COPYCOP: Ownership Verification for Graph Neural Networks
Provides a method for ownership verification of GNNs, addressing a security problem for model developers.
CopyCop verifies whether a GNN was trained to mimic another GNN's node embeddings, even under different architectures and adversarial transformations. Experiments on 14 datasets and 5 architectures show it is accurate and robust against a broad class of attacks.
Given two GNNs that output node embeddings, how can we determine if they were trained independently? An adversary could have trained one GNN specifically to mimic the other GNN's embeddings. To obscure this relationship between the GNNs, the adversarial GNN might then transform its output embeddings. The two GNNs could have different architectures, weights, and embedding dimensions, and the adversary can transform the embeddings. Despite these stringent conditions, our algorithm (named CopyCop) can identify such copycat GNNs, unlike existing watermarking and fingerprinting methods. We also provide theoretical guarantees for CopyCop. Finally, experiments on 14 datasets and 5 GNN architectures demonstrate that CopyCop is accurate and robust against a broad class of adversarial attacks and transformations. Code is available at: https://anonymous.4open.science/r/CopyCop-Graph-Ownership-Verification-8143/README.md