As Graph Neural Networks (GNNs) become widely used in critical industries like healthcare, finance, and entertainment, they are increasingly targeted by backdoor attacks. These attacks compromise GNN safety and reliability by subtly manipulating training data to introduce hidden vulnerabilities. This study assesses the effectiveness of state-of-the-art defense mechanisms against the most recent backdoor attack techniques, aiming to identify potential attacks that could bypass current detection strategies. By comparing attack success rates across various GNN architectures, we find that no single attack evades all defenses. However, a robust defense can be achieved by combining two major types of existing defense mechanisms. This result highlights the urgent need for stronger, more comprehensive defenses to support safe GNN deployment.

Differential Privacy is a standard approach for ensuring privacy in deep learning models, but its effectiveness is less certain when applied to message-passing Graph Neural Networks (GNNs). GNNs, which process graph-structured data, generate node representations by aggregating information from neighboring nodes. At the k-th layer, GNNs propagate information across a node’s k-hop neighborhood, causing interconnected nodes to influence each other’s representations. Consequently, protecting the privacy of a single node, edge, or feature often requires safeguarding information about related graph elements as well. Previous methods have addressed this issue by injecting noise into the data, though finding the right balance is challenging; while more noise increases privacy, excessive noise degrades model output. Other approaches use custom architectures to decouple neighborhood aggregation from node representation learning, but these solutions often struggle to scale to large graphs. We propose a strategy for training subgraph-level DP-GNNs by extracting disjoint subgraphs from the training dataset and applying the DP-SGD algorithm, treating each subgraph as an independent sample. This method protects the privacy of target nodes and their neighbors. Our graph partitioning approach is inspired by community detection techniques, which help preserve relevant connections within partitions. By restructuring the training data, our solution enhances privacy protection while maintaining model utility, ultimately outperforming existing techniques.

In conventional federated learning (FL) frameworks for knowledge graph embedding (KGE), individual clients independently train their local KGE models. A trusted server then collects and aggregates the locally computed embeddings (e.g., by averaging) to generate a consolidated, shared model. This process maintains data privacy throughout FL training, as the server does not require direct access to client data. However, data heterogeneity (i.e., non-identically distributed data across clients) significantly challenges the performance of FL global averaging-based aggregation algorithms, where averaging embeddings can lead to oversmoothing and loss of relational patterns among entities. To address these challenges, we introduce a supervised, KGE model-agnostic contrastive learning (CL) approach for federated settings. Our approach uses CL to align embeddings of the same entity across clients while maintaining distinctions between different entities, thus preserving both intra-and inter-entity relationships during aggregation. Experiments on benchmark datasets demonstrate that our proposed model outperforms state-of-the-art FL-KGE aggregation algorithms, particularly with large numbers of clients.