An Out-Of-Distribution Membership Inference Attack Approach for Cross-Domain Graph Attacks

1 Introduction

Graph Neural Networks (GNNs) [Wu et al., 2019; Fu et al., 2023] have been widely applied in various practical and potentially high-risk scenarios, such as social networks [Sharma et al., 2024], bioinformatics networks [Zhang et al., 2021], and medical diagnosis [Boll et al., 2024]. Existing researches [Wu et al., 2020b; Veliˇckovi´c et al., 2017] leverage the ability of GNNs to capture structural information and node features to address diverse downstream tasks [Tu et al., 2021]. However, the in-depth mining of data and the powerful representation capabilities of the model also raise serious privacy concerns [Zhang et al., 2025; Zhang et al., 2024a].

With the growing concern for personal privacy security [Zhang et al., 2024b; Wei et al., 2024; Li et al., 2025], graph-structured data has been proven to be highly susceptible to Membership Inference Attacks (MIA) due to its rich associative semantics. In MIA, attackers attempt to infer whether a specific node belongs to the training set of the target GNN model, which can lead to severe privacy leakage, especially when the model is trained on sensitive domain datasets. For example, when medical diagnosis data is modeled as a graph for training, MIA allows attackers to obtain an individual's health information without having specific details. However, the success of traditional MIA [Wei et al., 2025] is usually based on the assumption that attackers can access shadow datasets with the same distribution as the target. In reality, as shown in Fig. 1, it is often difficult to obtain similarly distributed data, and there can be biases in data distribution across different environments [Liu et al., 2021]. These issues lead to diminished attack efficacy due to significant gaps in training data distribution. Therefore, cross-domain graph attacks are more practical as they better reflect scenarios where data access is restricted and the data comes from diverse distributions across different domains.

Out-of-distribution (OOD) [Liu et al., 2021] methods show excellent capabilities in domain adaptation tasks. Existing approaches [Arjovsky et al., 2019; Krueger et al., 2021] make the model's learned representations consistent across different data distributions through invariant learning, thus providing robustness and generalization to unseen distributions. However, graph-structured data may not exhibit high connectivity but a scale-free power-law distribution [Wu et al., 2020a]. It indicates that the structural differences among nodes and edges in different domains may be significant, requiring the shadow model to account for graph data with substantial distributional differences while mimicking the target model's decisions. Therefore, arbitrarily changing the training domain or roughly incorporating graph OOD [Liu et al., 2023; Wu et al., 2022] methods may lead to a shadow model that fails to adapt to multiple domains, resulting in posterior distribution shifts and affecting the effectiveness of the attack.

Therefore, to explore the privacy risks faced by models when dealing with data from different distributions, an intuitive idea is to reveal the privacy vulnerabilities of GNNs in OOD inference scenarios by studying the cross-domain graph attack. Overall, our research faces the following two challenges: Based on the MIA assumptions, existing methods overly rely on specific data features and lack adaptability to the topology of graph OOD data. This results in an inability to distinguish the intrinsic characteristics of training data when faced with confounded distributions, leading to suboptimal attack performance. Therefore, the key issue lies in simultaneously capturing the common representations of graph features and graph structures across domains, and extending the attack. Due to the distribution discrepancies between the shadow and target datasets, existing attack models tend to overfit specific features of the shadow dataset, failing to adequately learn the attributes and structural information directly relevant to downstream tasks. This necessitates joint invariant learning to reinforce the acquisition of critical topological information in graph structures.

To address the above problem, we propose a novel out-ofdistribution MIA approach for cross-domain graph attacks, named GOOD-MIA. Specifically, to acquire knowledge from multiple domains during the training, we generate multiple graphs in different environments using an augmentation method [Fu et al., 2024]. Then, we extract invariant features of the data in multi-domain generalization training to depict the distribution of the training data. Moreover, in the model's inference, we constrain sufficient and critical beneficial information for downstream classification tasks and further reinforce invariant representations to maintain the mimicry of the target model's behavior. For the attack model, we encourage the equalization of training risks to minimize the likelihood of risk changes when the distribution shifts. Finally, extensive experiments validate the effectiveness of cross-domain attacks. Our contributions are summarized as follows:

• To the best of our knowledge, this is the first work to conduct cross-domain attacks against GNNs. It breaks the conventional settings of MIA and reveals the privacy leakage risks of graph models on unknown distributions.
• We propose a novel Graph Out-Of-Distribution Membership Inference Attack (GOOD-MIA) to achieve cross-domain graph attacks. By capturing invariant representations of cross-domain graph data and constraining the training direction of the model, we mitigate distribution shifts during the risk extrapolation process.
• Comprehensive experiments on multiple real-world datasets demonstrate that GOOD-MIA leads in crossdomain graph attack performance.

2 RelatedWork

2.1 Membership Inference Attacks on GNN

MIAs aim to infer whether or not a data sample was used to train a target model [Shokri et al., 2017]. Later works [Hayes et al., 2017; Song and Shmatikov, 2019; He et al., 2020] further investigate the feasibility of MIAs in other types of models, such as image generative and segmentation models. [Olatunji et al., 2021] first migrated membership inference attack to the graph data, using a shadow training technique. The proposed scheme is based on node-level tasks performed on graph data. [He et al., 2021] proposed a scheme for the membership inference attack using the 0-hop subgraph and the 2-hop subgraph, which combined the membership inference attack with the structure of the graph. However, the adversary requires all needs a shadow dataset that is identically distributed with the target dataset as the auxiliary dataset in the above membership inference attacks. In practical application scenarios, due to the diversity of data, it is almost impossible to obtain identically distributed data as the auxiliary dataset. Therefore, the effectiveness of the aforementioned MIAs is likely overestimated [Hintersdorf et al., 2021].

2.2 Out-Of-Distribution Generalization on Graphs

Previous work [Beery et al., 2018; Recht et al., 2019] has shown that the performance of neural networks is sensitive to distribution changes and exhibits unsatisfactory performance in new environments. It is difficult to solve this generalization problem because the observations in the training data cannot cover all real-world environments. Several kinds of strategies can be applied to tackle OOD generalization [Liu et al., 2021]. Causal inference aims to learn causal representations in causal graphs. By capturing causal representations, the model can obtain potential direct associations, which can help resist distribution changes caused by interventions. Invariant learning methods represented by invariant risk minimization (IRM) [Arjovsky et al., 2019], which are proposed based on causal inference, have extended generalization models to more practical environments. Although the above methods have improved the generalization ability of existing ML

models, it is difficult to identify invariance due to the complex topological structure of the graph. GIL [Li et al., 2022] captures the invariant relationships within the graph structure and the environment by jointly optimizing three modules. EERM [Wu et al., 2022] trains multiple context generators to explore invariance within environments. FLOOD [Liu et al., 2023] combines invariant representation learning and contrastive learning to train a more flexible framework to deal with different environments. However, the features captured by the existing invariant learning are relatively generic. Although they can render the model more generalizable, these features may not be beneficial for downstream tasks when dealing with data from other distributions.

3 Preliminaries

In this section, we introduce the notation used in this paper, as well as some related methods.

3.1 Problem Statement

The goal of an adversary is to determine whether a given node is used to train a target GNN model or not. Formally, let G = (V, A,X) represents the graph dataset, V is the node set with size n = |V|, and E ⊆ V×V represents the edge set. We denote the adjacency matrix of G as A ∈ {0, 1}n×n , where Aij = 1 if node vi connects to node vj, otherwise Aij = 0, and N(v) is the neighbor set of node v. X ∈ Rn×f is the matrix of node attributes where each row vector Xv ∈ Rf is the corresponding attributes of node v. Given a target node v in the target dataset Gt, a target GNN model Mt, and the adversary's background knowledge K. Membership inference attack A is defined as:

3.2 Invariant Learning

Invariant learning is used to capture invariant relationships among different distributions. Therefore, when conducting cross-domain attacks, we can utilize invariant learning to capture invariant representations between different datasets.

Empirical Risk Minimization (ERM) [Vapnik, 1991] solution is found by minimizing the global risk, expressed as the expected loss over the observational distribution, but it does not generalize well to other domains in the testing[Liu et al., 2023], ERM as:

where EPobs(x,y,e) indicates that the expectation is taken with respect to the observed data distribution Pobs(x, y, e), ℓ is the loss function and ω is the parameter.

Invariant Risk Minimization (IRM) [Arjovsky et al., 2019] includes a regularization objective that enables the classifier f(·) to achieve optimality across all environments, following:

where E obs is is the observed environment, β is penalty weight, Re is short for RERM in environment e, and ∥·∥22 is the square of the L2 norm.

Risk Extrapolation (REx) [Krueger et al., 2021] is a form of robust optimization over a perturbation set of extrapolated domains. That means that reducing differences in risk across training domains can reduce a model's sensitivity to distribution shifts. The REx is defined as:

where λ is the extrapolated weight.

3.3 Graph Information Bottleneck

The information bottleneck (IB) [Fu et al., 2025a; Fu et al., 2025b] principle uses mutual information I(X; Y ) as a cost function and regularization. The GIB is defined as follows:

where ξ is the balancing coefficient.

4 Graph Out-Of-DistributionMembership Inference Attack

In this section, we first define cross-domain MI attacks against GNNs. Then, we discuss the threat model and present the attack methodology.

4.1 Threat Model

In this paper, we study MIAs under the black-box settings, which means the adversary can't access the target model's parameters but can only observe the input and output of the target model, We then analyze the adversary's background knowledge K along two dimensions, i.e., shadow dataset, shadow model.

Our setting. As mentioned above, it is very difficult to obtain datasets with the same distribution in real life, so our setting is different from previous work [He et al., 2021; Olatunji et al., 2021]. We assume that the attacker uses a dataset with a different distribution from the target dataset for auxiliary training. Using the shadow dataset, the attacker needs to train a shadowmodel that can learn invariant features and structures. However, the generalized representations and structures learned from data in different domains may not fully mimic the target model. Therefore, based on the above discussion, the purpose of training the shadow model is not only to mimic the behavior of the target model but also to summarize the membership status of data points in the training set of the ML model.

4.2 AttackMethodology

According to the traditional procedure of membership inference attacks on previous ML models and GNN models [Olatunji et al., 2021; Shokri et al., 2017], our GOODMIA also models the attack model as a binary classification task where the goal is to determine if a given node v ∈ Vt. We illustrate the pipeline of GOOD-MIA in Fig. 2, which consists of two modules: (1) Shadowmodel training: we adopt IRM and GIB to train the GNN model for invariant representation learning and privacy-sensitive learning. The training environments are constructed by data augmentation on graphs. (2) Attack model training: we adopt REx to train the binary classification model for OOD generalization.

Shadow Model Training

To endow the shadow model with generalization ability, we need a shadow model that can capture the invariant properties of graphs, such as features and structures, enabling the posterior distribution learned by the model to be as close as possible to the output posterior of the target model. For a shadow dataset GS , the adversary first constructs multiple training environments from the original shadow graph GS. Then, each augmented graph GS is divided into two disjoint subgraph, including G Train S and G Test S . We perform two typical graph augmentations, namely node feature masking and DropEdge [You et al., 2020]:

where ˜Xe represents the features after data augmentation, ˜Ae is the adjacency matrix after data augmentation, and e represents different environments.

Next, we train a GNN encoder fω(·) to extract invariant features and to capture information-sensitive representations from the graphs in different training environments. fω : (X, A) → Rd is a L-layer graph neural networks and outputs d-dimension representation for each node. In layer l(l = 1, ...,L), the representation for node i under environment e is defined by:

where Ne(i) indicates the neighbor set of node i decided by ˜Ae, and h(0) e,i = ˜Xe.

Finally, a softmax layer is applied to the node representations in the last layer for the final prediction of the node classes. The GNN parameterized by ω is trained by minimizing the cross-entropy loss defined by:

where σ is the activation function.

To learn a better invariant representation, we use IRM to capture the invariant representations Xc in the graph structure during across different training domains, when ∀e1 ̸= e2, Pe1 (Y | Xc) = Pe2 (Y | Xc), IRM constructs a linear combination with penalty weights as:

where β1 ∈ [0,+∞) controls the balance between reducing average risk and penalty weights of risks.

Overall, in the shadow model training phase, both invariant learning and information bottleneck are jointly optimized under the overall loss as:

where α ∈ [0, 1) is the weight factor used to balance the constant risk and the graph information bottleneck.

Attack Model Training

The attack model is a binary machine learning classifier and its input is derived from a node's posteriors provided by a GNN. The MLP parameterized by (w, b) is trained by minimizing the cross-entropy loss defined as.

To enable the attack model to obtain a good generalization ability of the attack, we adopt the REx principle. The goal of using REx is to reduce the differences in risks across different domains, thereby enhancing the model's robustness against distribution shifts. It encourages the equality of training risks and when a distribution shift occurs at test time, the risks are more likely to change less. Minimax-REx builds a linear affine combination of training risks, as represented by:

where M is the number of environments, which consists of a posteriori of the enhanced graph.

Practically, as there is a maximum in Eq. (12), it is hard and unstable to optimize RMM-REx. To tackle the problem, we replace Eq. (12) with the variance of risks as:

where β2 ∈ [0,+∞) controls the balance between reducing average risk and enforcing equality of risks.

4.3 Overall Algorithm and Complexity Analysis

The overall training algorithm is summarized in Algorithm 1. Given a shadow graph GS, we first construct M training environments by data augmentation (Line 1). With the GNN initialized parameters (Line 2), we get the node representation under each environment (Line 5). After that, the model is trained until convergence by minimizing Eq.(8) (Line 7). In the attack model training phase, We use the output posterior of the shadow model to construct the attack dataset and regard the posterior outputs of different augmented graphs as different environments in the attack dataset. Finally, the attack model is updated by minimizing Eq. (13) (Line 11).

Consider a graph with N nodes and E edges, the average degree is ¯ d, an MLP with N samples, D input dimensions, and H dimensions of the hidden layer. GNN with L layers computes embeddings in time O (NL¯ d2 ) and the time complexity of the MLP is O (NDH). GOOD-MIA does M encoder computations per update step (M for training environment) plus a prediction step. The overall time complexity has a linear relationship with the previous work.

5 Experiments

In this section, we investigate the effectiveness of the proposed attack model in the face of three cross-domain settings with practical significance, aiming to address the following research questions.

Algorithm 1 GOOD-MIA: Out-of-Distribution Membership Inference Attack Approach for Cross-domain Graphs Attack

Input: target graph Gtarget, shadow graph Gshadow, Number of training environments M

Parameter: ω, ψ

Output: Membership prediction

• 1: Construct M shadow training environments by Eq. (6);
• 2: Initialization parameters ω, ψ;
• 3: while Shadowmodel training epoch <N S epoch do
• 4: for e = 1, . . . ,M do
• 5: Get the representation h for nodes of Ge w.r.t Eq. (7);
• 6: end for
• 7: Train ω by minimizing Eq. (10);
• 8: end while
• 9: return Posterior probability for shadowmodel;
• 10: while Attack model training epoch <N Attack epoch do
• 11: Train ω by minimizing Eq. (13);
• 12: end while

5.1 Experimental Settings

Datasets. We adopt five node property prediction datasets of different sizes and properties, including Cora, Citeseer, Pubmed, Twitch and Facebook-100. For Cora, Citeseer and Pubmed [Sen et al., 2008], we keep the original node labels and synthetically create spurious node features to introduce distribution shifts between different domain data. The Twitch and Facebook-100 [Rozemberczki and Sarkar, 2021; Traud et al., 2012] represent canonical real-world social networks. For Twitch, we consider subgraph-level data splits: nodes in subgraph DE are used as target model datasets, while nodes in ENGB, ES, FR, PTBR, RU and TW are used as shadow model datasets to set cross-domain attacks in different domain environments. For Facebook-100, we use John Hopkins, Amherst and Cornell5 as the target datasets, Penn and Reed as the shadow datasets. We summarize the dataset information in Tab. 1.

Baselines. We established three backbone models (GCN, GAT, SGC) to test the expressiveness of GOOD-MIA in different scenarios. We compare the proposed GOOD-MIA with the state-of-the-art attack methods TSTS [Olatunji et al., 2021] on GNNs. The baselines in our experiment have the same setting as our method, that is, the shadow dataset has a different distribution from the target dataset.

Evaluation Metrics. We use Accuracy, AUC score, and Recall [He et al., 2021; Olatunji et al., 2021; Salem et al., 2018] to evaluate the performance of the attack model.

5.2 Performance Evaluation

We conduct comprehensive performance verification and ablation experiments on GOOD-MIA.

Distribution Shifts on Synthetic Data. We report the attack scores on the citation network dataset in Tab. 2. We found that when using different GNNs as the backbone, GOODMIA consistently showed a significant advantage over corresponding competitors under artificially induced distribution shifts. Also, when the datasets were Cora and PubMed, their performance was close to that of the attack models trained with datasets of the same distribution [Olatunji et al., 2021]. The results indicate that this attack model can effectively capture cross-domain features and their structures when using datasets with different distributions, enabling the model to launch effective attacks.

Distribution Shifts across Domains. Tab. 3 and Tab. 4 demonstrate the attack performance in real-world social network datasets. This kind of dataset has great practical significance because it is rather difficult for us to obtain datasets with the same distribution, while it is relatively easy to acquire datasets with approximate distributions. This kind of dataset is challenging for cross-domain attacks since the nodes in different subgraphs are disconnected. We found GOOD-MIA achieves overall superior performance over competitors. This demonstrates the efficacy of our model in tackling OOD attacks across graphs in different domains.

Overall. For different datasets, the invariance of their features and structures may vary in strength. For example, citation networks may exhibit strong invariance in their structures, making them easier to capture in cross-domain scenarios. Social networks may exhibit weak invariance in their structures, leading to less clear capture and, consequently, poorer attack performance.

5.3 Ablation Study

In this section, we analyze the effectiveness of the three variants:

• GOOD-MIA (w/o IRM ): We remove the IRM in the shadowmodel training objective (Eq. (10)).
• GOOD-MIA (w/oGIB ): We remove the GIB in the shadowmodel training objective (Eq. (10)).
• GOOD-MIA (w/oREx ): We remove the REx in the attack model training objective (Eq. (13)), and using the traditional Cross Entropy Loss

We choose GCN as the backbone to evaluate three key modules of GOOD-MIA, namely IRM, GIB, and REx, by removing each module respectively. We report the ablation experiments of artificial data MIA in Tab. 2. Compared with the three variants, the complete model achieves the best attack performance in terms of the total number, indicating that each module is essential for the generalization of the attack model.

Removing the IRM part, when training the shadow model, GOOD-MIA\IRM can only capture features and structures related to downstream tasks through the information bottleneck. It fails to obtain invariant representations of the data when the distributions vary. Merely conducting REx via the attack model cannot yield a satisfactory attack effect.

Omitting the GIB part, GOOD-MIA\GIB can only obtain generalized representations of the data. Although such information may have the same probability under different distributions, it may not be a crucial part in cross-domain attacks.

Without the REx part, although GOOD-MIA\REx can capture invariant representations as well as structures and features related to downstream tasks during the training of the shadow model, simply using an MLP insufficient to achieve effective cross-domain attack. We conclude that only by combining these three can we improve the capability of crossdomain attacks in GOOD-MIA.

5.4 Analysis

Hyperparameter Trade-off Analysis. We conduct a hyperparameter analysis of the trade-off parameter in the shadow model to verify the roles of information bottleneck and invariant learning in GOOD-MIA. The results are shown in Fig. 3, indicating that the sensitivity to attack accuracy when setting α varies between different GNN models. It can be seen from this that the analysis we presented earlier is correct. When the shadow model learns invariant representations using IRM, generalizing to other domains may not be relevant to the downstream tasks. Therefore, it is also necessary to capture the features and structures that are closely related to the downstream tasks. Moreover, when using different GNN models, the attack effect obtained by using different parameters is also different due to different aggregation methods.

In summary, the hyperparameter settings can be further optimized based on the characteristics of different models to improve the overall performance of the attack model.

Different Model Architecture. We further investigate whether the different number of neurons affects the attack performance. We evaluated the target model with 256 neurons in its hidden layer, while the number of neurons in the shadow model varied from 32 to 256. The results are depicted in Fig. 4. We observed that in Cora and CiteSeer, the closer the shadow model approximates the target model, the higher the attack accuracy. PubMed is the opposite. This may be attributed to the lower feature dimensionality of PubMed.

6 Conclusions

In this paper, we propose a novel framework named GOODMIA, designed to explore the feasibility of cross-domain membership inference attacks when identically distributed auxiliary datasets are unavailable in real-world scenarios, and to enhance the effectiveness of such cross-domain attacks.

We decompose the overall objectives of GOOD-MIA into shadow model training and attack model training, which have a linear relationship. During the shadow model training phase, invariant features and key graph structures are first captured from the environments of different graph data. Subsequently, attack training sets for different environments are constructed, followed by training the attack model. Finally, through risk extrapolation, the attack model can be generalized to other domains for attacks. Extensive experiments show that GOOD-MIA exhibits excellent attack inference capabilities and domain adaptability.

Acknowledgments

The corresponding author is Xingcheng Fu and Yuecen Wei. This paper was supported by the National Natural Science Foundation of China (Nos. 62162005, 62462007 and U21A20474), National Natural Science Foundation Joint Cultivation Project of Guangxi Normal University (No. 2024PY028), Guangxi Bagui Youth Talent Training Program, Guangxi Collaborative Innovation Center of Multisource Information Integration and Intelligent Processing and the Key Lab of Education Blockchain and Intelligent Technology, Ministry of Education (EBME24-01).