A Robust Watermark-based Fingerprint Framework for GNNs Ownership Verification
Han Zhang, Yan Wang, Guanfeng Liu, Pengfei Ding, Huaxiong Wang, Kwok-Yan Lam
cs.LG
Quick verdict
REMARK 声称通过分布内水印探测实现了 SOTA GNN 所有权验证；其结果优于三种指纹基线，但仅为准确率指标且是单次运行结果。
Summary
本文提出了 REMARK，这是一个将水印生成与基于指纹的验证相结合的图神经网络（GNN）所有权验证框架。针对现有方法的三个局限性——分布外随机水印图导致的效用损失、要求替代模型在含水印数据上进行训练的假设，以及依赖单一输出级别——作者通过 IDWG 模块（GNN-explainer 引导的子图提取、动态图聚类、多头注意力特征合成以及 MMD 引导的结构生成）生成了分布内的探测图，并使用双层 MLP 对原始图和探测图之间的输出差异进行分类。在六个数据集（Cora、CiteSeer、PubMed、CS、Computers、ogbn-arxiv）和四种架构（GCN、GAT、GraphSAGE、GIN）上，REMARK 在嵌入级别上与 Grove/GNNFingers 持平（约为 100%），并取得了最佳的 logit 级别平均值（98.92%±0.09，而其他方法分别为 96.58% 和 95.28%）。在 40% 的替代模型剪枝下，它在 PubMed 上的平均值为 93.81%，在自适应微调攻击下保持在 89.06% 以上。局限性：评估仅限于准确率，没有假阳性率分析；大多数表格缺乏方差和显著性检验；水印基线和 SigFinger 被排除在外，因此 SOTA 的声明仅涵盖了三个指纹基线；消融实验仅涵盖了一个数据集；表 5 中的“平均改进”列未定义。代码和附录通过匿名存储库提供。
Review complete
Assessment at a glance
5
risk flags identified
● high 0
● medium 3
● low 2
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- IDWG-generated in-distribution watermark graphs nearly eliminate embedding-distribution shift (MMD 0.000–0.107 in Table 6 vs 0.13–0.79 for random watermarks in Table 1), avoiding OOD-induced utility degradation.
- REMARK verifies ownership without requiring surrogate models to have been trained on watermark-containing data, reaching ~100% embedding-level accuracy across six datasets and four architectures (Table 4).
- REMARK achieves the best logit-level verification accuracy (98.92%±0.09 average) versus GNNFingers (96.58%±1.37) and Canary (95.28%±0.98), working at both output levels.
- REMARK is more robust than baselines under surrogate pruning (best in 16 of 20 settings, Table 7) and maintains ≥89.06% accuracy under adaptive fine-tuning attacks (Table 8).
Strengths
Quantified pilot study motivating the design
Section 3.2 measures each claimed limitation: embedding MMD between random watermarks and training graphs of 0.13–0.79 (Table 1, max 0.7929 for GCN/Computers), downstream drops up to −21.35% (GAT, Computers, Table 2), and watermark learnability collapsing on Computers (46.15–76.92%, Table 3). The problem is demonstrated with numbers, not anecdotes.
Coherent module design with in-distribution probes
IDWG combines a custom GNNExplainer (~16-node explanation subgraphs), nearest-neighbor-chain dynamic clustering, MHA feature synthesis, and MMD-guided structure generation (§4.1). Table 6 shows watermark-vs-original MMD of 0.000–0.107 versus 0.13–0.79 for random watermarks, directly supporting the in-distribution claim.
Unusually broad evaluation grid
Honest overhead reporting
Reproducibility artifacts
Weaknesses
Accuracy-only evaluation with no false-positive analysis
Weak statistical rigor
SOTA claim rests on a narrow baseline set
Ablation breadth and dataset ambiguity
Adaptive-attack threat model is under-specified
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
REMARK — Structured Preliminary Review
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is REMARK and what problem does it solve?
REMARK is a framework for proving ownership of graph neural network (GNN) models. It generates 'watermark' probe graphs that statistically resemble the model's training data, feeds both the original and probe graphs to a suspect model, and uses the difference in outputs as a fingerprint that a small MLP classifier labels as owned or not owned. This protects expensive-to-train GNNs against model stealing and unauthorized reuse.
Does REMARK degrade the protected model's accuracy?
No. Unlike earlier watermarking methods that train the GNN on out-of-distribution watermark graphs — which the paper's pilot study shows causing accuracy drops of up to about 21% — REMARK never modifies the protected model. Probe graphs are attached only at verification time, so downstream task performance is untouched.
How accurate is REMARK?
Across six datasets and four GNN architectures, it matches prior fingerprinting methods (about 100%) at the embedding level and achieves the best logit-level accuracy: 98.92% ± 0.09 on average, versus 96.58% for GNNFingers and 95.28% for Canary. Under 40% pruning of surrogate models it averages 93.81% on PubMed, and stays at or above 89.06% under an adaptive fine-tuning attack.
Is code or data available for REMARK?
The paper links an anonymized repository (anonymous.4open.science/r/REMARK_APPENDIX-F1A0) hosting the code and appendices, with hyperparameters listed in its Table 14. All six datasets are public via PyG and OGB, though the Cora/CiteSeer statistics suggest the 'Full' dataset variants rather than the standard Planetoid versions.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figures (Fig 2, Fig 4a–c, appendix Figs 5–21) appear in the extraction only as captions and qualitative descriptions; their plotted values (e.g., the Fig 4c ablation magnitudes) could not be visually verified.
- Review is based on the arXiv v1 extraction only; the contents of the anonymous code repository were not inspected, so code availability is taken from the paper's statement.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.