Dagger: Decoupling-based Model Stealing Attack against Graph Neural Networks

Ying Song; Xiaowei Jia; Balaji Palanisamy

cs.CRSep 29, 2026

Dagger: Decoupling-based Model Stealing Attack against Graph Neural Networks

Authors: Ying Song, Xiaowei Jia, Balaji Palanisamy

Organizations: University of Pittsburgh · Rutgers University

Abstract

As Graph Neural Networks (GNNs) are widely deployed as Machine Learning-as-a-Service (MLaaS) APIs, model stealing attacks have emerged as a critical security threat. By querying a victim model's black-box API, an adversary can construct a functionally equivalent surrogate model, compromising proprietary intellectual property and downstream security. Existing GNN stealing attacks, however, rely on overly permissive assumptions, such as soft-label outputs, large query budgets, full-graph query access, and prior knowledge of victim backbones that rarely hold in real-world deployments. In this work, we formalize a strictly constrained black-box, hard-label and backbone-agnostic threat model for GNN stealing attacks under a tight query budget. Given these realistic restrictions, we identify four fundamental challenges: sparse local structures and isolated nodes that degrade victim label quality, insufficient supervision signals, systematic imbalance with incomplete class coverage, and backbone mismatch. To address these interlocking barriers, we propose Dagger, a novel two-phase decoupling-based attack framework. Specifically, in Phase 1, Dagger pre-trains a surrogate using decoupled information propagation to preserve structural context over sparse local subgraphs while handling isolated nodes, combined with manifold-level node mixup to synthesize continuous supervision signals and smooth decision boundaries. In Phase 2, Dagger freezes the encoder and fine-tunes the classifier head via class-balanced sampling paired with logit adjustment to rectify severe query imbalance without requiring extra victim queries. Extensive experiments across four benchmark graphs and four GNN backbones demonstrate that Dagger consistently outperforms state-of-the-art GNN stealing attacks, achieving up to 18.16% higher fidelity while only utilizing 12.23 $\times$ fewer queries than the strongest baseline.

Figures & tables

Dataset	# of Nodes	# of Edges	# of Features	# of Classes	Avg. Degree	Node Homophily (%)
Cora	2,708	10,556	1,433	7	3.90	82.52
PubMed	19,717	88,651	500	3	4.50	79.24
Computer	13,752	491,722	767	10	35.76	78.53
Physics	34,493	495,924	8,415	5	14.38	91.53

TABLE I : Statistics of the Graph Datasets

Fig. 1 : Label Quality Changes across Multi-hop Expansion

Fig. 4 : Pairwise Prediction Agreement Changes across Multi-hop Expansion

Dataset	Backbone	Baseline	Metrics
Dataset	Backbone	Baseline	ACC	FID	Macro F1	Boundary Fid.	Query
Cora	GCN	Rand	26.57 $\pm$ 0.00	27.31 $\pm$ 0.00	6.00 $\pm$ 0.00	10.00 $\pm$ 0.00	135
		MEA	61.50 $\pm$ 2.63	64.33 $\pm$ 2.30	53.08 $\pm$ 2.37	37.62 $\pm$ 4.10	686
		AdvMEA	40.22 $\pm$ 3.95	42.19 $\pm$ 5.77	28.47 $\pm$ 6.43	19.05 $\pm$ 7.59	315
		CEGA	28.66 $\pm$ 5.15	28.41 $\pm$ 5.25	19.32 $\pm$ 3.13	13.33 $\pm$ 2.69	133
		DFEAII-Real	29.64 $\pm$ 3.87	29.64 $\pm$ 4.11	13.87 $\pm$ 3.51	10.48 $\pm$ 0.67	135

TABLE II : The Performance of Dagger on Cora and Computer. Unit of Top 4 metrics: 1e-2 . Arrow indicates the direction of better performance and the bold font denotes the ‘best’ results.

Fig. 6 : GNN Architecture Configuration Sensitivity

Panel of Figure 9 — Fig. 7 : Manifold Coefficient Sensitivity

Panel of Figure 10 — Fig. 8 : Query Budget Sensitivity

Dataset	Backbone	Baseline	Metrics
Dataset	Backbone	Baseline	ACC	FID	Macro F1	Boundary Fid.
Cora	GCN	No manifold	65.81 $\pm$ 0.46	68.14 $\pm$ 0.92	51.25 $\pm$ 0.47	30.95 $\pm$ 1.35
		No LA	70.36 $\pm$ 0.46	72.94 $\pm$ 0.17	54.24 $\pm$ 0.37	29.05 $\pm$ 0.67
		No Tuning	70.60 $\pm$ 0.63	72.94 $\pm$ 0.70	54.22 $\pm$ 0.59	29.05 $\pm$ 1.35
		Dagger	71.83 $\pm$ 0.46	73.68 $\pm$ 0.17	59.22 $\pm$ 1.20	32.86 $\pm$ 1.17
	GAT	No manifold	55.10 $\pm$ 1.66	57.44 $\pm$ 1.36	45.69 $\pm$ 1.31	27.78 $\pm$ 0.98

TABLE III : Ablation Studies across Graph Datasets and GNN backbones

Dataset	Backbone	Defense	Pred Acc	Pred Fid	Metrics
Dataset	Backbone	Defense	Pred Acc	Pred Fid	ACC	FID	Macro F1	Boundary Fid.
Cora	GCN	PRADA	83.03	100.00	68.88 $\pm$ 0.17	72.45 $\pm$ 0.63	55.80 $\pm$ 0.64	33.33 $\pm$ 1.78
	GCN	BackdoorWM	85.98	84.87	75.15 $\pm$ 1.36	75.77 $\pm$ 0.97	69.79 $\pm$ 1.42	41.43 $\pm$ 1.17
	GAT	PRADA	80.81	100.00	72.69 $\pm$ 1.38	74.91 $\pm$ 0.60	65.61 $\pm$ 2.25	40.97 $\pm$ 2.60
	GAT	BackdoorWM	85.98	84.87	74.66 $\pm$ 0.97	76.01 $\pm$ 1.68	68.96 $\pm$ 1.08	41.67 $\pm$ 5.10
	APPNP	PRADA	80.44	100.00	68.02 $\pm$ 0.46	73.55 $\pm$ 0.35	53.95 $\pm$ 0.63	45.95 $\pm$ 1.10

TABLE IV : Dagger’s Attack Performance against Defense Mechanisms across Graph Datasets and GNN Backbones

Dataset	GNN	Metrics
Dataset	GNN	Acc	F1
Cora	GCN	83.03	79.61
	GAT	80.81	73.26
	APPNP	80.44	67.30
	GraphSAGE	87.45	85.48
PubMed	GCN	84.28	83.18

TABLE V : Benign Performance across GNN Backbones

Dataset	Backbone	Baseline	Metrics
Dataset	Backbone	Baseline	ACC	FID	Macro F1	Boundary Fid.	Query
PubMed	GCN	Rand	40.67 $\pm$ 0.00	39.15 $\pm$ 0.00	19.27 $\pm$ 0.00	39.04 $\pm$ 0.00	985
		MEA	82.44 $\pm$ 0.57	93.93 $\pm$ 1.48	81.26 $\pm$ 0.65	63.74 $\pm$ 1.03	3810
		AdvMEA	50.91 $\pm$ 5.15	53.23 $\pm$ 5.90	44.38 $\pm$ 10.17	51.52 $\pm$ 3.48	150
		CEGA	50.68 $\pm$ 1.21	54.36 $\pm$ 1.18	47.83 $\pm$ 2.72	42.54 $\pm$ 0.62	984
		DFEAII-Real	49.15 $\pm$ 2.47	52.18 $\pm$ 2.35	42.51 $\pm$ 3.44	39.04 $\pm$ 1.29	985

TABLE VI : The Performance of Dagger on PubMed and Physics. Unit: 1e-2 . Arrow indicates the direction of better performance and the bold font denotes the ‘best’ results.

Panel of Figure 15 — Fig. 9 : Balance Level Sensitivity and Other Factors

Dataset	Backbone	Ablation	Metrics
Dataset	Backbone	Ablation	ACC	FID	Macro F1	Boundary Fid.
PubMed	GCN	No manifold	83.67 $\pm$ 0.08	91.48 $\pm$ 0.23	82.50 $\pm$ 0.18	52.78 $\pm$ 0.21
		No LA	84.18 $\pm$ 0.11	91.77 $\pm$ 0.42	83.12 $\pm$ 0.18	53.65 $\pm$ 1.61
		No Tuning	83.54 $\pm$ 0.71	91.21 $\pm$ 0.48	82.11 $\pm$ 0.98	52.78 $\pm$ 1.09
		Dagger	83.81 $\pm$ 0.06	91.72 $\pm$ 0.17	82.80 $\pm$ 0.14	54.53 $\pm$ 0.55
	GAT	No manifold	84.08 $\pm$ 0.43	92.11 $\pm$ 0.16	82.83 $\pm$ 0.50	59.07 $\pm$ 0.42

TABLE VII : Ablation Studies across Graph Datasets and GNN Backbones

Explore similar work

May 12, 2026cs.CR

GraphIP-Bench: How Hard Is It to Steal a Graph Neural Network, and Can We Stop It?

Graph neural networks (GNNs) deployed as cloud services can be stolen through model-extraction attacks, which train a surrogate from query responses to reproduce the target's behavior, and a growing line of ownership defenses tries to prevent or trace such theft. This paper asks two questions: how hard is it to steal a GNN, and can we stop it? Prior work cannot answer either, because experiments use inconsistent datasets, threat models, and metrics. We introduce GraphIP-Bench, a unified benchmark that evaluates both sides under a single black-box protocol. GraphIP-Bench integrates twelve extraction attacks, twelve defenses spanning watermarking, output perturbation, and query-pattern detection, ten public graphs covering homophilic, heterophilic, and large-scale regimes, three GNN backbones, and three graph-learning tasks. It reports fidelity, task utility, ownership verification, and computational cost on shared splits, queries, and budgets. We further add a joint attack-and-defense track that runs every attack on every defended target and measures watermark verification on the resulting surrogate, exposing how much protection a defense retains after extraction. The empirical picture is clear: stealing a GNN is easy at medium query budgets and most defenses do not change this; several watermarks verify reliably on the protected model but lose most of their verification signal on the extracted surrogate, exposing a gap that single-model evaluations miss; and heterophilic graphs are systematically harder to steal, while a cross-architecture mismatch between target and surrogate reduces but does not prevent extraction. We release GraphIP-Bench with reproducible scripts and configurations, and integrate the attacks and defenses into the PyGIP library. Code: https://github.com/LabRAI/GraphIP-Bench. Library: https://labrai.github.io/PyGIP/index.html.

Kaixiang Zhao, Bolin Shen, Yuyang Dai +2

University of Notre Dame · Florida State University · University of California, Berkeley

Graph Neural Networks Watermarking Neural Network Hard

Ask PDF

Jun 28, 2026cs.LG

Blackknife: Hard-Label Query-Limited Black-Box Attacks on Heterogeneous Graph Neural Networks

Heterogeneous graph neural networks (HGNNs) have achieved strong performance in modeling complex graph-structured data with multiple node and relation types. However, their robustness under realistic black-box adversarial settings remains insufficiently explored. Existing attacks on HGNNs usually assume access to model gradients, soft prediction scores, or the complete graph structure, which is often unavailable when HGNN-based services are deployed as closed systems. In this paper, we propose Blackknife, a hard-label, query-limited, and structure-limited black-box evasion attack framework for heterogeneous graph neural networks. Blackknife assumes no access to the victim model architecture, parameters, gradients, logits, confidence scores, or the full graph structure. Instead, it only relies on locally observable one-hop heterogeneous structures and a small number of hard-label queries. To generate effective perturbations under these strict constraints, Blackknife first constructs a local relation-aware surrogate model from observable heterogeneous neighborhoods. It then relaxes discrete edge addition and deletion operations into continuous soft weights and optimizes them through projected gradient descent. Finally, the optimized perturbations are discretized into relation-preserving structural rewiring operations and verified using limited hard-label feedback from the victim model. Extensive experiments on three benchmark heterogeneous graph datasets, including ACM, DBLP, and IMDB, demonstrate that Blackknife consistently achieves strong attack success rates against representative HGNN models. The results further show that Blackknife remains effective under topology-based defense strategies, revealing the vulnerability of HGNNs to local structure-limited black-box attacks.

Honglin Gao, Junhao Ren, Lan Zhao +3

Nanyang Technological University, 50 Nanyang Avenue, Singapore, 639798, Singapore · Computer Network Information Center, Chinese Academy of Sciences, Beijing, China

Graph Neural Networks White-Box Spectral-Subspace-Guided Attack Label Propagation

Ask PDF

Aug 11, 2026cs.LG

Defending against Model Extraction for GNNs with Model Reprogramming

Graph Neural Networks (GNNs) serve as the backbone for high-stakes applications in Machine-Learning-as-a-Service (MLaaS). Still, their black-box deployment exposes them to Model Extraction (ME) attacks, in which adversaries steal intellectual property by querying APIs. Existing defenses suffer from a critical ''Euclidean bias'': they transfer image-based strategies (e.g., random noise) to graphs, ignoring the complex topological dependencies between nodes, which often results in severe utility degradation. Passive methods like watermarking also fail to prevent theft in real time. To bridge this gap, we propose GraphRP (Graph Reprogramming Protection), a proactive defense framework that repurposes Model Reprogramming for security. Unlike static perturbations, GraphRP introduces a Structure-Aware Gating Mechanism driven by learnable topological prototypes. This creates a dynamic ''structural firewall'' that selectively modulates the model's decision boundary: it preserves fidelity for benign queries residing on the training manifold, while maximizing the Fisher Information along the perturbation direction for adversarial queries. Under standard assumptions (bounded loss, optimal attacker, and local second-order approximation), we prove a lower bound on the attacker's estimation error that increases with the structural sensitivity of the reprogramming noise. Extensive experiments on both hard-label and soft-label ME attacks demonstrate that GraphRP significantly degrades attack effectiveness while preserving benign utility.

Yan Wen, Zhenyi Wang, Heng Huang

University of Maryland, College Park Department of Computer Science College Park, MD, USA · University of Central Florida Department of Computer Science and Institute of Artificial Intelligence Orlando, FL, USA

Graph Neural Networks Semantic Firewall

Ask PDF