WATERMARKING GRAPH NEURAL NETWORKS VIA EXPLANATIONS FOR OWNERSHIP PROTECTION
Watermarking;GNNs;Ownership;Verification;Ownership Verification;Explanation;Graph
**Summary**: This paper proposed to watermark the explanations of Graph Neural Networks (GNN) to protect the copyright of GNNs. Specifically, this paper utilized GraphLIME to generate the explanations and embed the watermark into them via a dual-objective loss function. This paper further provided a theoretical analysis of the difficulty of locating the watermark.


**Soundness**: fair

**Presentation**: fair

**Contribution**: Poor



**Strengths**

1. The studied problem is of great significance and sufficient interest to ICLR audiences.
2. The main idea is easy to follow to a large extent.
3. The authors try to provide theoretical analyses of their method, which should be encouraged.



**Weaknesses**

1. This paper is very similar to [1] (initially submitted to S&P 2024 on December 7, 2023 and released on arXiv in May 8, 2024, link: https://arxiv.org/abs/2405.04825) in various aspects. It appears to be a straightforward implementation of [1] on Graph Neural Networks. However, it seems that the authors intentionally omit the reference to [1] and exaggerate their contributions by not citing [1].  The authors should provide a detailed discussion of the differences and originality of this paper compared with [1]. Otherwise, this paper might be regarded as plagiarism. The resemblances are outlined below.
   1. These two papers share **the same motivation** that existing backdoor-based watermarking methods are harmful and ambiguous.
   2. These two papers share **the same insight** to embed the watermark into the explanation of the neural network.
   3. These two papers share **nearly the same method** to embed the watermark. [1] proposed to utilize a LIME-based method, while this paper leverages GraphLIME (which is an extension of LIME in GNN).
   4. Both papers utilize **ridge regression** to calculate the explanations.
   5. Both papers use **hypothesis-based methods** for ownership verification.  [1] utilized the chi2-test while this paper uses the z-test.
2. This paper uses Z-test for ownership verification and the follow-up analyses, based on matching indices. However, Z-test can be used only when the variable follows the Gaussian distribution (https://en.wikipedia.org/wiki/Z-test). However, to the best of our knowledge, the matching indice (MI) follows a multinomial distribution instead of the Gaussian distribution. In this case, it is not appropriate to use the Z test. Even if the author tries to claim that the distribution of MI approaches the Gaussian distribution under the central limit theorem, the author needs to verify its correctness through the Normality Test.
3. Missing some important baselines [2, 3]. This paper also lacks an empirical comparison with these baselines.
4. The experiments on the robustness are inadequate. There is no discussion about the resistance to potential adaptive attacks. For example, the adversaries can design a strong adaptive attack by including the proposed method as a regularization and conducting overwirte attacks.



References:

1. Explanation as a Watermark: Towards Harmless and Multi-bit Model Ownership Verification via Watermarking Feature Attribution. NDSS, 2025.
2. Revisiting Black-box Ownership Verification for Graph Neural Networks. S&P, 2024.
3. Watermarking Graph Neural Networks by Random Graphs. ISDFS, 2021.


**Questions**
1. Clarify the differences and novelty of this paper compared with [1].
2. Provide empirical comparisons with existing baseline methods.

---
**Alert for Potential Plagiarism**

We have good reasons to believe that the core methodology of this paper was ported over from our NDSS'25 paper (Explanation as a Watermark: Towards Harmless and Multi-bit Model Ownership Verification via Watermarking Feature Attribution). The authors exaggerate their contribution in this submission by deliberately not citing our NDSS paper. In general, our paper provides a general watermarking method that can be used for both image classification and text generation. This paper is just an implementation of our paper in graph classification, although we did not do GNN experiments in our paper.

Although this paper was accepted in September 2024, and I know ICLR has a 3-month concurrent work policy. However, our work was uploaded to arxiv in early May this year (https://arxiv.org/abs/2405.04825), not to mention that it had already been reviewed by two conferences (SP, CCS). This paper is not only similar to ours in the general direction but also completely plagiarizes our technology. We believe that the original intention of the concurrent work policy is to protect authors from missing comparative work due to objective reasons, rather than to protect malicious plagiarism due to subjective intention. 

I urge the authors to explain this issue and provide a proper and comprehensive illustration and comparison of our work.
Alert for Potential Plagiarism: Highly similar to our work without proper reference and discussions
Yes
No ethics review needed.
1 As far as I know, GNNs is only one type of models for node classification, how about more powerful models such as graph transformers?

2 In Table 1, the authors only show the accuracy after inserting watermark. How about accuracy with performing watermarking? Those data is needed to demonstrate the stealthiness of the attack.
1 This motivation of the paper is clear.

2 The experiments are quite solid.

3 The soundness of the proposed method is good.
In this paper, the authors propose to watermarking GNNs via the explanations of GNNs. Their theory indicates that locating the watermark is an NP-hard problem and the experiments demonstrate that the proposed attack is robust to current defenses.
1 Although the authors claim that the proposed method can avoid data pollution and eliminates intentional misclassification. However, compared to the traditional methods, it requires a more tight threat model: the training process of target models. It is not always accessible to all scenarios.

2 In Figure 2, the results indicate that fine-tuning fails to remove the effectiveness of the embedded watermark. However, as far as I know, the effectiveness of the fine-tuning attack is closely related to the detailed setting of the learning rate, A larger learning rate might attack the proposed method.

3 In this paper, the authors only narrows the attack in the node classfication. It is only a sub-task in the graph community. I am not sure whether the attack is general enough to be applied to another task, such as edge classification.
Yes
No ethics review needed.
Please refer to weaknesses.
It is novel to utilize explanation as 'poisoned labels' of watermarked data, which will not negatively influence the performance of GNNs.
This paper proposes a graph explanation-based watermarking method. The watermarks are set as specific explanations and are trained into the protected model by backdoor techniques. During verification, explanations of watermarked data will be compared with the ground-truth explanations to determine the ownership. In empirical evaluations, authors demonstrate the performance of the proposed watermarking method from different views, e.g., effectiveness, uniqueness, robustness, and undetectability.
The major concern is how verifiers could get the explanations via black-box access to the protected model during the black-box verification. If I read carefully enough, the explanation of GraphLIME can only be obtained under white-box settings with node embeddings or other model parameters. How is the query efficient if they can be obtained via black-box access? I welcome discussion from authors and will consider raising the score if the answer is appropriate.
Yes
No ethics review needed.
Plz see the weakness.
1. The paper studies a novel problem for GNN ownership verification. 
2. The proposed method is interesting and the empirical results demonstrate the effectiveness. 
3. The authors conduct serious robustness evaluation of the proposed methodology.
This paper aims to inject watermarks to graph neural networks, in order to serve as a verification strategy to protect the ownership of the graph neural network. In order to achieve the goal, the authors investigate a new methodology of graph model explanation.
**Concerns Regarding the Presentation**\
From Section 3, the paper uses too many math notations and equations, but didn't provide sufficient explanation and clarification. This make the paper not very easy to follow. For example, the GNN explanation part in Section 3.2, it is hard to see how someone can use it to explain the GNN prediction. Moreover, the switch from Lasso to Ridge Regression will make the give weights to all features. I am not sure how to find important features based on the Ridge Regression output. 

**Concerns Regarding the Threat Model**\
The threat model discussed in this paper appears to lack sufficient justification. Specifically:
1. It is unclear why or under what circumstances “the adversary does not know the location of the watermarked subgraphs, but knows the shape and number of the subgraphs.” In practice, if the adversary is not the model trainer, they may have limited knowledge about the watermark.
2. The authors also mention that the model ownership verifier cannot access the protected model. It’s not immediately clear why the verifier would be unable to access the model parameters. Try to imagine, if an artist who owns a painting work sues another party for copyright infringement, it would be unusual for the artist to prevent the judges from examining their original artworks.
Yes
No ethics review needed.
1. How does the model perform without watermarking? It would be helpful to compare the classification accuracy on downstream tasks before and after embedding the watermark.
2. The explanation method GraphLIME is applied only to the node classification task in the paper. Can this watermarking method be extended to other downstream tasks in graph-based applications?
The paper first introduces node feature explanations into GNN watermarking and demonstrates the potential of model explanations for applications in the GNN watermarking domain. By embedding the watermark within GNN prediction explanations rather than in the training data, the method mitigates risks associated with data pollution and misclassification.
The paper proposes a graph neural network watermarking method that embeds ownership information into the explanations of predictions. During the training process, the node classification loss maintains the model's classification accuracy, while the watermark embedding loss ensures that the feature explanations of the watermarked subgraphs align with the watermark pattern. After training, the model owner can claim its ownership by the similarity between the explanations and the watermark pattern. The author proves that it is an NP-hard problem for attackers to find the watermarked subgraphs. The method mitigates the impact of intentional misclassification compared to traditional backdoor-based watermarking techniques. Experiments on three datasets in node classification task illustrate the effectiveness of ownership verification and its robustness to pruning and fine-tuning.
1. Several prior methods have been proposed in the area of GNN watermarking, such as [1] and [2]. It is important to consider experiments that compare the watermark accuracy and downstream task performance of these methods.
2. The paper highlights the robustness of the method against pruning and fine-tuning. Given that adversaries may attempt model extraction attacks, as described in [3], it is advisable to address the robustness against such extraction attacks.

[1] Zhao, Xiangyu, Hanzhou Wu, and Xinpeng Zhang. "Watermarking graph neural networks by random graphs." 2021 9th International Symposium on Digital Forensics and Security (ISDFS). IEEE, 2021.

[2]Xu, Jing, et al. "Watermarking graph neural networks based on backdoor attacks." 2023 IEEE 8th European Symposium on Security and Privacy (EuroS&P). IEEE, 2023.

[3]Shen, Yun, et al. "Model stealing attacks against inductive graph neural networks." 2022 IEEE Symposium on Security and Privacy (SP). IEEE, 2022.
A black-box approach ownership verification method that watermarks the explanations of GNN output.
@inproceedings{
anonymous2024watermarking,
title={{WATERMARKING} {GRAPH} {NEURAL} {NETWORKS} {VIA} {EXPLANATIONS} {FOR} {OWNERSHIP} {PROTECTION}},
author={Anonymous},
booktitle={Submitted to The Thirteenth International Conference on Learning Representations},
year={2024},
url={https://openreview.net/forum?id=EgP6IEyfYJ},
note={under review}
}
Graph Neural Networks (GNNs) are the mainstream method to learn pervasive graph data and are widely deployed in industry, making their intellectual property valuable. However, protecting GNNs from unauthorized use remains a challenge. Watermarking, which embeds ownership information into a model, is a potential solution. However, existing watermarking methods have two key limitations: First, almost all of them focus on non-graph data, with watermarking GNNs for complex graph data largely unexplored. Second, the de facto backdoor-based watermarking methods pollute training data and induce ownership ambiguity through intentional misclassification. We develop a novel method that watermarks explanations of GNN predictions. Our explanation-based watermarking inherits the strengths of backdoor-based methods (e.g., robust to watermark removal attacks), but avoids data pollution and eliminates intentional misclassification. In particular, our method learns to embed the watermark in GNN explanations such that this unique watermark is statistically distinct from other potential solutions, and ownership claims must show statistical significance to be verified. We theoretically prove that, even with full knowledge of our method, locating the watermark is an NP-hard problem. Empirically, our method manifests robustness to removal attacks like fine-tuning and pruning. By addressing these challenges, our approach marks a significant advancement in protecting GNN intellectual property.
I certify that there is no URL (e.g., github page) that could be used to find authors’ identity.
I acknowledge that I and all co-authors of this work have read and commit to adhering to the ICLR Code of Ethics.
Watermarking GNNs Ownership Verification Ownership Verification Explanation Graph
I certify that there is no acknowledgement section in this submission for double blind review.
/pdf/aaeeacee115f6a1824ade5766ad4306f3c370ea0.pdf
alignment, fairness, safety, privacy, and societal considerations
I understand the reciprocal reviewing requirement as described on https://iclr.cc/Conferences/2025/CallForPapers. If none of the authors are registered as a reviewer, it may result in a desk rejection at the discretion of the program chairs. To request an exception, please complete this form at https://forms.gle/Huojr6VjkFxiQsUp6.
I certify that this submission complies with the submission instructions as described on https://iclr.cc/Conferences/2025/AuthorGuide.
WATERMARKING GRAPH NEURAL NETWORKS VIA EXPLANATIONS FOR OWNERSHIP PROTECTION
ICLR 2025 Conference Submission
ICLR.cc/2025/Conference/Submission