cs.LGAug 26, 2026

Auditing Privacy Risks in LLM-Enhanced Graph Neural Networks

Authors: Longzhu He, Zelang Wen, Chaozhuo Li, Sen Su

Organizations: Beijing University of Posts and Telecommunications

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Large language models (LLMs) have recently advanced graph neural networks (GNNs) by enriching node representations with semantic information, giving rise to LLM-enhanced GNNs that achieve substantial performance gains. However, how such semantic enhancement affects privacy risks remains largely underexplored. To bridge this gap, we systematically audit the privacy risks of LLM-enhanced GNNs through a unified framework consisting of five stages: (1) dataset preparation, (2) victim model training, (3) privacy attack, (4) risk assessment, and (5) defense analysis. Specifically, our evaluation spans ten text-attributed graph datasets across diverse domains, six privacy attacks, 42 LLM-enhanced GNN configurations, and three more recent language-model backbones. Extensive experiments show that, despite their utility improvements, LLM-enhanced GNNs consistently exhibit greater empirical privacy vulnerability than shallow text representation baselines under the evaluated attacks across diverse models and datasets. Further analysis shows that LLM-enhanced representations exhibit more distinguishable link-, label-, and membership-related signals in the embedding space, making them more exploitable by inference attacks. Finally, we evaluate representative defenses and examine their effectiveness in mitigating these privacy risks. Overall, this work provides a systematic audit of privacy risks in LLM-enhanced GNNs and offers insights for developing more secure and trustworthy graph learning systems.

Figures & tables

Figure 1: Overview of the proposed privacy auditing framework. It consists of five stages: dataset preparation, victim model training, privacy attack, risk assessment, and defense analysis.
Figure 2: Adversary–model interaction illustration under black-box access.
Dataset#Nodes#Edges#ClassesDomain
Cora2,7085,4297Citation
CiteSeer3,3274,5526Citation
Ogbn-Products12,01121,98747E-commerce
Tape-Arxiv2313,16723,73540Citation
Instagram11,339144,0102Social
Reddit33,434198,4482Social
Table 1: Statistics of datasets.
DatasetShallowTAPEKEALLaMALinqSimTegE5-Large
Cora80.8 ±\pm 1.182.1 ±\pm 1.183.2 ±\pm 0.882.2 ±\pm 0.684.8 ±\pm 0.483.3 ±\pm 0.984.5 ±\pm 0.9
Tape-Arxiv2355.4 ±\pm 0.772.3 ±\pm 0.665.6 ±\pm 0.570.3 ±\pm 0.771.4 ±\pm 0.470.7 ±\pm 0.671.3 ±\pm 0.5
CiteSeer72.3 ±\pm 1.273.6 ±\pm 1.675.2 ±\pm 1.575.3 ±\pm 1.676.6 ±\pm 0.674.9 ±\pm 0.876.2 ±\pm 2.1
Ogbn-Products65.6 ±\pm 0.583.1 ±\pm 0.280.9 ±\pm 0.381.2 ±\pm 0.381.7 ±\pm 0.881.4 ±\pm 0.282.2 ±\pm 0.1
Instagram63.7 ±\pm 0.765.6 ±\pm 0.866.1 ±\pm 0.667.3 ±\pm 0.467.7 ±\pm 0.764.5 ±\pm 0.765.6 ±\pm 0.9
Reddit60.0 ±\pm 0.961.5 ±\pm 1.061.2 ±\pm 1.062.8 ±\pm 0.362.5 ±\pm 1.162.3 ±\pm 0.461.1 ±\pm 0.5
Table 2: Node classification accuracy (%) across different datasets based on the GCN backbone. The highest results are highlighted with bold , while the second-best results are marked with underline .
Figure 3: Link inference results ( MLA / ELA , AUC %) on Cora, Tape-Arxiv23, and CiteSeer with GCN. Additional results across more datasets and settings are provided in Appendix.
Figure 4: Label inference results ( HGA / NIA , Accuracy %) on Cora, Tape-Arxiv23, and CiteSeer with GCN. Additional results across more datasets and settings are provided in Appendix.
Figure 5: Membership inference results ( MIA / NMA , AUC/Accuracy %) on Cora, Tape-Arxiv23, and CiteSeer with GCN. Additional results across more datasets and settings are provided in Appendix.
Figure 6: In-depth analysis of privacy vulnerability on Tape-Arxiv23 with GCN, comparing Linq against the Shallow baseline. (a) Embedding distance distributions of connected vs. unconnected pairs (link inference). (b) CDF of embedding distances of intra-class vs. inter-class pairs (label inference). (c) Prediction confidence distributions of member vs. non-member nodes (membership inference).
Figure 7: Effectiveness of six local embedding DP mechanisms under a fixed privacy budget ϵe=5.0\epsilon_{e}=5.0 on Tape-Arxiv23 with GCN and Linq; blue bars denote results before perturbation. (a)-(c) show attack performance for MLA , NIA , and MIA , respectively. (d) reports the corresponding model utility.
Figure 8: Attack and utility performance under varying privacy budgets on Tape-Arxiv23 with GCN and Linq. (a) Embedding-level DP ( ϵe\epsilon_{e} ) vs. MLA (AUC %) and utility (Accuracy %). (b) Link-level DP (RR) vs. MLA (AUC %) and utility. (c) Label-level DP ( kk -RR) vs. HGA (Accuracy %) and utility.

Explore similar work

CardsList
Aug 4, 2026cs.CR

PriDyG: Privacy-preserving Dynamic Graph Inference with LLM-GNN Collaboration

Graph inference over relational data can expose sensitive edge information, and this risk becomes more severe in dynamic graphs, where repeated model updates cause privacy loss to accumulate. We formulate Edge-level Differentially Private Dynamic Graph Inference (EDG) and propose PriDyG, a private inference framework that combines GNN-based structural learning with LLM-based semantic reasoning. PriDyG introduces incremental private multi-hop aggregation, which buffers newly arrived edges and processes each edge exactly once. By parallel composition, the total privacy cost equals that of a single static release, independent of the number or schedule of model updates. Compared with geometrically decaying budget allocation, incremental aggregation avoids exponentially increasing noise while preserving exact one-hop signals and at least half of two-hop information transfers. PriDyG further complements privatized GNN outputs with LLM predictions derived solely from node text, incurring no additional edge-level privacy cost. Experiments on four benchmarks for node classification and link prediction show that PriDyG consistently outperforms geometrically decaying baselines under the same privacy budget and matches the utility of naive per-update retraining while reducing cumulative privacy cost by up to three orders of magnitude.

Yuyang Xia, Ruixuan Liu, Li Xiong

Emory University Atlanta, Georgia, USA

Gnn-Based DetectorsStreaming Inference
AskPDF
Jun 8, 2026cs.CR

Unveiling Privacy Risks in Multi-modal Large Language Models: Task-specific Vulnerabilities and Mitigation Challenges

Privacy risks in text-only Large Language Models (LLMs) are well studied, particularly their tendency to memorize and leak sensitive information. However, Multi-modal Large Language Models (MLLMs), which process both text and images, introduce unique privacy challenges that remain underexplored. Compared to text-only models, MLLMs can extract and expose sensitive information embedded in images, posing new privacy risks. We reveal that some MLLMs are susceptible to privacy breaches, leaking sensitive data embedded in images or stored in memory. Specifically, in this paper, we (1) introduce MM-Privacy, a comprehensive dataset designed to assess privacy risks across various multi-modal tasks and scenarios, where we define Disclosure Risks and Retention Risks. (2) systematically evaluate different MLLMs using MM-Privacy and demonstrate how models leak sensitive data across various tasks, and (3) provide additional insights into the role of task inconsistency in privacy risks, emphasizing the urgent need for mitigation strategies. Our findings highlight privacy concerns in MLLMs, underscoring the necessity of safeguards to prevent data exposure. Our dataset and code can be found here.

Tiejin Chen, Pingzhi Li, Kaixiong Zhou +2

Arizona State University · University of North Carolina at Chapel Hill · North Carolina State University

Multimodal Large Language ModelsPrivacy
AskPDF
Jun 29, 2026cs.AI

Rethinking Generative Reconstruction Attacks against Graph Neural Network Models

The application of graph data in numerous disciplines raises the need for gathering and analyzing huge volumes of data, some of which is private and sensitive. The non-Euclidean nature of the graph data makes the analysis computationally challenging, leading to the use of Graph Neural Networks (GNNs) in the age of AI. GNNs may inadvertently leak sensitive data they are trained on, which raises serious data security issues, including the model inversion attack. In this study, we analyze GNNs' vulnerabilities by introducing two novel graph inversion (i.e., reconstruction) attacks: graph-label conditioned (GLC) attack and embedding-label conditioned (ELC) attack, utilizing targetmodel predictions and their intermediate representations, respectively. We perform a comprehensive analysis of our introduced privacy attacks and compare them with existing baselines across three benchmark graph datasets (i.e., NCI1, PROTEINS, and AIDS) and four graph distributional/structural metrics (i.e., FGD, EGD, MMD, and GKS). Our work demonstrates that an adversary can use the generator-discriminator technique to reconstruct high-quality graphs in real-world black-box attack scenarios against GNNs. Additionally, we present a variant of our attacks (Ours--) with 50% reduced queries, achieving good or comparable reconstruction attack performance. In addition, we show that GNNs are highly vulnerable to privacy attacks, varying Laplacian noise-scales.

Adebayo Keji, Sayanton Dibbo

Department of Computer Science, The University of Alabama

Graph Neural Networks
AskPDF