We propose GNNInfer, the first automatic property inference technique for GNNs. To tackle the challenge of varying input structures in GNNs, GNNInfer first identifies a set of representative influential structures that contribute significantly towards the prediction of a GNN. Using these structures, GNNInfer converts each pair of an influential structure and the GNN to their equivalent FNN and then leverages existing property inference techniques to effectively capture properties of the GNN that are specific to the influential structures. GNNINfer then generalizes the captured properties to any input graphs that contain the influential structures. Finally, GNNInfer improves the correctness of the inferred properties by building a model (either a decision tree or linear regression) that estimates the deviation of GNN output from the inferred properties given full input graphs. The learned model helps GNNInfer extend the inferred properties with constraints to the input and output of the GNN, obtaining stronger properties that hold on full input graphs. Our experiments show that GNNInfer is effective in inferring likely properties of popular real-world GNNs, and more importantly, these inferred properties help effectively defend against GNNs' backdoor attacks. In particular, out of the 13 ground truth properties, GNNInfer re-discovered 8 correct properties and discovered likely correct properties that approximate the remaining 5 ground truth properties. Using properties inferred by GNNInfer to defend against the state-of-the-art backdoor attack technique on GNNs, namely UGBA, experiments show that GNNInfer's defense success rate is up to 30 times better than existing baselines.

翻译：我们提出GNNInfer，这是首个针对图神经网络（GNN）的自动化属性推断技术。为应对GNN中输入结构多样化的挑战，GNNInfer首先识别出一组对GNN预测贡献显著的具代表性影响力结构。利用这些结构，GNNInfer将每个影响力结构与GNN的配对转化为等价的前馈神经网络（FNN），进而借助现有属性推断技术有效捕获该GNN在特定影响力结构下的属性。随后，GNNInfer将所捕获的属性推广至包含这些影响力结构的任意输入图。最后，GNNInfer通过构建模型（决策树或线性回归）来估计给定完整输入图时GNN输出与推断属性的偏差，从而提升推断属性的正确性。学习得到的模型帮助GNNInfer将推断属性扩展至包含GNN输入输出的约束，获得在完整输入图上成立的更强属性。实验表明，GNNInfer在推断主流真实世界GNN的近似属性方面效果显著，更重要的是，这些推断属性可有效防御针对GNN的后门攻击。在13个真实属性中，GNNInfer重新发现了8个正确属性，并发现了可近似剩余5个真实属性的可能正确属性。使用GNNInfer推断的属性防御当前最先进的GNN后门攻击技术UGBA的实验显示，GNNInfer的防御成功率相比现有基线最高提升30倍。