Jul 9, 2026 · cs.LGJ/K move · Enter open · S save
Wenxiu Ding, Muzhi Liu, Zheng Yan, Mingjun Wang+2
State Key Laboratory of Integrated Services Networks, School of Cyber Engineering, Xidian University, Xi’an, Shaanxi, China · School of Cyber Engineering, Xidian University, Xi’an, Shaanxi, China
Graph Neural Networks (GNNs) have shown considerable success in learning from graph-structured data, but their use in privacy-sensitive areas remains difficult because graph structure can leak sensitive link information. To satisfy edge-level differential privacy, a common approach is to inject noise into all elements of the graph's adjacency matrix, thereby obfuscating the existence of any single edge. However, stronger privacy requires more noise, and excessive noise reduces utility, making the privacy-utility balance a major barrier to practical privacy-preserving graph learning. To address this issue, we propose EdgeRefine, a local differential privacy framework that improves this trade-off through adaptive edge refinement. EdgeRefine first estimates edge-existence probabilities using Jaccard similarity and ranks edges for noisy edge removal. To ensure the sparsity and reliability of the final graph, it uses the privacy budget
ε to determine the ratio of true to false edges, samples them separately based on this probability ranking, and controls the total number of edges with a separate sampling rate
k. Extensive experiments show that EdgeRefine achieves accuracy comparable to the noise-free baseline and substantially outperforms other privacy-preserving methods across datasets and GNN architectures. Under privacy budget
ε=2.5, EdgeRefine improves node classification accuracy over state-of-the-art baselines by 17.8% on ACM under GAT and 19.7% on Cora under GCN. In graph classification, it achieves an average accuracy degradation of around 5% compared to the noise-free baseline. Under graph reconstruction attacks, EdgeRefine maintains relative absolute error levels above 1 across all privacy budgets, averaging 1.962 on Cora and 1.472 on AMAP, indicating strong resilience against privacy leakage.