Double Whammy: Stealthy Data Manipulation-Aided Reconstruction Attack on Graph Federated Learning

Abstract

Graph federated learning (GFL) is one of the effective distributed learning paradigms for training graph neural network (GNN) on isolated graph data. It perfectly addresses the issue that GNN requires a large amount of labeled graph data without original data sharing. Unfortunately, recent research has constructed a successful graph reconstruction attack (GRA) on GFL. However, these attacks are still challenged in aspects of effectiveness and stealth. To address the issues, we propose the first Data Manipulation-aided Reconstruction attack on GFL, dubbed as DMan4Rec. The malicious client is born to manipulate its locally collected data to enhance graph stealing privacy from benign ones, so as to construct a double whammy on GFL. It differs from previous work in three terms: 1) effectiveness - to fully utilize the sparsity and feature smoothness of the graph, novel penalty terms are designed adaptive to diverse similarity functions for connected and unconnected node pairs, as well as incorporation label smoothing on top of the original cross-entropy loss; 2) scalability - DMan4Rec is capable of both white-box and black-box attacks via training a supervised model to infer the posterior probabilities obtained from limited queries; 3) stealthiness - by manipulating the malicious client’s node features, it can maintain the overall graph structure’s invariance and conceal the attack. Comprehensive experiments on four real datasets and three GNN models demonstrate that DMan4Rec achieves the state-of-the-art (SOTA) performance, e.g., the attack AUC and precision improved by 9.2% and 10.5%, respectively, compared with the SOTA. Particularly, DMan4Rec achieves an AUC score and a precision score of up to 99.59% and 99.56%, respectively, in black-box setting. Nevertheless, the complete overlap of the distribution graphs supports the stealthiness of the attack. Besides, DMan4Rec still beats the defensive GFL, which alarms a new threat to GFL.