Auditing Privacy Risks in LLM-Enhanced Graph Neural Networks

Longzhu He; Zelang Wen; Chaozhuo Li; Sen Su

cs.LGAug 26, 2026

Auditing Privacy Risks in LLM-Enhanced Graph Neural Networks

Authors: Longzhu He, Zelang Wen, Chaozhuo Li, Sen Su

Organizations: Beijing University of Posts and Telecommunications

Abstract

Large language models (LLMs) have recently advanced graph neural networks (GNNs) by enriching node representations with semantic information, giving rise to LLM-enhanced GNNs that achieve substantial performance gains. However, how such semantic enhancement affects privacy risks remains largely underexplored. To bridge this gap, we systematically audit the privacy risks of LLM-enhanced GNNs through a unified framework consisting of five stages: (1) dataset preparation, (2) victim model training, (3) privacy attack, (4) risk assessment, and (5) defense analysis. Specifically, our evaluation spans ten text-attributed graph datasets across diverse domains, six privacy attacks, 42 LLM-enhanced GNN configurations, and three more recent language-model backbones. Extensive experiments show that, despite their utility improvements, LLM-enhanced GNNs consistently exhibit greater empirical privacy vulnerability than shallow text representation baselines under the evaluated attacks across diverse models and datasets. Further analysis shows that LLM-enhanced representations exhibit more distinguishable link-, label-, and membership-related signals in the embedding space, making them more exploitable by inference attacks. Finally, we evaluate representative defenses and examine their effectiveness in mitigating these privacy risks. Overall, this work provides a systematic audit of privacy risks in LLM-enhanced GNNs and offers insights for developing more secure and trustworthy graph learning systems.

Figures & tables

Figure 1: Overview of the proposed privacy auditing framework. It consists of five stages: dataset preparation, victim model training, privacy attack, risk assessment, and defense analysis.

Figure 2: Adversary–model interaction illustration under black-box access.

Dataset	#Nodes	#Edges	#Classes	Domain
Cora	2,708	5,429	7	Citation
CiteSeer	3,327	4,552	6	Citation
Ogbn-Products	12,011	21,987	47	E-commerce
Tape-Arxiv23	13,167	23,735	40	Citation
Instagram	11,339	144,010	2	Social
Reddit	33,434	198,448	2	Social

Table 1: Statistics of datasets.

Dataset	Shallow	TAPE	KEA	LLaMA	Linq	SimTeg	E5-Large
Cora	80.8 $\pm$ 1.1	82.1 $\pm$ 1.1	83.2 $\pm$ 0.8	82.2 $\pm$ 0.6	84.8 $\pm$ 0.4	83.3 $\pm$ 0.9	84.5 $\pm$ 0.9
Tape-Arxiv23	55.4 $\pm$ 0.7	72.3 $\pm$ 0.6	65.6 $\pm$ 0.5	70.3 $\pm$ 0.7	71.4 $\pm$ 0.4	70.7 $\pm$ 0.6	71.3 $\pm$ 0.5
CiteSeer	72.3 $\pm$ 1.2	73.6 $\pm$ 1.6	75.2 $\pm$ 1.5	75.3 $\pm$ 1.6	76.6 $\pm$ 0.6	74.9 $\pm$ 0.8	76.2 $\pm$ 2.1
Ogbn-Products	65.6 $\pm$ 0.5	83.1 $\pm$ 0.2	80.9 $\pm$ 0.3	81.2 $\pm$ 0.3	81.7 $\pm$ 0.8	81.4 $\pm$ 0.2	82.2 $\pm$ 0.1
Instagram	63.7 $\pm$ 0.7	65.6 $\pm$ 0.8	66.1 $\pm$ 0.6	67.3 $\pm$ 0.4	67.7 $\pm$ 0.7	64.5 $\pm$ 0.7	65.6 $\pm$ 0.9
Reddit	60.0 $\pm$ 0.9	61.5 $\pm$ 1.0	61.2 $\pm$ 1.0	62.8 $\pm$ 0.3	62.5 $\pm$ 1.1	62.3 $\pm$ 0.4	61.1 $\pm$ 0.5

Table 2: Node classification accuracy (%) across different datasets based on the GCN backbone. The highest results are highlighted with bold , while the second-best results are marked with underline .

Panel of Figure 3 — Figure 3: Link inference results ( MLA / ELA , AUC %) on Cora, Tape-Arxiv23, and CiteSeer with GCN. Additional results across more datasets and settings are provided in Appendix.

Panel of Figure 4 — Figure 4: Label inference results ( HGA / NIA , Accuracy %) on Cora, Tape-Arxiv23, and CiteSeer with GCN. Additional results across more datasets and settings are provided in Appendix.

Panel of Figure 5 — Figure 5: Membership inference results ( MIA / NMA , AUC/Accuracy %) on Cora, Tape-Arxiv23, and CiteSeer with GCN. Additional results across more datasets and settings are provided in Appendix.

Panel of Figure 6 — Figure 6: In-depth analysis of privacy vulnerability on Tape-Arxiv23 with GCN, comparing Linq against the Shallow baseline. (a) Embedding distance distributions of connected vs. unconnected pairs (link inference). (b) CDF of embedding distances of intra-class vs. inter-class pairs (label inference). (c) Prediction confidence distributions of member vs. non-member nodes (membership inference).

Panel of Figure 7 — Figure 7: Effectiveness of six local embedding DP mechanisms under a fixed privacy budget $\epsilon_{e}=5.0$ on Tape-Arxiv23 with GCN and Linq; blue bars denote results before perturbation. (a)-(c) show attack performance for MLA , NIA , and MIA , respectively. (d) reports the corresponding model utility.

Panel of Figure 8 — Figure 8: Attack and utility performance under varying privacy budgets on Tape-Arxiv23 with GCN and Linq. (a) Embedding-level DP ( $\epsilon_{e}$ ) vs. MLA (AUC %) and utility (Accuracy %). (b) Link-level DP (RR) vs. MLA (AUC %) and utility. (c) Label-level DP ( $k$ -RR) vs. HGA (Accuracy %) and utility.

Explore similar work

PriDyG: Privacy-preserving Dynamic Graph Inference with LLM-GNN Collaboration
Aug 4, 2026Yuyang Xia, Ruixuan Liu, Li XiongGnn-Based Detectors Streaming Inference
Emory University Atlanta, Georgia, USA
Unveiling Privacy Risks in Multi-modal Large Language Models: Task-specific Vulnerabilities and Mitigation Challenges
Jun 8, 2026Tiejin Chen, Pingzhi Li, Kaixiong Zhou +2Multimodal Large Language Models Privacy
Arizona State University · University of North Carolina at Chapel Hill · North Carolina State University
Rethinking Generative Reconstruction Attacks against Graph Neural Network Models
Jun 29, 2026Adebayo Keji, Sayanton DibboGraph Neural Networks
Department of Computer Science, The University of Alabama

Aug 4, 2026, cs.CRJ/K move · Enter open · S save

PriDyG: Privacy-preserving Dynamic Graph Inference with LLM-GNN Collaboration

Yuyang Xia, Ruixuan Liu, Li Xiong

Emory University Atlanta, Georgia, USA

Gnn-Based Detectors Streaming Inference

Open paper AskPDF arXiv

Graph inference over relational data can expose sensitive edge information, and this risk becomes more severe in dynamic graphs, where repeated model updates cause privacy loss to accumulate. We formulate Edge-level Differentially Private Dynamic Graph Inference (EDG) and propose PriDyG, a private inference framework that combines GNN-based structural learning with LLM-based semantic reasoning. PriDyG introduces incremental private multi-hop aggregation, which buffers newly arrived edges and processes each edge exactly once. By parallel composition, the total privacy cost equals that of a single static release, independent of the number or schedule of model updates. Compared with geometrically decaying budget allocation, incremental aggregation avoids exponentially increasing noise while preserving exact one-hop signals and at least half of two-hop information transfers. PriDyG further complements privatized GNN outputs with LLM predictions derived solely from node text, incurring no additional edge-level privacy cost. Experiments on four benchmarks for node classification and link prediction show that PriDyG consistently outperforms geometrically decaying baselines under the same privacy budget and matches the utility of naive per-update retraining while reducing cumulative privacy cost by up to three orders of magnitude.

Abstract

Explore similar work

PriDyG: Privacy-preserving Dynamic Graph Inference with LLM-GNN Collaboration

Unveiling Privacy Risks in Multi-modal Large Language Models: Task-specific Vulnerabilities and Mitigation Challenges

Rethinking Generative Reconstruction Attacks against Graph Neural Network Models