With the increasing popularity of graph neural networks (GNNs) in several sensitive applications like healthcare and medicine, concerns have been raised over the privacy aspects of trained GNNs. More notably, GNNs are vulnerable to privacy attacks, such as membership inference attacks, even if only black-box access to the trained model is granted. We propose PrivGNN, a privacy-preserving framework for releasing GNN models in a centralized setting. Assuming an access to a public unlabeled graph, PrivGNN provides a framework to release GNN models trained explicitly on public data along with knowledge obtained from the private data in a privacy preserving manner. PrivGNN combines the knowledge-distillation framework with the two noise mechanisms, random subsampling, and noisy labeling, to ensure rigorous privacy guarantees. We theoretically analyze our approach in the Renyi differential privacy framework. Besides, we show the solid experimental performance of our method compared to several baselines adapted for graph-structured data. Our code is available at https://github.com/iyempissy/privGnn.

翻译：随着图神经网络在医疗健康等敏感领域的广泛应用，训练后的图神经网络存在的隐私问题引发广泛关注。值得注意的是，即便仅授予对训练模型的黑盒访问权限，图神经网络仍易受到成员推断攻击等隐私威胁。本文提出PrivGNN框架，用于在集中式场景下实现隐私保护的图模型发布。该框架假设可访问公开无标注图数据，通过隐私保护方式释放基于公开数据训练的图模型及其从私有数据中提取的知识。PrivGNN融合知识蒸馏框架与两种噪声机制（随机子采样和噪声标注），确保严格的隐私保障。我们在Rényi差分隐私框架下对该方法进行了理论分析。此外，与为图结构数据适配的多种基线方法相比，实验证明本方法具有显著性能优势。相关代码已开源至https://github.com/iyempissy/privGnn。