Watermarking Graph Neural Networks via Explanations for Ownership Protection

Graph Neural Networks (GNNs) are widely deployed in industry, making their intellectual property valuable. However, protecting GNNs from unauthorized use remains a challenge. Watermarking offers a solution by embedding ownership information into models. Existing watermarking methods have two limitations: First, they rarely focus on graph data or GNNs. Second, the \emph{de facto} backdoor-based method relies on manipulating training data, which can introduce ownership ambiguity through misclassification and vulnerability to data poisoning attacks that can interrupt the backdoor mechanism. Our explanation-based watermarking inherits the strengths of backdoor-based methods (e.g., black-box verification) without data manipulation, eliminating ownership ambiguity and data dependencies. In particular, we watermark GNN explanations such that these explanations are statistically distinct from others, so ownership claims must be verified through statistical significance. We theoretically prove that, even with full knowledge of our method, locating the watermark is NP-hard. Empirically, our method demonstrates robustness to fine-tuning and pruning attacks. By addressing these challenges, our approach significantly advances GNN intellectual property protection.

Graph Neural Networks (GNNs) are AI models that analyze connected data like social networks or molecular structures, and are increasingly valuable in industry. Like any valuable software, they can be stolen or used without permission. Watermarking, similar to a hidden signature embedded in digital media, offers a way to prove ownership of these models. Existing watermarking techniques for AI models typically work by secretly manipulating training data, which can create legal ambiguity about ownership and leave the model vulnerable to attacks that erase the watermark. We propose a new approach that instead hides the ownership signature inside the model's own explanations, meaning the reasoning it produces when justifying its decisions. These explanations are designed to carry a statistically unique pattern that can verify ownership without ever touching the training data. We mathematically prove that finding and removing this hidden signature is computationally intractable, even for an attacker who fully understands our method.