aiqbench analysis
This research introduces REMARK, a novel framework designed to address critical vulnerabilities in Graph Neural Network (GNN) ownership verification by enhancing robustness against out-of-distribution attacks and removing unrealistic assumptions about surrogate model training. By leveraging carefully crafted in-distribution watermark graphs, the method achieves state-of-the-art accuracy in detecting model theft while preserving the utility of protected models for legitimate tasks. This advancement directly tackles the economic risks associated with GNN infringement through more reliable technical safeguards.
A Robust Watermark-based Fingerprint Framework for GNNs Ownership Verification
arXiv:2609.04772v1 Announce Type: new Abstract: The high training cost of Graph Neural Networks (GNNs) has raised growing concerns regarding model ownership infringement, such as model stealing and unauthorized misuse. To verify model ownership and prevent significant economic losses, two groups of GNN Ownership Verification (OV) methods have been proposed: watermark-based methods and fingerprint-based methods. However, these methods typically face three limitations: (1) the performance degradation of protected models caused by out-of-distribution (OOD) watermark graphs with respect to the training set; (2) the unrealistic assumption that surrogate models have been trained on a watermark-containing training set; and (3) over-reliance on specific output levels for fingerprint extraction. In this paper, we propose a Robust watErMArk-based fingeRprint frameworK for GNNs, named REMARK. REMARK first generates carefully crafted in-distribution watermark graphs that maximize output differences between GNN models, thus mitigating OOD-induced performance degradation. REMARK then extracts robust fingerprints from these output differences to verify GNN ownership, thereby removing the assumptions that surrogate models must be trained on a watermark-containing dataset or expose specific output levels. Extensive experiments across widely used real-world datasets and GNN architectures demonstrate that REMARK achieves state-of-the-art OV accuracy and robustness while preserving the utility of protected models.
Abstract:The high training cost of Graph Neural Networks (GNNs) has raised growing concerns regarding model ownership infringement, such as model stealing and unauthorized misuse. To verify model ownership and prevent significant economic losses, two groups of GNN Ownership Verification (OV) methods have been proposed: watermark-based methods and fingerprint-based methods. However, these methods typically face three limitations: (1) the performance degradation of protected models caused by out-of-distribution (OOD) watermark graphs with respect to the training set; (2) the unrealistic assumption that surrogate models have been trained on a watermark-containing training set; and (3) over-reliance on specific output levels for fingerprint extraction. In this paper, we propose a Robust watErMArk-based fingeRprint frameworK for GNNs, named REMARK. REMARK first generates carefully crafted in-distribution watermark graphs that maximize output differences between GNN models, thus mitigating OOD-induced performance degradation. REMARK then extracts robust fingerprints from these output differences to verify GNN ownership, thereby removing the assumptions that surrogate models must be trained on a watermark-containing dataset or expose specific output levels. Extensive experiments across widely used real-world datasets and GNN architectures demonstrate that REMARK achieves state-of-the-art OV accuracy and robustness while preserving the utility of protected models.
Machine Learning (cs.LG)
arXiv:2609.04772 [cs.LG]
(or arXiv:2609.04772v1 [cs.LG] for this version)
https://doi.org/10.48550/arXiv.2609.04772 Focus to learn more arXiv-issued DOI via DataCite (pending registration)
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Full text under the publisher's open licence · 286 words
Related coverage
GENIE: Watermarking Graph Neural Networks for Link Prediction
arXiv · Sep 2, 2026
Geometry-Aware Localized Watermarking for Copyright Protection in Embedding-as-a-Service
arXiv · Aug 6, 2026
From Bits to Beliefs: Recoverable Semantic Fingerprints for Black-Box Verification of Large Language Models
arXiv · Sep 22, 2026
CertDW: Towards Certified Dataset Ownership Verification via Conformal Calibration
arXiv · Sep 12, 2026