SecGAT: Efficient and Privacy-Preserving Graph Attention Network Inference in Cloud

Privacy-Preserving and Fair Training for Federated GNN

Graph neural networks (GNNs) have become a dominant paradigm for learning over graph-structured data. To protect data privacy in distributed graph settings, federated GNNs have emerged as a promising solution by enabling collaborative model training without raw data sharing. However, recent studies demonstrate that federated GNNs can inherit and even amplify biases from distributed data, resulting in unfair global models. While state-of-the-art (SOTA) approaches have introduced fairness-aware federated GNN frameworks, they overlook the privacy risks arising from client–server communications during training. To address this gap, we propose SaFeGNN, a Secure and Fair Federated Graph Neural Network framework that jointly enforces privacy protection and fairness guarantees. SaFeGNN secures the communication process via additive secret sharing and client-level differential privacy, achieving stronger security guarantees compared to existing solutions. Experimental results show that SaFeGNN maintains performance close to that of the baseline, with only an additional overhead of 2.7 s and 3.6 MB per global round.

PriDyG: Privacy-preserving Dynamic Graph Inference with LLM-GNN Collaboration

Experiments on four benchmarks for node classification and link prediction show that PriDyG consistently outperforms geometrically decaying baselines under the same privacy budget and matches the utility of naive per-update retraining while reducing cumulative privacy cost by up to three orders of magnitude.

Link Inference Attack on Privacy-Preserving Knowledge Graphs

Search as You Want: Authenticated Keyword Search on Graphs With Bounded Leakage

Large-scale graph data are widely used in research and industry, where keyword search serves as a fundamental query paradigm. To reduce costs, data owners commonly outsource graph storage and query processing to cloud service providers, raising concerns about result integrity. Recently, an authenticated graph keyword search scheme was proposed via leveraging the blockchain network, yet it reveals extraneous graph information to the client, incurring structural inference attacks. To solve this issue, we propose PA-GKS, a privacy-aware authenticated graph keyword search scheme with bounded explicit graph leakage of vertex labels and adjacency relations through a decoupled attestation mechanism, where matching roots and answer-trees are attested with different indices independently. We also employ the PGM-index (a learned index) to accelerate the search performance. To further support realistic query requirements, we extend PA-GKS to PA-GKS$^{*}$, which enables flexible and customized keyword search with score thresholds. PA-GKS$^{*}$ introduces a distance-driven tiering strategy and a Merkle tree–chain hybrid index, allowing the two-phase pruning to efficiently prune invalid matching roots. The authenticity and efficiency of our schemes are validated through security analysis and substantial experiments.

Structural Leakage in Graph Encryption: Attacks and Defenses

Graph encryption schemes (GES) enable secure outsourcing of graph data while supporting efficient queries. This report provides a comprehensive analysis of structural leakage in GES for single-pair shortest path (SPSP) queries, integrating findings from two recent works. First, we analyze PathGES, a scheme designed to resist query recovery attacks through heavy-light decomposition (HLD) and canonical fragment encoding. Our analysis reveals that PathGES suffers from significant imbalances in HLD decomposition, with over 99% of token-path mappings being one-to-one on real-world datasets, enabling both the Falzon-Paterson attack and side-channel inference of path lengths. Second, we present Fragment Tree attack that exploits these structural weaknesses to recover query contents, achieving up to 10.24% exact recovery on sparse graphs. Third, we introduce BlindGES, an enhanced scheme incorporating a Merge-and-Divide mechanism and two-level multimap index that reduces one-to-one mappings to below 20%, cuts setup time by 50%, reduces storage overhead by 32%, and limits path length leakage to under 1%. This report systematically presents attack methodologies, defense mechanisms, security proofs, and experimental evaluations on seven real-world datasets.

Latency-Optimal Adaptive Split Inference for Privacy-Preserving Cloud-Edge-End Collaboration

Internet of Things (IoT) end devices are increasingly expected to support privacy-sensitive batch inference, yet their limited computational resources often make full local execution of convolutional neural networks impractical. This paper presents a latency-optimal adaptive split inference framework for privacy-preserving cloud-edge-end collaboration. The end device acts as the trust anchor, executes the plaintext model prefix, encrypts the split activation using fully homomorphic encryption (FHE), and keeps the secret key locally, while the edge and cloud execute assigned model segments only on FHE ciphertexts. We formulate collaborative encrypted inference as a split-pair selection problem over an end-side split point and an edge-side termination point. The proposed planner jointly models plaintext prefix execution, encryption, communication, edge-side FHE execution, and cloud-side FHE completion, and supports both convolution-level and block-level split granularities. Experiments on CIFAR-10 and PathMNIST show that the proposed convolution-level collaborative scheme achieves amortized end-to-end speedups of approximately 12.9 times over full-cloud FHE and 3.9 times over the block-level alternative, while preserving the corresponding plaintext-model accuracy. Including modeled communication, the amortized latencies are 1033.279 s/sample on CIFAR-10 and 1023.429 s/sample on PathMNIST.