88.96\pm 2.27$
	BackdoorWM	$77.85\pm 0.47$	$65.36\pm 0.50$	$78.43\pm 0.66$	$88.84\pm 0.26$	$79.16\pm 0.53$	$86.28\pm 0.44$	$88.50\pm 1.41$
	SurviveWM	$79.93\pm 0.99$	$65.31\pm 1.22$	$79.93\pm 0.55$	$89.58\pm 0.33$	$81.38\pm 0.92$	$86.99\pm 0.90$	$89.53\pm 0.44$
	CITED	$\mathbf{81.98\pm 0.13}$	$\mathbf{68.92\pm 0.33}$	$\mathbf{81.30\pm 0.14}$	$\mathbf{91.42\pm 0.22}$	$\mathbf{84.10\pm 0.39}$	$\mathbf{85.82\pm 0.27}$	$\mathbf{91.45\pm 0.25}$
GAT	GrOVe	$81.42\pm 0.69$	$66.64\pm 1.10$	$78.80\pm 0.81$	$89.81\pm 1.77$	$82.85\pm 1.77$	$87.03\pm 0.11$	$89.31\pm 1.54$

Appendix

Table 8: Performance evaluation of all defense methods on the original task, reported in terms of F1-score. All numerical values are in percentage. Our results are highlighted in bold .

Model	Method	Cora	CiteSeer	PubMed	Photo	Computers	CS	Physics
GCN	GrOVe	$96.65\pm 0.15$	$87.06\pm 0.31$	$93.38\pm 0.16$	$99.53\pm 0.08$	$98.64\pm 0.10$	$99.38\pm 0.08$	$98.09\pm 0.17$
	RandomWM	$96.69\pm 0.02$	$87.06\pm 0.07$	$93.33\pm 0.23$	$99.55\pm 0.04$	$98.63\pm 0.26$	$99.37\pm 0.08$	$98.33\pm 0.33$
	BackdoorWM	$95.85\pm 0.32$	$86.30\pm 0.20$	$91.55\pm 0.53$	$97.90\pm 0.30$	$97.63\pm 0.44$	$98.79\pm 0.13$	$98.10\pm 0.32$
	SurviveWM	$96.80\pm 0.06$	$86.73\pm 0.34$	$93.28\pm 0.39$	$99.35\pm 0.17$	$98.66\pm 0.03$	$98.99\pm 0.22$	$98.59\pm 0.22$
	CITED	$\mathbf{97.40\pm 0.00}$	$\mathbf{89.19\pm 0.14}$	$\mathbf{94.01\pm 0.06}$	$\mathbf{99.59\pm 0.00}$	$\mathbf{99.09\pm 0.02}$	$\mathbf{99.49\pm 0.01}$	$\mathbf{99.82\pm 0.01}$
GAT	GrOVe	$97.50\pm 0.11$	$87.45\pm 0.65$	$93.26\pm 0.35$	$99.30\pm 0.12$	$98.90\pm 0.08$	$99.32\pm 0.02$	$98.33\pm 0.18$

Appendix

Table 9: Performance evaluation of all defense methods on the original task, reported in terms of AUROC. All numerical values are in percentage. Our results are highlighted in bold .

coefficient	ARUC ${}^{\text{emb}}$	ARUC ${}^{\text{label}}$
(0.300, 0.40, 0.300)	67.87 $\pm$ 0.01	45.33 $\pm$ 0.04
(0.275, 0.45, 0.275)	66.24 $\pm$ 0.02	46.76 $\pm$ 0.06
(0.250, 0.50, 0.250)	67.73 $\pm$ 0.01	50.40 $\pm$ 0.06
(0.225, 0.55, 0.225)	68.02 $\pm$ 0.04	47.55 $\pm$ 0.09
(0.200, 0.60, 0.200)	66.07 $\pm$ 0.02	55.27 $\pm$ 0.10
(0.175, 0.65, 0.175)	66.23 $\pm$ 0.03	50.58 $\pm$ 0.16

Appendix

Table 10: ARUC results under different coefficient settings. Results are reported as mean

\pm

std.

Method	Cora	CiteSeer	PubMed	Photo	Computers	CS	Physics
RandomWM	31.56 $\pm$ 1.26	58.67 $\pm$ 13.2	30.67 $\pm$ 2.51	21.48 $\pm$ 4.82	16.30 $\pm$ 9.91	22.67 $\pm$ 9.43	62.07 $\pm$ 12.1
BackdoorWM	43.85 $\pm$ 31.0	23.85 $\pm$ 16.1	27.49 $\pm$ 5.44	4.890 $\pm$ 3.14	35.70 $\pm$ 11.1	18.52 $\pm$ 10.5	29.93 $\pm$ 24.1
SurviveWM	41.19 $\pm$ 2.30	39.56 $\pm$ 3.14	37.04 $\pm$ 0.84	48.89 $\pm$ 6.29	1.780 $\pm$ 2.51	46.37 $\pm$ 7.96	37.33 $\pm$ 17.6
CITED	89.04 $\pm$ 7.76	99.85 $\pm$ 0.21	98.67 $\pm$ 1.89	90.52 $\pm$ 3.02	88.15 $\pm$ 5.63	97.93 $\pm$ 0.91	98.24 $\pm$ 0.36
CITED_prune	88.00 $\pm$ 0.10	94.18 $\pm$ 0.22	89.24 $\pm$ 0.09	82.67 $\pm$ 0.15	83.68 $\pm$ 0.07	56.00 $\pm$ 0.12	67.87 $\pm$ 0.14
CITED_fintune	77.33 $\pm$ 0.11	97.33 $\pm$ 0.04	90.67 $\pm$ 0.07	81.33 $\pm$ 0.11	85.33 $\pm$ 0.04	66.53 $\pm$ 0.17	64.17 $\pm$ 0.10

Appendix

Table 11: Performance of robustness under removal attack. Results are reported as mean

\pm

std.

Noise Ratio	Cora	Citeseer	PubMed	Photo	Computers	CS	Physics
0.1	0.3193 $\pm$ 0.0273	0.5428 $\pm$ 0.0000	0.5180 $\pm$ 0.0024	0.4743 $\pm$ 0.0249	0.4381 $\pm$ 0.0286	0.6109 $\pm$ 0.0203	0.7108 $\pm$ 0.0000
0.3	0.4100 $\pm$ 0.1556	0.5580 $\pm$ 0.0122	0.5330 $\pm$ 0.0000	0.4920 $\pm$ 0.0000	0.4513 $\pm$ 0.0105	0.6577 $\pm$ 0.0000	0.7043 $\pm$ 0.0152
0.5	0.4633 $\pm$ 0.0603	0.5640 $\pm$ 0.0436	0.5764 $\pm$ 0.0001	0.5313 $\pm$ 0.0014	0.4400 $\pm$ 0.0229	0.6482 $\pm$ 0.0187	0.7521 $\pm$ 0.0109
0.7	0.5107 $\pm$ 0.0585	0.6141 $\pm$ 0.0142	0.5451 $\pm$ 0.0000	0.5140 $\pm$ 0.0164	0.4263 $\pm$ 0.0116	0.6602 $\pm$ 0.0148	0.7846 $\pm$ 0.0001
0.9	0.7160 $\pm$ 0.0368	0.6615 $\pm$ 0.0213	0.5523 $\pm$ 0.0117	0.5062 $\pm$ 0.0146	0.4128 $\pm$ 0.0281	0.6280 $\pm$ 0.0110	0.7474 $\pm$ 0.0020

Appendix

Table 12: Ownership verification performance under noisy labels at the label level.

Imbalance Ratio	Cora	Citeseer	PubMed	Photo	Computers	CS	Physics
0.1	0.6953 $\pm$ 0.0019	0.1840 $\pm$ 0.1265	0.6460 $\pm$ 0.0057	0.4893 $\pm$ 0.0443	0.4107 $\pm$ 0.0442	0.5767 $\pm$ 0.0560	0.7280 $\pm$ 0.0205
0.3	0.7080 $\pm$ 0.0057	0.1840 $\pm$ 0.1301	0.6900 $\pm$ 0.0000	0.7287 $\pm$ 0.0038	0.7760 $\pm$ 0.0033	0.5913 $\pm$ 0.0019	0.6753 $\pm$ 0.0160
0.5	0.7073 $\pm$ 0.0038	0.0000 $\pm$ 0.0000	0.7600 $\pm$ 0.0000	0.9460 $\pm$ 0.0000	0.9333 $\pm$ 0.0009	0.8473 $\pm$ 0.0019	0.6900 $\pm$ 0.0000
0.7	0.7053 $\pm$ 0.0009	0.9520 $\pm$ 0.0000	0.9160 $\pm$ 0.0000	0.9780 $\pm$ 0.0000	0.9687 $\pm$ 0.0025	0.9540 $\pm$ 0.0000	0.8040 $\pm$ 0.0000
0.9	0.6887 $\pm$ 0.0019	0.9560 $\pm$ 0.0000	0.9540 $\pm$ 0.0000	0.9760 $\pm$ 0.0000	0.9667 $\pm$ 0.0034	0.9760 $\pm$ 0.0000	0.9140 $\pm$ 0.0000

Appendix

Table 13: Ownership verification performance under class imbalance at the label level.

Imbalance Ratio	Cora	Citeseer	PubMed	Photo	Computers	CS	Physics
0.1	0.6953 $\pm$ 0.0019	0.6980 $\pm$ 0.0028	0.6700 $\pm$ 0.0000	0.7033 $\pm$ 0.0084	0.6640 $\pm$ 0.0049	0.7320 $\pm$ 0.0000	0.6913 $\pm$ 0.0009
0.3	0.7080 $\pm$ 0.0057	0.6960 $\pm$ 0.0102	0.6840 $\pm$ 0.0000	0.6940 $\pm$ 0.0173	0.6707 $\pm$ 0.0038	0.7320 $\pm$ 0.0000	0.6980 $\pm$ 0.0000
0.5	0.7073 $\pm$ 0.0038	0.7053 $\pm$ 0.0038	0.6860 $\pm$ 0.0000	0.6920 $\pm$ 0.0118	0.6713 $\pm$ 0.0038	0.7360 $\pm$ 0.0000	0.7040 $\pm$ 0.0000
0.7	0.7053 $\pm$ 0.0009	0.7140 $\pm$ 0.0000	0.6760 $\pm$ 0.0000	0.6953 $\pm$ 0.0118	0.6647 $\pm$ 0.0038	0.7360 $\pm$ 0.0000	0.7140 $\pm$ 0.0000
0.9	0.6887 $\pm$ 0.0019	0.7140 $\pm$ 0.0000	0.6660 $\pm$ 0.0000	0.7053 $\pm$ 0.0147	0.6687 $\pm$ 0.0050	0.7200 $\pm$ 0.0000	0.7100 $\pm$ 0.0000

Appendix

Table 14: Ownership verification performance under class imbalance at the embedding level.

Group Ratio	Cora	Citeseer	PubMed	Photo	Computers	CS	Physics
0.25	0.4231 $\pm$ 0.0224	0.5100 $\pm$ 0.0028	0.5793 $\pm$ 0.0637	0.4266 $\pm$ 0.0150	0.4619 $\pm$ 0.0262	0.5486 $\pm$ 0.0191	0.4380 $\pm$ 0.0001
0.50	0.4369 $\pm$ 0.0316	0.5360 $\pm$ 0.0318	0.6500 $\pm$ 0.0172	0.4406 $\pm$ 0.0899	0.4626 $\pm$ 0.0423	0.5060 $\pm$ 0.0662	0.4646 $\pm$ 0.0339
0.75	0.4660 $\pm$ 0.0112	0.5986 $\pm$ 0.0530	0.6540 $\pm$ 0.0299	0.4706 $\pm$ 0.0188	0.5286 $\pm$ 0.0228	0.5513 $\pm$ 0.0217	0.5306 $\pm$ 0.0627
1.00	0.4817 $\pm$ 0.0413	0.5607 $\pm$ 0.0377	0.6540 $\pm$ 0.0197	0.4793 $\pm$ 0.1148	0.5893 $\pm$ 0.0586	0.5586 $\pm$ 0.0247	0.5560 $\pm$ 0.0056

Appendix

Table 15: Ownership verification performance under grouped signature compression at the label level.

Group Ratio	Cora	Citeseer	PubMed	Photo	Computers	CS	Physics
0.25	0.6298 $\pm$ 0.0149	0.6486 $\pm$ 0.0009	0.6326 $\pm$ 0.0150	0.6593 $\pm$ 0.0009	0.6720 $\pm$ 0.0000	0.6673 $\pm$ 0.0024	0.6280 $\pm$ 0.0000
0.50	0.6445 $\pm$ 0.0065	0.6293 $\pm$ 0.0037	0.6413 $\pm$ 0.0041	0.6688 $\pm$ 0.0028	0.6860 $\pm$ 0.0016	0.6573 $\pm$ 0.0108	0.6313 $\pm$ 0.0018
0.75	0.6779 $\pm$ 0.0031	0.7094 $\pm$ 0.0043	0.6619 $\pm$ 0.0043	0.6793 $\pm$ 0.0018	0.7060 $\pm$ 0.0016	0.6933 $\pm$ 0.0024	0.7093 $\pm$ 0.0037
1.00	0.6748 $\pm$ 0.0000	0.7060 $\pm$ 0.0000	0.6773 $\pm$ 0.0000	0.6680 $\pm$ 0.0016	0.7080 $\pm$ 0.0016	0.6999 $\pm$ 0.0001	0.6940 $\pm$ 0.0000

Appendix

Table 16: Ownership verification performance under grouped signature compression at the embedding level.

Sig Set Ratio	Original Size (bytes)	Compressed Size (bytes)	Compression Saving (%)
0.0247	292	8	97.26
0.0288	345	8	97.68
0.0354	427	8	98.12
0.0576	692	8	98.84
0.0819	987	8	99.18

Appendix

Table 17: Compression of the signature commitment using a sixty four bit hash digest.

Sig Set Ratio	Cora	Citeseer	PubMed	Photo	Computers	CS	Physics
0.0247	0.4140 $\pm$ 0.0000	0.6480 $\pm$ 0.0000	0.6960 $\pm$ 0.0000	0.6213 $\pm$ 0.0344	0.4823 $\pm$ 0.0114	0.6220 $\pm$ 0.0000	0.7440 $\pm$ 0.0000
0.0288	0.4420 $\pm$ 0.0000	0.6080 $\pm$ 0.0000	0.5840 $\pm$ 0.0000	0.2920 $\pm$ 0.0000	0.4853 $\pm$ 0.0075	0.6120 $\pm$ 0.0000	0.7440 $\pm$ 0.0000
0.0354	0.4600 $\pm$ 0.0000	0.6640 $\pm$ 0.0000	0.6740 $\pm$ 0.0001	0.4313 $\pm$ 0.0090	0.4460 $\pm$ 0.0129	0.6520 $\pm$ 0.0000	0.7560 $\pm$ 0.0000
0.0576	0.4681 $\pm$ 0.0002	0.6340 $\pm$ 0.0000	0.6400 $\pm$ 0.0000	0.3020 $\pm$ 0.0254	0.5033 $\pm$ 0.0179	0.6800 $\pm$ 0.0000	0.8600 $\pm$ 0.0001
0.0819	0.4940 $\pm$ 0.0056	0.6713 $\pm$ 0.0857	0.6953 $\pm$ 0.0047	0.5026 $\pm$ 0.0249	0.3980 $\pm$ 0.0412	0.6613 $\pm$ 0.0603	0.7686 $\pm$ 0.0122

Appendix

Table 18: Ownership verification performance when varying the signature set ratio.

Model	Metric	ENZYMES	PROTEINS
CITED	ARUC	0.4277 $\pm$ 0.0535	0.3747 $\pm$ 0.1162
CITED	AUC	1.0000 $\pm$ 0.0000	0.9778 $\pm$ 0.0143

Appendix

Table 19: Ownership verification results for graph classification tasks.

Model	Metric	ZINC
CITED	ARUC	0.5164 $\pm$ 0.0191
CITED	AUC	1.0000 $\pm$ 0.0000
CITED	RMSE	1.7349 $\pm$ 0.0112

Appendix

Table 20: Ownership verification results for the regression task on the ZINC dataset.

	Cora	CiteSeer	PubMed	Photo	Computers	CS	Physics
Sig Gen Time (s)	$0.05\pm 0.06$	$0.05\pm 0.06$	$0.05\pm 0.05$	$0.04\pm 0.06$	$0.04\pm 0.05$	$0.04\pm 0.05$	$0.05\pm 0.06$
Training Time (s)	$1.18\pm 0.01$	$1.04\pm 0.09$	$2.70\pm 0.26$	$4.09\pm 1.10$	$4.76\pm 0.01$	$6.54\pm 0.02$	$19.45\pm 0.01$
Percentage (%)	$3.77\pm 5.12$	$4.43\pm 4.96$	$2.38\pm 2.86$	$0.93\pm 1.17$	$0.82\pm 1.09$	$0.59\pm 0.78$	$0.25\pm 0.32$

Appendix

Table 21: Runtime of signature generation compared to standard GCN training. All results are reported as mean

\pm

standard deviation over multiple trials.

Explore similar work

CREDIT: Certified Ownership Verification of Deep Neural Networks Against Model Extraction Attacks
Feb 23, 2026Bolin Shen, Zhan Cheng, Neil Zhenqiang Gong +2Model Extraction Attacks Black-Box Model Auditing
Department of Computer Science, Florida State University, Tallahassee, Florida, United States · Department of Mathematics, University of Wisconsin, Madison, Wisconsin, United States · Department of Computer Science, Duke University, Durham, North Carolina, United States +1
Defending against Model Extraction for GNNs with Model Reprogramming
Aug 11, 2026Yan Wen, Zhenyi Wang, Heng HuangGraph Neural Networks Model Extraction Attacks
University of Maryland, College Park Department of Computer Science College Park, MD, USA · University of Central Florida Department of Computer Science and Institute of Artificial Intelligence Orlando, FL, USA
GraphIP-Bench: How Hard Is It to Steal a Graph Neural Network, and Can We Stop It?
May 12, 2026Kaixiang Zhao, Bolin Shen, Yuyang Dai +2Graph Neural Networks Model Extraction Attacks
University of Notre Dame · Florida State University · University of California, Berkeley

Feb 23, 2026J/K move · Enter open · S save

CREDIT: Certified Ownership Verification of Deep Neural Networks Against Model Extraction Attacks

Bolin Shen, Zhan Cheng, Neil Zhenqiang Gong, Fan Yao+1

Department of Computer Science, Florida State University, Tallahassee, Florida, United States · Department of Mathematics, University of Wisconsin, Madison, Wisconsin, United States · Department of Computer Science, Duke University, Durham, North Carolina, United States+1

Model Extraction Attacks Black-Box Model Auditing

Open paper AskPDF arXiv

Machine Learning as a Service (MLaaS) has emerged as a widely adopted paradigm for providing access to deep neural network (DNN) models, enabling users to conveniently leverage these models through standardized APIs. However, such services are highly vulnerable to Model Extraction Attacks (MEAs), where an adversary repeatedly queries a target model to collect input-output pairs and uses them to train a surrogate model that closely replicates its functionality. While numerous defense strategies have been proposed, verifying the ownership of a suspicious model with strict theoretical guarantees remains a challenging task. To address this gap, we introduce CREDIT, a certified ownership verification against MEAs. Specifically, we employ mutual information to quantify the similarity between DNN models, propose a practical verification threshold, and provide rigorous theoretical guarantees for ownership verification based on this threshold. We extensively evaluate our approach on several mainstream datasets across different domains and tasks, achieving state-of-the-art performance. Our implementation is publicly available at: https://github.com/LabRAI/CREDIT.

Abstract

Explore similar work

CREDIT: Certified Ownership Verification of Deep Neural Networks Against Model Extraction Attacks

Defending against Model Extraction for GNNs with Model Reprogramming

GraphIP-Bench: How Hard Is It to Steal a Graph Neural Network, and Can We Stop It?