Adversarial Attacks on GNN-Based Vertical Federated Learning

Graph Neural Network (GNN) has emerged as a powerful technique for graph representation learning. However, when faced with large-scale private data collected from users, GNN may struggle to deliver optimal performance due to the lack of rich features and complete adjacent relationships. To address this challenge, a solution called vertical federated learning (VFL) has been proposed, which aims to protect local data privacy by training a global model collaboratively. Naturally, for graph-structured data, it is intuitive to develop a GNN-based VFL framework known as GVFL. Despite the success of GNN and VFL, it is essential to investigate whether the vulnerability of GNN to adversarial attacks persists in the GVFL setting. Therefore, we present the first study on adversarial attacks in GVFL and propose a novel adversarial attack method. This method generates adversarial perturbations based on the noise-enhanced global node embeddings, leveraging privacy leakage and the gradient of pairwise nodes. Our approach begins by stealing the global node embeddings and constructing a shadow model of the server for the attack generator. Next, we introduce noise into the node embeddings to confuse the shadow model. Finally, guided by the noise-enhanced node embeddings, we utilize the gradient of pairwise nodes to generate attacks. Extensive experiments conducted on three benchmark datasets demonstrate that our method outperforms baselines in different GNN-based GVFLs, establishing state-of-the-art attack performance.