Graph Reprogramming Defends GNNs Against Model Extraction Attacks

This paper addresses the vulnerability of Graph Neural Networks (GNNs) to model extraction attacks, a significant concern for Machine-Learning-as-a-Service (MLaaS) deployments where intellectual property can be stolen via API queries. Existing defense mechanisms, often adapted from image-based strategies, tend to perform poorly on graphs due to their "Euclidean bias," failing to account for complex topological dependencies and leading to utility degradation. The authors introduce GraphRP (Graph Reprogramming Protection), a novel proactive defense framework that repurposes model reprogramming for security. GraphRP integrates a Structure-Aware Gating Mechanism, driven by learnable topological prototypes, to create a dynamic "structural firewall." This firewall intelligently adjusts the model's decision boundary, ensuring high fidelity for legitimate queries that align with the training data manifold, while simultaneously increasing the Fisher Information along adversarial perturbation directions. The research provides theoretical proof, under standard assumptions, that GraphRP can establish a lower bound on an attacker's estimation error, which scales with the structural sensitivity of the reprogramming noise. Extensive experiments confirm that GraphRP significantly reduces the effectiveness of both hard-label and soft-label model extraction attacks, all while maintaining the utility of the GNN for benign users.