Dagger: Decoupling-based Model Stealing Attack against Graph Neural Networks

Ying Song; Xiaowei Jia; Balaji Palanisamy

cs.CRSep 29, 2026

Dagger: Decoupling-based Model Stealing Attack against Graph Neural Networks

Authors: Ying Song, Xiaowei Jia, Balaji Palanisamy

Organizations: University of Pittsburgh · Rutgers University

Abstract

As Graph Neural Networks (GNNs) are widely deployed as Machine Learning-as-a-Service (MLaaS) APIs, model stealing attacks have emerged as a critical security threat. By querying a victim model's black-box API, an adversary can construct a functionally equivalent surrogate model, compromising proprietary intellectual property and downstream security. Existing GNN stealing attacks, however, rely on overly permissive assumptions, such as soft-label outputs, large query budgets, full-graph query access, and prior knowledge of victim backbones that rarely hold in real-world deployments. In this work, we formalize a strictly constrained black-box, hard-label and backbone-agnostic threat model for GNN stealing attacks under a tight query budget. Given these realistic restrictions, we identify four fundamental challenges: sparse local structures and isolated nodes that degrade victim label quality, insufficient supervision signals, systematic imbalance with incomplete class coverage, and backbone mismatch. To address these interlocking barriers, we propose Dagger, a novel two-phase decoupling-based attack framework. Specifically, in Phase 1, Dagger pre-trains a surrogate using decoupled information propagation to preserve structural context over sparse local subgraphs while handling isolated nodes, combined with manifold-level node mixup to synthesize continuous supervision signals and smooth decision boundaries. In Phase 2, Dagger freezes the encoder and fine-tunes the classifier head via class-balanced sampling paired with logit adjustment to rectify severe query imbalance without requiring extra victim queries. Extensive experiments across four benchmark graphs and four GNN backbones demonstrate that Dagger consistently outperforms state-of-the-art GNN stealing attacks, achieving up to 18.16% higher fidelity while only utilizing 12.23 $\times$ fewer queries than the strongest baseline.

Figures & tables

Dataset	# of Nodes	# of Edges	# of Features	# of Classes	Avg. Degree	Node Homophily (%)
Cora	2,708	10,556	1,433	7	3.90	82.52
PubMed	19,717	88,651	500	3	4.50	79.24
Computer	13,752	491,722	767	10	35.76	78.53
Physics	34,493	495,924	8,415	5	14.38	91.53

TABLE I : Statistics of the Graph Datasets

Fig. 1 : Label Quality Changes across Multi-hop Expansion

Fig. 4 : Pairwise Prediction Agreement Changes across Multi-hop Expansion

Dataset	Backbone	Baseline	Metrics
Dataset	Backbone	Baseline	ACC	FID	Macro F1	Boundary Fid.	Query
Cora	GCN	Rand	26.57 $\pm$ 0.00	27.31 $\pm$ 0.00	6.00 $\pm$ 0.00	10.00 $\pm$ 0.00	135
		MEA	61.50 $\pm$ 2.63	64.33 $\pm$ 2.30	53.08 $\pm$ 2.37	37.62 $\pm$ 4.10	686
		AdvMEA	40.22 $\pm$ 3.95	42.19 $\pm$ 5.77	28.47 $\pm$ 6.43	19.05 $\pm$ 7.59	315
		CEGA	28.66 $\pm$ 5.15	28.41 $\pm$ 5.25	19.32 $\pm$ 3.13	13.33 $\pm$ 2.69	133
		DFEAII-Real	29.64 $\pm$ 3.87	29.64 $\pm$ 4.11	13.87 $\pm$ 3.51	10.48 $\pm$ 0.67	135

TABLE II : The Performance of Dagger on Cora and Computer. Unit of Top 4 metrics: 1e-2 . Arrow indicates the direction of better performance and the bold font denotes the ‘best’ results.

Fig. 6 : GNN Architecture Configuration Sensitivity

Panel of Figure 9 — Fig. 7 : Manifold Coefficient Sensitivity

Panel of Figure 10 — Fig. 8 : Query Budget Sensitivity

Dataset	Backbone	Baseline	Metrics
Dataset	Backbone	Baseline	ACC	FID	Macro F1	Boundary Fid.
Cora	GCN	No manifold	65.81 $\pm$ 0.46	68.14 $\pm$ 0.92	51.25 $\pm$ 0.47	30.95 $\pm$ 1.35
		No LA	70.36 $\pm$ 0.46	72.94 $\pm$ 0.17	54.24 $\pm$ 0.37	29.05 $\pm$ 0.67
		No Tuning	70.60 $\pm$ 0.63	72.94 $\pm$ 0.70	54.22 $\pm$ 0.59	29.05 $\pm$ 1.35
		Dagger	71.83 $\pm$ 0.46	73.68 $\pm$ 0.17	59.22 $\pm$ 1.20	32.86 $\pm$ 1.17
	GAT	No manifold	55.10 $\pm$ 1.66	57.44 $\pm$ 1.36	45.69 $\pm$ 1.31	27.78 $\pm$ 0.98

TABLE III : Ablation Studies across Graph Datasets and GNN backbones

Dataset	Backbone	Defense	Pred Acc	Pred Fid	Metrics
Dataset	Backbone	Defense	Pred Acc	Pred Fid	ACC	FID	Macro F1	Boundary Fid.
Cora	GCN	PRADA	83.03	100.00	68.88 $\pm$ 0.17	72.45 $\pm$ 0.63	55.80 $\pm$ 0.64	33.33 $\pm$ 1.78
	GCN	BackdoorWM	85.98	84.87	75.15 $\pm$ 1.36	75.77 $\pm$ 0.97	69.79 $\pm$ 1.42	41.43 $\pm$ 1.17
	GAT	PRADA	80.81	100.00	72.69 $\pm$ 1.38	74.91 $\pm$ 0.60	65.61 $\pm$ 2.25	40.97 $\pm$ 2.60
	GAT	BackdoorWM	85.98	84.87	74.66 $\pm$ 0.97	76.01 $\pm$ 1.68	68.96 $\pm$ 1.08	41.67 $\pm$ 5.10
	APPNP	PRADA	80.44	100.00	68.02 $\pm$ 0.46	73.55 $\pm$ 0.35	53.95 $\pm$ 0.63	45.95 $\pm$ 1.10

TABLE IV : Dagger’s Attack Performance against Defense Mechanisms across Graph Datasets and GNN Backbones

Dataset	GNN	Metrics
Dataset	GNN	Acc	F1
Cora	GCN	83.03	79.61
	GAT	80.81	73.26
	APPNP	80.44	67.30
	GraphSAGE	87.45	85.48
PubMed	GCN	84.28	83.18

TABLE V : Benign Performance across GNN Backbones

Dataset	Backbone	Baseline	Metrics
Dataset	Backbone	Baseline	ACC	FID	Macro F1	Boundary Fid.	Query
PubMed	GCN	Rand	40.67 $\pm$ 0.00	39.15 $\pm$ 0.00	19.27 $\pm$ 0.00	39.04 $\pm$ 0.00	985
		MEA	82.44 $\pm$ 0.57	93.93 $\pm$ 1.48	81.26 $\pm$ 0.65	63.74 $\pm$ 1.03	3810
		AdvMEA	50.91 $\pm$ 5.15	53.23 $\pm$ 5.90	44.38 $\pm$ 10.17	51.52 $\pm$ 3.48	150
		CEGA	50.68 $\pm$ 1.21	54.36 $\pm$ 1.18	47.83 $\pm$ 2.72	42.54 $\pm$ 0.62	984
		DFEAII-Real	49.15 $\pm$ 2.47	52.18 $\pm$ 2.35	42.51 $\pm$ 3.44	39.04 $\pm$ 1.29	985

TABLE VI : The Performance of Dagger on PubMed and Physics. Unit: 1e-2 . Arrow indicates the direction of better performance and the bold font denotes the ‘best’ results.

Panel of Figure 15 — Fig. 9 : Balance Level Sensitivity and Other Factors

Dataset	Backbone	Ablation	Metrics
Dataset	Backbone	Ablation	ACC	FID	Macro F1	Boundary Fid.
PubMed	GCN	No manifold	83.67 $\pm$ 0.08	91.48 $\pm$ 0.23	82.50 $\pm$ 0.18	52.78 $\pm$ 0.21
		No LA	84.18 $\pm$ 0.11	91.77 $\pm$ 0.42	83.12 $\pm$ 0.18	53.65 $\pm$ 1.61
		No Tuning	83.54 $\pm$ 0.71	91.21 $\pm$ 0.48	82.11 $\pm$ 0.98	52.78 $\pm$ 1.09
		Dagger	83.81 $\pm$ 0.06	91.72 $\pm$ 0.17	82.80 $\pm$ 0.14	54.53 $\pm$ 0.55
	GAT	No manifold	84.08 $\pm$ 0.43	92.11 $\pm$ 0.16	82.83 $\pm$ 0.50	59.07 $\pm$ 0.42

TABLE VII : Ablation Studies across Graph Datasets and GNN Backbones

Explore similar work

GraphIP-Bench: How Hard Is It to Steal a Graph Neural Network, and Can We Stop It?
May 12, 2026Kaixiang Zhao, Bolin Shen, Yuyang Dai +2Graph Neural Networks Watermarking
University of Notre Dame · Florida State University · University of California, Berkeley
Blackknife: Hard-Label Query-Limited Black-Box Attacks on Heterogeneous Graph Neural Networks
Jun 28, 2026Honglin Gao, Junhao Ren, Lan Zhao +3Graph Neural Networks White-Box Spectral-Subspace-Guided Attack
Nanyang Technological University, 50 Nanyang Avenue, Singapore, 639798, Singapore · Computer Network Information Center, Chinese Academy of Sciences, Beijing, China
Defending against Model Extraction for GNNs with Model Reprogramming
Aug 11, 2026Yan Wen, Zhenyi Wang, Heng HuangGraph Neural Networks Semantic Firewall
University of Maryland, College Park Department of Computer Science College Park, MD, USA · University of Central Florida Department of Computer Science and Institute of Artificial Intelligence Orlando, FL, USA

May 12, 2026, cs.CRJ/K move · Enter open · S save

GraphIP-Bench: How Hard Is It to Steal a Graph Neural Network, and Can We Stop It?

Kaixiang Zhao, Bolin Shen, Yuyang Dai, Shayok Chakraborty+1

University of Notre Dame · Florida State University · University of California, Berkeley

Graph Neural Networks Watermarking Neural Network Hard

Open paper AskPDF arXiv

Graph neural networks (GNNs) deployed as cloud services can be stolen through model-extraction attacks, which train a surrogate from query responses to reproduce the target's behavior, and a growing line of ownership defenses tries to prevent or trace such theft. This paper asks two questions: how hard is it to steal a GNN, and can we stop it? Prior work cannot answer either, because experiments use inconsistent datasets, threat models, and metrics. We introduce GraphIP-Bench, a unified benchmark that evaluates both sides under a single black-box protocol. GraphIP-Bench integrates twelve extraction attacks, twelve defenses spanning watermarking, output perturbation, and query-pattern detection, ten public graphs covering homophilic, heterophilic, and large-scale regimes, three GNN backbones, and three graph-learning tasks. It reports fidelity, task utility, ownership verification, and computational cost on shared splits, queries, and budgets. We further add a joint attack-and-defense track that runs every attack on every defended target and measures watermark verification on the resulting surrogate, exposing how much protection a defense retains after extraction. The empirical picture is clear: stealing a GNN is easy at medium query budgets and most defenses do not change this; several watermarks verify reliably on the protected model but lose most of their verification signal on the extracted surrogate, exposing a gap that single-model evaluations miss; and heterophilic graphs are systematically harder to steal, while a cross-architecture mismatch between target and surrogate reduces but does not prevent extraction. We release GraphIP-Bench with reproducible scripts and configurations, and integrate the attacks and defenses into the PyGIP library. Code: https://github.com/LabRAI/GraphIP-Bench. Library: https://labrai.github.io/PyGIP/index.html.

Abstract

Explore similar work

GraphIP-Bench: How Hard Is It to Steal a Graph Neural Network, and Can We Stop It?

Blackknife: Hard-Label Query-Limited Black-Box Attacks on Heterogeneous Graph Neural Networks

Defending against Model Extraction for GNNs with Model Reprogramming