Beyond Homophily: Towards Generalized Graph Reconstruction Attack and Defense

2026-06-06

AI Summary

This work addresses the vulnerability of graph neural networks (GNNs) to graph reconstruction attacks, which exploit sensitive structural information leaked during training. It presents the first unified framework modeling both attack and defense through the lens of representation propagation chains, interpreting GNN forward propagation as a Markov chain to elucidate how graph homophily and heterophily influence information leakage. Building on this insight, the authors propose a general-purpose attack method, MC-GRA(+), and a complementary defense mechanism, MC-GPB(+), integrating Markov approximation, hierarchical alignment optimization, and an information suppression strategy that balances privacy and utility. Experimental results demonstrate that MC-GRA(+) substantially improves reconstruction accuracy, while MC-GPB(+) effectively reduces attack success rates with only minor degradation in node classification performance, showing robust applicability across diverse graph structures and GNN architectures.

Abstract

Graph neural networks (GNNs) are widely deployed on relational data, yet they can leak sensitive or proprietary information about the training graph adjacency, e.g., social ties, transactions, and interactions. This work studies graph reconstruction attacks (GRA), a form of model inversion that reconstructs the training adjacency from a trained GNN, given different levels of attacker-side information. We first provide a systematic characterization of when and why adjacency becomes recoverable through features, labels, embeddings, and predictions, with leakage modulated by graph homophily, heterophily, and the model's inductive bias. Motivated by these findings, we view GNN inference through a Markov chain approximation lens, treating the layered forward computation as a chain of topology-dependent representations. Building on this view, we develop complementary attack and defense methods. On the attack side, we propose MC-GRA (+), which reconstructs the adjacency by optimizing a surrogate adjacency whose GNN-induced representations align with those of the target model at each layer. On the defense side, we propose MC-GPB (+), which suppresses adjacency-dependent information throughout the representation chain while aiming to preserve classification accuracy under a privacy-utility trade-off. Experiments across homophilic/heterophilic graph benchmarks and GNNs show that our attacks improve reconstruction fidelity over prior methods, while our defenses reduce reconstruction success with only minor accuracy loss.

Problem

• Graph Reconstruction Attack
• Graph Neural Networks
• Privacy Leakage
• Model Inversion
• Adjacency Recovery

Innovation

• Graph Reconstruction Attack
• Markov Chain Approximation
• GNN Privacy
• Homophily-Heterophily Generalization
• Privacy-Utility Trade-off