A Robust Watermark-based Fingerprint Framework for GNNs Ownership Verification

Graph Neural Networks (GNNs) represent valuable intellectual property, yet watermarks based on out-of-distribution triggers can weaken under pruning, fine-tuning, and distillation. We present InvGNN-WM, which links ownership verification to graph-invariant prediction. By supervising a shared GNN backbone to predict normalized algebraic connectivity on owner-private carrier graphs, InvGNN-WM enables calibrated multi-bit black-box verification through either an auxiliary scalar endpoint or a fixed owner-side decoder of ordinary task logits. We provide conditional guarantees for task-loss control, decision preservation, and key separation, and prove NP-completeness of the exact-removal decision problem for a restricted class of monotone separable decoders. Experiments on node- and graph-classification benchmarks demonstrate high watermark fidelity with small changes in task performance. The task-logit deployment achieves higher detection rates than PreGIP-adapted in matched comparisons and retains detection under the evaluated extraction and retraining budgets. Watermark-assisted distillation further enables owner-side recovery using private verification material.

Given two GNNs that output node embeddings, how can we determine if they were trained independently? An adversary could have trained one GNN specifically to mimic the other GNN's embeddings. To obscure this relationship between the GNNs, the adversarial GNN might then transform its output embeddings. The two GNNs could have different architectures, weights, and embedding dimensions, and the adversary can transform the embeddings. Despite these stringent conditions, our algorithm (named CopyCop) can identify such copycat GNNs, unlike existing watermarking and fingerprinting methods. We also provide theoretical guarantees for CopyCop. Finally, experiments on 14 datasets and 5 GNN architectures demonstrate that CopyCop is accurate and robust against a broad class of adversarial attacks and transformations. Code is available at: https://anonymous.4open.science/r/CopyCop-Graph-Ownership-Verification-8143/README.md

The rapid adoption, usefulness, and resource-intensive training of Graph Neural Network (GNN) models have made them an invaluable intellectual property in graph-based machine learning. However, their wide-spread adoption also makes them susceptible to stealing, necessitating robust Ownership Demonstration (OD) techniques. Watermarking is a promising OD framework for deep neural networks, but existing methods fail to generalize to GNNs due to the non-Euclidean nature of graph data. Existing works on GNN watermarking primarily focus on node and graph classification, overlooking Link Prediction (LP). In this paper, we propose GENIE (watermarking Graph nEural Networks for lInk prEdiction), the first scheme to watermark GNNs for LP. GENIE creates a novel backdoor for both node-representation and subgraph-based LP methods, utilizing a unique trigger set and a secret watermark vector. Our OD scheme is equipped with Dynamic Watermark Thresholding (DWT), ensuring high verification probability while addressing practical issues in existing OD schemes. We extensively evaluate GENIE across 4 diverse model architectures (i.e., SEAL, GCN, GraphSAGE and NeoGNN), 7 real-world datasets and 21 watermark removal techniques and demonstrate its robustness to watermark removal and ownership piracy attacks. Finally, we discuss adaptive attacks against GENIE and a defense strategy to counter it. The codebase and related artifacts are publicly available at our Project Page.