Decision Boundary-Aware Counterfactual Learning Against Model Extraction Attacks on Graph Neural Networks

When it comes to the marriage of graph neural networks (GNNs) and model extraction attacks, the deployment of GNNs within Machine Learning as a Service (MLaaS) through a publicly pay-per-query API has opened up new attack surfaces. Existing defenses either sacrifice prediction accuracy or fail to thwart more advanced attacks. We investigate this dilemma and discover that fortified models with complex and narrow decision regions are difficult to be reproduced. Nevertheless, complex and narrow decision boundaries are prone to violate the subspaces of neighbor classes under the intrinsic coupling property of graph structure. Furthermore, class-wise representative features within the interior of class-wise subspaces endow the attackers with the capability of functionality replication. Here, we propose a novel model extraction defense, dubbed Decision Boundary-aware Counterfactual Learning (DBCL). DBCL proactively launches counterattacks on potential model extraction attacks, from the very beginning of sensitivity measurement that implicitly detect the malicious queries, such that class-wise representative features embodied in the highly sensitive query batch trigger the demand of worsening their query results unconsciously. Moreover, DBCL draws inspiration from counterfactual learning, aiming at finding the decision boundary-aware adversarial topology perturbations for ambiguously classified query samples, i.e., hard samples, to cross the decision boundary exactly, which introduces the tractive behaviour w.r.t. the inter-connected sensitive samples for class-wise ambiguous topology features. From the graph-structured actionable insights, DBCL innovatively finds the minimum perturbation sufficient for counterfactual learning, without jeopardizing the victim model’s predictive capacity by including confidently classified query samples, i.e., easy samples including sensitive and non-sensitive samples, into their correct classes. Empirically, DBCL shows its effectiveness in reducing the extraction accuracy of the SOTA model extraction attempt with different GNN backbone encoders in evaluating node classification performance. Moreover, we show that DBCL is robust to adaptive model extraction attacks.