Adversarial Attacks on Locally Private Graph Neural Networks

Matta Varun; Ajay Kumar Dhakar; Yuan Hong; Shamik Sural

cs.LGMar 21, 2026

Adversarial Attacks on Locally Private Graph Neural Networks

Authors: Matta Varun, Ajay Kumar Dhakar, Yuan Hong, Shamik Sural

Organizations: Indian Institute of Technology Kharagpur, India · University of Connecticut, USA

Abstract

Graph neural network (GNN) is a powerful tool for analyzing graph-structured data. However, their vulnerability to adversarial attacks raises serious concerns, especially when dealing with sensitive information. Local Differential Privacy (LDP) offers a privacy-preserving framework for training GNNs, but its impact on adversarial robustness remains underexplored. This paper investigates adversarial attacks on LDP-protected GNNs. We explore how the privacy guarantees of LDP can be leveraged or hindered by adversarial perturbations. The effectiveness of existing attack methods on LDP-protected GNNs are analyzed and potential challenges in crafting adversarial examples under LDP constraints are discussed. Additionally, we suggest directions for defending LDP-protected GNNs against adversarial attacks. This work investigates the interplay between privacy and security in graph learning, highlighting the need for robust and privacy-preserving GNN architectures.

Figures & tables

Figure 1: Visualization of Node Injection Attack on LPGNN.

Figure 2: Visualization of Label Flipping Attack on LPGNN.

Figure 3: Visualization of Inference Attack on LPGNN.

Figure 4: Visualization of Poisoning Attack on LPGNN.

LPGNN Baselines (Accuracy in %)
Dataset	GCN	GAT	SAGE
Cora	79.9	56.3	77.4
PubMed	78.6	81	78.6
Facebook	85.3	57.1	83.9
lastFM	78.6	56.3	77.5

Table 1: Baseline Results

Panel of Figure 5 — Figure 5: Node Injection Attack results against the number of nodes injected into the graph as a percentage of total initial nodes

Panel of Figure 6 — Figure 6: Node Injection Attack results against the feature privacy budget ( $\epsilon_{x}$ ) where 10% of total nodes are injected

Panel of Figure 7 — Figure 7: Label Flipping Attack results against the number of node labels flipped in the graph (as a % of total initial nodes)

Panel of Figure 8 — Figure 8: Label Flipping Attack results against the feature privacy budget ( $\epsilon_{x}$ ) where 10% of total node labels are flipped

Table 2: Impact of

x_{\text{step}}

on Node Injection Attack Performance: Accuracy (%) vs.

x_{\text{step}}

for different injection rates

Table 3: Impact of

x_{\text{step}}

on Label Flipping Attack Performance: Accuracy (%) vs.

x_{\text{step}}

for different flipping rates

Table 4: Impact of

y_{\text{step}}

on Node Injection Attack Performance: Accuracy (%) vs.

y_{\text{step}}

for different injection rates

Table 5: Impact of

y_{\text{step}}

on Label Flipping Attack Performance: Accuracy (%) vs.

y_{\text{step}}

for different flipping rates

Panel of Figure 9 — Figure 9: Success Rate of the Data Poisoning Attack and the impact of privacy budget ( $\epsilon$ )

LPGNN Inference Attack Results
Metric	Cora	PubMed	Facebook	LastFM
C. Similarity	0.005	0.001	0.001	0.001
Mean F. D.	21.973	7.924	66.924	116.666

Table 6: Inference Attack Results

Explore similar work

Trust-But-Verify: Poisoning-Resilient Locally Private Graph Learning Protocols
Sep 7, 2026Longzhu He, Li Sun, Hao Peng +3Data Poisoning Attacks Decentralized Learning
Beijing University of Posts and Telecommunications · Beihang University · The Hong Kong University of Science and Technology +1
Towards Personalized Differentially Private Learning for Decentralized Local Graphs
Jul 6, 2026Longzhu He, Peng Tang, Chaozhuo Li +5Graph Neural Networks Decentralized Learning
School of Computer Science, Beijing University of Posts and Telecommunications, Beijing 100876, China · State Key Laboratory of Networking and Switching Technology, Beijing University of Posts and Telecommunications, Beijing 100876, China · School of Cyber Science and Technology, Shandong University, Qingdao, China +2
Auditing Privacy Risks in LLM-Enhanced Graph Neural Networks
Aug 26, 2026Longzhu He, Zelang Wen, Chaozhuo Li +1Privacy-Preserving ML LLMs for Graph Learning
Beijing University of Posts and Telecommunications

Sep 7, 2026J/K move · Enter open · S save

Trust-But-Verify: Poisoning-Resilient Locally Private Graph Learning Protocols

Longzhu He, Li Sun, Hao Peng, Ruijie Wang+2

Beijing University of Posts and Telecommunications · Beihang University · The Hong Kong University of Science and Technology+1

Data Poisoning Attacks Decentralized Learning Graph Representation Learning Differential Privacy

Open paper AskPDF arXiv

Built upon local differential privacy (LDP), locally private graph learning protocols have emerged as an important paradigm for decentralized graph learning, balancing privacy protection and learning utility. Under such protocols, each user locally perturbs their node features and adjacency information before transmission, ensuring formal privacy guarantees without original data leaving the device. However, the inherently open participation nature renders these protocols critically vulnerable to data poisoning attacks, where adversaries inject carefully crafted malicious nodes to corrupt neighborhood aggregation and degrade downstream utility. Despite the severity of this threat, effective defenses in this setting remain largely unexplored. In this paper, we propose VERITAS, a poisoning-resilient locally private graph learning protocol built on a trust-but-verify paradigm. By introducing a verification list encoding graded peer trust levels, VERITAS jointly privatizes node features and graph structure on the user side, while exploiting bilateral attestation asymmetry on the server side to identify and prune malicious nodes. Concretely, VERITAS comprises four synergistic stages: (1) local data perturbation, (2) attestation-driven malicious node pruning, (3) utility restoration via dual denoising, and (4) robust private graph learning. Extensive experiments on four real-world benchmark datasets across multiple LDP mechanisms and GNN architectures demonstrate that VERITAS effectively defends against data poisoning attacks and significantly improves downstream graph learning utility under rigorous privacy guarantees.

Abstract

Explore similar work

Trust-But-Verify: Poisoning-Resilient Locally Private Graph Learning Protocols

Towards Personalized Differentially Private Learning for Decentralized Local Graphs

Auditing Privacy Risks in LLM-Enhanced Graph Neural Networks