Pull Request: GNNFingers Defense Implementation

[kienle1404]

📦 Pull Request: GNNFingers Implementation

📋 Summary

This PR introduces an implementation of GNNFingers (node classification variant) under models/defense/.

🔍 Highlights

• Replaces the simplified placeholder with a complete reproduction of the original GNNFingers defense.
• Implements:
  • F⁺ / F⁻ suspect pool generation using fine-tune, reinit, prune, and distill operations.
  • Alternating I/V joint training between fingerprint graphs and the Univerifier network.
  • Rank-and-flip on adjacency and feature clipping on node features.
  • ARUC metric for ownership verification (robustness–uniqueness trade-off).
• Adds accompanying scripts, tests, and configuration for easy reproduction.

🧩 New Files Added

File	Description
models/defense/GNNFingers.py	Full paper-faithful implementation
examples/test1.py	Paper-scale training example (Cora, PyG)
examples/verify_gnnfingers.py	CLI tool to verify owner/suspect models
tests/test_gnnfingers_smoke.py	Lightweight CI test (~30s runtime)
configs/gnnfingers_cora_paperish.yaml	Reproduction config for paper-like results
.gitignore	Updated to ignore generated files (registry/, ckpts/, *.pt)

---

✅ Checklist

• [ x ] My code follows the project's coding style
• [ x ] I have tested the changes and verified that they work
• [ x ] I have added necessary documentation (if applicable)
• [ x ] I have linked related issues above (if any)
• [ x ] The PR is made from a feature branch, not main

---

🧠 Additional Context

🖥️ Environment

• OS: Windows 11
• GPU: NVIDIA RTX 4050 Laptop GPU
• CUDA: 12.9
• Torch: 2.3.0+cu121
• DGL: 2.2.1 (cu121)
• PyG: 2.6.1 (torch-2.3.0+cu121 wheels)

⚙️ How to Reproduce

# Train and create fingerprint registry
python examples/test1.py

# Verify the owner model
python examples/verify_gnnfingers.py --owner

---

🧾 Expected Output (Cora dataset)

== Paper-ish metrics ==
robustness_at_tau=0.5: 1.0
uniqueness_at_tau=0.5: 0.755
ARUC: 0.9529353233830844
registry_path: registry/fingerprints.pt

---

📚 Alignment with the Paper

Paper Section	Implementation Reference
§3.2 Anti-Obfuscation GNN Preparation	_build_suspects() constructs F⁺ / F⁻ via fine-tuning, pruning, reinit, and distillation.
§3.3 Graph Fingerprint Construction	FingerprintNC.init_graph() and _clip_X() generate and clip feature and edge matrices.
§3.4 Joint Learning of I and V	_joint_train() alternates graph and verifier updates.
§3.4.1 Unified Verification Mechanism	Univerifier (MLP [128, 64, 32]) classifies (o₊, o₋).
§4 Evaluation	Cora benchmark settings faithfully reproduced.

---

📈 Performance Summary

Metric	Result	Interpretation
Robustness @ τ = 0.5	1.0	Pirated models correctly identified
Uniqueness @ τ = 0.5	0.755	Non-owner models correctly rejected
ARUC	0.9529	High ownership discrimination capacity

These results mirror the paper’s reported values for Cora.

---

📚 References

Xiaoyu You, Youhe Jiang, Jianwei Xu, Mi Zhang, and Min Yang.
“GNNFingers: A Fingerprinting Framework for Verifying Ownerships of Graph Neural Networks.”
In Proceedings of the ACM Web Conference 2024 (WWW ’24), pp. 652–663.
DOI: 10.1145/3589334.3645489

---

🧾 Notes for Reviewers

• Core defense logic is fully aligned with the paper’s Section 3 and PyGIP’s BaseDefense API.
• The verification CLI (verify_gnnfingers.py) reproduces the ownership test without retraining.
• The smoke test validates end-to-end correctness within ≈ 1 minute on CPU.
• No additional dependencies were introduced.

---

🚀 Next Steps

• Add suspect caching to reuse F⁺ / F⁻ sets across runs (suspects_cache_dir).
• Extend the defense to graph-level and link-prediction tasks.

---

Submitted by: Kien Le
Feature branch: feat/GNNFingers
Date: 10/24/2025