GraphRP's structural firewall blocks GNN theft without sacrificing accuracy

Graph Neural Networks (GNNs) power high-stakes MLaaS applications, but their black-box APIs are vulnerable to Model Extraction (ME) attacks, where adversaries steal model IP by querying responses. Existing defenses often suffer from a 'Euclidean bias'—they transplant image-based perturbations like random noise to graph data, ignoring the complex topological dependencies between nodes. This causes severe utility degradation and leaves GNNs exposed. Passive methods like watermarking also fail to prevent real-time theft.

To fix this, the authors introduce GraphRP (Graph Reprogramming Protection), a proactive defense that repurposes Model Reprogramming for security. Its core is a Structure-Aware Gating Mechanism driven by learnable topological prototypes, creating a dynamic 'structural firewall.' This firewall selectively modulates the decision boundary: benign queries on the training manifold retain high fidelity, while adversarial queries encounter maximized Fisher Information along the perturbation direction. The work proves a theoretical lower bound on attacker estimation error, and extensive experiments on both hard-label and soft-label ME attacks show GraphRP drastically reduces attack success without harming legitimate use. Accepted at KDD 2026, this offers a practical, robust defense for graph-based ML services.