arXiv CSopen access

GraphIP-Bench: How Hard Is It to Steal a Graph Neural Network, and Can We Stop It?

GraphIP–Bench: How Hard Is It to Steal a Graph Neural Network, and Can We Stop It?

arXiv:2605.12827v1 [cs.CR] 12 May 2026

Kaixiang Zhao∗ University of Notre Dame [email protected]

Bolin Shen∗ Florida State University [email protected]

Yuyang Dai University of California, Berkeley [email protected] Yushun Dong† Florida State University [email protected]

Shayok Chakraborty Florida State University [email protected]

Abstract Graph neural networks (GNNs) deployed as cloud services can be stolen through model-extraction attacks, which train a surrogate from query responses to reproduce the target’s behaviour, and a growing line of ownership defenses tries to prevent or trace such theft. The title of this paper asks two questions: how hard is it to steal a GNN?, and can we stop it? Prior work cannot answer either, because experiments use inconsistent datasets, threat models, and metrics. We introduce GraphIP-Bench, a unified benchmark which evaluates both sides under a single black-box protocol. It integrates twelve extraction attacks, twelve defenses spanning watermarking, output-perturbation, and query-pattern-detection families, ten public graphs covering homophilic, heterophilic, and large-scale regimes, three GNN backbones, and three graph-learning tasks, and it reports fidelity, task utility, ownership verification, and computational cost on shared splits, queries, and budgets. We further add a joint attack-and-defense track which runs every attack on every defended target and measures watermark verification on the resulting surrogate, which exposes the protection that a defense retains after extraction. The empirical picture is short: stealing a GNN is easy at medium query budgets and most defenses do not change this; several watermarks verify reliably on the protected model but lose most of their verification signal on the extracted surrogate, which exposes a gap that singlemodel evaluations miss; and heterophilic graphs are systematically harder to steal, while a cross-architecture mismatch between target and surrogate reduces but does not prevent extraction. Code: LabRAI/GraphIP-Bench.

1

Introduction

Graph neural networks (GNNs) are key components of modern data-driven services. Commercial platforms use them for product recommendation [34], autonomous vehicle perception [15], and molecular property prediction [12]. Their advantage is that they aggregate information over arbitrary relational structures, which arise in social, financial, and product data. Cloud providers now expose pre-trained GNNs through public inference endpoints, which allow customers to deploy state-of-theart analytics without local training or data collection. This deployment model also lets adversaries steal the model. The attack pattern is the same in every reported instance: the adversary submits carefully chosen queries, records the labels or confidence scores that the endpoint returns, and trains a local surrogate which reproduces the target’s behaviour. The literature calls this attack model extraction [28, 44, 38], and we use “stealing a GNN” as a ∗ Co-first author. † Corresponding author.

Preprint.

plain-language synonym throughout the paper. A successful theft leaks the owner’s intellectual property, undermines pay-per-query revenue, and lets competitors recreate proprietary functionality at low cost. For example, a stolen fraud-detection GNN exposes decision boundaries which adversaries can use to bypass screening, and a stolen pharmaceutical GNN reveals assay knowledge which is encoded in the model parameters. These risks motivate the two questions which the title of this paper makes explicit: how hard is it to steal a GNN?, and can we stop it? To stop the theft, recent work proposes two complementary defense families. Information-limiting defenses (output perturbation, query filtering, query-pattern detection) make each query response less useful to the attacker [13, 9, 6, 7, 8, 14]. Ownership-tracing defenses (watermarking and fingerprinting) embed a verifiable pattern in the trained model so that the owner can prove that an extracted surrogate was derived from their model [26, 32, 1, 35, 30, 25]. Surveys summarise both families and the broader security landscape for deep learning [18, 33, 22, 40, 39] and for graph learning in particular [2, 31, 36, 20, 43]. Experimental practice, however, remains fragmented: studies use private splits, incompatible budgets, and inconsistent metrics, and the few existing testbeds focus on robustness or privacy and exclude model extraction together with watermarking and fingerprinting [21]. The community therefore lacks an empirical basis on which to answer either of our two title questions. Several challenges must be addressed to enable fair and informative comparison. First, the community needs a single experimental protocol that fixes public splits, shared query sets, budgets, and explicit threat models (including whether the endpoint returns labels or confidence scores) and that treats datadriven and data-free attacks on equal terms [28, 38]. Second, evaluation must align success criteria with method goals: residual extraction for attacks, ownership verification for watermarking and fingerprinting, since these mechanisms aim to provide verifiable evidence of model ownership rather than to reduce agreement with the target [26, 32]. Third, studies should report the protection–utility balance under matched conditions, since adoption depends on how defenses affect task accuracy and inference latency. Fourth, benchmarks should report computational complexity (time and memory) to make the real cost of deployment transparent; prior work often omits this and obscures feasibility [13, 6]. Fifth, evaluating attacks and defenses separately misses the joint adversarial setting in which the attacker extracts a defended model and the defender verifies ownership on the surrogate — the setting that actually determines whether a defense is useful. Finally, consistent method naming, standardized hardware and software, and public reporting of seeds and tuning procedures are needed for reproducibility and to prevent protocol-induced bias. Existing studies only partially satisfy these requirements, which limits both scientific understanding and industrial uptake. We address these challenges with GraphIP-Bench, a reproducible benchmark and library which evaluates both stealing and stopping under a single black-box protocol. The suite integrates twelve representative extraction attacks (nine data-driven and three data-free) and twelve defenses spanning watermarking, output-perturbation, prediction-rounding, and query-pattern-detection. We evaluate every method on ten public graphs covering homophilic, heterophilic, and large-scale regimes, three GNN backbones, and three graph-learning tasks; the per-dataset, per-backbone, and per-method details are deferred to Section 3. A unified hyperparameter search and a consistent metric suite record security, utility, and efficiency. Going beyond prior single-track evaluations, we add a joint attack-and-defense track which runs every attack on every defended target and a watermark-survival metric which measures verification on the surrogate produced by each attack, together exposing how much protection a defense retains after the model is actually stolen. The headline finding of that joint track is that most parameter-side or trigger-based graph watermarks verify near-perfectly on the protected model but lose much of their verification signal on the extracted surrogate, while query-time mechanisms partially survive — watermark designs must therefore be re-evaluated on the surrogate, not only on the deployed model. To our knowledge, GraphIP-Bench is the first benchmark which offers a standardised evaluation of model-extraction attacks and ownership defenses for graph neural networks. The main contributions are: • Unified protocol. Public splits, shared queries, standardized budgets, and explicit endpoint assumptions; twelve attacks and twelve defenses run under identical settings on ten datasets, three GNN backbones, and three tasks for fair comparison. • Joint attack-and-defense track. Every attack is executed against every defended target with watermark verification measured on the extracted surrogate, which exposes the residual ownership signal that survives extraction.

2

• Protection–utility analysis. A sweep of defense configurations and attacker budgets summarises operating points with attack-agnostic frontiers and links them to graph structural properties (edge homophily, degree, density) and to backbone choice. • Cost and efficiency reporting. Asymptotic formulas and automated profilers record training time, memory, inference latency, verification time, and an estimated monetary cost, which makes deployment cost transparent for every method.

2

Preliminaries

Notation. An attributed graph is denoted by G = (V, E, X, A) with node set V, edge set E, nodefeature matrix X, and adjacency matrix A. Query budgets are reported as multiples of the test-set size, and four data-availability regimes (both, features only, structure only, data free) control which inputs the adversary can construct. Fidelity is the agreement rate between a surrogate and the target on the test split; accuracy and macro F1 measure task utility. Model Extraction Attacks. We consider the standard black-box threat model in which the adversary has query access to a deployed graph neural network and no knowledge of its weights, architecture, or training data. The adversary submits inputs (either genuine subgraphs or synthetic samples), records the returned labels or probability vectors, and trains a local model which minimises the discrepancy between its predictions and the target’s outputs. The resulting model is a surrogate which replicates the behaviour of the protected network and enables extraction of the owner’s intellectual property [28, 44, 38]. Prior work groups extraction queries into three strategies. Random querying submits subgraphs from public data and succeeds when the decision boundary is smooth [28]. Adaptive querying selects inputs which maximise information gain, often through the disagreement between the current surrogate and the target [44]. Data-free generation removes the need for public data by training a graph generator which produces queries during extraction [38]. These studies show that modest query budgets, often no larger than the number of nodes in a benchmark dataset, are sufficient to recover a model which matches the original on downstream tasks. Defense against Model Extraction Attacks. The literature groups defenses into two complementary families. Information-limiting defenses modify the target’s outputs so that the adversary receives a less useful signal: output perturbation adds calibrated noise or rounds confidence scores [13, 9], and query filtering detects and blocks suspicious request patterns [6, 7, 8, 14]. These methods can reduce the residual agreement of a surrogate, although they may also degrade accuracy for legitimate users. Ownership-tracing defenses embed an artefact which lets the owner verify infringement: graph watermarking modifies weights or decision regions so that the model reveals a secret on inputs which carry a trigger [26, 32, 1], and fingerprinting derives stable signatures from the model’s output distribution while leaving the parameters unchanged [35, 30, 25]. Surveys of these approaches identify open questions about robustness, utility loss, and verification cost [18, 33, 22, 40, 39], and our benchmark places all of them under a single protocol with matched datasets, budgets, and threat assumptions, which enables an objective comparison of their trade-offs.

3

Benchmark Design

In this section we describe the experimental protocol of GraphIP-Bench. We first state the protocol design, datasets, attacks, defenses, and implementation details, then articulate the five research questions that guide our empirical study. 3.1

Experimental Settings and Implementations

Protocol Design. GraphIP-Bench defines a single black-box protocol that fixes four disjoint splits for each dataset (train, validation, test, query), shares the same query sets across methods, and uses standardized query budgets at 0.05, 0.10, 0.25, 0.50, and 1.00 times the test size. Here “standardized” means that every method receives the same number of queries at each ratio and that these ratios are fixed across datasets. The set spans the commonly studied ranges in prior work [17, 23], which include very small budgets that test sample efficiency (0.05 to 0.10), medium budgets where most gains occur (0.25 to 0.50), and a large budget that approximates saturation (1.00). This design makes results comparable and representative across methods and datasets. The protocol states explicit endpoint assumptions, which include whether the service returns labels only or also confidence scores 3

and whether rate limits apply [28, 38]. We separate evaluation into an extraction track, an ownership track, and a joint track. The extraction track measures how well black-box attacks learn a surrogate of an undefended target, and it reports test accuracy with respect to ground truth and fidelity with respect to the target. The ownership track evaluates each defense on a defended target and reports defended accuracy, fidelity to the original target, and verification on a standardized verification set [42, 32, 26, 37, 30]. The joint track runs every attack on every defended target and reports surrogate fidelity to the defended model together with the verification rate measured on the surrogate, which we call watermark survival. To place different settings on equal footing, we control data availability with four regimes: features only, structure only, features and structure, and data free. We also report total attack time, total defense time, and peak GPU memory for both attacks and defenses to make deployment cost clear. Datasets. We use ten attributed graphs which cover four groups: homophilic citation networks (Cora, CiteSeer, PubMed), homophilic coauthor and product co-purchase networks (CoauthorCS, CoauthorPhysics, Computers, Photo), the large-scale OGBN-Arxiv graph, and two heterophilic graphs [19] (RomanEmpire, AmazonRatings). The graphs differ in size, density, class count, feature dimension, and edge homophily, which enables stress testing across structural regimes; full statistics are in Table 7 of Appendix D. For node classification we split each dataset into four disjoint subsets (train, validation, test, query) with no overlap, and for watermarking we reserve a fixed subset of the training data as the watermark set. We also include link prediction on Cora and graph classification on ENZYMES and PROTEINS from TUDataset [16] (Appendix F.10). Metrics. We report two groups of metrics under a single protocol. Performance for attacks includes test accuracy, macro F1, and fidelity, which is the agreement between the surrogate and the target on the test set. Performance for defenses includes the defended model’s test accuracy and macro F1, its fidelity to the original target, and ownership verification on a standardized verification set. Efficiency for attacks includes total attack time and peak GPU memory; efficiency for defenses includes total defense time and peak GPU memory. Model Extraction Attacks. For the extraction track we implement twelve representative attacks. Six are MEA-style baselines from a canonical study on query synthesis and surrogate training, which we denote MEA0 through MEA5 [29]; we further include the adaptive adversarial querying method AdvMEA [3], the centrality-and-entropy strategy CEGA [27], and the structure-aware pipeline Realistic [4]. To cover the data-free regime in a fair black-box manner, we add three variants [44] which use no target gradients: DFEA_I minimises the KL divergence between surrogate logits and target logits (soft-label distillation), DFEA_II trains on hard labels returned by the endpoint (label-only supervision), and DFEA_III augments label-only training with a consistency loss between two surrogates. We treat distinct hyperparameter settings of the same algorithm as separate methods, which enables fine-grained comparison under shared query sets and budgets. The four dataavailability regimes defined in Section 2 are realised by two control parameters, attack_x_ratio and attack_a_ratio, which fix the fraction of real features and real adjacency made available to each attack; the four regimes are denoted X-only (features only), A-only (structure only), both (features and structure), and data-free. Model Extraction Defenses. For the ownership and joint tracks we implement twelve defenses, which split between the two families introduced in Section 2. The ownership-tracing family contains five methods: the watermarking schemes RandomWM, BackdoorWM, SurviveWM, and ImperceptibleWM [42, 32, 26, 37], and the query-based integrity scheme Integrity [30]. The information-limiting family contains seven methods: two output-perturbation variants OP_low and OP_high which add Gaussian noise to the returned logits at two scales [9, 13], two predictionrounding variants PR_2bit and PR_top1 which quantise the returned scores or return only the top-1 label, and three query-detection methods which follow PRADA [7], an adaptive-misinformation strategy [8], and a gradient-redirection strategy [14], denoted PRADA, AdaptMisinfo, and GradRedir. Every defense protects the same target architecture, and we report the defended model’s test accuracy and its fidelity to the original target. For watermarking and integrity we measure ownership verification on a standardised verification set using accuracy; for information-limiting and query-detection methods we use the verification proxy that matches each method’s design, which is the trigger-label hit rate or the watermark-graph accuracy when a defense exposes such an artefact and the marker accuracy on the protected model otherwise.

4

GNN Backbones. To test whether conclusions are robust to the choice of model architecture, we use three widely adopted GNN backbones. The first is GCN [10], which uses spectral graph convolution. The second is GAT [24], which uses attention over neighbors. The third is GraphSAGE [5], which uses neighbor sampling and a learned aggregator. Each backbone is implemented in both DGL and PyTorch Geometric so that defenses with library-specific dependencies can be evaluated on a matched architecture; we use a DGL GCN with hidden dimension 16 as the default backbone, and we explicitly mark deviations when a defense uses a different backbone for fairness. 3.2

Research Questions

RQ1. How does extraction effectiveness change with the query budget, and does the trend hold on heterophilic and large-scale graphs? We run twelve black-box attacks on undefended targets across the ten datasets at five budgets and four data-availability regimes, and we report accuracy, macro F1, and fidelity averaged over three seeds. RQ2. How effective are existing defenses on the protected model? We evaluate the five watermarking and integrity methods together with the seven information-limiting and query-detection methods on a shared backbone, and we report defended accuracy, fidelity, and ownership verification. RQ3. How well do defenses balance protection and utility? For each defense we report the utility loss against the undefended target together with defended fidelity and verification rate, which makes the protection-utility trade-off explicit. RQ4. What are the computational complexity and practical efficiency of attacks and defenses? We report asymptotic time and memory complexity, and measure wall-clock time and peak GPU memory on NVIDIA A100 hardware for both the extraction and the ownership track. RQ5. How effective are defenses in the joint adversarial setting, and does the watermark signal survive on the extracted surrogate? We run every attack on every defended target at a fixed budget and report surrogate fidelity to the defended model together with the verification rate measured on the surrogate, which we call watermark survival.

4

Empirical Investigation

We now present an empirical study that follows the unified protocol in Section 3, uses shared query sets and standardized budgets, and reports security, utility, and efficiency under identical settings. Complementary generalisation experiments are reported in Appendix F.10. 4.1

Budget Sensitivity of Model Extraction Attacks (RQ1)

To answer RQ1, we evaluate twelve black-box attacks on undefended targets under the protocol in Section 3.2. Results are averaged over three seeds, and we report fidelity to the target together with accuracy on the ground truth. Table 1 shows a representative case on Computers when both features and adjacency are available. Figure 1 reports sample efficiency on all ten datasets and four regimes; the y-axis is the median budget at which each attack reaches 90% of its own best fidelity. Figure 2 plots accuracy and fidelity on six representative datasets which span the four regimes that matter for our findings: two clean homophilic citation graphs (Cora, PubMed), the high-average-degree exception (Computers), the highest-homophily reference (CoauthorPhysics), the large-scale graph (OGBN-Arxiv), and the lowest-homophily heterophilic graph (RomanEmpire). The full ten-dataset, three-metric (Acc, Fidelity, F1) version, the regime-sensitivity heatmap, and the per-dataset and per-regime tables are reported as Figures 10 and 11 and Appendix F.1. Table 1: RQ1 on Computers (both features and adjacency available). Fidelity (%) across query budgets with mean ± standard deviation over three seeds. Higher is better. Bold marks the best value in each column. Budget 0.05× 0.10× 0.25× 0.50× 1.00×

MEA0

MEA1

MEA2

MEA3

MEA4

MEA5

AdvMEA

CEGA

51.0±7.0 41.5±15.5 51.0±7.5 53.8±3.0 38.4±13.4 61.3±4.3 35.5±17.8 36.0±25.0 67.3±3.1 27.7±14.0 58.8±6.0 64.8±5.5 37.9±12.6 65.6±6.4 25.7±24.7 36.7±23.0 67.0±1.5 46.2±5.5 65.2±2.4 67.6±6.2 63.6±4.0 66.5±2.1 26.9±22.4 43.4±17.5 71.4±2.7 49.4±5.6 66.2±6.3 74.9±4.3 74.3±5.0 73.9±3.5 46.1±12.5 53.9±29.2 80.5±4.6 56.3±12.6 68.3±8.0 79.5±5.2 83.7±4.3 76.3±4.2 22.8±11.8 54.1±33.4

Realistic

DFEA_I

64.5±33.7 67.9±45.4 67.7±45.3 67.4±44.0 67.0±44.8

67.5±12.4 43.9±8.1 72.9±5.5 73.7±18.1 28.4±20.5 66.7±14.2 60.3±25.5 28.4±20.5 72.9±3.1 64.8±15.9 28.4±20.5 82.5±3.1 55.8±28.2 28.4±20.5 82.1±2.8

DFEA_II DFEA_III

The results expose a consistent picture across the ten datasets. CEGA is the most sample-efficient attack on the homophilic graphs but is unstable on Computers, where the high average degree (36.8) destabilises its centrality-driven query selection. The MEA family saturates near the medium budget: 5

MEA0

Cora

Fidelity (%)

Acc (%)

100

MEA1

MEA2

MEA3

PubMed

100

MEA4

MEA5

AdvMEA

Computers

100

100

CEGA

Realistic

DFEA_I

CoauthorPhysics

40

80

80

80

80

60

60

60

60

40

40

40

40

20

20

20

20

0

0

0

0

100

100

100

100

80

80

80

80

60

60

60

60

60

40

40

40

40

40

20

20

20

20

0

0.0

0.5

Budget ×

1.0

0

0.0

0.5

Budget ×

1.0

0

0.0

0.5

1.0

Budget ×

0

DFEA_II

DFEA_III

OGBNArxiv

RomanEmpire 40 30

30

20 20

10

80

75 50 25

20 0.0

0.5

1.0

0.0

0.5

Budget ×

1.0

0.0

Budget ×

0.5

1.0

Budget ×

Figure 2: Budget–metric curves on six representative datasets (columns) for accuracy and fidelity (rows). Lines are the twelve attacks (mean over three seeds, shaded bands ±1 std). The four homophilic graphs share a 0–100% y-axis; OGBN-Arxiv and RomanEmpire use per-subplot ranges since their target accuracy is bounded by intrinsic task difficulty. The full ten-dataset, three-metric version (including macro F1) and per-dataset numbers are reported as Figure 10 and Appendix F.1.

fidelity improves rapidly up to ∼ 0.5× and then plateaus. Data-free variants are competitive with the data-driven methods across most datasets, with DFEA_II on the high-degree product graphs (especially Computers and Photo) as the main outlier, which reflects an attack-specific dependence on graph statistics and synthetic-query coverage. Strong data-driven attacks are nearly invariant to removing either features or structure, but collapse without any real input: the corresponding ratios in the regime-sensitivity heatmap (Appendix F.7) stay near one in the features-only and structure-only blocks and drop sharply in the data-free block. Together these observations indicate that effective extraction on graphs is primarily a sample-efficiency problem rather than a brute-force budget problem, and that data-free extraction can match data-driven attacks on graphs whose label space is well covered by synthetic queries; a longer discussion appears in Appendix F.7. Median budget

0.3 Extension to large-scale and heterophilic graphs. The seven graphs in the original protocol are small and ho0.2 mophilic, which limits the conclusions to one structural regime. To extend the protocol along three independent 0.1 axes, we evaluate the same twelve attacks on three additional graphs: OGBN-Arxiv (169,343 nodes, 40 classes, 0.0 edge homophily 0.699) probes scale and class-count stress, while RomanEmpire (edge homophily 0.291) and Attack AmazonRatings (edge homophily 0.452, ordinal 5-class ratings) probe heterophily. Figure 3 summarises surro- Figure 1: Sample efficiency across ten gate fidelity at the medium budget 0.25× on each of the datasets and four regimes. three additional graphs in the features-and-structure regime; the per-attack and per-budget results for all four regimes appear in Tables 36–38 of Appendix F.4. 0.25×0.25×0.25×0.25×

0.10×

0.10×

0.10×

M 4 E dv A5 M E C A E R GA ea lis D tic FE D A_ FE I D A_ FE II A _I II

A

3

0.05×0.05×0.05×

E

2

A

E

A

M

1

A

E

M

A

M

A

E

M

M

E

0

0.05×0.05×

These additional large-scale and heterophilic graphs reproduce the qualitative ordering observed on the seven homophilic datasets of the core protocol: simple data-driven methods (MEA0, MEA3, MEA5) and CEGA reach high fidelity, AdvMEA is unstable, and the data-free variants are also competitive on all three additional graphs (typically within 5 pp of the strongest data-driven attacks). Two further patterns are specific to these graphs; a longer discussion appears in Appendix F.4. First, OGBN-Arxiv exposes a scale and class-count effect. The undefended target reaches only 37.7–54.9% accuracy across our three backbones (Appendix Table 35) because the task itself is harder (40 fine-grained classes), so we report fidelity as the comparable measure: the strongest attacks (data-driven and data-free alike) reach ∼ 75–82% at 0.25×, while AdvMEA drops to ∼ 26%, indicating that the 40-class label space is the main difficulty rather than the graph scale itself. Second, heterophilic graphs separate attacks which assume labelled neighbourhoods from those which do not. On RomanEmpire (homophily 0.291) the strongest data-driven attacks reach 77% fidelity, but AdvMEA drops to 21.9%, a 50 pp loss which isolates an implicit homophily assumption in its adversarial query generator. AmazonRatings is intermediate: although its homophily is 0.452, the labels are ordinal 1–5 ratings, so neighbouring classes carry graded similarity which aggregation can still exploit; the strongest data-driven attacks still reach ≥ 93% fidelity. 6

Table 2: RQ2 summary for watermarking and integrity defenses across all ten datasets. Median (IQR) over datasets. Utility drop is the absolute drop in test accuracy (pp) against the undefended target on a matched backbone; negative values indicate that the defended model out-performs the matched undefended baseline. Defense RandomWM BackdoorWM SurviveWM ImperceptibleWM Integrity

F1 (%)

Fidelity (%)

Owner. verif. (%)

Utility drop (pp) ↓

Time (s)

Peak mem. (GB)

64.99 (12.02) 69.13 (15.51) 67.47 (27.86) 69.49 (9.19) 73.43 (35.00)

74.13 (10.70) 80.07 (15.95) 79.93 (32.92) 77.63 (13.88) 76.03 (22.52)

72.00 (24.7) 100.0 (0.00) 21.76 (32.4) 100.0 (0.00) 66.67 (50.0)

3.93 (6.18) 3.27 (2.87) 0.13 (18.2) 1.65 (6.28) 4.03 (21.8)

34.8 (14.6) 1.98 (0.45) 2.27 (0.92) 676(697) 1.38 (0.45)

0.09 (0.26) 0.16 (0.68) 0.32 (0.96) 2.30 (2.58) 0.20 (0.90)

Table 3: Seven information-limiting and query-detection defenses on a shared target backbone (DGL GCN, hidden 16) across ten datasets. Each cell reports protected accuracy (%) with the verification proxy (%) in parentheses (mean over three seeds; standard deviations in Appendix F.5). Dataset

OP_low

OP_high

PR_2bit

PR_top1

PRADA

AdaptMisinfo

GradRedir

Cora CiteSeer PubMed Computers Photo CoauthorCS CoauthorPhysics OGBN-Arxiv RomanEmpire AmazonRatings

79.4 (98.6) 67.6 (97.8) 77.9 (99.0) 44.0 (89.2) 89.1 (98.9) 87.8 (99.5) 89.4 (99.8) 37.7 (95.5) 42.7 (95.3) 42.0 (94.8)

79.2 (93.9) 66.3 (91.0) 75.9 (94.7) 37.6 (55.3) 90.7 (96.6) 88.2 (98.8) 89.1 (99.3) 37.8 (81.2) 40.6 (82.2) 41.2 (80.0)

73.3 (83.7) 53.9 (70.3) 77.6 (93.4) 36.1 (61.7) 90.4 (96.7) 87.5 (98.1) 90.2 (98.7) 30.2 (59.6) 35.2 (56.4) 39.4 (70.6)

79.6 (100.0) 68.8 (100.0) 78.2 (100.0) 34.8 (100.0) 95.5 (100.0) 88.1 (100.0) 89.5 (100.0) 39.5 (100.0) 42.7 (100.0) 41.6 (100.0)

40.2 (43.0) 69.3 (100.0) 78.0 (100.0) 46.0 (100.0) 87.0 (100.0) 75.0 (79.6) 83.4 (89.0) 37.0 (100.0) 19.7 (25.4) 41.8 (100.0)

41.0 (48.5) 39.8 (52.5) 44.1 (48.6) 28.0 (64.3) 46.3 (49.6) 52.4 (58.7) 59.0 (63.1) 19.9 (52.3) 22.5 (50.8) 33.9 (48.9)

79.8 (100.0) 68.4 (100.0) 78.3 (100.0) 52.4 (100.0) 66.6 (100.0) 88.2 (100.0) 89.7 (100.0) 38.2 (100.0) 42.5 (100.0) 41.7 (100.0)

4.2

Effectiveness of Ownership and Information-Limiting Defenses (RQ2)

To answer RQ2, we evaluate the twelve defenses on a shared target under identical splits, averaging over three seeds. We report the five watermarking and integrity methods first and then the seven information-limiting and query-detection methods. Utility drop is defended accuracy minus undefended accuracy on the same dataset, and ownership verification is accuracy on a fixed verification set; we summarize across datasets with the median and report variability with the inter-quartile range. Table 2 reports the median values together with time and memory; the corresponding boxplot view and per-dataset numbers are reported in Appendix F.2. Among the watermarking and integrity defenses, MEA0 BackdoorWM offers the best protection-utility balance: MEA1 it reaches the highest median fidelity (80.07%), perMEA2 fect verification, and only a 3.27 pp median utility MEA3 drop. ImperceptibleWM also reaches perfect verMEA4 ification, but at a much higher training cost which MEA5 is visible as a long memory tail in Figure 8 of Ap- AdvMEA pendix F.6. RandomWM and SurviveWM expose a CEGA stability-verification trade-off: SurviveWM minimises Realistic utility loss (0.13 pp median) but weakens verificaDFEA_I tion, while RandomWM is more variable across datasets. DFEA_II Integrity gives the highest median F1 (73.43%) DFEA_III with low time and memory, but its verification rate 0 20 40 60 80 100 120 Surrogate fidelity (\%) at 0.25 × is bimodal because the current proxy is a single binary fingerprint-flip event. A per-defense breakdown toFigure 3: Surrogate fidelity (%) at budget gether with the boxplot view appears in Appendix F.2. 0.25× on the three additional graphs for Information-limiting and query-detection defenses. all twelve attacks (mean over three seeds, We further evaluate seven information-limiting and whiskers are ± one std). query-detection methods on the same target backbone (DGL GCN) across all ten datasets, which complements the five ownership-tracing methods above with a different defense family. Table 3 reports the protected-model accuracy and the verification proxy on the protected model itself, and Appendix F.5 contains the standard deviations. 77 77

48

94

82

69

94

53

92

74 74

66

94

73

90

77 77

22

95

26

69

73

58

77

OGBN-Arxiv RomanEmpire AmazonRatings

89

75

91

72

81

90

76 81

76

94

78

95

The seven methods separate into three groups. Output perturbation (OP_low, OP_high) preserves accuracy on most graphs and yields a verification rate close to the noise-free regime when the noise scale is small, while the rate drops on graphs with more classes or with a heterophilic structure when the noise scale is large. Prediction rounding reveals a sharp split: PR_top1, which returns 7

only the top-1 label, gives perfect verification on every dataset because the marker label is always preserved, while PR_2bit, which quantizes the returned probability vector, suffers a notable drop on classes with similar logits. Query-detection methods (PRADA, AdaptMisinfo, GradRedir) show three distinct profiles: PRADA preserves accuracy on smaller graphs but degrades on Cora and the heterophilic RomanEmpire graph, AdaptMisinfo consistently reduces accuracy because it perturbs benign queries that resemble suspicious ones, and GradRedir preserves accuracy and reaches perfect verification on most datasets but reduces accuracy on Photo. Together these results show that backdoor triggers and label-quantization defenses provide the most reliable verification on the protected model, while output perturbation and query detection trade utility for protection at noticeable cost. 4.3

Protection-Utility Balance of Defenses (RQ3)

F1 (%)

To answer RQ3, we evaluate the defended model’s 100 task utility and its alignment with the original target 90 together with ownership verification on a fixed ver80 ification set under the unified protocol in Section 3. 70 All defenses protect the same architecture and use 60 identical splits; we compute metrics for every dataset BackdoorWM 50 and every seed. Figure 4 aggregates all ten datasets ImperceptibleWM Integrity 40 and all three seeds in a single view: each point is one RandomWM 30 dataset-seed run, the horizontal axis shows utility loss SurviveWM (pp) relative to the undefended target, and the vertical 20 0 5 10 15 20 25 axis shows F1 (%). To keep the central region readUtility loss (pp) able we cap the horizontal axis at 25 pp and exclude a small number of extreme outliers (Integrity on Photo Figure 4: Protection-utility scatter across ten and on a few heterophilic dataset-seed combinations); datasets and three seeds per defense (one these outliers are reported in full in Appendix F.2. point per dataset-seed run). Upper-left is best. The cloud of points concentrates in the region of small loss (0–10 pp) and high F1 (65–80 %), which shows that several defenses preserve task performance while enabling ownership verification. First, BackdoorWM consistently lies near the top left, which indicates that it preserves accuracy while enabling strong ownership verification; its spread is tight across datasets, which suggests stable behavior under our protocol. Second, ImperceptibleWM occupies a similar region but with higher cost, which matches the efficiency results in RQ4 and reflects the overhead of representation-level optimization. Third, RandomWM, SurviveWM, and Integrity form broader clusters, which shows that their balance depends more on data characteristics: RandomWM has moderate loss and verification with larger variance; SurviveWM has the smallest median loss but weak verification; Integrity preserves utility while yielding a binary ownership signal whose effectiveness varies across datasets. These observations imply that backdoor-style triggers provide the most reliable protection-utility balance in our setting, while representation-level watermarks trade efficiency for verification strength and the remaining methods are more sensitive to the data distribution. 4.4

Computational Cost of Attacks and Defenses (RQ4)

To answer RQ4, we profile empirical efficiency on NVIDIA A100 hardware. For attacks we fix the budget at 1.00× in the both regime and measure total attack time, query time, surrogate training time, and peak memory; for defenses we measure total defense time and peak memory. All values are mean ± std over three seeds. Tables 4–5 list total time on the seven homophilic graphs, and Figure 8 of Appendix F.6 reports peak memory aggregated across all ten datasets. Most attacks finish within minutes and use sub-GB memory, while structure-reconstruction pipelines are prohibitively expensive: the MEA family and CEGA take 0.7–2.5 min per run, whereas Realistic takes hundreds to thousands of minutes (Table 4) because it trains an auxiliary edge model, a cost which is hard to justify since RQ1 shows that fidelity plateaus by 0.25×. The adaptive attack AdvMEA is slower and more variable across datasets, which matches the overhead of policy search. On the defense side, BackdoorWM, SurviveWM, and Integrity train in 1–6 s with low memory, whereas ImperceptibleWM sits in a much heavier regime because it uses representation-level losses and larger buffers. The peak-memory profile and the per-attack memory tail are reported in Appendix F.6. 8

Table 4: RQ4: total attack time (min) at budget 1.00× on undefended targets in the both regime, restricted to the seven homophilic graphs (mean ± std over three seeds). The aggregate pattern on OGBN-Arxiv, RomanEmpire, and AmazonRatings is captured in Figure 8 of Appendix F.6. Attack MEA0 MEA1 MEA2 MEA3 MEA4 MEA5 AdvMEA CEGA Realistic DFEA_I DFEA_II DFEA_III

Cora

CiteSeer

CoauthorCS

CoauthorPhys

Computers

Photo

PubMed

0.69 ± 0.09 0.69 ± 0.09 1.51 ± 0.11 0.66 ± 0.08 0.76 ± 0.09 0.69 ± 0.10 2.35 ± 1.37 1.07 ± 0.11 90.3 ± 2.12 0.96 ± 0.06 0.82 ± 0.06 1.48 ± 0.14

0.72 ± 0.08 0.73 ± 0.08 1.73 ± 0.22 0.74 ± 0.08 0.94 ± 0.03 0.75 ± 0.07 4.39 ± 2.52 1.03 ± 0.07 111 ± 3.72 1.11 ± 0.04 0.88 ± 0.09 1.55 ± 0.12

0.86 ± 0.10 0.86 ± 0.10 2.01 ± 0.08 0.70 ± 0.04 2.58 ± 0.09 0.77 ± 0.08 8.88 ± 0.55 1.48 ± 0.14 472 ± 4.89 1.02 ± 0.04 0.80 ± 0.03 1.46 ± 0.16

1.36 ± 0.03 1.34 ± 0.07 2.25 ± 0.11 0.86 ± 0.10 6.46 ± 0.29 0.92 ± 0.18 4.93 ± 0.05 2.15 ± 0.05 976 ± 7.34 0.97 ± 0.08 0.86 ± 0.09 1.52 ± 0.15

2.18 ± 1.84 2.18 ± 1.88 2.21 ± 0.79 3.27 ± 1.93 2.50 ± 1.82 2.66 ± 0.99 13.0 ± 8.45 3.51 ± 3.41 840 ± 17.7 2.82 ± 2.51 1.28 ± 0.57 3.30 ± 2.47

0.79 ± 0.04 0.76 ± 0.06 1.59 ± 0.18 1.14 ± 0.09 0.84 ± 0.04 1.25 ± 0.20 10.3 ± 11.4 1.07 ± 0.10 248 ± 0.14 1.00 ± 0.09 0.87 ± 0.09 1.62 ± 0.11

1.21 ± 0.09 1.17 ± 0.01 2.02 ± 0.09 1.20 ± 0.03 1.73 ± 0.07 1.23 ± 0.01 4.51 ± 4.76 1.75 ± 0.11 529 ± 18.1 1.32 ± 0.08 1.07 ± 0.11 1.86 ± 0.15

Table 5: RQ4: total defense time (s) for the five watermarking and integrity defenses on the seven homophilic graphs (mean ± std over three seeds; lower is better). Memory aggregates and the three additional graphs are reported in Figure 8 of Appendix F.6. Defense RandomWM BackdoorWM SurviveWM Impercept. Integrity

4.5

Cora

CiteSeer

CoauthorCS

CoauthorPhys

Computers

Photo

PubMed

24.3 ± 0.07 1.88 ± 0.01 1.59 ± 0.00 676 ± 2.45 1.29 ± 0.01

23.9 ± 0.09 2.17 ± 0.23 1.62 ± 0.00 709 ± 2.33 1.10 ± 0.01

57.3 ± 2.58 2.54 ± 0.01 2.75 ± 0.01 906 ± 10.1 1.52 ± 0.16

34.8 ± 0.77 3.89 ± 0.06 5.62 ± 0.02 950 ± 14.0 2.37 ± 0.07

41.3 ± 0.23 1.98 ± 0.00 2.31 ± 0.04 461 ± 7.61 1.92 ± 0.03

36.0 ± 0.30 1.92 ± 0.01 1.52 ± 0.06 209 ± 11.0 1.38 ± 0.01

21.8 ± 0.13 1.88 ± 0.02 2.27 ± 0.09 196 ± 14.8 1.25 ± 0.19

Joint Attack-and-Defense Evaluation and Watermark Survival (RQ5)

To answer RQ5, we run every attack on every defended target and report two metrics: surrogate fidelity to the defended model (whether extraction is still effective) and the watermark verification rate measured on the surrogate, which we call watermark survival (whether a defense still yields a verifiable signal after extraction). We use the same ten datasets and shared query sets as RQ1 with budget fixed at 0.25×. Three consolidated heatmaps on Computers (joint fidelity against the five watermarks, joint fidelity against the seven information-limiting defenses, and watermark survival) and per-dataset numerical tables are in Appendix F.8. Table 6 compresses the joint outcome on Com- Table 6: RQ5 summary on Computers at 0.25×. puters into three numbers per watermark: me- Median fidelity is taken over the twelve attacks; dian surrogate fidelity over the twelve attacks, verif. on target and verif. on surrogate are the waverification on the protected model, and verifi- termark verification rates on the protected model cation on the extracted surrogate. Watermarks and on the extracted surrogate. do not reduce surrogate fidelity: the strong dataMedian Verif. Verif. driven attacks reach 77–92% fidelity against ev- Watermark fidelity (%) target (%) surr. (%) ery watermark, within a few points of the un71.1 100.0 59.2 defended baseline (Table 1); only PRADA and BackdoorWM SurviveWM 74.6 100.0 10.0 100.0 100.0 100.0 AdaptMisinfo substantially reduce fidelity, at Integrity 85.3 100.0 14.7 the clean-accuracy cost reported in RQ2. Wa- RandomWM ImperceptibleWM 84.3 100.0 0.0 termark survival, by contrast, is highly defensespecific: Integrity survives at 100% because its verification is invoked at query time and re-applies to the surrogate’s outputs; SurviveWM, RandomWM, and ImperceptibleWM collapse to low or nearrandom survival rates as their trigger lives in the target’s parameters and is not preserved when the surrogate retrains from labels alone; BackdoorWM is more heterogeneous, with its trigger leaking partially through the label channel and partially surviving for several attacks on larger graphs. This split is the load-bearing finding of the paper, and has two implications missed by existing graph-watermark evaluations. First, designs that rely on training-time signal modification cannot be defended against an extracted surrogate that need not preserve the original parameters: verification on the protected model is necessary but insufficient for ownership tracing. Second, future graph watermarks should be evaluated on the extracted surrogate as the primary metric, and at minimum match the survival of Integrity, which in our protocol means anchoring verification in a querytime mechanism rather than in the model parameters. The gap is not an artefact of our broader protocol: replaying SurviveWM and BackdoorWM under their original papers’ setups in Appendix F.9 reproduces the same surrogate-side collapse. Per-dataset RQ5 numbers are in Appendix F.8. 9

5

Conclusion

GraphIP-Bench provides a unified benchmark for GNN model extraction and ownership defenses. Across ten graphs, twelve attacks, and twelve defenses, we find that GNNs are often easy to extract: the strongest attacks exceed 90% surrogate fidelity on most datasets at medium budgets. Existing defenses offer only partial protection, and most watermarks lose substantial verification signal after extraction. Limitations and future work are discussed in Appendix B.

References [1] Enyan Dai, Minhua Lin, and Suhang Wang. Pregip: Watermarking the pretraining of graph neural networks for deep intellectual property protection. arXiv preprint arXiv:2402.04435, 2024. [2] Enyan Dai, Tianxiang Zhao, Huaisheng Zhu, Junjie Xu, Zhimeng Guo, Hui Liu, Jiliang Tang, and Suhang Wang. A comprehensive survey on trustworthy graph neural networks: Privacy, robustness, fairness, and explainability. Machine Intelligence Research, pages 1–51, 2024. [3] David DeFazio and Arti Ramesh. Adversarial model extraction on graph neural networks. arXiv preprint arXiv:1912.07721, 2019. [4] Faqian Guan, Tianqing Zhu, Hanjin Tong, and Wanlei Zhou. A realistic model extraction attack against graph neural networks. Knowledge-Based Systems, page 112144, 2024. [5] Will Hamilton, Zhitao Ying, and Jure Leskovec. Inductive representation learning on large graphs. Advances in neural information processing systems, 30, 2017. [6] Hongsheng Hu, Shuo Wang, Tian Dong, and Minhui Xue. Learn what you want to unlearn: Unlearning inversion attacks against machine unlearning. arXiv preprint arXiv:2404.03233, 2024. [7] Mika Juuti, Sebastian Szyller, Samuel Marchal, and N Asokan. Prada: protecting against dnn model stealing attacks. In 2019 IEEE European Symposium on Security and Privacy (EuroS&P), pages 512–527, 2019. [8] Sanjay Kariyappa and Moinuddin K Qureshi. Defending against model stealing attacks with adaptive misinformation. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 770–778, 2020. [9] Manish Kesarwani, Bhaskar Mukhoty, Vijay Arya, and Sameep Mehta. Model extraction warning in mlaas paradigm. In Proceedings of the 34th Annual Computer Security Applications Conference, pages 371–380, 2018. [10] Thomas N Kipf and Max Welling. Semi-supervised classification with graph convolutional networks. arXiv preprint arXiv:1609.02907, 2016. [11] Lincan Li, Bolin Shen, Chenxi Zhao, Yuxiang Sun, Kaixiang Zhao, Shirui Pan, and Yushun Dong. Intellectual property in graph-based machine learning as a service: Attacks and defenses. arXiv preprint arXiv:2508.19641, 2025. [12] Wenjun Li, Wanjun Ma, Mengyun Yang, and Xiwei Tang. Drug repurposing based on the dtd-gnn graph neural network: revealing the relationships among drugs, targets and diseases. BMC genomics, 25, 2024. [13] Jiacheng Liang, Ren Pang, Changjiang Li, and Ting Wang. Model extraction attacks revisited. In Proceedings of the 19th ACM Asia Conference on Computer and Communications Security, pages 1231–1245, 2024. [14] Mantas Mazeika, Bo Li, and David Forsyth. How to steer your adversary: Targeted and efficient model stealing defenses with gradient redirection. In International conference on machine learning, pages 15241–15254. PMLR, 2022. 10

[15] Alessio Monti, Alessia Bertugli, Simone Calderara, and Rita Cucchiara. Dag-net: Double attentive graph neural network for trajectory forecasting. In 2020 25th international conference on pattern recognition (ICPR), pages 2551–2558. IEEE, 2021. [16] Christopher Morris, Nils M Kriege, Franka Bause, Kristian Kersting, Petra Mutzel, and Marion Neumann. Tudataset: A collection of benchmark datasets for learning with graphs. arXiv preprint arXiv:2007.08663, 2020. [17] Tribhuvanesh Orekondy, Bernt Schiele, and Mario Fritz. Knockoff nets: Stealing functionality of black-box models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 4954–4963, 2019. [18] Sen Peng, Yufei Chen, Jie Xu, Zizhuo Chen, Cong Wang, and Xiaohua Jia. Intellectual property protection of dnn models. World Wide Web, 26(4):1877–1911, 2023. [19] Oleg Platonov, Denis Kuznedelev, Michael Diskin, Artem Babenko, and Liudmila Prokhorenkova. A critical look at the evaluation of gnns under heterophily: Are we really making progress? arXiv preprint arXiv:2302.11640, 2023. [20] Hanjin Sun, Wen Yang, and Yatie Xiao. A review of adversarial attacks and defenses on graphs. In Proceedings of the 4th International Conference on Artificial Intelligence and Computer Engineering, page 416–421, 2024. [21] Lichao Sun, Yingtong Dou, Carl Yang, Kai Zhang, Ji Wang, Philip S. Yu, Lifang He, and Bo Li. Adversarial attack and defense on graph data: A survey. IEEE Transactions on Knowledge and Data Engineering, 35(8):7693–7711, 2023. [22] Yuchen Sun, Tianpeng Liu, Panhe Hu, Qing Liao, Shaojing Fu, Nenghai Yu, Deke Guo, Yongxiang Liu, and Li Liu. Deep intellectual property protection: A survey. arXiv preprint arXiv:2304.14613, 2023. [23] Florian Tramèr, Fan Zhang, Ari Juels, Michael K Reiter, and Thomas Ristenpart. Stealing machine learning models via prediction {APIs}. In 25th USENIX security symposium (USENIX Security 16), pages 601–618, 2016. [24] Petar Veličković, Guillem Cucurull, Arantxa Casanova, Adriana Romero, Pietro Lio, and Yoshua Bengio. Graph attention networks. arXiv preprint arXiv:1710.10903, 2017. [25] Asim Waheed, Vasisht Duddu, and N. Asokan. Grove: Ownership verification of graph neural networks using embeddings. In 2024 IEEE Symposium on Security and Privacy (SP), pages 2460–2477, 2024. [26] Haiming Wang, Zhikun Zhang, Min Chen, and Shibo He. Making watermark survive model extraction attacks in graph neural networks. In ICC 2023-IEEE International Conference on Communications, pages 57–62, 2023. [27] Zebin Wang, Menghan Lin, Bolin Shen, Ken Anderson, Molei Liu, Tianxi Cai, and Yushun Dong. Cega: A cost-effective approach for graph-based model extraction and acquisition. arXiv preprint arXiv:2506.17709, 2025. [28] Bang Wu, Xiangwen Yang, Shirui Pan, and Xingliang Yuan. Adapting membership inference attacks to gnn for graph classification: Approaches and implications. In 2021 IEEE International Conference on Data Mining (ICDM), pages 1421–1426, 2021. [29] Bang Wu, Xiangwen Yang, Shirui Pan, and Xingliang Yuan. Model extraction attacks on graph neural networks: Taxonomy and realisation. In Proceedings of the 2022 ACM on Asia conference on computer and communications security, pages 337–350, 2022. [30] Bang Wu, Xingliang Yuan, Shuo Wang, Qi Li, Minhui Xue, and Shirui Pan. Securing graph neural networks in mlaas: A comprehensive realization of query-based integrity verification. In 2024 IEEE Symposium on Security and Privacy (SP), pages 2534–2552. IEEE, 2024. 11

[31] Bingzhe Wu, Yatao Bian, Hengtong Zhang, Jintang Li, Junchi Yu, Liang Chen, Chaochao Chen, and Junzhou Huang. Trustworthy graph learning: Reliability, explainability, and privacy protection. In Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pages 4838–4839, 2022. [32] Jing Xu, Stefanos Koffas, Oğuzhan Ersoy, and Stjepan Picek. Watermarking graph neural networks based on backdoor attacks. In 2023 IEEE 8th European Symposium on Security and Privacy (EuroS&P), pages 1179–1197, 2023. [33] Mingfu Xue, Yushu Zhang, Jian Wang, and Weiqiang Liu. Intellectual property protection for deep learning models: Taxonomy, methods, attacks, and evaluations. IEEE Transactions on Artificial Intelligence, 3(6):908–923, 2021. [34] Liangwei Yang, Shengjie Wang, Yunzhe Tao, Jiankai Sun, Xiaolong Liu, Philip S Yu, and Taiqing Wang. Dgrec: Graph neural network for recommendation with diversified embedding generation. In Proceedings of the sixteenth ACM international conference on web search and data mining, pages 661–669, 2023. [35] Xiaoyu You, Youhe Jiang, Jianwei Xu, Mi Zhang, and Min Yang. Gnnfingers: A fingerprinting framework for verifying ownerships of graph neural networks. In Proceedings of the ACM on Web Conference 2024, pages 652–663, 2024. [36] He Zhang, Bang Wu, Xingliang Yuan, Shirui Pan, Hanghang Tong, and Jian Pei. Trustworthy graph neural networks: Aspects, methods and trends. arXiv preprint arXiv:2205.07424, 2022. [37] Linji Zhang, Mingfu Xue, Leo Yu Zhang, Yushu Zhang, and Weiqiang Liu. An imperceptible and owner-unique watermarking method for graph neural networks. In Proceedings of the ACM Turing Award Celebration Conference-China 2024, pages 108–113, 2024. [38] Zaixi Zhang, Qi Liu, Zhenya Huang, Hao Wang, Chee-Kong Lee, and Enhong Chen. Model inversion attacks against graph neural networks. IEEE Transactions on Knowledge and Data Engineering, 2022. [39] Kaixiang Zhao, Lincan Li, Kaize Ding, Neil Zhenqiang Gong, Yue Zhao, and Yushun Dong. A survey of model extraction attacks and defenses in distributed computing environments. arXiv preprint arXiv:2502.16065, 2025. [40] Kaixiang Zhao, Lincan Li, Kaize Ding, Neil Zhenqiang Gong, Yue Zhao, and Yushun Dong. A survey on model extraction attacks and defenses for large language models. arXiv preprint arXiv:2506.22521, 2025. [41] Kaixiang Zhao, Lincan Li, Kaize Ding, Neil Zhenqiang Gong, Yue Zhao, and Yushun Dong. A systematic survey of model extraction attacks and defenses: State-of-the-art and perspectives. arXiv preprint arXiv:2508.15031, 2025. [42] Xiangyu Zhao, Hanzhou Wu, and Xinpeng Zhang. Watermarking graph neural networks by random graphs. In 2021 9th International Symposium on Digital Forensics and Security (ISDFS), pages 1–6, 2021. [43] Qinkai Zheng, Xu Zou, Yuxiao Dong, Yukuo Cen, Da Yin, Jiarong Xu, Yang Yang, and Jie Tang. Graph robustness benchmark: Benchmarking the adversarial robustness of graph machine learning. In Thirty-fifth Conference on Neural Information Processing Systems Datasets and Benchmarks Track, 2021. [44] Yuanxin Zhuang, Chuan Shi, Mengmei Zhang, Jinghui Chen, Lingjuan Lyu, Pan Zhou, and Lichao Sun. Unveiling the secrets without data: Can graph neural networks be exploited through {Data-Free} model extraction attacks? In 33rd USENIX Security Symposium (USENIX Security 24), pages 5251–5268, 2024.

12

Appendix Contents A Related Work

14

B Limitations and Future Work

15

C Implementation Details

15

D Dataset Statistics

16

E Reproducibility and Configurations

16

E.1 Implementation validation against original papers . . . . . . . . . . . . . . . . . . F Supplementary Experimental Results and Discussion

17 20

F.1

Attack effectiveness results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

20

F.2

Defense performance results . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

21

F.3

Baseline utility across backbones . . . . . . . . . . . . . . . . . . . . . . . . . . .

23

F.4

Attack effectiveness on the three additional datasets . . . . . . . . . . . . . . . . .

26

F.5

Standard deviations for information-limiting defenses . . . . . . . . . . . . . . . .

27

F.6

Peak GPU memory of attacks and defenses (RQ4) . . . . . . . . . . . . . . . . . .

29

F.7

Extended statistical analysis of attack effectiveness (RQ1) . . . . . . . . . . . . .

32

F.8

Joint evaluation and watermark survival per dataset . . . . . . . . . . . . . . . . .

36

F.9

RQ5 watermark survival under each paper’s original setup . . . . . . . . . . . . .

40

F.10 Generalisation across structure, architecture, and tasks . . . . . . . . . . . . . . .

44

F.11 Defense hyperparameter ablation . . . . . . . . . . . . . . . . . . . . . . . . . . .

50

13

A

Related Work

Surveys of intellectual-property protection for ML. A first body of work surveys intellectualproperty protection for machine learning models in vision and language, covering watermarking schemes that embed verifiable signals during training, fingerprinting schemes that identify a model from its decision boundary, differential-privacy approaches that bound the leakage of training data, and frameworks for tracing stolen models [41, 11, 18, 33, 22, 40, 39]. These surveys document a rich design space but report results on heterogeneous benchmarks (CIFAR, ImageNet, GLUE), and the threat models they consider rarely include the graph-specific failure modes that arise when the input is a heterogeneous attributed graph. Parallel surveys for graph learning catalogue privacy, robustness, and fairness risks of graph neural networks [2, 31, 36, 20, 43], but they review adversarial manipulation and information leakage on graphs and do not unify model extraction with ownership verification. Existing graph-security testbeds. Several testbeds standardize parts of graph security evaluation [21]; they typically emphasize either adversarial robustness (small structural perturbations that flip predictions) or membership-inference privacy (recovering whether a node was in the training set). To our knowledge no prior testbed evaluates model extraction together with ownership-verification techniques (watermarking, fingerprinting, query-detection) under a single reproducible protocol with shared query sets, fixed splits, and matched backbones across attack and defense families. The closest prior work releases per-attack and per-defense reference implementations but does not measure (i) joint surrogate fidelity under defended targets, (ii) watermark survival on the extracted surrogate, or (iii) protection-utility-efficiency trade-offs in a single comparable view; these are precisely the three axes that GraphIP-Bench introduces. Attacks, defenses, and ownership schemes. The attack literature proposes random-query MEAstyle attacks on the target output [28], adaptive query-selection attacks that learn an informative query distribution [44], and data-free attacks that synthesize the queries when the real graph is unavailable [38]. The information-limiting defense literature contributes output-perturbation methods that add bounded noise to the returned scores [13, 9, 6], query-pattern-detection methods that flag and react to suspicious query streams [7, 8, 14], and graph-specific ownership schemes that embed a verifiable backdoor or fingerprint into the model [26, 32, 1, 35, 30, 25]. Each of these methods is reported on its own dataset/budget/backbone combination, which prevents apples-toapples comparison; specifically, the strongest extraction attack reported in any prior work depends on what the authors chose as the budget unit (query count vs. fraction of train set), what the authors fixed as the victim backbone, and whether the threat model assumes hard-label or soft-label outputs. We address this gap with the first unified benchmark that evaluates graph model extraction and ownership defenses under a single reproducible protocol: we fix public splits and shared query sets, standardize budgets and endpoint assumptions, separate an extraction track from an ownership-verification track, and add a joint track (RQ5) that runs every attack on every defended target with watermark survival measured on the extracted surrogate rather than only on the protected model. We further report protection-utility trade-offs (RQ3) and computational cost (RQ4) with released reference implementations so that future methods can be evaluated under exactly the same conditions. Position relative to recent work. Three recent contemporaneous lines of work are most related but do not subsume GraphIP-Bench: (i) graph-specific watermarking papers that propose a new ownership-tracing scheme [1, 35] typically evaluate the watermark on the protected model only, while we are the first to systematically measure survival of every watermarking scheme on the extracted surrogate; (ii) graph-extraction papers [28, 44, 38] typically evaluate one attack family against one or two defenses, while we evaluate twelve attacks against twelve defenses on ten datasets including three heterophilic and large-scale graphs; (iii) general ML-extraction defenses [7, 8, 14] are typically evaluated on vision/language models, while we adapt them to the graph setting and report which defense families generalise (output-perturbation, query-detection) and which collapse (model-side watermarks lose verifiability after extraction). The combined view gives the first reproducible answer to the question of which existing techniques actually compose, and which leave a research gap that future work should target. 14

B

Limitations and Future Work

Scope of the threat model. GraphIP-Bench targets the most widely deployed extraction setting: a black-box query interface in which the attacker observes only the target’s outputs, with budgets expressed as a fraction of the training-set size. This is the standard threat model assumed by every attack and defense we benchmark, which makes it the right scope for a unified comparison. Extending the protocol to grey-box, adaptive multi-step, federated, or streaming settings is a natural follow-up that builds on the same evaluation infrastructure. Architecture and task coverage. GraphIP-Bench covers the three GNN backbones (GCN, GAT, GraphSAGE) and the three graph-learning tasks (node classification, link prediction, graph classification) used by the methods we benchmark, which already spans the bulk of published GNN-extraction and GNN-watermarking work. The protocol is backbone- and task-agnostic, so adding emerging architectures (e.g., graph transformers, heterogeneous or temporal GNNs) is a configuration extension rather than a redesign. Defense families to extend. GraphIP-Bench integrates twelve defenses across watermarking, output perturbation, prediction rounding, and query-pattern detection – the families with public reference implementations for graph models. Differential-privacy training and attribute-encryption / homomorphic-inference deployments use a different query interface and are natural next additions; the unified protocol provides the slot in which to drop them in once mature reference implementations exist. Future-work targets indicated by our findings. The results identify three concrete research targets. (i) Surrogate-surviving watermarks. Our joint track (RQ5) shows that ownership-tracing designs should be evaluated on the extracted surrogate as the primary metric and should anchor verification in a query-time mechanism, as Integrity does in our protocol. (ii) Query-detection defenses with bounded clean-accuracy cost. The protection-utility frontier we report suggests room for query-pattern detectors that match the fidelity reduction of PRADA and AdaptMisinfo at a fraction of the utility cost. (iii) Heterophily-aware extraction analysis. The relative ordering of attacks is preserved across homophilic, heterophilic, and large-scale regimes (RQ1, Appendix F.10); a structural account that connects graph properties (homophily, degree distribution) to extraction behaviour would close the explanatory loop.

C

Implementation Details

Hardware. All GPU experiments are submitted as Slurm jobs on a shared multi-tenant academic compute cluster. The compute partitions used in this work expose NVIDIA A100 80 GB PCIe GPUs (eight GPUs per node, multiple nodes); a small number of memory-stress runs additionally use H100 and H200 partitions on the same cluster. Unless otherwise stated, every reported measurement uses a single NVIDIA A100 80 GB GPU on a node with 1.0 TiB of system memory and dual AMD EPYC CPUs. Operating system and drivers. The compute nodes run Red Hat Enterprise Linux 9.6 (kernel 5.14.0570) with NVIDIA driver 570.195.03 and a CUDA 12.8 driver capability. Login nodes have no GPU access, so all timing and memory numbers are recorded from Slurm-allocated GPU jobs only. Software stack. The full pipeline runs in a dedicated Conda environment named graphip: Python 3.11.15, PyTorch 2.2.1 + cu121, DGL 2.1.0 + cu121, PyTorch Geometric 2.7.0, OGB 1.3.6, NumPy 1.26.4, SciPy 1.17.1, NetworkX 3.6.1, and the standard scientific Python ecosystem (matplotlib, pandas, scikit-learn). PyTorch is pinned to 2.2.1 because the matching DGL 2.1.0 graphbolt kernels only ship pre-built shared libraries for PyTorch 2.0–2.2 on CUDA 12.1; we install everything from prebuilt CUDA wheels and do not require the CUDA toolkit compiler. Protocol. For each method we fix four disjoint splits per dataset (train, validation, test, query) and apply the same preprocessing pipeline and hyperparameter search protocol described in Appendix E. We repeat all measurements with three random seeds (0, 1, 2) and report the mean and the standard deviation. Wall-clock time is recorded with time.perf_counter timers in the training loop; peak GPU memory is obtained from the CUDA runtime via torch.cuda.max_memory_allocated and cross-checked with nvidia-smi. All experiments share identical hardware, software, and 15

configuration defaults so that results are directly comparable across attacks, defenses, datasets, regimes, and budgets.

D

Dataset Statistics

We summarize the graph datasets used in our experiments in Table 7. Edges are counted as undirected (unique). The average degree is computed as 2E/N . For the Planetoid datasets (Cora, CiteSeer, PubMed) we follow the standard splits; for Amazon (Computers, Photo) and Coauthor (CoauthorCS, CoauthorPhysics) we use 100 training nodes per class with fixed validation and test sizes in our loader. For OGBN-Arxiv we follow the official train, validation, and test splits provided by the OGB library. For RomanEmpire and AmazonRatings we follow the splits released by Platonov et al. [19]. Table 7: Dataset statistics. Edges are undirected and unique. Avg. degree is 2E/N . The edge homophily is the fraction of edges whose endpoints share the same label. Dataset

# Nodes

# Edges

Avg. degree

# Classes

Edge homophily

Node Text

Cora 2,708 CiteSeer 3,327 PubMed 19,717 Computers 13,752 Photo 7,650 CoauthorCS 18,333 CoauthorPhysics 34,493 OGBN-Arxiv 169,343 RomanEmpire 22,662 AmazonRatings 24,492

5,278 4,614 44,325 252,737 122,906 81,894 247,962 667,793 44,258 105,296

3.9 2.8 4.5 36.8 32.1 8.9 14.4 7.9 3.9 8.6

7 6 3 10 8 15 5 40 18 5

0.810 0.739 0.802 0.783 0.833 0.808 0.931 0.699 0.291 0.452

Paper content Paper content Paper content Entity description Entity description Paper content Paper content Paper title and abstract Wikipedia text Product description

E

Domain Citation Citation Citation Web link Web link Citation Citation Citation Heterophilic Heterophilic

Reproducibility and Configurations

Scope and averaging. We release scripts, fixed random seeds, and per-method configurations to reproduce all tables and figures. Results are averaged over three seeds (0, 1, 2) and reported as mean ± standard deviation unless stated otherwise. Seeds and determinism. For each run we set the Python and CUDA random states and propagate the seed through data loading and sampling. GPU runs use deterministic kernels when available. Device selection. A command-line flag –device selects the process-visible GPU (via the environment) or the CPU; all modules use the same device setting throughout the run. Dataset loading and splits. A unified loader normalizes dataset aliases and returns DGL graphs with node features and masks. Planetoid datasets (Cora, CiteSeer, PubMed) use the standard train/validation/test masks. Amazon and Coauthor datasets (Computers, Photo, CoauthorCS, CoauthorPhysics) use a canonical per-class sampling scheme with 100 training nodes per class and fixed validation/test sizes. OGBN-Arxiv uses the official OGB train/validation/test splits. RomanEmpire and AmazonRatings use the splits released by Platonov et al. [19]. For graph classification (ENZYMES, PROTEINS) and link prediction (Cora) we follow the standard splits provided by TUDataset and PyTorch Geometric, respectively. GNN backbones. The default backbone for the extraction track and for the original watermarking, integrity, and information-limiting defenses is a DGL GCN with hidden dimension 16. RandomWM is implemented in DGL with a GraphSAGE backbone of hidden dimension 128, and ImperceptibleWM is implemented in PyTorch Geometric with a GCN backbone of hidden dimension 128. The crossarchitecture analysis (Appendix F.10) additionally trains target and surrogate models with GAT and GraphSAGE under matched hidden dimensions. Baseline utility for each backbone on every dataset is reported in Table 35. Directory layout and logs. Attack track (RQ1) writes newline-delimited JSON files under outputs/RQ1_final/<Dataset>/<Dataset>.jsonl. Each record contains header fields (track, dataset, attack, configuration index, constructor/run configuration, budget multiplier, node fraction induced by the budget, regime, feature/adjacency ratios, seed), performance metrics (accuracy, F1, precision, recall, fidelity), and compute metrics (train target time, query time, surrogate training time, total attack time, per-query inference latency for target and surrogate, peak GPU memory, GPU hours). Ownership/defense track (RQ2/RQ3) writes outputs/RQ2_RQ3_best/<Dataset>.jsonl with fields 16

(track, dataset, defense, configuration index, configuration, seed), performance metrics (accuracy, F1, precision, recall, watermark accuracy), and compute metrics (train target time, defense training time, defense inference time, total defense time, peak GPU memory, GPU hours). The joint track (RQ5) writes a parallel directory outputs/RQ5_joint/ with the same record format extended by an attack field. Leaderboards and LaTeX tables are exported with selection and formatting utilities. RQ1 (attacks) configuration. The attack runner sweeps query budgets {0.05, 0.10, 0.25, 0.50, 1.00} and four regimes (features only, structure only, both available, data free). Per-method training schedules are recorded in logs. For the MEA family, CEGA, and Realistic we use 200 epochs per cycle; CEGA additionally uses learning rate 0.01 and 200 target/surrogate epochs. The AdvMEA implementation uses its internal fixed epoch schedule; any external epoch parameter appears in logs for uniformity but does not affect training. RQ2/RQ3 (defenses) configuration. We provide a best-configuration runner that replays the top settings discovered by a prior grid search. Table 8 lists the fixed constructor parameters used for each defense. The same default applies across all ten datasets unless an explicit hyperparameter sweep is run, which is reported in Appendix F.11. Other runtime arguments remain at method defaults. Table 8: Fixed default configuration used for each defense in the ownership track. The same default applies across all ten datasets unless explicitly varied in the hyperparameter sweep (Appendix F.11). Defense

Key hyperparameter

Default value

Watermarking and integrity (5 methods) RandomWM BackdoorWM SurviveWM ImperceptibleWM Integrity

watermark-node ratio trigger density watermark strength epsilon — (parameter-free verifier)

0.002 0.01 0.25 0.25 —

Information-limiting and query-detection (7 methods) OP_low Gaussian noise scale σ OP_high Gaussian noise scale σ PR_2bit precision bits PR_top1 returned scores PRADA detection threshold AdaptMisinfo misinformation ratio GradRedir redirection strength

0.05 0.20 2 top-1 label only method default method default method default

Common search spaces. Attacks: budget, regime, and per-method cycles/epochs (when applicable). Learning rate and dropout follow method defaults unless a method requires explicit settings (CEGA uses learning rate 0.01). Defenses: grid search over typical ranges around the default in Table 8; a single best configuration per defense is fixed across datasets to keep the protocol uniform. The full sweep on Cora and Computers is reported in Appendix F.11. How to re-run. RQ1 (attacks): call the attack runner with dataset, attack, budget, regime, and seed. Logs are saved under outputs/RQ1_final with the exact budget multiplier recorded in each line. RQ2/RQ3 (defenses): call the best-configuration runner with seeds [0, 1, 2]; outputs are saved under outputs/RQ2_RQ3_best. RQ5 (joint): call the joint runner that pairs every attack with every defense at the medium budget; outputs are saved under outputs/RQ5_joint. This setup unifies scripts, seeds, and logging across datasets and methods, enabling direct regeneration of all tables from the released outputs. E.1

Implementation validation against original papers

To check that our re-implementations behave consistently with each method’s original publication, we compare our reproduced numbers against the closest matching setting reported by the original authors. For attacks we use the highest-overlap target dataset reported in each paper; for defenses we report ownership verification on the closest-matching dataset and backbone. The protocol differs from each paper in budget unit and split, so the goal is qualitative agreement on the relative ordering and absolute level rather than identity. Where a direct comparison is impossible we explicitly state why and report the next-most-similar setting. Reference implementation and fairness-preserving adjustments. The core algorithm of every method — query-selection rule, surrogate-training objective, structure-synthesis procedure, watermark-embedding loss — follows the original publication. On top of this we apply five fairnesspreserving adjustments that put every method on equal footing: the surrogate hidden dimension is 17

fixed at 16 for the default GCN backbone (Section 3); the query budget is expressed as a fraction of the test set rather than an absolute query count; the four data-availability regimes (both, x_only, a_only, data_free) are applied uniformly; three seeds (0, 1, 2) are reused across methods; and no per-method hyperparameter tuning is performed beyond Appendix F.11. Most of the deltas in Table 9 are within ±14 pp of the original numbers and reflect these adjustments; we explain each case below. MEA0–MEA5 (Wu et al., 2022) [29]. The original paper reports surrogate fidelity on Cora, CiteSeer, and PubMed at a fixed attack-node budget of ∼ 25% of total nodes (Table 4 of the original); our protocol reports fidelity at 1.00× of the test-set fraction, a comparable absolute query count. Comparisons on Cora are summarised in Table 9. The agreement on the six MEA variants is good: MEA0, MEA1, MEA2, MEA3, and MEA5 all reach 89–95% fidelity in both protocols, within ±14 pp of the original numbers despite the different splits, query-set construction, and validation procedure; MEA4 agrees with the original within ∼ 10 pp. AdvMEA (DeFazio and Ramesh, 2019) [3]. The original paper does not report dataset-level surrogate fidelity in tabular form; the strongest claim in their experiments section is that “the extraction can achieve up to ∼ 80% fidelity” on Cora and Pubmed under strong adversary assumptions (full 2-hop subgraph access plus class priors). Our reproduction on Cora reaches 66–68 % fidelity at 1.00× across regimes (Table 9), within ∼ 12 pp of the upper bound the original paper claims. The absolute number depends sharply on which adversarial perturbation budget is used; ours follows the standard setting in our hyperparameter table. CEGA (Wang et al., 2025) [27]. The original CEGA paper reports test accuracy / fidelity / F1 on Coauthor-CS, Coauthor-Physics, Amazon-Computer, and Amazon-Photo at a 20C-query budget (i.e., 20 times the number of classes). Our protocol uses budgets expressed as a fraction of the test set, and the closest match is the small-budget regime (0.05× to 0.10×). On CoauthorCS, 20C = 300 queries which falls between our 0.05× and 0.10× on that dataset; the corresponding fidelity in our setup is in the upper 80 %–low 90 % range, agreeing with the original 93.40 % within a few points (Table 9). Crucially, the original paper’s relative ordering — CEGA > AGE > GRAIN > Random — is reproduced under our protocol on every overlapping dataset. Realistic (Guan et al., 2024) [4]. The original paper varies query budgets across four levels (Attack0 through Attack-3) on Cora, Citeseer, Pubmed, with default training-set sizes that are dataset-specific (e.g. Cora: 35 queries for Attack-0). The closest match in our protocol is the smallest-budget bucket (0.05×). Our reproduction reaches Cora fidelity 62.0 ± 4.5 % at 0.05×, compared with the original Attack-0 (Cora) fidelity of 72.14 ± 3.56 %; the gap of about 10 pp is in the same direction (small budget ⇒ moderate fidelity) and the qualitative ranking “Realistic > baseline GCN” transfers to our protocol. DFEA_I / DFEA_II / DFEA_III (Zhuang et al., 2024) [44]. The original paper reports three datafree attack variants on Cora, Pubmed, Amazon-Computers, and OGB-Arxiv; on Cora the strongest variants reach 93–94% fidelity, with the “Random Graph” baseline at 73.7%. Our reproduction reaches 90–97% fidelity at 1.00× on Cora across the three variants (Table 9), agreeing with the strongest original numbers within ∼ 4 pp. The qualitative claim of the original paper — that data-free extraction is feasible at high fidelity on homophilic graphs and harder on heterophilic / high-class-count settings — is preserved: across our ten datasets the three variants reach 77–99% fidelity at 1.00× on the seven homophilic graphs and 33–84% on RomanEmpire, AmazonRatings, and OGBN-Arxiv (Tables 13–38). BackdoorWM (Xu et al., 2023) [32]. The original paper reports watermark accuracy on Cora and CiteSeer for GCN, GAT, and GraphSAGE backbones (Table 6 of the original paper): GCN/Cora 97.56%, GCN/CiteSeer 98.05%. Our protocol reports the same metric on the same datasets: 100% on every one of the seven homophilic datasets including Cora and CiteSeer (Table 34 in Appendix F.2). The ∼ 2 pp difference is well within the variance the original paper reports across watermark-rate settings, and the claim that BackdoorWM is essentially perfect at watermark verification on the protected model is preserved. SurviveWM (Wang et al., 2023) [26]. The original paper evaluates watermark survival on MSRC-9 and ENZYMES (graph classification) using a GraphSAGE host model with 50/30/20 train/extract/test 18

splits, and reports the “average effectiveness Ē” of watermark retention after extraction. The metric is binary (1 if watermark retaining rate exceeds two reference thresholds, 0 otherwise) and is averaged over 100 repeated runs. Our protocol uses node-level datasets and a continuous verification rate, so a direct numerical comparison is not possible. We report the qualitative claim instead: SurviveWM produces a non-trivial verification rate on the protected model (median 54 % on Cora) but collapses to ∼ 14 % on the extracted surrogate (Table 41c in Appendix F.8), which contradicts the original paper’s claim that the watermark “survives” extraction. The disagreement is the central finding of our RQ5 and motivates evaluation on the surrogate as the primary metric. ImperceptibleWM (Zhang et al., 2024) [37]. The original paper reports the original-vswatermarked model accuracy gap on Cora and Pubmed for GCN/GAT/GraphSAGE (Table 2 of the original): on GCN/Cora the watermarked model reaches 83.40% accuracy versus 83.74% for the unwatermarked one (a 0.34% utility drop). Our reproduction on the same dataset and backbone shows 79.4% undefended versus 71.94% watermarked (utility drop of ∼ 7.5%). Two design differences explain the larger drop: our protocol uses a fixed cross-dataset hyperparameter (Appendix E) rather than the per-dataset tuning the original paper performs, and our undefended baseline runs at the standard hidden dimension 16 used throughout the protocol rather than the 128 used by the original. The claim of “no significant impact on the primary task” holds with the original tuning but is loosened under our standardised protocol. RandomWM (Zhao et al., 2021) [42]. The original paper reports watermark accuracy as a function of trigger-graph parameters on Cora and Pubmed, but does not provide a single headline number for direct comparison. The qualitative claim is that the watermark accuracy can be tuned above 90% with appropriate parameter choices. Our reproduction shows median verification rate 75% on Cora and 94–98% on Computers and Photo (Table 34), which is within the range the original paper reports for non-extreme parameter settings. Integrity (Wu et al., 2024) [30]. The original paper does not report a single “verification accuracy” number on the protected model. Instead it reports a verification-query-number improvement multiplier relative to a random-node-selection baseline (e.g. on Cora transductive: BFA 4.0×, RandAttack 1.3×). The metric is fundamentally different from our verification-rate metric, so a direct numerical comparison is not possible. We instead validate the qualitative claim: Integrity reaches 100% verification on every homophilic dataset of our protocol (Table 34), consistent with the original paper’s claim that fingerprinting nodes selected by their algorithm are reliably distinguishable on the protected model. PRADA (Juuti et al., 2019) [7]. The original paper evaluates query-pattern detection on image classifiers (MNIST, GTSRB, CIFAR-10) with DNN backbones; it does not include any graph dataset or GNN backbone. A direct numerical comparison is therefore impossible. Our adaptation transfers the distance-based detector to the graph setting and measures verification accuracy on the protected model and extracted surrogate; the qualitative behaviour (significant fidelity reduction at the cost of clean accuracy, see Tables 39–40) is consistent with the original paper’s vision-domain results. AdaptMisinfo (Kariyappa and Qureshi, 2020) [8], GradRedir (Mazeika et al., 2022) [14]. Both original papers evaluate on image classification benchmarks (CIFAR-10, CIFAR-100, ImageNet) with CNN backbones (ResNet-18, ResNet-34) — no graph dataset or GNN model is used. The metric is also defined for the image domain (extraction-fidelity reduction at fixed query budgets). A direct numerical comparison is therefore impossible. Our adaptation re-implements the perturbation rule on graph-classification logits and reports the same protocol-level metrics as the other defenses; the qualitative claim that adaptive misinformation reduces extraction fidelity at a clean-accuracy cost transfers to the graph setting. OP_low / OP_high / PR_2bit / PR_top1. These are protocol-level information-limiting wrappers that we adapt from generic stealing-defense literature [9, 13]. The cited papers do not report graph-specific numbers, and PR_2bit/PR_top1 are not standalone published methods but standard label-quantisation/top-1 wrappers; we therefore do not have a baseline number to compare against. The qualitative claim from the source literature — that label-quantising the response is an effective lightweight defense — transfers to our protocol: PR_2bit is the only inference-time wrapper in our benchmark which substantively reduces surrogate fidelity (Tables 56–57). 19

Table 9: Implementation validation for attacks where a numerical comparison is possible. “Original” is the closest-matching setting reported in the source paper. “Ours” is the corresponding number under the GraphIP-Bench protocol. “∆” is Ours minus Original (positive means our reproduction reaches higher fidelity). All numbers are surrogate fidelity (%) unless otherwise noted; Cora at 1.00× in the both regime is used for our values unless the source-paper setting dictates a different budget bucket. Method

Source paper / setting

Closest in ours

MEA0 MEA1 MEA2 MEA3 MEA4 MEA5 AdvMEA CEGA Realistic DFEA_I DFEA_II DFEA_III

Wu 2022, Cora, full attack nodes Wu 2022, Cora, full attack nodes Wu 2022, Cora, full attack nodes Wu 2022, Cora, shadow graph Wu 2022, Cora, shadow graph Wu 2022, Cora, shadow graph DeFazio 2019, Cora, strong-adversary upper bound Wang 2025, CoauthorCS, 20C queries Guan 2024, Cora, Attack-0 (35 queries) Zhuang 2024, Cora, Random-Graph baseline Zhuang 2024, Cora, Attack II-E (real graph)† Zhuang 2024, Cora, Attack III-E (real graph)†

Cora, 1.00×, both Cora, 1.00×, both Cora, 1.00×, both Cora, 1.00×, both Cora, 1.00×, both Cora, 1.00×, both Cora, 1.00×, both CoauthorCS, 0.10×, both Cora, 0.05×, both Cora, 1.00×, data_free Cora, 1.00×, data_free Cora, 1.00×, data_free

Original

Ours

∆

89.6 82.5 80.9 79.0 79.0 80.7 ∼80 93.4 72.1 73.7 92.8 93.0

92.4 91.3 94.8 92.7 89.5 92.5 68.2 ∼90.0 62.0 90.2 96.8 92.7

+2.8 +8.8 +13.9 +13.7 +10.5 +11.8 −11.8 ∼ −3.4 −10.1 +16.5 +4.0 −0.3

†

The original paper does not separate Attack-II/III into “Random-Graph” rows the way it does for Attack-I; we cite the real-graph Attack-E numbers as the closest published reference.

Table 10: RQ1 overview: regimes × metrics (%). Means across datasets and the five budgets (0.05–1.00). both

x_only

a_only

data_free

Attack

Acc

F1

Fidelity

Acc

F1

Fidelity

Acc

F1

Fidelity

Acc

F1

Fidelity

MEA0 MEA1 MEA2 MEA3 MEA4 MEA5 AdvMEA CEGA Realistic DFEA_I DFEA_II DFEA_III

78.07 57.08 65.88 78.74 73.71 79.34 62.16 75.01 59.20 77.22 65.53 77.84

64.77 43.79 52.97 65.31 54.80 65.77 53.63 64.61 47.72 66.28 57.18 67.50

83.75 60.33 74.74 83.26 78.54 83.92 63.77 83.08 76.70 87.69 72.55 89.77

78.97 57.07 66.14 79.19 71.38 79.64 62.92 74.94 59.76 77.21 65.53 77.80

64.72 43.96 52.92 65.28 53.02 65.72 53.97 64.64 47.30 66.27 57.19 67.34

84.72 60.34 74.87 83.35 76.36 84.31 64.21 82.68 77.40 87.69 72.56 89.65

79.35 57.08 66.26 78.65 72.08 79.30 62.08 75.58 59.03 77.21 65.39 77.82

65.97 43.80 53.19 64.29 53.58 65.67 53.35 64.71 46.86 66.26 57.23 67.40

85.24 60.32 74.94 83.16 76.71 84.03 63.49 83.80 76.59 87.68 72.86 89.68

20.23 21.06 66.17 22.88 16.69 21.20 62.94 74.02 58.71 77.20 65.52 77.80

5.72 5.68 53.06 6.59 5.01 6.34 54.37 63.83 47.25 66.25 57.18 67.36

19.58 18.98 75.00 21.56 16.23 20.19 64.37 82.08 77.16 87.70 72.56 89.69

Validation summary table. Table 9 compresses the comparable attack reproductions into one view; defenses are summarised in the paragraphs above because their headline metrics are method-specific. The takeaway is twofold. First, on attacks that share a clearly comparable setting with the source paper, our reproduction agrees with the original numbers within a band of ∼ ±14 pp, with the direction of agreement consistent. Second, where the original paper uses a different protocol (image domain for PRADA / AdaptMisinfo / GradRedir, graph-classification metrics for SurviveWM, queryimprovement multipliers for Integrity), a direct number-to-number comparison is not possible; we explicitly note these mismatches above and validate the qualitative claim instead.

F

Supplementary Experimental Results and Discussion

F.1

Attack effectiveness results

This appendix reports the full results for attacks across the seven homophilic datasets of the core protocol; the three additional graphs (RomanEmpire, AmazonRatings, OGBN-Arxiv) are reported in Appendix F.4 (Tables 36–38). We first present compact overview tables which summarize, for each metric (Accuracy, F1, and Fidelity), the mean performance of twelve attacks across four query regimes (with an additional Overall column). Each number is averaged over the seven homophilic datasets and the five budget levels defined in the main text. These tables allow the reader to identify, at a glance, which attack performs best under each regime. We then provide the complete per-dataset matrices. For each dataset and each metric, we show a 2 × 2 panel that contains four sub-tables (one per regime). Each sub-table is a 12 × 5 matrix whose rows are the attacks and whose columns are the five query budgets. Bold font marks the best score in each budget column. All splits, budgets, and aggregation rules match the protocol in the main paper. 20

Table 11: RQ1 detailed for dataset=Cora, metric=Acc (%). Rows are attacks; columns are budgets. Mean ± std across seeds; best per column is bold. (b) Regime=x_only

(a) Regime=both Attack

0.05

0.10

0.25

0.50

Attack

1.00

0.05

0.10

0.25

0.50

1.00

MEA0 67.4±4.4 75.4±1.6 79.7±0.7 80.8±0.2 81.7±0.3 MEA1 52.7±0.5 63.5±2.0 81.5±0.7 80.8±0.1 82.3±0.2 MEA2 55.1±4.2 65.7±0.8 75.6±1.2 78.6±0.9 80.1±0.8 MEA3 67.1±3.4 74.3±1.9 79.6±1.5 81.2±0.6 81.1±0.3 MEA4 45.4±6.1 65.7±1.9 77.3±0.9 78.5±0.2 80.5±0.0 MEA5 72.1±2.9 75.4±0.8 79.9±0.7 81.4±0.6 81.2±0.3 AdvMEA 64.8±4.2 66.8±2.2 65.1±1.4 67.7±4.7 66.7±2.3 CEGA 71.0±5.2 76.5±0.9 79.7±0.2 79.3±0.6 79.3±0.3 Realistic 55.4±8.2 67.1±2.8 71.0±4.4 74.8±1.8 75.9±2.4 DFEA_I 76.3±2.3 78.6±0.4 80.2±1.0 80.9±0.2 80.7±0.6 DFEA_II 77.1±1.1 78.9±0.7 79.9±1.0 79.5±0.3 80.6±0.1 DFEA_III 77.0±0.9 79.4±1.5 80.4±1.2 80.7±0.8 81.6±0.5

MEA0 68.7±4.2 75.1±0.7 80.1±0.2 80.4±1.3 81.2±0.5 MEA1 52.7±0.5 63.5±2.0 81.5±0.7 80.8±0.1 82.3±0.2 MEA2 55.7±1.6 67.7±0.3 76.3±0.4 79.2±0.8 80.1±0.8 MEA3 64.7±1.7 74.0±0.4 79.7±0.4 81.4±0.4 81.1±0.1 MEA4 42.9±8.4 63.7±3.7 76.8±0.4 78.5±0.2 80.5±0.0 MEA5 69.9±3.4 77.0±1.7 80.5±0.3 81.5±0.5 81.2±0.1 AdvMEA 65.5±3.3 68.8±2.5 65.4±2.0 63.6±0.8 65.0±3.0 CEGA 74.1±0.5 77.6±0.4 77.7±1.2 78.7±1.1 79.4±0.3 Realistic 55.7±8.3 64.2±5.0 71.0±4.3 74.8±3.4 75.5±2.7 DFEA_I 76.3±2.3 78.6±0.4 80.2±1.0 80.9±0.2 80.7±0.6 DFEA_II 77.1±1.1 78.9±0.7 79.9±1.0 79.5±0.3 80.6±0.1 DFEA_III 77.0±0.9 79.4±1.5 80.4±1.2 80.7±0.8 81.6±0.5

(c) Regime=a_only

(d) Regime=data_free

Attack

0.05

0.10

0.25

0.50

Attack

1.00

0.05

0.10

0.25

0.50

1.00

MEA0 10.9±2.5 14.6±0.2 19.3±8.9 20.2±8.2 19.0±9.3 MEA1 14.4±0.0 14.4±0.0 14.4±0.0 14.4±0.0 14.4±0.0 MEA2 60.5±1.8 69.4±1.8 76.1±1.2 78.2±0.6 80.2±0.8 MEA3 17.6±10.6 12.3±2.4 17.1±10.8 13.5±0.7 26.2±8.0 MEA4 17.1±10.8 19.9±8.5 18.5±9.7 10.9±2.5 18.0±10.0 MEA5 24.6±13.0 11.9±2.7 21.1±7.7 20.4±8.1 18.7±9.5 AdvMEA 68.6±2.4 68.5±1.5 65.1±6.3 65.8±2.9 67.9±3.7 CEGA 71.0±1.8 77.0±0.7 78.8±1.9 79.2±0.9 79.2±0.1 Realistic 67.9±2.3 70.8±1.6 69.0±3.6 66.5±2.6 69.1±1.6 DFEA_I 76.3±2.3 78.6±0.4 80.2±1.0 80.9±0.2 80.7±0.6 DFEA_II 77.1±1.1 78.9±0.7 79.9±1.0 79.5±0.3 80.6±0.1 DFEA_III 77.0±0.9 79.4±1.5 80.4±1.2 80.7±0.8 81.6±0.5

MEA0 69.4±0.3 75.6±0.3 78.7±1.6 80.1±1.3 80.8±0.6 MEA1 52.7±0.5 63.5±2.0 81.5±0.7 80.8±0.1 82.3±0.2 MEA2 57.8±1.2 67.7±1.5 75.7±0.4 78.6±1.8 80.2±0.8 MEA3 63.0±1.3 75.2±1.8 79.7±0.8 81.0±0.6 81.3±0.2 MEA4 45.9±5.8 63.4±1.4 77.4±0.6 78.5±0.2 80.5±0.0 MEA5 65.6±6.9 76.5±1.5 79.6±1.1 81.5±0.5 81.3±0.1 AdvMEA 65.4±2.7 64.0±2.3 65.8±1.7 68.1±1.9 60.5±5.7 CEGA 69.6±3.6 78.0±0.4 78.0±0.8 79.6±0.5 79.2±0.6 Realistic 51.5±4.3 64.5±6.0 72.0±2.3 75.3±2.5 76.3±2.7 DFEA_I 76.3±2.3 78.6±0.4 80.2±1.0 80.9±0.2 80.7±0.6 DFEA_II 77.1±1.1 78.9±0.7 79.9±1.0 79.5±0.3 80.6±0.1 DFEA_III 77.1±0.9 79.4±1.5 80.4±1.2 80.7±0.8 81.6±0.5

The overview table exposes three deep findings that the per-dataset detail tables (Tables 11–31) hide because of cell-level noise. First, the ranking of attacks by mean fidelity is essentially identical across the three real-input regimes (both, x_only, a_only). For example, the top-five strongest attacks by fidelity in the both column are DFEA_III, DFEA_I, MEA5, MEA0, MEA3 (in order 89.77, 87.69, 83.92, 83.75, 83.26); the same five attacks occupy the top-five positions in the x_only and a_only columns. The granularity of removing only one input modality at a time is therefore not sufficient to differentiate strong attacks — a conclusion that motivates our use of the more aggressive data_free regime as the discriminative axis. Second, the data-free family (DFEA_I/II/III and MEA2) together with AdvMEA, CEGA, and Realistic are essentially regimeinvariant: their data_free fidelity is within ∼ 1 pp of their both fidelity. This is a structural property of the attacks: CEGA retrains a centrality-based query selector even on synthetic graphs, AdvMEA learns adversarial features from scratch, Realistic reconstructs the structure with an auxiliary edge model, and the DFEA variants synthesise their own queries by design. They are the only candidates for an attacker who genuinely has no access to the real graph. Third, the Acc and F1 columns track each other except on heterophilic-style class distributions. On Cora-like datasets the F1 column tracks Acc within ∼ 5 pp; the largest Acc/F1 gap appears for MEA0 (Acc 78.07, F1 64.77), reflecting a slight class-imbalance bias in the surrogate. Future attack design should therefore report F1 alongside accuracy, especially when targeting graphs with skewed class distributions such as OGBN-Arxiv. F.2

Defense performance results

This subsection contains the per-dataset defense performance and the boxplot view that the main text references. Figure 5 aggregates utility drop and ownership verification across all ten datasets and three seeds (30 points per defense), and the per-dataset numbers follow. Table 32 reports task utility measured by macro F1 (%); Table 33 reports behavioural alignment with the original target measured by fidelity (%) on the same test inputs; Table 34 summarises ownership verification on a standardised verification set. Together these views separate downstream utility, behavioural consistency, and ownership verification, so that the trade-offs across defenses are explicit on every dataset. Watermark profile across six axes. Tables 32–34 report the three primary metrics separately. To make the trade-offs across the five watermarking and integrity defenses visible at a glance, Figure 6 reports the same numbers as a radar chart together with two efficiency axes (training time and peak memory, both inverted to a higher-is-better score on a log scale to match the other axes). Three patterns become explicit which the per-metric tables only show implicitly. First, no defense dominates 21

Table 12: RQ1 detailed for dataset=Cora, metric=F1 (%). Rows are attacks; columns are budgets. Mean ± std across seeds; best per column is bold. (b) Regime=x_only

(a) Regime=both Attack

0.05

0.10

0.25

0.50

Attack

1.00

0.05

0.10

0.25

0.50

1.00

MEA0 61.0±6.6 73.9±1.5 77.9±1.2 79.6±0.4 81.0±0.1 MEA1 50.5±0.5 58.2±4.1 80.3±0.7 80.2±0.2 81.8±0.0 MEA2 52.2±4.3 63.2±1.7 74.7±1.0 78.0±0.8 79.2±0.8 MEA3 60.6±5.9 70.4±2.8 78.4±1.6 79.5±0.9 80.2±0.2 MEA4 44.3±6.5 65.8±1.2 76.1±0.6 77.3±0.0 79.2±0.3 MEA5 67.9±4.1 70.3±3.8 78.8±0.8 80.3±0.6 80.2±0.4 AdvMEA 65.2±2.9 67.3±2.3 66.6±0.7 67.7±3.9 67.3±2.0 CEGA 69.9±4.4 75.6±0.9 79.1±0.1 78.6±0.3 78.4±0.2 Realistic 53.1±6.4 61.1±4.6 69.3±3.8 73.9±1.2 75.0±2.0 DFEA_I 72.7±5.1 75.5±1.0 78.9±1.1 79.6±0.2 79.3±1.1 DFEA_II 75.3±0.8 77.5±0.7 78.6±1.2 78.5±0.3 79.7±0.2 DFEA_III 74.4±2.4 77.6±1.6 79.3±1.1 79.7±0.6 80.7±0.5

MEA0 63.2±4.5 68.7±0.4 78.8±0.2 79.0±1.8 80.4±0.6 MEA1 50.5±0.5 58.2±4.1 80.3±0.7 80.2±0.2 81.8±0.0 MEA2 50.5±1.8 66.1±0.7 75.1±0.5 78.5±0.7 79.2±0.8 MEA3 58.0±2.6 70.0±1.8 78.5±0.5 80.5±0.3 80.2±0.1 MEA4 27.9±6.9 62.2±4.5 75.8±0.5 77.3±0.0 79.2±0.3 MEA5 66.5±1.3 74.2±2.4 79.2±0.5 80.3±0.4 80.3±0.3 AdvMEA 66.3±2.8 67.0±3.0 65.3±3.1 64.0±0.5 66.4±2.2 CEGA 73.6±1.1 77.2±0.4 77.4±0.7 78.1±0.7 78.6±0.2 Realistic 50.9±6.5 58.8±4.9 68.2±6.1 74.0±3.1 75.2±2.6 DFEA_I 72.5±5.3 75.5±1.0 78.9±1.1 79.6±0.2 79.3±1.1 DFEA_II 75.3±0.7 77.5±0.7 78.6±1.2 78.5±0.3 79.7±0.2 DFEA_III 74.4±2.4 77.7±1.6 79.3±1.1 79.7±0.6 80.7±0.5

(c) Regime=a_only

(d) Regime=data_free

Attack

0.05

0.10

0.25

0.50

Attack

1.00

MEA0 64.3±0.6 72.9±0.8 77.5±1.9 78.7±1.8 80.0±0.7 MEA1 50.4±0.5 58.2±4.1 80.3±0.7 80.2±0.2 81.8±0.0 MEA2 52.9±1.2 65.5±1.8 74.5±0.7 77.6±1.7 79.2±0.8 MEA3 55.7±3.0 70.3±3.0 78.3±1.4 80.0±0.3 80.4±0.2 MEA4 34.6±8.6 60.4±4.2 76.4±0.2 77.3±0.0 79.2±0.3 MEA5 58.8±11.2 73.7±2.4 77.7±1.0 80.7±0.4 80.2±0.2 AdvMEA 67.0±2.0 64.7±3.1 65.8±1.1 67.0±1.4 62.6±3.9 CEGA 68.7±1.4 77.5±0.6 77.4±0.9 79.0±0.8 78.4±0.6 Realistic 46.3±5.0 62.2±8.0 70.8±1.2 74.6±2.2 76.0±2.0 DFEA_I 72.7±5.1 75.5±1.0 78.9±1.1 79.6±0.2 79.3±1.1 DFEA_II 75.3±0.8 77.5±0.7 78.6±1.2 78.5±0.3 79.7±0.2 DFEA_III 74.5±2.3 77.7±1.6 79.3±1.1 79.7±0.6 80.7±0.5

0.05

0.10

0.25

0.50

1.00

MEA0 2.8±0.6 3.6±0.1 4.5±1.7 4.7±1.6 4.4±1.8 MEA1 3.6±0.0 3.6±0.0 3.6±0.0 3.6±0.0 3.6±0.0 MEA2 55.4±0.5 69.0±0.4 74.8±1.1 77.5±0.5 79.2±0.8 MEA3 4.1±2.1 3.1±0.6 4.0±2.2 3.4±0.1 5.8±1.5 MEA4 4.0±2.2 4.6±1.6 4.3±1.9 2.8±0.6 4.2±2.0 MEA5 7.4±4.8 3.6±0.4 6.1±1.7 4.7±1.5 4.5±1.7 AdvMEA 68.4±0.6 68.4±1.1 64.7±6.1 66.3±2.2 68.0±2.7 CEGA 69.5±1.5 76.3±0.5 78.4±1.6 78.5±0.9 78.7±0.2 Realistic 63.1±3.3 67.8±3.2 67.1±3.7 63.0±4.0 67.2±1.8 DFEA_I 72.5±5.3 75.5±1.0 78.9±1.1 79.6±0.2 79.3±1.1 DFEA_II 75.3±0.8 77.5±0.7 78.6±1.2 78.5±0.3 79.7±0.2 DFEA_III 74.4±2.4 77.6±1.6 79.3±1.1 79.7±0.6 80.6±0.5

Table 13: RQ1 detailed for dataset=Cora, metric=Fidelity (%). Rows are attacks; columns are budgets. Mean ± std across seeds; best per column is bold. (a) Regime=both Attack

0.05

0.10

0.25

(b) Regime=x_only 0.50

Attack

1.00

0.05

0.10

0.25

0.50

1.00

MEA0 69.3±3.1 82.6±1.6 87.5±0.9 89.7±0.7 92.4±0.6 MEA1 57.3±0.2 70.6±2.0 89.9±0.9 90.4±0.6 91.3±0.4 MEA2 57.4±3.2 68.8±0.9 82.8±1.2 89.3±0.3 94.8±0.2 MEA3 71.2±3.6 79.3±2.7 88.0±0.8 90.1±1.4 92.7±0.9 MEA4 49.2±6.2 71.9±1.7 85.0±1.3 87.6±0.6 89.5±0.2 MEA5 75.8±4.8 82.1±4.5 88.3±0.6 92.8±1.1 92.5±0.7 AdvMEA 67.6±4.0 68.8±2.8 67.4±1.6 69.0±4.9 68.2±4.0 CEGA 78.4±4.4 86.5±1.0 91.5±0.4 92.5±0.4 93.7±0.5 Realistic 62.0±4.5 68.1±1.8 78.6±0.7 83.7±0.6 88.5±1.7 DFEA_I 82.2±3.5 85.7±1.0 89.2±1.8 90.2±0.4 90.2±0.5 DFEA_II 79.9±0.7 84.1±0.8 88.5±0.3 93.1±0.4 96.8±0.5 DFEA_III 81.4±2.1 86.1±2.4 88.4±1.9 91.5±0.2 92.7±0.3

MEA0 72.2±3.9 79.5±0.9 88.2±1.2 90.9±1.2 92.1±0.8 MEA1 57.3±0.2 70.6±2.0 89.9±0.9 90.4±0.5 91.3±0.4 MEA2 55.5±0.9 72.2±1.6 83.9±0.8 89.6±0.7 94.8±0.2 MEA3 69.1±0.8 77.7±0.5 88.0±0.9 90.9±1.1 92.5±1.3 MEA4 45.3±8.6 69.2±3.7 84.6±0.7 87.6±0.6 89.6±0.2 MEA5 73.9±1.8 83.2±0.3 88.8±0.8 91.9±0.5 92.3±1.1 AdvMEA 66.7±2.0 71.2±3.0 66.5±1.5 67.1±1.5 67.4±3.1 CEGA 82.5±1.7 86.8±0.8 90.8±1.1 92.8±0.8 93.7±0.1 Realistic 62.9±4.6 69.8±1.7 79.4±2.4 84.1±0.9 87.9±0.2 DFEA_I 82.2±3.5 85.7±1.0 89.2±1.8 90.2±0.4 90.2±0.5 DFEA_II 79.9±0.7 84.1±0.8 88.5±0.3 93.1±0.4 96.8±0.5 DFEA_III 81.3±2.2 86.1±2.4 88.4±1.9 91.5±0.2 92.7±0.3

(c) Regime=a_only

(d) Regime=data_free

Attack

0.05

0.10

0.25

0.50

Attack

1.00

0.05

0.10

0.25

0.50

1.00

MEA0 12.3±2.0 15.9±0.8 17.3±6.2 19.0±5.0 18.0±6.3 MEA1 15.3±0.2 15.3±0.2 15.3±0.2 15.3±0.1 15.3±0.2 MEA2 58.9±1.1 73.2±0.3 83.8±0.7 89.7±0.3 94.8±0.2 MEA3 16.2±7.9 13.3±2.5 15.3±8.0 13.8±1.0 23.1±4.3 MEA4 15.5±8.0 18.7±5.5 17.3±6.6 12.3±2.0 16.8±6.7 MEA5 21.9±10.9 12.5±2.6 20.2±4.3 19.5±4.8 17.2±6.6 AdvMEA 69.4±2.7 70.1±0.9 67.4±5.8 67.4±2.1 70.5±3.5 CEGA 79.8±2.7 88.0±0.4 91.0±1.5 92.5±0.0 93.5±0.6 Realistic 73.0±3.5 72.9±1.6 74.3±1.4 72.9±1.8 73.1±5.0 DFEA_I 82.2±3.5 85.7±1.0 89.2±1.8 90.2±0.4 90.2±0.5 DFEA_II 79.9±0.7 84.1±0.8 88.5±0.3 93.1±0.4 96.8±0.5 DFEA_III 81.4±2.1 86.1±2.4 88.4±1.9 91.5±0.2 92.7±0.3

MEA0 74.1±0.8 81.9±1.4 87.2±1.1 89.5±1.3 92.4±1.2 MEA1 57.2±0.2 70.6±2.0 89.9±0.9 90.4±0.6 91.3±0.4 MEA2 56.8±2.1 69.9±2.2 82.9±0.3 90.0±1.0 94.8±0.2 MEA3 64.3±0.6 80.9±1.2 88.1±0.3 92.0±0.5 92.7±1.1 MEA4 48.3±4.1 68.2±1.8 85.6±0.5 87.6±0.6 89.5±0.2 MEA5 68.8±8.4 82.1±1.6 88.0±0.9 92.2±0.7 92.7±1.4 AdvMEA 67.5±3.0 66.1±2.3 67.4±3.6 68.9±2.5 62.7±4.3 CEGA 78.2±3.8 88.4±0.9 91.0±0.7 92.3±0.3 93.7±0.3 Realistic 56.5±4.1 69.3±3.9 79.8±0.3 84.3±1.9 89.1±0.9 DFEA_I 82.2±3.5 85.7±1.0 89.2±1.8 90.2±0.4 90.2±0.5 DFEA_II 79.9±0.7 84.1±0.8 88.5±0.3 93.1±0.4 96.8±0.5 DFEA_III 81.3±2.2 86.1±2.4 88.4±1.9 91.5±0.2 92.7±0.3

on every axis. BackdoorWM encloses the largest area on the verification, fidelity, and utility axes but sits in the middle of the speed and memory axes. Integrity is the only defense which is simultaneously fast and light while keeping competitive verification. ImperceptibleWM achieves perfect verification at the cost of being the slowest and heaviest defense, which gives it a visibly indented profile on the speed and memory axes. Second, SurviveWM keeps utility almost unchanged but loses on the verification axis, which is consistent with the bimodal verification numbers in Table 34; this is a clear stability–verification trade-off rather than a generic weakness. Third, the gap between RandomWM and the other watermarks is structural rather than a per-dataset artefact: 22

Table 14: RQ1 detailed for dataset=CiteSeer, metric=Acc (%). Rows are attacks; columns are budgets. Mean ± std across seeds; best per column is bold. (b) Regime=x_only

(a) Regime=both Attack

0.05

0.10

0.25

0.50

Attack

1.00

0.05

0.10

0.25

0.50

1.00

MEA0 55.4±6.9 62.4±2.4 69.0±0.7 70.1±0.9 70.1±0.6 MEA1 41.6±1.4 41.8±2.6 54.0±7.9 66.3±1.4 69.0±0.6 MEA2 36.7±2.8 47.0±3.0 59.6±1.2 66.3±0.7 69.3±0.3 MEA3 50.7±2.8 59.7±3.3 69.4±1.0 69.6±0.0 70.2±0.4 MEA4 44.9±1.0 57.9±3.7 67.1±0.2 69.9±0.4 70.6±0.4 MEA5 49.0±2.1 62.8±1.8 69.5±1.1 69.8±0.2 70.4±0.8 AdvMEA 51.8±8.1 46.3±4.2 53.2±0.7 52.3±1.7 51.3±5.1 CEGA 59.9±3.2 64.6±2.1 66.5±1.1 67.0±1.5 67.2±0.3 Realistic 47.2±2.0 57.7±4.2 64.3±2.3 64.5±0.4 65.2±1.1 DFEA_I 69.1±1.1 71.0±1.1 70.8±1.2 71.2±0.3 71.0±0.6 DFEA_II 70.3±1.4 70.0±0.4 69.5±0.6 69.7±0.8 70.3±0.5 DFEA_III 68.2±1.7 70.2±0.3 70.2±1.1 70.9±0.4 71.4±0.6

MEA0 54.1±3.3 63.2±2.4 69.8±1.2 70.0±0.9 69.6±0.2 MEA1 41.6±1.4 41.8±2.6 54.0±7.9 66.3±1.4 68.9±0.6 MEA2 47.2±2.2 48.4±2.6 59.2±1.2 65.9±0.8 69.2±0.3 MEA3 57.9±4.1 64.6±1.8 68.7±1.0 69.9±0.8 69.9±0.7 MEA4 39.9±4.7 59.0±2.3 66.6±0.5 69.9±0.4 70.6±0.4 MEA5 55.3±1.9 65.9±0.7 70.3±0.6 70.3±0.7 70.0±0.5 AdvMEA 48.9±0.9 51.4±2.4 53.9±4.3 48.2±6.8 45.9±2.2 CEGA 61.3±1.9 65.2±1.1 66.7±0.6 67.3±0.6 67.8±0.5 Realistic 48.1±3.5 53.2±4.3 61.5±1.9 62.7±2.0 65.4±1.4 DFEA_I 69.1±1.1 71.0±1.1 70.8±1.2 71.2±0.3 71.0±0.6 DFEA_II 70.3±1.4 70.0±0.4 69.5±0.6 69.7±0.8 70.3±0.5 DFEA_III 68.3±1.7 70.2±0.3 70.2±1.1 70.9±0.4 71.4±0.6

(c) Regime=a_only

(d) Regime=data_free

Attack

0.05

0.10

0.25

0.50

Attack

1.00

MEA0 52.5±3.1 64.5±1.5 70.2±0.9 69.3±0.8 70.1±1.1 MEA1 41.6±1.4 41.8±2.6 54.0±7.9 66.3±1.4 69.0±0.6 MEA2 35.9±1.2 49.6±1.5 59.0±0.9 65.9±1.4 69.2±0.3 MEA3 48.1±5.0 62.3±3.3 68.4±1.5 70.1±0.5 70.0±0.5 MEA4 43.9±1.3 56.8±1.3 66.2±0.6 69.9±0.4 70.6±0.4 MEA5 52.7±3.1 63.5±1.9 69.9±0.6 69.7±0.4 70.8±1.1 AdvMEA 47.5±4.0 51.2±4.3 54.0±4.7 49.9±5.4 46.5±0.3 CEGA 58.4±3.2 64.6±0.4 66.8±0.8 68.0±1.1 67.4±0.7 Realistic 40.7±7.3 55.1±4.9 62.8±0.2 63.2±2.2 64.1±1.2 DFEA_I 69.1±1.1 71.0±1.1 70.8±1.2 71.2±0.3 71.0±0.6 DFEA_II 70.3±1.4 70.0±0.4 69.5±0.6 69.7±0.8 70.3±0.5 DFEA_III 68.2±1.7 70.2±0.3 70.2±1.1 70.9±0.4 71.4±0.6

0.05

0.10

0.25

0.50

1.00

MEA0 12.8±7.3 17.4±1.0 14.7±4.9 14.7±4.9 17.4±1.0 MEA1 21.4±2.4 21.4±2.4 21.4±2.4 21.4±2.4 21.4±2.4 MEA2 37.9±1.1 50.8±1.7 60.8±2.0 64.9±1.4 69.3±0.3 MEA3 18.1±0.0 19.5±2.6 16.7±5.4 17.7±0.6 16.6±0.4 MEA4 21.5±2.3 14.6±4.9 14.3±4.7 16.7±1.0 17.5±1.0 MEA5 18.8±3.1 17.3±0.6 19.8±2.3 17.3±0.6 14.0±4.5 AdvMEA 48.9±2.9 47.6±1.7 53.1±8.2 50.1±2.5 50.1±5.8 CEGA 60.9±2.4 64.4±0.8 67.8±0.8 67.6±0.7 67.5±0.6 Realistic 59.0±2.0 58.2±2.6 59.0±1.5 57.0±1.5 60.1±2.5 DFEA_I 69.1±1.1 71.0±1.1 70.8±1.2 71.2±0.3 71.0±0.6 DFEA_II 70.3±1.4 70.0±0.4 69.5±0.6 69.7±0.8 70.3±0.5 DFEA_III 68.2±1.7 70.2±0.3 70.1±1.0 70.9±0.4 71.4±0.6

Table 15: RQ1 detailed for dataset=CiteSeer, metric=F1 (%). Rows are attacks; columns are budgets. Mean ± std across seeds; best per column is bold. (a) Regime=both Attack

0.05

0.10

0.25

(b) Regime=x_only 0.50

Attack

1.00

0.05

0.10

0.25

0.50

1.00

MEA0 50.9±4.6 55.4±1.7 63.7±0.6 66.0±0.8 66.6±0.2 MEA1 34.4±1.3 35.0±4.3 51.0±8.3 63.7±1.0 65.9±0.6 MEA2 34.6±2.9 44.7±3.1 57.2±1.7 63.3±1.1 66.1±0.4 MEA3 43.3±5.1 54.1±3.0 65.4±0.5 65.8±1.0 66.5±0.1 MEA4 36.5±2.6 55.1±4.6 63.8±0.1 66.4±0.5 67.2±0.3 MEA5 42.1±0.6 56.9±1.8 65.8±1.1 65.8±0.5 66.8±0.5 AdvMEA 47.8±5.1 41.3±5.4 46.7±0.4 45.6±1.6 46.8±6.4 CEGA 54.7±2.3 61.0±1.5 63.4±1.1 63.9±1.4 63.9±0.2 Realistic 42.4±3.0 53.0±3.3 59.2±2.6 60.4±1.1 61.3±1.2 DFEA_I 64.0±0.8 65.2±1.0 64.7±2.1 65.3±1.3 64.8±2.0 DFEA_II 65.2±2.0 66.0±0.2 66.5±0.6 66.8±1.0 67.4±0.6 DFEA_III 62.4±2.1 65.3±0.4 66.3±1.4 67.0±0.3 67.3±0.6

MEA0 46.1±2.9 58.8±0.4 64.8±1.4 66.2±0.5 65.7±0.4 MEA1 34.4±1.3 35.0±4.3 51.0±8.3 63.7±1.0 65.8±0.6 MEA2 42.7±1.7 45.8±3.3 56.9±1.5 62.9±0.8 66.1±0.3 MEA3 51.9±4.4 57.7±0.5 63.4±1.0 65.0±0.4 66.3±0.7 MEA4 34.7±3.4 53.7±1.9 63.3±0.5 66.4±0.5 67.2±0.3 MEA5 47.0±5.4 59.9±1.6 65.4±0.7 65.8±0.7 66.3±0.5 AdvMEA 43.3±0.4 47.5±0.5 50.3±3.0 44.4±6.0 42.3±2.5 CEGA 57.4±1.1 61.4±0.8 63.3±0.5 63.9±0.5 64.5±0.8 Realistic 42.1±5.1 47.4±5.2 58.1±1.9 59.4±2.3 61.6±1.9 DFEA_I 64.0±0.8 65.2±1.0 64.7±2.1 65.3±1.3 64.8±2.0 DFEA_II 65.2±2.0 66.0±0.2 66.5±0.6 66.8±1.0 67.4±0.6 DFEA_III 62.4±2.1 65.3±0.4 66.3±1.4 67.0±0.3 67.3±0.6

(c) Regime=a_only

(d) Regime=data_free

Attack

0.05

0.10

0.25

0.50

Attack

1.00

MEA0 46.0±3.1 57.1±3.2 65.8±1.3 65.6±0.6 66.6±1.1 MEA1 34.4±1.3 35.0±4.3 51.0±8.3 63.7±1.0 65.9±0.6 MEA2 33.5±1.4 46.8±1.0 56.4±0.7 63.0±1.4 66.1±0.3 MEA3 39.5±6.3 56.5±1.3 63.6±2.1 66.1±0.8 66.4±0.4 MEA4 33.0±4.6 54.5±1.7 63.1±0.7 66.4±0.5 67.2±0.3 MEA5 45.2±2.5 59.0±2.1 65.1±1.5 65.8±0.3 67.1±0.9 AdvMEA 44.2±6.2 46.2±4.9 47.9±7.8 47.3±3.3 41.5±1.2 CEGA 54.1±1.9 61.4±0.1 63.4±0.7 65.0±0.9 64.1±0.9 Realistic 33.2±10.0 50.1±4.6 58.5±0.3 58.9±2.7 60.6±1.0 DFEA_I 64.0±0.8 65.2±1.0 64.7±2.1 65.3±1.3 64.8±2.0 DFEA_II 65.2±2.0 66.0±0.2 66.5±0.6 66.8±1.0 67.4±0.6 DFEA_III 62.4±2.1 65.3±0.4 66.3±1.4 67.0±0.3 67.3±0.6

0.05

0.10

0.25

0.50

1.00

MEA0 3.7±1.8 4.9±0.2 4.2±1.3 4.2±1.3 4.9±0.2 MEA1 5.9±0.5 5.9±0.5 5.9±0.5 5.9±0.5 5.9±0.5 MEA2 33.8±0.5 48.3±1.1 58.4±1.7 61.6±1.4 66.1±0.4 MEA3 5.1±0.0 6.0±0.6 5.6±0.6 5.0±0.1 4.7±0.1 MEA4 5.9±0.5 4.2±1.3 4.1±1.2 4.8±0.2 5.0±0.3 MEA5 5.4±0.7 4.9±0.1 5.5±0.5 4.9±0.1 4.0±1.2 AdvMEA 45.1±0.8 42.0±1.2 48.5±4.5 47.1±1.8 47.1±4.9 CEGA 56.0±2.0 61.0±1.1 64.3±1.1 64.2±0.7 64.2±0.4 Realistic 53.9±1.4 53.4±3.4 54.4±0.7 51.7±3.7 54.9±2.8 DFEA_I 64.0±0.8 65.2±1.0 64.7±2.1 65.3±1.3 64.8±2.0 DFEA_II 65.2±2.0 66.0±0.2 66.5±0.6 66.8±1.0 67.4±0.6 DFEA_III 62.4±2.1 65.3±0.4 66.2±1.3 67.0±0.3 67.3±0.6

RandomWM loses on every metric except utility, which suggests the random-graph watermark is not competitive with trigger-based or query-based mechanisms under our protocol. F.3

Baseline utility across backbones

To allow utility-drop numbers in the main text to be compared across defenses that use different backbones, Table 35 reports the test accuracy of an undefended target on each of the ten datasets and for each of the three backbones used in the benchmark. The first column reports a DGL GCN with hidden dimension 16, which is the backbone used by every original watermarking defense and by 23

Table 16: RQ1 detailed for dataset=CiteSeer, metric=Fidelity (%). Rows are attacks; columns are budgets. Mean ± std across seeds; best per column is bold. (b) Regime=x_only

(a) Regime=both Attack

0.05

0.10

0.25

0.50

Attack

1.00

0.05

0.10

0.25

0.50

1.00

MEA0 62.9±6.1 69.9±3.6 82.8±1.5 86.7±1.0 90.0±0.7 MEA1 47.3±2.1 47.4±2.3 64.7±7.6 81.0±1.7 83.4±0.9 MEA2 42.4±4.3 55.5±3.2 74.4±2.3 83.8±0.4 91.5±0.2 MEA3 55.6±3.6 69.0±3.6 82.5±1.5 86.3±2.2 88.5±0.5 MEA4 48.3±2.9 65.4±5.3 79.4±0.8 83.3±1.5 84.1±1.3 MEA5 56.5±1.5 72.1±2.9 83.0±0.7 87.2±0.4 87.9±0.8 AdvMEA 55.9±6.8 50.0±4.2 54.5±2.5 57.2±1.0 52.7±6.0 CEGA 68.6±2.0 79.8±0.7 83.2±0.9 86.3±0.8 87.2±1.0 Realistic 54.1±3.8 64.5±1.5 73.3±1.4 78.3±3.5 84.1±0.8 DFEA_I 80.5±1.7 83.7±0.6 83.8±1.4 85.3±0.9 85.6±1.5 DFEA_II 76.9±1.3 80.8±1.1 85.6±0.8 90.1±1.0 93.6±0.9 DFEA_III 77.0±0.7 82.3±0.1 87.7±0.7 90.4±0.2 91.5±0.1

MEA0 58.5±2.3 73.2±0.6 82.0±0.2 85.8±0.5 89.2±0.8 MEA1 47.3±2.1 47.4±2.3 64.7±7.6 81.0±1.7 83.4±1.0 MEA2 51.4±2.4 54.9±2.0 74.0±1.7 84.5±1.3 91.5±0.2 MEA3 63.4±5.5 69.8±0.5 81.0±0.6 85.2±1.1 88.8±0.4 MEA4 43.5±4.9 67.1±2.3 79.7±1.8 83.3±1.5 84.1±1.3 MEA5 61.9±3.9 72.7±0.7 83.4±0.5 86.2±1.6 88.5±0.5 AdvMEA 52.4±3.0 55.2±3.2 57.7±3.7 52.7±6.8 50.7±3.0 CEGA 73.1±1.8 78.6±1.8 83.7±0.9 86.4±0.9 87.0±1.1 Realistic 54.5±3.8 60.3±2.7 74.5±1.8 80.0±2.9 84.4±1.1 DFEA_I 80.5±1.7 83.7±0.6 83.8±1.4 85.3±0.9 85.6±1.5 DFEA_II 77.0±1.3 80.8±1.1 85.6±0.8 90.1±1.0 93.6±0.9 DFEA_III 77.0±0.7 82.3±0.1 87.6±0.7 90.4±0.2 91.5±0.1

(c) Regime=a_only

(d) Regime=data_free

Attack

0.05

0.10

0.25

0.50

Attack

1.00

MEA0 57.6±3.5 73.1±4.4 82.9±0.5 85.8±0.5 89.8±0.7 MEA1 47.3±2.1 47.4±2.3 64.7±7.6 81.0±1.7 83.4±0.9 MEA2 40.1±1.3 58.3±1.3 72.1±0.6 84.8±1.1 91.5±0.2 MEA3 54.4±4.3 72.5±3.2 80.8±0.7 87.1±0.3 87.9±0.5 MEA4 44.5±4.3 66.6±2.9 80.0±1.6 83.3±1.5 84.1±1.3 MEA5 58.2±2.7 73.7±2.3 84.0±1.7 86.2±1.5 88.5±0.8 AdvMEA 52.2±3.8 53.6±3.0 56.1±6.6 53.5±5.3 50.6±2.2 CEGA 69.9±3.5 79.6±2.4 81.9±0.9 87.2±0.3 88.8±0.5 Realistic 48.1±7.3 61.3±4.2 73.8±0.7 81.1±0.8 84.2±0.3 DFEA_I 80.5±1.7 83.7±0.6 83.8±1.4 85.3±0.9 85.6±1.5 DFEA_II 77.0±1.3 80.8±1.1 85.6±0.8 90.1±1.0 93.6±0.9 DFEA_III 77.1±0.6 82.3±0.1 87.6±0.7 90.4±0.2 91.5±0.1

0.05

0.10

0.25

0.50

1.00

MEA0 12.2±3.6 18.4±0.9 16.1±4.7 15.9±4.5 18.6±0.9 MEA1 18.1±0.7 18.1±0.7 18.1±0.7 18.1±0.7 18.1±0.7 MEA2 43.1±1.0 59.3±2.2 73.5±2.2 85.3±1.1 91.5±0.2 MEA3 19.0±0.4 18.0±0.9 16.1±2.0 18.3±1.1 17.2±0.3 MEA4 17.6±0.6 15.9±4.5 15.4±4.3 17.9±0.8 18.7±1.0 MEA5 17.6±0.5 17.9±1.0 19.0±0.6 17.6±0.7 15.3±4.3 AdvMEA 54.3±3.5 52.7±1.0 56.3±6.5 53.3±2.1 54.6±3.1 CEGA 71.9±2.1 77.4±0.1 85.2±0.7 86.4±1.0 86.9±0.9 Realistic 70.6±2.6 69.8±3.7 67.3±1.1 67.2±2.3 70.8±3.1 DFEA_I 80.5±1.7 83.7±0.6 83.8±1.4 85.3±0.9 85.6±1.5 DFEA_II 77.0±1.3 80.8±1.1 85.6±0.8 90.1±1.0 93.6±0.9 DFEA_III 77.1±0.6 82.3±0.1 87.6±0.7 90.4±0.2 91.5±0.1

Table 17: RQ1 detailed for dataset=CoauthorCS, metric=Acc (%). Rows are attacks; columns are budgets. Mean ± std across seeds; best per column is bold. (b) Regime=x_only

(a) Regime=both Attack

0.05

0.10

0.25

0.50

Attack

1.00

0.05

0.10

0.25

0.50

1.00

MEA0 84.3±3.8 88.4±1.8 90.8±1.1 91.2±1.2 92.2±0.9 MEA1 71.1±0.8 74.4±0.7 77.2±0.3 89.2±0.7 89.5±0.4 MEA2 48.5±1.5 56.2±0.8 70.8±0.6 80.6±1.1 84.6±1.5 MEA3 86.2±0.6 88.8±0.7 90.8±0.5 91.8±0.3 92.8±0.3 MEA4 68.4±8.5 79.4±7.5 85.8±3.7 90.3±0.5 91.0±0.2 MEA5 87.3±0.7 88.5±0.3 91.4±0.8 92.2±0.1 92.0±0.4 AdvMEA 92.0±0.4 91.8±0.2 91.7±0.4 91.8±0.4 91.9±0.3 CEGA 89.0±1.0 90.4±0.7 91.6±0.4 91.8±0.0 91.7±0.6 Realistic 71.9±5.8 81.1±4.4 81.0±3.4 79.1±3.4 77.7±2.1 DFEA_I 89.7±1.1 89.7±0.7 89.6±0.4 89.8±0.6 89.4±0.6 DFEA_II 91.3±1.4 90.9±0.2 90.1±0.8 88.6±0.8 87.4±0.2 DFEA_III 89.6±0.7 89.4±0.8 89.3±0.9 88.6±0.2 88.3±0.2

MEA0 83.5±2.7 89.1±0.2 91.5±0.6 92.3±0.2 92.2±1.6 MEA1 71.1±0.8 74.4±0.7 77.2±0.3 89.2±0.7 89.5±0.4 MEA2 46.6±1.6 55.6±2.0 71.0±1.2 80.5±0.5 84.6±1.5 MEA3 79.2±3.8 89.0±1.0 90.2±0.7 91.2±0.5 91.6±0.3 MEA4 65.3±10.4 73.3±0.6 86.9±1.5 89.7±0.2 91.0±0.3 MEA5 83.2±2.8 89.7±1.9 91.0±0.4 91.6±1.2 91.7±1.1 AdvMEA 91.7±0.3 91.8±0.6 91.8±0.6 91.6±0.4 91.8±0.4 CEGA 88.7±0.8 90.3±0.4 91.0±0.1 91.7±0.5 91.9±0.4 Realistic 68.8±8.3 77.2±4.3 81.2±2.2 78.9±2.4 79.3±1.2 DFEA_I 89.8±1.1 89.7±0.7 89.6±0.5 89.8±0.6 89.4±0.6 DFEA_II 91.3±1.4 90.9±0.2 90.1±0.8 88.7±0.8 87.4±0.2 DFEA_III 89.6±0.7 89.4±0.8 89.3±0.9 88.6±0.2 88.3±0.2

(c) Regime=a_only

(d) Regime=data_free

Attack

0.05

0.10

0.25

0.50

Attack

1.00

0.05

0.10

0.25

0.50

1.00

MEA0 7.4±2.7 33.5±23.5 7.4±3.8 3.5±2.7 22.1±19.8 MEA1 0.5±0.4 0.5±0.4 0.5±0.4 0.5±0.4 0.5±0.4 MEA2 45.2±1.7 54.3±2.6 73.8±1.0 81.5±1.1 84.6±1.5 MEA3 21.5±20.3 22.1±19.9 17.5±23.1 37.2±18.2 18.9±19.5 MEA4 4.0±2.4 22.6±19.5 18.4±22.5 20.1±21.5 7.1±3.0 MEA5 17.0±12.7 26.4±23.8 18.1±22.7 6.2±4.3 7.8±5.0 AdvMEA 91.7±0.3 91.9±0.2 91.8±0.3 91.8±0.4 91.8±0.3 CEGA 88.8±1.0 91.1±0.6 91.4±0.3 91.3±0.8 91.1±0.6 Realistic 74.9±2.2 77.4±2.8 75.1±2.0 79.7±1.1 79.9±1.9 DFEA_I 89.7±1.1 89.7±0.7 89.6±0.4 89.8±0.6 89.5±0.6 DFEA_II 91.3±1.4 90.9±0.2 90.1±0.8 88.6±0.8 87.4±0.2 DFEA_III 89.6±0.7 89.4±0.8 89.3±0.9 88.6±0.2 88.3±0.1

MEA0 85.1±2.1 89.0±1.4 90.5±0.5 91.0±0.3 91.4±0.7 MEA1 71.1±0.8 74.4±0.7 77.2±0.3 89.2±0.7 89.5±0.4 MEA2 46.7±1.7 59.5±0.9 73.3±1.0 81.1±0.8 84.6±1.5 MEA3 87.6±0.4 89.5±1.3 90.8±0.7 91.9±0.3 92.5±0.4 MEA4 58.5±15.4 82.6±3.3 87.2±0.2 90.0±0.7 91.0±0.4 MEA5 86.5±1.2 89.2±0.7 91.3±0.0 92.0±0.9 92.0±0.6 AdvMEA 91.8±0.2 91.7±0.3 91.9±0.2 91.8±0.4 91.6±0.5 CEGA 90.0±0.2 90.4±0.2 91.8±0.5 91.3±0.8 91.7±0.7 Realistic 74.5±3.2 80.8±2.0 84.4±4.4 77.1±3.0 77.3±2.3 DFEA_I 89.8±1.1 89.7±0.7 89.6±0.4 89.8±0.7 89.4±0.6 DFEA_II 91.3±1.4 90.9±0.2 90.1±0.8 88.6±0.8 87.4±0.2 DFEA_III 89.6±0.7 89.4±0.8 89.3±0.9 88.6±0.2 88.3±0.2

every information-limiting defense. The second column reports a DGL GraphSAGE with hidden dimension 128, which is the backbone used by RandomWM. The third column reports a PyG GCN with hidden dimension 128, which is the backbone used by ImperceptibleWM. The baseline-utility table reveals one pattern that has direct consequences for any cross-defense comparison in the main text: the per-dataset gap between the two backbones used by watermark methods can be huge, and it is largest exactly on the graphs where defenses are evaluated as “most informative”. On RomanEmpire, the GraphSAGE-128 baseline of 77.5 % is 34.7 pp higher than the GCN-16 baseline of 42.8 %; on Computers the gap is 15.2 pp; on OGBN-Arxiv it is 17.2 pp. This 24

Table 18: RQ1 detailed for dataset=CoauthorCS, metric=F1 (%). Rows are attacks; columns are budgets. Mean ± std across seeds; best per column is bold. (b) Regime=x_only

(a) Regime=both Attack

0.05

0.10

0.25

0.50

Attack

1.00

0.05

0.10

0.25

0.50

1.00

MEA0 51.8±1.1 61.1±3.9 70.1±3.4 73.7±3.8 77.1±2.5 MEA1 34.5±0.3 36.7±0.4 42.1±1.7 61.2±0.9 64.3±1.3 MEA2 32.7±1.4 38.9±3.3 52.1±4.0 57.5±5.4 59.5±4.5 MEA3 54.8±2.8 64.2±4.6 71.6±4.2 76.8±0.6 76.4±1.5 MEA4 25.2±4.7 38.0±4.8 52.3±8.8 67.1±1.9 71.3±1.1 MEA5 54.6±1.0 59.5±1.4 71.8±5.1 77.6±1.4 77.7±0.1 AdvMEA 75.0±1.6 73.7±0.8 74.0±1.8 74.9±2.2 75.3±1.0 CEGA 67.6±2.1 72.6±1.5 74.7±2.0 76.5±0.9 74.1±2.4 Realistic 42.9±6.9 53.4±2.3 61.3±3.9 56.6±5.6 54.2±3.5 DFEA_I 81.9±2.0 82.0±0.9 81.6±0.8 81.3±0.6 80.5±0.8 DFEA_II 83.1±1.3 82.1±0.4 81.6±2.1 78.2±2.3 77.0±1.6 DFEA_III 81.8±1.0 80.7±0.6 80.6±2.0 78.8±0.5 78.6±0.9

MEA0 44.4±3.8 60.9±4.1 74.5±0.4 76.1±1.7 74.8±4.7 MEA1 34.5±0.3 36.7±0.4 42.1±1.7 61.2±0.9 64.3±1.3 MEA2 31.8±1.1 41.5±1.6 55.6±3.9 58.8±3.0 59.5±4.5 MEA3 45.6±0.8 62.5±6.8 67.6±3.0 74.1±1.6 73.5±1.6 MEA4 20.8±8.6 36.1±6.9 52.2±4.5 64.5±0.7 71.1±0.8 MEA5 50.4±3.0 66.6±5.2 71.6±4.0 73.1±6.9 74.4±3.6 AdvMEA 74.7±0.7 74.7±2.0 74.6±1.6 74.3±1.0 73.2±1.9 CEGA 70.0±0.9 70.8±1.5 74.0±2.8 72.5±1.3 72.8±1.4 Realistic 46.1±1.1 46.4±3.0 56.5±1.7 56.9±3.7 55.8±0.6 DFEA_I 81.9±2.0 82.0±1.0 81.6±0.8 81.3±0.6 80.5±0.8 DFEA_II 83.1±1.3 82.1±0.4 81.6±2.1 78.2±2.3 77.0±1.6 DFEA_III 81.8±1.0 80.7±0.6 80.6±2.0 78.8±0.5 78.6±0.9

(c) Regime=a_only

(d) Regime=data_free

Attack

0.05

0.10

0.25

0.50

Attack

1.00

MEA0 56.0±6.3 65.7±4.6 71.3±2.8 73.2±1.6 73.4±3.3 MEA1 34.5±0.3 36.7±0.4 42.1±1.7 61.2±0.9 64.3±1.3 MEA2 31.6±6.0 43.5±3.7 54.7±1.8 58.9±4.6 59.5±4.5 MEA3 57.1±0.9 64.4±7.1 70.5±4.1 74.8±2.2 75.8±0.9 MEA4 21.3±4.2 47.2±8.5 52.4±0.9 66.1±2.5 71.3±1.4 MEA5 53.6±3.3 67.3±4.9 74.1±1.1 77.3±1.9 74.1±2.0 AdvMEA 75.0±0.8 75.2±1.0 74.7±1.1 74.6±1.1 74.4±1.0 CEGA 69.4±2.1 71.2±0.9 73.9±0.9 73.3±3.0 72.3±1.3 Realistic 41.5±6.9 56.2±2.7 61.6±5.3 54.4±5.0 54.5±0.8 DFEA_I 81.9±2.0 82.0±0.9 81.6±0.8 81.3±0.7 80.5±0.8 DFEA_II 83.1±1.3 82.1±0.4 81.6±2.1 78.2±2.3 77.0±1.6 DFEA_III 81.8±1.0 80.7±0.6 80.6±2.0 78.8±0.5 78.6±0.9

0.05

0.10

0.25

0.50

1.00

MEA0 0.9±0.3 3.0±2.1 0.9±0.5 0.4±0.3 2.1±1.6 MEA1 0.1±0.0 0.1±0.0 0.1±0.0 0.1±0.0 0.1±0.0 MEA2 32.0±2.6 38.9±7.7 55.3±3.7 59.8±6.4 59.5±4.5 MEA3 2.4±1.5 3.4±1.9 1.6±2.0 3.9±0.8 2.9±2.8 MEA4 0.5±0.3 2.2±1.6 1.7±2.0 1.9±1.8 0.9±0.4 MEA5 2.7±2.2 5.5±5.0 1.8±1.9 0.8±0.5 3.6±2.6 AdvMEA 75.1±1.0 74.9±0.8 73.9±0.9 74.7±0.9 74.6±0.7 CEGA 65.1±3.0 72.6±2.4 71.9±1.0 75.5±0.8 72.0±1.0 Realistic 52.0±1.7 55.1±3.3 54.1±1.5 59.5±0.8 56.9±2.8 DFEA_I 81.9±2.0 82.0±1.0 81.6±0.8 81.3±0.6 80.5±0.7 DFEA_II 83.1±1.3 82.1±0.4 81.6±2.1 78.2±2.3 77.0±1.6 DFEA_III 81.8±1.0 80.7±0.6 80.6±2.0 78.8±0.5 78.5±0.9

Table 19: RQ1 detailed for dataset=CoauthorCS, metric=Fidelity (%). Rows are attacks; columns are budgets. Mean ± std across seeds; best per column is bold. (a) Regime=both Attack

0.05

0.10

0.25

(b) Regime=x_only 0.50

Attack

1.00

0.05

0.10

0.25

0.50

1.00

MEA0 83.7±4.0 87.9±1.6 91.2±1.2 92.8±0.3 94.5±0.3 MEA1 71.0±0.8 74.2±0.5 76.9±0.5 89.8±0.8 90.2±0.7 MEA2 47.8±1.2 57.3±1.4 73.0±2.3 84.2±1.7 87.7±2.9 MEA3 85.2±1.8 88.2±1.3 90.8±1.0 91.7±0.2 93.1±0.6 MEA4 66.7±8.4 79.1±7.2 86.9±3.4 93.5±0.7 96.3±0.5 MEA5 85.8±0.2 87.8±0.3 91.1±0.2 92.4±0.4 93.6±0.8 AdvMEA 92.3±0.5 92.3±0.4 92.0±0.4 92.1±0.3 92.3±0.4 CEGA 90.3±0.6 91.7±0.7 93.5±0.7 94.9±0.8 94.8±0.5 Realistic 72.6±5.2 81.5±4.3 82.5±3.2 80.4±3.7 80.9±2.0 DFEA_I 91.6±0.5 93.2±0.2 94.7±0.4 95.7±1.1 96.9±0.9 DFEA_II 89.6±1.2 91.1±1.1 93.1±0.7 96.1±0.4 100.0±0.0 DFEA_III 91.0±0.7 92.6±0.4 94.8±0.0 96.8±0.7 98.9±0.3

MEA0 83.3±2.8 88.8±0.5 92.3±0.7 93.3±0.5 93.7±0.2 MEA1 71.0±0.8 74.2±0.5 76.9±0.5 89.8±0.8 90.2±0.7 MEA2 46.2±1.8 56.5±2.5 74.3±2.6 83.7±2.2 87.7±2.9 MEA3 77.8±4.5 88.6±0.9 90.0±0.6 91.7±0.4 93.4±0.5 MEA4 63.8±10.0 72.2±0.8 87.7±1.2 92.9±0.3 96.4±0.4 MEA5 83.5±2.4 89.2±2.0 91.0±0.3 92.0±0.7 93.1±1.0 AdvMEA 92.0±0.4 92.1±0.3 92.2±0.6 92.0±0.3 92.2±0.2 CEGA 90.2±0.6 92.7±0.3 92.8±0.4 94.5±0.3 96.2±0.3 Realistic 68.4±8.8 78.1±4.7 81.4±1.7 80.8±1.9 80.5±1.1 DFEA_I 91.7±0.5 93.2±0.2 94.6±0.4 95.6±1.0 96.9±0.9 DFEA_II 89.6±1.2 91.1±1.1 93.1±0.7 96.1±0.4 100.0±0.0 DFEA_III 91.0±0.7 92.6±0.4 94.8±0.0 96.8±0.7 98.9±0.3

(c) Regime=a_only

(d) Regime=data_free

Attack

0.05

0.10

0.25

0.50

Attack

1.00

0.05

0.10

0.25

0.50

1.00

MEA0 6.6±2.5 32.2±22.7 7.0±3.9 3.4±2.8 21.2±19.1 MEA1 0.6±0.7 0.6±0.7 0.6±0.7 0.6±0.7 0.6±0.7 MEA2 45.1±2.4 55.9±2.2 75.3±2.4 84.1±1.9 87.7±2.9 MEA3 20.4±19.6 21.2±19.1 16.8±22.4 36.1±17.3 18.7±18.9 MEA4 3.9±2.2 22.1±18.8 17.4±21.7 19.4±20.5 7.0±3.1 MEA5 16.3±12.3 25.8±23.0 17.3±21.8 5.8±3.7 8.0±5.0 AdvMEA 91.9±0.4 92.2±0.4 92.2±0.4 92.0±0.5 92.1±0.5 CEGA 90.0±1.2 92.3±0.6 93.1±0.3 93.8±0.7 95.5±0.5 Realistic 77.8±2.5 78.9±2.1 76.4±2.5 80.3±1.9 81.5±2.1 DFEA_I 91.7±0.5 93.2±0.2 94.7±0.4 95.6±1.0 96.9±0.8 DFEA_II 89.6±1.2 91.1±1.1 93.1±0.7 96.1±0.4 100.0±0.0 DFEA_III 91.0±0.7 92.6±0.4 94.8±0.0 96.8±0.7 98.9±0.3

MEA0 84.6±2.4 89.4±1.4 91.9±0.6 92.9±0.4 94.6±0.4 MEA1 71.0±0.8 74.2±0.5 76.9±0.5 89.8±0.8 90.2±0.7 MEA2 46.3±1.1 60.7±0.8 76.0±0.3 84.0±1.6 87.7±2.9 MEA3 86.5±0.5 89.5±1.4 90.8±0.9 92.0±0.4 93.5±0.1 MEA4 57.4±15.1 81.4±2.8 88.5±0.3 92.8±1.3 96.6±0.4 MEA5 86.2±1.6 89.0±0.6 91.1±0.4 92.4±0.7 93.7±1.0 AdvMEA 92.0±0.3 92.0±0.4 92.3±0.4 91.9±0.3 91.9±0.3 CEGA 90.2±1.0 92.5±0.5 93.8±0.5 94.2±0.3 95.8±0.3 Realistic 73.9±3.3 82.2±1.5 85.7±4.5 78.6±3.7 79.0±2.6 DFEA_I 91.7±0.5 93.2±0.2 94.7±0.4 95.7±1.0 96.9±0.9 DFEA_II 89.6±1.2 91.1±1.1 93.1±0.7 96.1±0.4 100.0±0.0 DFEA_III 91.0±0.7 92.6±0.4 94.8±0.0 96.8±0.7 98.9±0.3

means that any utility-drop number in the main text that compares RandomWM (GraphSAGE-128) against the GCN-16 baseline implicitly attributes the entire backbone gap to the defense, which would over-estimate RandomWM’s damage by 15–35 pp on these three graphs; we therefore always compare each defense against its own matched-backbone baseline rather than against a single shared GCN baseline. 25

Table 20: RQ1 detailed for dataset=CoauthorPhysics, metric=Acc (%). Rows are attacks; columns are budgets. Mean ± std across seeds; best per column is bold. (b) Regime=x_only

(a) Regime=both Attack

0.05

0.10

0.25

0.50

Attack

1.00

0.05

0.10

0.25

0.50

1.00

MEA0 82.2±4.9 89.6±0.4 90.9±0.2 90.7±0.4 92.8±1.0 MEA1 3.5±0.0 10.1±0.6 17.2±0.2 44.0±1.9 79.5±7.9 MEA2 33.3±2.4 44.2±1.4 66.8±1.0 73.6±4.4 84.0±3.1 MEA3 74.0±1.4 81.1±2.6 89.5±1.4 89.8±0.7 90.6±1.8 MEA4 70.1±10.5 74.0±10.0 87.7±2.0 89.6±0.5 89.5±0.6 MEA5 75.4±4.8 78.4±4.7 89.8±1.6 91.0±0.8 91.3±1.0 AdvMEA 91.4±1.2 91.6±0.7 91.3±0.2 90.6±1.3 91.4±0.9 CEGA 90.9±1.3 90.4±2.8 91.5±0.6 91.0±0.5 90.8±0.3 Realistic 79.6±3.8 77.0±6.5 79.3±1.7 76.1±3.1 73.0±1.5 DFEA_I 90.7±0.2 90.8±0.2 90.8±0.5 90.8±0.2 90.6±0.2 DFEA_II 90.9±0.2 90.0±0.6 90.6±0.4 90.1±0.4 89.5±0.4 DFEA_III 90.5±0.4 90.1±0.6 90.5±0.4 90.3±0.5 90.4±0.3

MEA0 80.9±4.2 90.4±1.8 89.3±1.5 91.5±0.9 91.3±0.8 MEA1 3.5±0.0 10.1±0.6 17.2±0.2 44.0±1.9 79.5±7.9 MEA2 31.0±2.1 41.2±2.2 64.9±4.1 71.9±6.2 83.9±3.1 MEA3 75.3±1.5 84.0±2.4 89.8±0.9 91.6±0.5 91.4±0.5 MEA4 39.5±17.4 83.4±4.5 88.7±1.6 90.2±0.6 89.9±0.3 MEA5 76.2±5.5 78.9±5.5 89.0±1.5 91.5±0.7 91.2±1.4 AdvMEA 90.8±1.2 91.2±1.0 90.7±0.4 91.6±0.4 90.9±0.9 CEGA 90.9±0.4 91.2±1.0 91.6±0.3 91.2±0.5 91.2±0.4 Realistic 79.0±5.6 83.0±4.6 79.4±2.7 78.6±2.6 74.4±0.5 DFEA_I 90.7±0.2 90.8±0.2 90.8±0.5 90.8±0.2 90.6±0.2 DFEA_II 90.9±0.2 90.0±0.6 90.6±0.4 90.1±0.4 89.5±0.4 DFEA_III 90.4±0.4 90.1±0.6 90.5±0.4 90.3±0.5 90.4±0.3

(c) Regime=a_only

(d) Regime=data_free

Attack

0.05

0.10

0.25

0.50

Attack

1.00

0.05

0.10

0.25

0.50

1.00

MEA0 5.5±2.9 27.6±18.8 3.5±0.0 15.7±10.1 20.8±20.3 MEA1 3.5±0.0 3.5±0.0 3.5±0.0 3.5±0.0 3.5±0.0 MEA2 31.5±1.3 43.1±2.3 64.7±2.0 75.4±4.3 83.9±3.1 MEA3 6.7±2.3 19.5±21.1 28.6±19.9 35.8±22.7 18.8±21.6 MEA4 4.9±1.9 13.7±11.6 5.5±2.9 14.4±11.3 12.3±12.5 MEA5 3.5±0.0 34.0±21.6 29.9±12.2 25.0±18.8 18.8±21.6 AdvMEA 91.1±0.5 91.6±0.7 91.1±0.9 91.2±0.8 91.0±0.4 CEGA 89.0±1.5 90.7±0.7 91.6±0.5 91.0±0.2 91.4±0.3 Realistic 70.1±1.6 73.5±1.7 71.5±1.4 71.5±2.7 69.6±3.6 DFEA_I 90.7±0.2 90.8±0.2 90.8±0.5 90.8±0.2 90.6±0.2 DFEA_II 90.9±0.2 90.0±0.6 90.6±0.4 90.1±0.4 89.5±0.4 DFEA_III 90.5±0.4 90.1±0.6 90.5±0.4 90.3±0.5 90.4±0.3

MEA0 85.3±2.4 89.0±0.8 91.1±0.4 90.1±2.0 92.0±0.6 MEA1 3.5±0.0 10.1±0.6 17.2±0.2 44.0±1.9 79.5±7.9 MEA2 34.0±1.0 46.1±0.6 65.9±2.4 76.1±2.6 83.9±3.1 MEA3 70.5±6.3 83.9±2.6 89.6±1.0 90.7±1.1 91.3±0.5 MEA4 61.6±24.8 77.9±6.2 86.0±3.0 89.4±0.5 89.7±0.6 MEA5 73.1±9.3 83.9±1.0 89.4±1.5 90.7±0.7 90.4±0.6 AdvMEA 91.4±0.4 91.0±0.7 91.6±1.0 90.9±1.1 91.0±0.7 CEGA 90.7±1.0 91.8±0.6 91.6±0.3 91.3±0.1 91.5±0.8 Realistic 72.2±5.2 84.5±1.3 72.7±7.7 74.1±1.2 69.8±2.1 DFEA_I 90.7±0.2 90.8±0.2 90.8±0.5 90.8±0.2 90.7±0.3 DFEA_II 90.9±0.2 90.0±0.6 90.6±0.4 90.1±0.4 89.5±0.4 DFEA_III 90.5±0.4 90.1±0.6 90.5±0.4 90.3±0.5 90.4±0.3

Table 21: RQ1 detailed for dataset=CoauthorPhysics, metric=F1 (%). Rows are attacks; columns are budgets. Mean ± std across seeds; best per column is bold. (a) Regime=both Attack

0.05

0.10

0.25

(b) Regime=x_only 0.50

Attack

1.00

0.05

0.10

0.25

0.50

1.00

MEA0 71.3±6.1 78.7±2.0 80.3±0.6 80.9±0.8 84.2±1.5 MEA1 1.4±0.0 10.4±1.8 18.5±1.1 44.0±1.2 71.6±5.2 MEA2 32.1±2.9 41.2±2.4 55.3±2.5 57.0±8.9 57.5±8.9 MEA3 61.1±3.7 70.1±2.5 79.9±2.3 79.5±0.9 80.4±3.1 MEA4 38.8±7.7 48.9±6.7 68.6±1.4 74.8±1.7 76.1±0.9 MEA5 62.6±6.6 67.6±4.2 78.6±2.6 79.3±1.6 81.6±0.6 AdvMEA 82.9±2.3 82.9±1.7 82.9±1.0 81.5±2.2 82.5±2.0 CEGA 80.5±1.4 80.3±3.9 80.3±1.6 79.8±1.3 80.2±0.2 Realistic 64.7±4.0 64.9±5.4 65.2±1.1 62.9±3.2 60.0±1.1 DFEA_I 81.3±0.5 81.5±0.2 81.8±0.7 81.9±0.5 81.7±0.3 DFEA_II 82.0±0.3 80.3±1.2 81.7±1.0 80.7±1.0 79.4±0.6 DFEA_III 81.1±0.9 80.4±1.2 81.4±0.9 81.2±1.1 81.1±0.3

MEA0 63.9±4.3 78.5±3.6 77.5±2.1 79.4±1.4 81.9±1.0 MEA1 1.4±0.0 10.4±1.8 18.5±1.1 44.0±1.2 71.6±5.2 MEA2 26.3±2.6 39.0±0.2 52.9±5.7 54.1±8.1 57.4±8.8 MEA3 58.1±4.4 71.1±2.8 79.4±0.5 81.4±0.8 81.5±1.6 MEA4 21.8±5.2 61.3±8.0 69.3±4.0 75.1±1.9 76.9±0.6 MEA5 63.0±6.6 68.0±3.4 78.6±2.6 81.1±1.4 81.0±1.6 AdvMEA 81.9±2.2 82.1±1.9 81.7±1.1 83.2±0.9 81.6±2.2 CEGA 79.8±1.9 81.6±1.2 81.8±0.5 81.2±1.0 81.1±0.7 Realistic 63.4±4.6 68.1±5.3 65.6±4.9 64.1±3.9 60.6±0.3 DFEA_I 81.3±0.5 81.5±0.2 81.8±0.7 81.9±0.5 81.7±0.3 DFEA_II 82.0±0.3 80.3±1.2 81.7±1.0 80.7±1.0 79.4±0.6 DFEA_III 81.0±1.0 80.4±1.2 81.4±0.9 81.2±1.1 81.1±0.3

(c) Regime=a_only

(d) Regime=data_free

Attack

0.05

0.10

0.25

0.50

Attack

1.00

MEA0 70.1±6.9 78.0±1.8 80.6±0.4 79.9±3.5 82.7±1.6 MEA1 1.4±0.0 10.4±1.8 18.5±1.1 44.0±1.2 71.6±5.2 MEA2 29.8±2.9 37.7±1.8 57.0±3.8 58.9±7.7 57.5±8.9 MEA3 62.6±2.9 72.7±1.8 78.8±1.7 79.9±3.0 81.4±1.0 MEA4 42.8±15.8 51.2±5.7 64.2±3.1 76.4±2.3 76.6±0.9 MEA5 60.1±9.1 72.1±0.8 78.0±2.2 79.9±1.2 79.1±1.1 AdvMEA 82.8±1.1 82.1±1.7 82.9±2.2 81.8±1.8 82.1±1.5 CEGA 79.2±2.1 80.7±0.7 81.6±0.7 81.3±1.2 80.6±0.5 Realistic 52.4±8.7 70.5±2.6 60.2±6.0 60.1±2.4 56.2±1.3 DFEA_I 81.3±0.5 81.5±0.2 81.8±0.7 81.9±0.5 81.7±0.4 DFEA_II 82.0±0.3 80.3±1.2 81.7±1.0 80.7±1.0 79.4±0.6 DFEA_III 81.1±0.9 80.4±1.2 81.4±0.9 81.2±1.1 81.1±0.3

F.4

0.05

0.10

0.25

0.50

1.00

MEA0 2.1±1.0 7.9±4.9 1.4±0.0 5.2±2.9 6.0±5.2 MEA1 1.4±0.0 1.4±0.0 1.4±0.0 1.4±0.0 1.4±0.0 MEA2 31.4±2.6 39.8±0.8 55.2±2.1 58.4±8.2 57.5±8.9 MEA3 3.5±2.1 6.2±5.1 10.2±7.7 17.1±9.7 5.3±5.6 MEA4 1.8±0.7 4.5±3.4 2.1±1.0 4.7±3.3 4.0±3.7 MEA5 1.4±0.0 9.3±5.6 12.3±4.0 9.0±5.4 5.3±5.6 AdvMEA 82.5±1.3 82.7±1.6 82.2±2.0 82.7±1.6 82.3±0.9 CEGA 77.8±1.5 79.5±2.5 80.4±0.9 80.4±0.5 80.8±1.0 Realistic 56.4±3.0 58.3±1.0 58.5±1.9 56.0±2.7 55.1±2.9 DFEA_I 81.3±0.5 81.5±0.2 81.8±0.7 81.9±0.5 81.7±0.3 DFEA_II 82.0±0.3 80.3±1.2 81.7±1.0 80.7±1.0 79.4±0.6 DFEA_III 81.1±0.9 80.4±1.2 81.4±0.9 81.2±1.1 81.1±0.3

Attack effectiveness on the three additional datasets

We report the per-attack and per-budget fidelity for all twelve attacks on the three additional graphs (RomanEmpire, AmazonRatings, OGBN-Arxiv) in the four regimes. Constant values across budgets reflect attacks whose surrogate is independent of the query budget (e.g., the data-free DFEA variants, which always train on the same synthesized queries). 26

Table 22: RQ1 detailed for dataset=CoauthorPhysics, metric=Fidelity (%). Rows are attacks; columns are budgets. Mean ± std across seeds; best per column is bold. (b) Regime=x_only

(a) Regime=both Attack

0.05

0.10

0.25

0.50

Attack

1.00

0.05

0.10

0.25

0.50

1.00

MEA0 81.9±4.5 89.3±0.9 92.5±0.7 92.8±0.9 94.2±0.1 MEA1 2.7±0.5 9.5±0.3 15.3±0.7 44.4±1.6 78.6±7.3 MEA2 32.5±2.5 44.8±1.9 69.0±1.0 76.1±4.9 85.8±3.2 MEA3 74.4±2.1 80.8±3.0 89.1±1.0 90.4±1.7 93.0±0.7 MEA4 69.2±11.7 75.4±11.2 90.7±0.9 95.5±0.6 97.8±0.4 MEA5 74.3±5.8 77.5±4.9 89.5±1.5 91.2±1.4 91.9±0.2 AdvMEA 90.0±0.5 90.2±0.5 89.7±0.8 89.5±0.9 90.2±0.4 CEGA 91.0±1.4 91.6±1.3 94.1±0.0 94.9±0.3 96.8±0.3 Realistic 80.5±4.1 77.5±6.4 82.2±1.6 77.4±2.2 74.3±1.4 DFEA_I 95.4±0.3 96.4±0.6 97.3±0.3 97.6±0.7 97.7±0.7 DFEA_II 93.6±0.7 94.4±0.5 96.3±0.2 97.3±0.1 99.6±0.1 DFEA_III 93.7±0.3 95.1±0.4 96.8±0.4 97.7±0.4 98.7±0.1

MEA0 80.4±4.7 89.9±1.2 92.0±1.5 93.6±0.7 93.3±0.8 MEA1 2.7±0.5 9.5±0.3 15.3±0.7 44.4±1.6 78.6±7.3 MEA2 30.4±2.2 41.2±2.5 66.3±4.1 74.0±6.2 85.7±3.1 MEA3 74.5±1.4 83.1±2.9 90.1±1.2 92.6±1.4 92.9±0.4 MEA4 40.3±18.5 84.0±4.2 90.9±0.1 94.4±0.4 98.1±0.6 MEA5 75.8±5.7 77.8±6.2 89.1±1.4 92.4±1.1 93.4±0.9 AdvMEA 89.8±0.6 90.4±0.2 89.8±0.2 90.0±0.3 89.9±0.3 CEGA 92.3±1.3 93.0±1.3 94.1±0.6 94.7±0.8 96.3±0.8 Realistic 79.1±6.6 84.3±4.3 81.0±2.9 79.2±2.2 76.7±1.1 DFEA_I 95.4±0.3 96.4±0.6 97.3±0.3 97.6±0.7 97.7±0.7 DFEA_II 93.6±0.7 94.4±0.5 96.3±0.2 97.3±0.1 99.6±0.1 DFEA_III 93.6±0.2 95.1±0.4 96.8±0.4 97.7±0.4 98.7±0.1

(c) Regime=a_only

(d) Regime=data_free

Attack

0.05

0.10

0.25

0.50

Attack

1.00

0.05

0.10

0.25

0.50

1.00

MEA0 4.6±2.8 27.6±18.8 2.7±0.5 16.3±11.3 19.5±20.3 MEA1 2.7±0.5 2.7±0.5 2.7±0.5 2.7±0.5 2.7±0.5 MEA2 31.1±1.6 43.4±2.3 67.7±1.7 77.6±4.8 85.8±3.2 MEA3 6.2±2.2 18.9±20.8 28.8±20.2 35.8±22.6 17.8±21.4 MEA4 4.6±2.7 14.6±12.7 4.6±2.8 14.7±12.6 12.5±13.9 MEA5 2.7±0.5 33.3±21.6 30.5±12.9 24.6±18.9 17.9±21.9 AdvMEA 89.7±0.6 90.5±0.9 89.9±0.6 90.0±0.7 89.7±0.3 CEGA 89.6±1.7 92.8±0.7 95.0±0.2 95.1±1.0 96.5±0.4 Realistic 72.7±2.0 75.2±2.1 73.5±0.7 73.5±2.0 71.6±4.1 DFEA_I 95.4±0.3 96.4±0.6 97.3±0.3 97.6±0.7 97.7±0.7 DFEA_II 93.6±0.7 94.4±0.5 96.3±0.2 97.3±0.1 99.6±0.1 DFEA_III 93.7±0.3 95.1±0.4 96.8±0.4 97.7±0.4 98.7±0.1

MEA0 84.5±3.8 88.6±0.5 91.9±0.8 91.8±1.0 94.5±0.4 MEA1 2.7±0.5 9.5±0.3 15.3±0.7 44.4±1.6 78.6±7.3 MEA2 33.7±0.6 46.5±1.1 68.5±2.6 77.9±3.1 85.8±3.2 MEA3 69.7±6.2 84.3±3.2 89.8±0.5 90.7±0.3 93.7±0.8 MEA4 61.1±25.0 78.4±6.6 89.0±1.9 94.6±0.7 97.9±0.3 MEA5 72.1±9.2 84.0±1.2 90.4±1.9 92.6±0.9 94.4±0.3 AdvMEA 90.0±0.9 90.1±0.1 90.1±0.4 89.9±0.8 90.1±0.3 CEGA 91.5±0.4 93.3±0.6 93.5±0.4 95.6±1.1 96.2±0.4 Realistic 72.8±4.6 85.6±2.4 73.0±7.3 75.6±1.1 72.0±3.2 DFEA_I 95.4±0.3 96.4±0.6 97.3±0.3 97.6±0.7 97.7±0.7 DFEA_II 93.6±0.7 94.4±0.5 96.3±0.2 97.3±0.1 99.6±0.1 DFEA_III 93.7±0.3 95.1±0.4 96.8±0.4 97.7±0.4 98.7±0.1

Table 23: RQ1 detailed for dataset=Computers, metric=Acc (%). Rows are attacks; columns are budgets. Mean ± std across seeds; best per column is bold. (a) Regime=both Attack

0.05

0.10

0.25

(b) Regime=x_only 0.50

Attack

1.00

0.05

0.10

0.25

0.50

1.00

MEA0 51.7±7.0 60.4±4.2 65.7±2.4 67.3±2.3 71.4±1.4 MEA1 46.4±19.1 31.3±14.7 48.1±2.6 51.9±1.4 53.0±5.3 MEA2 40.2±23.5 43.0±22.8 42.1±25.4 40.8±26.2 41.5±26.7 MEA3 61.6±2.2 69.8±2.0 66.0±1.3 69.3±2.5 70.7±3.1 MEA4 41.7±14.8 35.0±19.2 65.9±4.1 66.5±3.7 71.7±0.3 MEA5 67.8±2.0 68.8±2.9 69.4±3.1 70.5±3.3 70.1±4.2 AdvMEA 34.7±17.3 20.8±22.8 22.4±23.3 46.8±13.1 16.8±11.4 CEGA 29.8±21.9 27.8±20.7 34.8±14.0 45.4±24.1 39.6±25.5 Realistic 2.4±1.1 1.1±0.7 1.1±0.7 1.5±1.2 1.1±0.7 DFEA_I 39.2±24.6 40.5±15.6 39.9±22.8 36.9±22.9 45.4±13.7 DFEA_II 31.5±19.0 30.1±18.0 30.1±18.0 30.1±18.0 30.1±18.0 DFEA_III 45.2±22.1 41.3±16.4 44.1±21.4 46.4±21.2 46.1±21.7

MEA0 54.7±8.8 63.8±1.1 64.4±5.4 64.7±6.9 67.0±4.9 MEA1 46.4±19.1 31.3±14.7 48.0±2.5 51.7±1.3 52.9±5.6 MEA2 41.5±23.0 42.1±21.0 41.8±24.8 41.4±25.6 41.5±26.7 MEA3 63.7±3.0 68.4±1.8 69.2±3.4 70.3±3.9 70.1±1.8 MEA4 31.7±4.2 37.0±22.1 61.4±4.3 67.2±0.9 71.4±1.1 MEA5 69.9±2.3 67.7±2.3 67.9±3.1 71.1±3.3 72.1±1.9 AdvMEA 27.6±23.9 33.1±21.1 31.6±22.4 29.5±21.4 40.4±26.8 CEGA 27.9±17.2 27.5±20.0 43.6±25.0 25.1±22.5 41.6±29.1 Realistic 12.9±15.6 13.2±16.7 1.1±0.7 13.6±16.6 10.9±13.6 DFEA_I 38.5±24.2 40.6±15.7 39.9±22.8 37.0±22.9 45.4±13.7 DFEA_II 31.5±19.0 30.1±18.0 30.1±18.0 30.1±18.0 30.1±18.0 DFEA_III 44.2±22.0 41.2±16.4 44.1±21.4 46.6±21.3 45.7±21.6

(c) Regime=a_only

(d) Regime=data_free

Attack

0.05

0.10

0.25

0.50

Attack

1.00

MEA0 62.9±5.2 64.4±2.9 62.3±1.6 67.7±2.6 67.6±3.3 MEA1 46.4±19.1 31.3±14.7 48.1±2.6 51.9±1.4 53.0±5.3 MEA2 38.9±21.1 41.3±23.3 41.3±24.3 41.4±26.5 41.5±26.7 MEA3 62.1±2.2 67.2±1.0 68.1±4.2 65.2±5.8 71.7±1.7 MEA4 40.2±16.5 44.6±19.3 54.0±17.1 62.2±7.8 68.4±0.5 MEA5 64.5±4.1 69.9±0.5 68.3±1.8 71.5±4.9 71.7±1.6 AdvMEA 36.9±14.9 40.3±16.2 27.0±23.9 31.6±24.1 17.2±8.3 CEGA 29.1±16.6 31.0±20.7 39.7±23.2 36.1±25.4 39.3±28.1 Realistic 12.7±16.1 1.5±1.2 15.0±19.4 1.1±0.7 14.6±18.4 DFEA_I 39.1±24.5 40.1±15.4 39.9±22.8 37.0±22.9 45.5±13.8 DFEA_II 31.2±18.8 30.1±18.0 30.1±18.0 25.4±15.7 30.1±18.0 DFEA_III 44.2±22.0 41.3±16.4 44.1±21.4 46.6±21.3 46.1±21.7

F.5

0.05

0.10

0.25

0.50

1.00

MEA0 25.7±22.9 11.7±7.5 29.7±18.9 44.1±16.9 8.6±8.2 MEA1 56.1±0.0 56.1±0.0 56.1±0.0 56.1±0.0 56.1±0.0 MEA2 40.1±21.2 41.5±21.8 42.5±22.9 40.1±25.0 41.5±26.7 MEA3 38.6±24.7 41.7±20.4 27.3±20.9 25.6±23.0 19.8±25.7 MEA4 25.6±23.0 4.7±5.8 19.0±26.2 5.7±5.3 4.7±5.8 MEA5 19.3±26.0 20.9±25.0 25.4±22.0 26.5±21.2 24.8±22.8 AdvMEA 42.6±13.0 32.0±16.6 23.6±21.7 20.7±17.0 39.4±10.4 CEGA 30.4±15.3 17.2±17.0 39.6±28.3 34.9±26.8 36.4±24.5 Realistic 13.6±17.4 1.3±0.5 10.8±13.4 8.2±9.7 1.0±0.6 DFEA_I 38.7±24.3 40.4±15.6 39.9±22.8 37.0±23.0 45.5±13.8 DFEA_II 31.2±18.8 30.1±18.0 30.1±18.0 30.1±18.0 30.1±18.0 DFEA_III 44.2±22.0 41.3±16.4 44.1±21.4 46.6±21.3 45.7±21.6

Standard deviations for information-limiting defenses

Tables 39–40 extend Table 3 of the main text with standard deviations for each protected-model accuracy and verification proxy. The seven defenses are split across two tables for readability: the four output-perturbation / prediction-rounding defenses are in Table 39, and the three query-detection defenses are in Table 40. Heatmap view of the seven information-limiting defenses. Figure 7 reports the same numbers as Tables 39–40 as a 10 × 7 heatmap, with protected-model accuracy on the left panel and the verification proxy on the right panel. The two-panel view exposes three patterns which are not visible in the per-defense tables. First, the verification proxy clusters into two regimes. The four 27

Table 24: RQ1 detailed for dataset=Computers, metric=F1 (%). Rows are attacks; columns are budgets. Mean ± std across seeds; best per column is bold. (b) Regime=x_only

(a) Regime=both Attack

0.05

0.10

0.25

0.50

Attack

1.00

0.05

0.10

0.25

0.50

1.00

MEA0 22.0±6.0 44.3±4.0 46.4±8.0 44.1±2.0 60.0±0.6 MEA1 13.0±6.0 7.6±3.7 17.2±5.5 19.3±7.8 22.7±4.6 MEA2 20.3±12.7 27.3±15.1 27.8±18.1 26.5±18.2 27.1±18.8 MEA3 20.6±4.3 41.7±4.6 44.0±4.2 54.5±4.0 58.8±2.5 MEA4 13.8±1.8 16.5±9.6 28.0±6.6 36.7±9.7 46.8±4.4 MEA5 29.8±1.1 39.5±4.5 56.3±4.8 53.5±1.9 53.7±8.7 AdvMEA 21.7±13.1 14.9±14.0 15.5±16.6 30.0±8.0 12.0±9.9 CEGA 26.8±18.9 22.8±15.0 31.3±15.1 39.5±23.5 33.4±21 Realistic 2.0±1.2 0.2±0.1 0.2±0.1 0.5±0.3 0.2±0.1 DFEA_I 32.3±22.5 29.9±16.3 33.4±19.9 28.2±20.8 29.6±19.0 DFEA_II 11.7±9.4 4.3±2.4 4.3±2.4 4.3±2.4 4.3±2.4 DFEA_III 34.2±18.1 27.6±15.8 32.1±18.4 38.0±20.3 38.7±20.9

MEA0 29.9±7.4 41.9±4.5 43.1±8.7 42.5±18.6 50.8±7.5 MEA1 13.0±6.0 7.6±3.7 17.1±5.5 19.9±8.5 27.8±2.7 MEA2 25.4±14.1 26.3±12.6 26.6±15.9 27.5±18.5 27.1±18.8 MEA3 29.0±3.6 40.5±2.5 50.5±7.4 51.0±12.1 56.9±3.9 MEA4 12.7±4.4 15.6±5.3 24.6±5.1 34.5±9.6 47.8±1.1 MEA5 32.9±4.8 39.0±4.6 50.6±8.6 52.5±4.6 59.5±1.9 AdvMEA 17.3±13.6 17.5±12.9 22.8±16.0 18.8±11.7 27.5±18.8 CEGA 29.1±17.2 27.1±19.3 36.9±20.2 21.0±20.3 35.8±25.5 Realistic 3.9±4.3 5.1±6.8 0.2±0.1 5.5±7.2 3.2±4.1 DFEA_I 31.9±22.1 30.0±16.4 33.2±19.7 27.8±20.3 29.6±19.0 DFEA_II 11.7±9.4 4.3±2.4 4.3±2.4 4.3±2.4 4.3±2.4 DFEA_III 30.4±15.7 26.8±14.8 32.1±18.4 38.1±20.4 37.6±20.3

(c) Regime=a_only

(d) Regime=data_free

Attack

0.05

0.10

0.25

0.50

Attack

1.00

MEA0 33.3±3.9 44.3±5.7 35.8±10.0 55.1±0.6 52.9±5.0 MEA1 13.0±6.0 7.6±3.7 17.2±5.5 19.3±7.8 22.7±4.6 MEA2 22.1±12.5 25.9±15.4 26.8±16.7 27.2±18.7 27.1±18.8 MEA3 24.9±1.6 34.9±1.8 45.5±9.0 42.4±18.4 60.8±2.4 MEA4 15.1±4.4 16.4±9.1 27.8±5.7 32.1±8.9 40.6±5.5 MEA5 32.5±5.3 38.5±1.8 48.9±5.2 57.0±9.1 58.4±1.5 AdvMEA 23.1±12.3 25.9±11.9 17.8±16.5 20.0±15.2 11.9±6.3 CEGA 21.5±15.5 22.0±23.1 33.2±19.2 31.4±19.8 34.6±25.0 Realistic 4.0±5.2 0.4±0.3 4.3±5.6 0.2±0.1 4.8±5.8 DFEA_I 31.9±22.1 29.6±15.9 33.4±19.9 27.8±20.3 29.3±18.7 DFEA_II 11.6±9.4 4.3±2.4 4.3±2.4 6.1±4.3 4.3±2.4 DFEA_III 30.4±15.7 27.6±15.8 32.1±18.4 38.1±20.3 38.7±20.9

0.05

0.10

0.25

0.50

1.00

MEA0 3.6±2.9 2.0±1.2 4.3±2.1 5.9±1.8 1.5±1.3 MEA1 7.2±0.0 7.2±0.0 7.2±0.0 7.2±0.0 7.2±0.0 MEA2 24.2±11.6 25.1±13.5 25.3±13.9 26.2±17.5 27.1±18.8 MEA3 5.0±3.1 5.6±2.3 5.1±3.5 3.5±2.9 2.7±3.2 MEA4 3.5±2.9 0.8±1.0 2.5±3.3 1.0±0.9 0.8±1.0 MEA5 2.7±3.2 3.3±2.9 4.8±3.0 4.4±2.1 4.4±2.9 AdvMEA 31.8±11.4 21.1±13.9 13.9±11.5 16.2±13.4 23.3±8.1 CEGA 21.7±13.3 15.7±18.4 32.8±22.6 28.1±20.6 35.5±22.6 Realistic 5.2±6.9 1.0±1.1 3.6±4.7 2.2±2.7 0.2±0.1 DFEA_I 31.7±22.0 29.8±16.1 33.4±19.9 27.8±20.3 29.3±18.7 DFEA_II 11.5±9.3 4.3±2.4 4.3±2.4 4.3±2.4 4.3±2.4 DFEA_III 30.4±15.7 27.6±15.8 32.0±18.4 38.1±20.4 37.6±20.3

Table 25: RQ1 detailed for dataset=Computers, metric=Fidelity (%). Rows are attacks; columns are budgets. Mean ± std across seeds; best per column is bold. (b) Regime=x_only

(a) Regime=both Attack

0.05

0.10

0.25

0.50

Attack

1.00

0.05

0.10

0.25

0.50

1.00

MEA0 51.0±7.0 67.3±3.1 67.0±1.5 71.4±2.7 80.5±4.6 MEA1 41.5±15.5 27.7±14.0 46.2±5.5 49.4±5.6 56.3±12.6 MEA2 51.0±7.5 58.8±6.0 65.2±2.4 66.2±6.3 68.3±8.0 MEA3 53.8±3.0 64.8±5.5 67.6±6.2 74.9±4.3 79.5±5.2 MEA4 38.4±13.4 37.9±12.6 63.6±4.0 74.3±5.0 83.7±4.3 MEA5 61.3±4.3 65.6±6.4 66.5±2.1 73.9±3.5 76.3±4.2 AdvMEA 35.5±17.8 25.7±24.7 26.9±22.4 46.1±12.5 22.8±11.8 CEGA 36.0±25.0 36.7±23.0 43.4±17.5 53.9±29.2 54.1±33.4 Realistic 64.5±33.7 67.9±45.4 67.7±45.3 67.4±44.0 67.0±44.8 DFEA_I 67.5±12.4 73.7±18.1 60.3±25.5 64.8±15.9 55.8±28.2 DFEA_II 43.9±8.1 28.4±20.5 28.4±20.5 28.4±20.5 28.4±20.5 DFEA_III 72.9±5.5 66.7±14.2 72.9±3.1 82.5±3.1 82.1±2.8

MEA0 54.8±10.5 65.4±7.0 70.6±2.9 69.7±10.9 79.8±3.1 MEA1 41.5±15.5 27.7±14.0 46.2±5.5 49.1±5.7 57.1±11.4 MEA2 53.9±6.6 58.6±6.4 63.9±0.6 68.4±5.0 68.3±8.0 MEA3 56.5±7.4 61.9±5.6 68.2±4.2 71.7±4.9 77.6±3.1 MEA4 33.7±0.4 34.7±18.5 65.6±4.0 75.7±0.8 84.6±3.4 MEA5 59.4±3.4 65.5±5.2 71.0±3.6 75.4±5.6 79.5±3.5 AdvMEA 29.0±24.1 33.6±19.9 34.5±23.4 28.7±16.6 39.8±25.8 CEGA 30.9±16.1 33.6±25.2 49.2±24.3 33.1±30.1 49.8±33.8 Realistic 75.1±25.8 78.7±30.0 67.9±45.4 81.0±25.5 78.6±25.1 DFEA_I 67.3±12.1 73.5±18.1 60.7±25.9 64.9±16.2 55.4±27.8 DFEA_II 43.9±8.1 28.4±20.5 28.4±20.5 28.4±20.5 28.4±20.5 DFEA_III 69.9±2.4 65.7±13.4 72.9±3.1 82.2±2.9 82.3±2.9

(c) Regime=a_only

(d) Regime=data_free

Attack

0.05

0.10

0.25

0.50

Attack

1.00

MEA0 60.7±2.6 66.5±6.5 66.1±1.6 77.1±2.9 78.8±0.9 MEA1 41.5±15.5 27.7±14.0 46.2±5.5 49.4±5.6 56.3±12.6 MEA2 47.8±10.2 59.6±4.5 64.3±1.1 66.8±7.2 68.3±8.0 MEA3 58.0±4.7 62.7±5.5 68.4±4.2 65.1±4.4 79.5±4.4 MEA4 42.3±14.5 38.0±15.4 54.9±16.2 64.1±4.0 81.2±2.2 MEA5 57.7±4.0 62.8±3.9 69.7±5.2 72.5±3.9 80.9±3.3 AdvMEA 39.9±16.5 40.0±16.3 32.3±22.2 32.2±23.3 20.2±8.3 CEGA 37.9±19.9 37.9±23.5 50.1±27.4 45.4±30.8 51.6±32.9 Realistic 69.5±26.3 64.5±43.1 77.2±30.2 67.8±45.4 80.8±26.0 DFEA_I 67.3±12.2 73.2±17.9 60.3±25.5 64.9±16.2 55.8±28.1 DFEA_II 44.2±7.8 28.4±20.4 28.4±20.5 38.9±12.6 28.4±20.5 DFEA_III 69.9±2.4 66.7±14.2 72.9±3.1 82.4±3.1 82.1±2.8

0.05

0.10

0.25

0.50

1.00

MEA0 22.2±16.0 9.5±6.5 22.7±14.2 33.7±11.0 14.2±10.6 MEA1 40.4±1.6 40.4±1.6 40.4±1.6 40.4±1.6 40.4±1.6 MEA2 54.3±7.2 57.0±7.2 66.0±2.4 67.1±4.5 68.4±8.0 MEA3 31.8±13.7 29.5±15.1 22.4±13.8 19.9±16.5 15.6±18.0 MEA4 23.9±16.7 3.3±3.6 15.1±19.0 6.7±5.1 4.4±4.7 MEA5 16.1±17.6 15.7±16.2 18.4±13.6 22.6±12.8 23.1±14.1 AdvMEA 44.9±13.6 34.2±18.1 21.6±17.4 24.3±18.1 40.7±12.2 CEGA 33.6±15.6 21.0±18.4 49.4±31.1 46.2±32.9 50.0±30.4 Realistic 82.1±22.2 70.2±41.7 82.5±24.8 75.5±34.6 66.5±44.5 DFEA_I 67.3±12.2 73.8±18.2 60.3±25.5 65.1±16.3 55.8±28.1 DFEA_II 44.2±7.8 28.4±20.5 28.4±20.5 28.4±20.5 28.4±20.4 DFEA_III 69.9±2.4 66.7±14.2 73.0±2.9 82.2±2.9 82.3±2.9

output-perturbation and rounding defenses (OP_low, OP_high, PR_2bit, PR_top1) plus GradRedir verify at ≥ 80% on every dataset, while the two query-detection defenses (PRADA, AdaptMisinfo) verify at ∼ 50% on most homophilic graphs and below 50% on RomanEmpire; this is consistent with the joint-evaluation behaviour reported in Appendix F.8, where the same two defenses are also the strongest at reducing surrogate fidelity. Second, the accuracy panel is largely flat across defenses on the eight non-Computers datasets. The output-perturbation methods leave protected accuracy within ∼ 2 pp of the undefended baseline on Cora, CiteSeer, PubMed, Photo, CoauthorCS, CoauthorPhysics, OGBN-Arxiv, and AmazonRatings, which means the protection signal in those rows is carried entirely by the verification panel. Third, Computers is the only dataset where the accuracy panel is heterogeneous: every defense produces high variance, and three defenses (OP_high, PR_2bit, AdaptMisinfo) push protected accuracy below 40%, which mirrors the high variance of 28

Table 26: RQ1 detailed for dataset=Photo, metric=Acc (%). Rows are attacks; columns are budgets. Mean ± std across seeds; best per column is bold. (b) Regime=x_only

(a) Regime=both Attack

0.05

0.10

0.25

0.50

Attack

1.00

0.05

0.10

0.25

0.50

1.00

MEA0 55.1±30.4 90.2±3.8 94.9±0.6 96.4±0.2 95.5±0.4 MEA1 2.0±0.2 39.5±26.2 42.2±28.9 62.7±33.5 67.0±36.5 MEA2 84.4±2.3 89.0±1.9 90.1±2.2 91.4±2.0 92.4±2.3 MEA3 78.9±14.6 93.9±2.4 96.2±0.4 96.5±0.2 96.3±0.5 MEA4 74.6±2.4 83.0±8.4 95.1±0.3 95.5±0.4 96.0±0.5 MEA5 80.2±7.1 92.8±1.3 95.0±1.6 95.5±0.8 96.4±0.2 AdvMEA 49.0±22.8 38.0±24.8 47.3±27.6 36.8±26.7 40.9±24.8 CEGA 79.6±5.4 83.0±14.5 89.8±6.4 94.8±0.6 88.9±9.3 Realistic 49.0±1.1 47.7±8.3 64.5±19.4 63.3±20.6 50.3±7.0 DFEA_I 91.0±2.5 91.1±2.9 91.4±2.7 91.4±3.0 91.7±3.1 DFEA_II 30.2±33.7 28.7±31.6 15.8±6.6 11.1±6.6 14.4±6.1 DFEA_III 92.3±1.6 92.6±1.8 90.6±3.6 92.4±1.8 92.7±1.9

MEA0 84.5±5.9 91.1±2.3 95.4±0.8 95.9±0.8 96.0±0.4 MEA1 2.0±0.2 39.6±26.4 42.2±28.9 62.7±33.5 67.0±36.5 MEA2 87.8±2.0 89.3±2.2 90.6±1.9 91.1±2.4 92.4±2.3 MEA3 83.0±5.1 92.8±2.1 95.7±0.1 95.8±0.8 96.2±0.3 MEA4 67.2±18.6 86.0±2.1 87.8±8.1 96.0±0.4 96.0±0.1 MEA5 82.5±13.8 94.5±1.7 95.9±0.1 96.4±0.2 96.1±0.6 AdvMEA 48.7±30.4 40.1±24.6 42.7±26.8 44.0±25.6 57.3±17.0 CEGA 84.9±6.6 85.9±6.1 82.7±7.0 93.8±1.9 94.1±3.0 Realistic 53.5±5.7 34.5±15.1 51.7±5.8 61.5±14.2 56.9±15.7 DFEA_I 91.0±2.4 91.1±2.9 91.4±2.7 91.4±3.0 91.7±3.1 DFEA_II 30.2±33.7 28.7±31.6 15.8±6.6 11.1±6.6 14.4±6.1 DFEA_III 92.3±1.6 92.6±1.8 90.6±3.6 92.4±1.8 92.7±1.9

(c) Regime=a_only

(d) Regime=data_free

Attack

0.05

0.10

0.25

0.50

Attack

1.00

MEA0 87.2±5.3 92.2±1.8 93.9±1.5 95.9±0.2 95.7±0.5 MEA1 2.0±0.2 39.4±26.0 42.2±28.9 62.7±33.5 67.0±36.5 MEA2 87.3±1.8 88.8±2.4 90.5±2.2 91.5±2.4 92.4±2.3 MEA3 81.6±3.9 92.5±1.8 95.6±0.2 96.0±0.2 96.7±0.3 MEA4 69.2±15.5 75.7±19.8 90.5±2.4 95.9±0.2 96.0±0.3 MEA5 75.5±4.4 94.2±1.3 95.7±0.4 96.0±0.2 96.6±0.4 AdvMEA 47.8±27.0 52.5±30.7 33.5±28.0 47.0±31.9 38.9±6.2 CEGA 90.0±3.4 84.9±8.2 95.1±0.7 95.5±0.9 94.2±2.5 Realistic 47.0±7.1 33.5±13.4 51.8±7.0 59.2±19.6 66.4±19.5 DFEA_I 90.9±2.5 91.1±2.9 91.4±2.7 91.4±3.0 91.7±3.1 DFEA_II 30.2±33.7 28.7±31.6 15.8±6.6 11.1±6.6 14.4±6.1 DFEA_III 92.3±1.6 92.6±1.8 90.6±3.6 92.4±1.8 92.7±1.9

0.05

0.10

0.25

0.50

1.00

MEA0 10.4±6.9 28.0±13.5 15.8±0.8 16.9±0.0 11.7±7.5 MEA1 10.2±7.2 10.2±7.2 10.2±7.2 10.2±7.2 10.2±7.2 MEA2 85.9±2.1 89.2±1.4 90.4±2.0 91.4±2.4 92.4±2.3 MEA3 21.2±19.2 10.8±7.5 5.7±6.8 6.1±7.7 15.3±0.0 MEA4 11.3±8.0 11.2±7.0 11.0±7.3 11.7±7.4 5.9±7.8 MEA5 32.0±21.4 27.1±14.2 10.9±6.3 10.4±6.4 22.1±19.1 AdvMEA 49.3±29.1 50.8±30.7 36.9±25.8 46.9±29.3 40.9±24.7 CEGA 51.2±32.0 89.9±7.7 95.1±0.5 92.7±2.8 92.8±1.5 Realistic 42.1±18.6 63.2±19.3 61.1±20.5 33.7±13.0 57.9±17.0 DFEA_I 90.9±2.5 91.1±2.9 91.4±2.7 91.4±3.0 91.7±3.1 DFEA_II 30.2±33.7 28.7±31.6 15.8±6.6 11.1±6.6 14.4±6.1 DFEA_III 92.3±1.6 92.6±1.8 90.6±3.6 92.4±1.8 92.7±1.9

Table 27: RQ1 detailed for dataset=Photo, metric=F1 (%). Rows are attacks; columns are budgets. Mean ± std across seeds; best per column is bold. (b) Regime=x_only

(a) Regime=both Attack

0.05

0.10

0.25

0.50

Attack

1.00

0.05

0.10

0.25

0.50

1.00

MEA0 31.9±15.5 54.4±4.2 59.6±4.6 64.4±2.4 62.0±3.0 MEA1 2.0±0.2 22.6±14.3 25.7±19.3 33.5±21.6 41.6±27.2 MEA2 42.2±2.4 49.7±8.8 56.4±6.6 57.4±8.7 59.0±9.6 MEA3 52.0±9.1 66.9±7.6 64.5±1.7 66.9±4.1 64.9±5.5 MEA4 32.6±2.7 37.6±7.0 50.1±2.0 49.6±1.5 55.3±2.8 MEA5 56.8±9.0 66.4±4.1 60.2±3.6 61.7±5.3 62.7±0.7 AdvMEA 28.5±14.3 25.6±14.7 28.6±15.2 20.1±16.2 21.8±13.3 CEGA 45.7±3.0 50.3±11.3 55.4±4.3 58.5±1.2 55.1±8.4 Realistic 15.4±4.7 15.9±4.8 28.0±18.4 28.6±19.9 17.0±5.2 DFEA_I 48.3±3.5 51.4±6.5 49.8±9.2 51.0±11.5 51.8±11.9 DFEA_II 16.9±21.7 14.0±17.7 10.0±6.0 5.4±5.5 5.6±4.5 DFEA_III 51.2±4.7 57.4±9.6 53.6±12.3 57.9±7.3 56.2±11.7

MEA0 46.4±7.7 59.5±6.0 58.4±2.4 66.3±2.7 65.7±1.0 MEA1 2.0±0.2 22.7±14.5 25.7±19.3 33.5±21.6 41.6±27.2 MEA2 43.5±1.7 45.4±2.8 48.2±2.8 58.0±10.2 59.0±9.6 MEA3 54.0±9.8 61.5±5.0 63.3±5.3 68.0±2.2 69.5±4.5 MEA4 24.8±15.5 43.3±4.7 43.0±5.1 60.1±4.7 55.9±2.4 MEA5 48.2±17.8 61.7±4.6 60.4±3.9 69.9±5.0 62.9±2.7 AdvMEA 28.7±14.8 23.3±13.4 24.0±15.4 29.0±16.3 34.3±10.8 CEGA 48.6±8.1 53.1±4.3 45.6±7.4 59.3±3.3 58.5±3.0 Realistic 15.3±4.5 13.0±4.5 15.6±5.0 26.5±15.7 22.5±12.1 DFEA_I 48.7±3.1 51.4±6.5 49.8±9.2 51.0±11.5 51.8±11.9 DFEA_II 16.9±21.7 14.0±17.7 10.0±6.0 5.4±5.5 5.6±4.5 DFEA_III 51.2±4.7 57.4±9.6 53.6±12.3 57.9±7.3 56.2±11.7

(c) Regime=a_only

(d) Regime=data_free

Attack

0.05

0.10

0.25

0.50

Attack

1.00

MEA0 57.9±4.5 63.7±7.0 57.5±9.1 64.2±3.5 64.0±4.5 MEA1 2.0±0.2 22.7±14.5 25.7±19.3 33.5±21.6 41.6±27.2 MEA2 48.6±10.0 48.5±6.9 52.2±8.7 58.3±10.5 59.0±9.6 MEA3 45.1±7.8 57.7±3.2 60.5±2.4 65.9±3.7 65.3±2.1 MEA4 33.8±6.9 33.0±17.0 46.4±4.7 51.1±3.2 56.1±4.1 MEA5 43.2±7.8 62.0±1.4 64.6±5.2 64.1±5.3 65.4±5.1 AdvMEA 29.5±14.9 32.1±17.1 19.4±17.3 26.8±17.8 21.6±3.4 CEGA 54.2±3.2 49.3±8.7 62.0±2.1 62.0±3.6 58.2±3.0 Realistic 15.0±3.0 10.0±5.7 17.1±5.6 26.5±17.5 32.6±24.6 DFEA_I 48.6±3.2 51.4±6.5 49.8±9.2 51.0±11.5 51.8±11.9 DFEA_II 16.9±21.7 14.0±17.7 10.0±6.0 5.4±5.5 5.6±4.5 DFEA_III 51.2±4.7 57.4±9.6 53.6±12.3 57.9±7.3 56.2±11.7

0.05

0.10

0.25

0.50

1.00

MEA0 2.3±1.5 5.3±1.9 3.4±0.1 3.6±0.0 2.5±1.6 MEA1 2.2±1.6 2.2±1.6 2.2±1.6 2.2±1.6 2.2±1.6 MEA2 43.3±2.6 46.6±3.1 46.0±3.5 59.1±9.5 59.0±9.6 MEA3 3.9±3.2 2.9±0.8 1.6±1.6 1.3±1.6 3.3±0.0 MEA4 2.4±1.7 2.4±1.5 2.4±1.6 2.5±1.6 1.3±1.7 MEA5 5.8±3.1 7.0±2.2 3.1±0.3 2.6±1.7 4.0±3.2 AdvMEA 29.9±15.9 30.8±17.4 22.9±14.2 29.2±19.0 23.3±11.7 CEGA 31.0±17.9 55.3±6.1 62.7±1.6 59.0±3.2 60.0±4.9 Realistic 13.7±4.1 28.6±18.2 27.0±17.7 10.3±6.3 24.6±15.1 DFEA_I 48.6±3.2 51.4±6.5 49.8±9.2 51.0±11.5 51.8±11.9 DFEA_II 16.9±21.7 14.0±17.7 10.0±6.0 5.4±5.5 5.6±4.5 DFEA_III 51.2±4.7 57.4±9.6 53.6±12.3 57.9±7.3 56.2±11.7

the same dataset in Tables 32–33 and is consistent with the structural-property analysis (high average degree) in Appendix F.10. F.6

Peak GPU memory of attacks and defenses (RQ4)

Figure 8 reports the peak GPU memory of every attack (panel a) and every defense (panel b) on a symmetric-log y-axis, aggregated over all ten datasets. The symlog scale is necessary because the workloads span more than two orders of magnitude on the same axis: MEA0, CEGA, and the lightweight defenses sit near 0.05–0.1 GB, while MEA2, Realistic, the DFEA family, and ImperceptibleWM reach several gigabytes. Two findings supplement the time-based discussion in the main text. First, peak memory is a more discriminative signal than wall-clock time for separating attack families. The fast MEA0/1/3/4/5/CEGA group is tightly clustered around 0.05–0.15 GB across every dataset, 29

Table 28: RQ1 detailed for dataset=Photo, metric=Fidelity (%). Rows are attacks; columns are budgets. Mean ± std across seeds; best per column is bold. (b) Regime=x_only

(a) Regime=both Attack

0.05

0.10

0.25

0.50

Attack

1.00

0.05

0.10

0.25

0.50

1.00

MEA0 54.7±30.8 90.8±4.1 95.4±1.4 96.6±1.1 96.8±0.1 MEA1 1.9±0.3 39.2±26.6 42.0±29.2 62.1±33.8 67.0±37.2 MEA2 85.2±3.2 89.2±2.4 93.3±2.0 95.4±1.6 96.1±1.9 MEA3 78.3±15.0 93.9±3.0 96.5±0.8 96.9±0.9 97.8±1.0 MEA4 74.3±2.6 83.1±8.2 95.2±0.4 96.7±1.1 97.4±0.8 MEA5 80.1±6.6 92.4±0.8 95.0±2.3 95.9±0.9 97.5±0.6 AdvMEA 49.5±22.9 38.6±24.6 48.0±27.4 37.3±26.7 41.3±24.7 CEGA 80.6±5.0 83.7±15.1 91.4±6.8 95.9±1.2 90.4±9.5 Realistic 70.7±15.3 72.5±13.9 83.6±10.3 86.9±5.1 77.5±11.1 DFEA_I 92.6±3.9 93.8±1.9 91.6±4.4 91.5±4.6 91.4±4.8 DFEA_II 30.1±31.7 29.2±30.5 16.1±5.2 11.4±5.4 13.8±6.1 DFEA_III 92.9±3.0 93.3±2.5 91.8±5.2 94.2±2.3 95.4±2.4

MEA0 84.2±5.8 91.0±3.3 96.0±0.8 96.8±1.0 96.6±1.2 MEA1 1.9±0.3 39.3±26.8 42.0±29.2 62.1±33.8 67.0±37.2 MEA2 86.8±3.4 90.2±1.8 92.9±2.0 95.4±1.8 96.1±1.9 MEA3 82.4±5.2 92.6±0.8 96.1±0.7 96.3±1.1 96.7±0.8 MEA4 67.3±18.7 85.8±1.8 88.5±7.8 97.0±0.9 97.3±0.9 MEA5 81.9±13.2 94.0±1.1 96.2±0.7 96.9±1.4 97.8±0.8 AdvMEA 49.5±30.4 40.3±24.6 43.1±26.5 44.7±25.5 57.6±17.4 CEGA 85.5±7.2 86.6±5.8 83.7±7.5 94.8±2.3 95.5±2.9 Realistic 76.1±11.1 53.1±24.5 72.3±16.7 81.6±9.4 85.5±5.4 DFEA_I 93.0±3.4 93.8±1.9 91.6±4.4 91.5±4.6 91.4±4.8 DFEA_II 30.1±31.7 29.2±30.5 16.1±5.2 11.4±5.4 13.8±6.1 DFEA_III 92.9±3.0 93.3±2.5 91.8±5.2 94.2±2.3 95.4±2.4

(c) Regime=a_only

(d) Regime=data_free

Attack

0.05

0.10

0.25

0.50

Attack

1.00

MEA0 87.3±5.7 92.4±1.1 94.3±2.3 96.5±0.9 97.5±0.9 MEA1 1.9±0.3 39.1±26.5 42.0±29.2 62.1±33.8 67.0±37.2 MEA2 88.5±2.5 90.1±2.0 92.8±2.1 95.4±1.7 96.1±1.9 MEA3 81.4±3.8 92.4±2.3 95.8±1.0 96.8±0.8 97.6±0.7 MEA4 69.0±16.2 76.0±19.4 90.9±2.0 96.1±0.6 98.2±0.5 MEA5 75.2±4.1 94.2±1.4 95.9±0.5 96.8±0.7 97.7±1.1 AdvMEA 48.3±26.7 53.1±30.6 34.1±28.0 47.7±31.8 39.1±6.0 CEGA 90.6±3.9 85.5±8.8 95.4±1.1 97.3±0.8 96.4±1.8 Realistic 69.3±14.6 62.2±32.2 78.4±11.1 84.9±7.0 85.2±8.0 DFEA_I 92.9±3.6 93.8±1.9 91.6±4.4 91.5±4.6 91.4±4.8 DFEA_II 30.1±31.7 29.2±30.5 16.1±5.2 11.4±5.4 13.8±6.1 DFEA_III 92.9±3.0 93.3±2.5 91.8±5.2 94.2±2.3 95.4±2.4

0.05

0.10

0.25

0.50

1.00

MEA0 10.3±7.0 28.3±13.4 15.6±0.6 16.2±0.6 11.6±7.6 MEA1 10.3±6.6 10.3±6.6 10.3±6.6 10.3±6.6 10.3±6.6 MEA2 86.4±2.8 89.3±1.6 92.8±2.6 95.2±1.9 96.1±1.9 MEA3 21.1±19.3 10.3±7.2 5.3±7.2 6.2±7.2 14.9±0.5 MEA4 11.1±8.0 10.7±6.7 10.0±6.9 10.9±7.0 5.9±7.4 MEA5 31.9±21.7 26.9±14.6 10.1±6.4 10.3±6.5 22.2±19.2 AdvMEA 50.3±29.2 51.6±30.7 37.6±25.6 47.6±29.1 41.1±24.3 CEGA 51.7±32.2 91.0±7.8 95.9±1.0 93.8±2.4 94.2±1.4 Realistic 70.4±15.5 86.8±4.3 86.0±5.6 61.8±31.4 85.0±5.8 DFEA_I 92.9±3.5 93.8±1.9 91.6±4.4 91.5±4.6 91.4±4.8 DFEA_II 30.1±31.7 29.2±30.5 16.1±5.2 11.4±5.4 13.8±6.1 DFEA_III 92.9±3.0 93.3±2.5 91.8±5.2 94.2±2.3 95.4±2.4

Table 29: RQ1 detailed for dataset=PubMed, metric=Acc (%). Rows are attacks; columns are budgets. Mean ± std across seeds; best per column is bold. (a) Regime=both Attack

0.05

0.10

0.25

(b) Regime=x_only 0.50

Attack

1.00

0.05

0.10

0.25

0.50

1.00

MEA0 70.6±1.5 75.8±1.8 77.4±0.3 76.7±0.4 78.2±0.3 MEA1 68.6±2.3 70.6±5.0 74.8±3.4 75.3±3.5 75.5±3.9 MEA2 69.9±0.9 72.8±0.6 76.1±1.0 77.7±0.5 77.8±0.2 MEA3 72.1±1.9 73.4±1.6 76.6±0.7 79.0±1.1 77.3±1.7 MEA4 67.8±0.6 71.2±3.8 75.3±0.9 78.2±0.5 78.6±0.8 MEA5 72.3±3.4 75.9±0.1 77.8±0.8 77.8±0.7 78.1±1.1 AdvMEA 60.4±3.2 66.5±1.9 65.5±2.6 62.6±6.7 66.0±2.6 CEGA 78.3±0.4 77.9±1.6 78.2±0.2 79.1±0.2 78.7±0.7 Realistic 72.7±1.5 71.5±1.0 74.7±0.2 75.6±1.8 76.8±0.8 DFEA_I 78.2±0.2 78.5±0.3 78.5±0.2 78.4±0.4 78.7±0.2 DFEA_II 78.7±0.5 78.9±0.5 79.7±0.4 79.6±0.4 79.1±0.3 DFEA_III 78.3±0.1 78.5±0.4 78.8±0.1 78.9±0.1 78.9±0.2

MEA0 72.1±3.2 76.8±1.1 76.8±1.7 78.0±0.5 78.5±0.3 MEA1 68.6±2.3 70.6±5.0 74.8±3.4 75.3±3.5 75.5±3.9 MEA2 69.4±0.1 73.9±0.7 76.4±1.2 77.6±0.2 77.8±0.2 MEA3 73.2±1.1 75.4±1.4 77.2±0.6 77.4±0.7 78.0±0.6 MEA4 51.5±4.7 65.7±6.3 77.0±1.3 77.4±0.9 78.6±0.8 MEA5 70.6±2.8 74.5±1.0 77.0±1.4 77.7±0.5 77.5±0.9 AdvMEA 64.3±9.4 64.2±5.4 64.0±6.3 62.5±3.1 61.6±3.1 CEGA 74.8±1.2 78.7±0.7 78.7±0.4 79.1±0.2 78.9±0.3 Realistic 67.1±1.7 74.2±0.6 76.7±1.0 75.7±0.4 76.0±0.8 DFEA_I 78.2±0.2 78.5±0.3 78.5±0.2 78.4±0.4 78.7±0.2 DFEA_II 78.7±0.5 78.9±0.5 79.7±0.4 79.6±0.4 79.1±0.2 DFEA_III 78.3±0.1 78.5±0.4 78.8±0.1 78.9±0.1 78.9±0.2

(c) Regime=a_only

(d) Regime=data_free

Attack

0.05

0.10

0.25

0.50

Attack

1.00

0.05

0.10

0.25

0.50

1.00

MEA0 33.1±10.7 41.3±0.0 40.9±0.3 40.9±0.3 40.9±0.3 MEA1 41.3±0.0 41.3±0.0 41.3±0.0 41.3±0.0 41.3±0.0 MEA2 70.4±1.3 73.2±0.7 76.2±0.2 77.2±0.3 77.8±0.2 MEA3 38.3±3.8 33.3±10.8 33.5±11.0 40.9±0.3 40.9±0.3 MEA4 40.7±0.0 33.1±10.7 33.3±10.8 33.3±10.8 41.1±0.3 MEA5 18.1±0.1 40.9±0.3 26.0±10.4 25.6±10.7 41.2±0.4 AdvMEA 62.1±6.5 66.9±1.9 65.3±4.1 62.0±6.2 62.7±3.6 CEGA 75.7±2.4 78.0±1.1 78.6±0.4 78.5±0.4 78.6±0.3 Realistic 76.1±0.6 77.2±0.4 76.6±0.5 76.2±0.8 75.9±0.5 DFEA_I 78.2±0.2 78.5±0.3 78.5±0.2 78.4±0.4 78.7±0.2 DFEA_II 78.7±0.5 78.9±0.5 79.7±0.4 79.6±0.4 79.1±0.2 DFEA_III 78.3±0.1 78.5±0.4 78.8±0.1 78.9±0.1 78.9±0.2

MEA0 71.1±0.9 76.3±0.6 77.3±1.0 78.4±0.5 78.3±0.6 MEA1 68.6±2.3 70.6±5.0 74.8±3.4 75.3±3.5 75.5±3.9 MEA2 68.9±2.0 73.4±0.9 75.8±1.5 77.4±0.1 77.8±0.2 MEA3 70.7±3.4 73.8±1.3 77.7±0.4 77.6±0.4 79.1±0.5 MEA4 54.4±7.9 71.4±0.5 76.6±1.2 78.0±1.0 78.8±1.0 MEA5 72.1±3.5 76.9±1.0 77.6±1.1 77.8±0.9 77.8±0.9 AdvMEA 59.3±7.4 63.2±6.2 62.5±5.0 63.6±2.0 63.8±2.6 CEGA 74.9±2.4 77.7±1.3 78.3±0.5 78.9±0.5 78.8±0.3 Realistic 69.6±1.5 72.7±0.8 74.9±0.6 76.5±0.9 76.6±0.4 DFEA_I 78.2±0.2 78.5±0.3 78.5±0.2 78.4±0.4 78.7±0.2 DFEA_II 78.7±0.5 78.9±0.5 79.7±0.4 79.6±0.4 79.1±0.2 DFEA_III 78.3±0.1 78.5±0.4 78.8±0.1 78.9±0.1 78.9±0.2

while the data-free DFEA family and Realistic sit at 1–5 GB; the within-group variance is much smaller than the between-group gap, which means an operator who watches GPU memory can infer the attack family without timing the queries. Second, the watermarking-versus-information-limiting split is sharp on the defense panel. The five watermarking defenses (left of the dashed line) all train an in-model artefact and so allocate proportional buffers (0.1–5 GB depending on the watermarking technique), whereas the seven information-limiting defenses (right of the dashed line) are inferencetime wrappers and use less than 0.05 GB on every dataset — they essentially add no memory cost on top of the protected model itself. This explains why output-perturbation defenses are attractive in deployment: they cost nothing in memory while providing the protection summarised in the main text. 30

Table 30: RQ1 detailed for dataset=PubMed, metric=F1 (%). Rows are attacks; columns are budgets. Mean ± std across seeds; best per column is bold. (b) Regime=x_only

(a) Regime=both Attack

0.05

0.10

0.25

0.50

Attack

1.00

0.05

0.10

0.25

0.50

1.00

MEA0 68.2±2.8 74.7±1.4 76.3±0.2 76.0±0.5 77.2±0.4 MEA1 50.2±1.7 68.3±6.2 74.0±3.5 74.6±3.5 74.9±3.9 MEA2 65.4±1.0 69.5±0.5 74.4±1.2 76.7±0.6 77.2±0.3 MEA3 70.3±2.3 72.2±2.0 75.4±0.5 78.0±0.9 76.3±1.6 MEA4 64.4±3.3 66.2±7.9 73.8±0.7 76.8±0.6 77.0±0.7 MEA5 71.3±3.0 74.1±0.5 76.5±0.9 76.7±0.5 77.1±1.2 AdvMEA 55.6±1.7 65.8±2.1 64.8±2.6 60.9±8.1 63.9±1.7 CEGA 77.3±0.3 76.9±1.5 77.4±0.1 78.3±0.1 77.7±0.6 Realistic 71.9±1.0 70.6±1.2 73.9±0.1 74.6±1.7 76.2±0.7 DFEA_I 77.5±0.2 77.8±0.3 77.7±0.2 77.7±0.4 78.0±0.2 DFEA_II 78.0±0.5 78.5±0.6 79.1±0.4 79.0±0.4 78.4±0.3 DFEA_III 77.6±0.1 77.8±0.4 78.0±0.1 78.2±0.2 78.2±0.1

MEA0 70.7±4.1 75.7±0.8 75.9±1.4 77.2±0.4 77.5±0.6 MEA1 50.2±1.7 68.3±6.2 74.0±3.5 74.6±3.5 74.9±3.9 MEA2 64.3±0.6 71.1±1.1 74.9±1.1 76.9±0.6 77.2±0.3 MEA3 71.6±1.3 74.1±1.4 75.7±0.8 76.3±0.7 76.9±0.9 MEA4 46.5±5.0 62.1±7.7 75.3±1.6 75.8±0.8 77.0±0.8 MEA5 68.2±2.9 73.0±0.5 75.5±2.1 76.5±0.3 76.6±0.8 AdvMEA 62.3±11.3 63.1±5.7 61.3±6.6 59.8±2.0 60.4±2.9 CEGA 74.4±0.9 77.8±0.6 77.8±0.4 78.2±0.2 78.1±0.3 Realistic 66.1±1.2 72.6±0.3 76.1±0.8 75.3±0.4 75.4±0.7 DFEA_I 77.5±0.2 77.8±0.3 77.7±0.2 77.7±0.4 78.0±0.2 DFEA_II 78.0±0.5 78.5±0.6 79.1±0.4 79.0±0.4 78.5±0.2 DFEA_III 77.6±0.1 77.8±0.4 78.0±0.1 78.2±0.2 78.2±0.1

(c) Regime=a_only

(d) Regime=data_free

Attack

0.05

0.10

0.25

0.50

Attack

1.00

MEA0 68.6±2.2 75.3±0.5 76.0±1.3 77.4±0.5 77.5±0.4 MEA1 50.2±1.7 68.3±6.2 74.0±3.5 74.6±3.5 74.9±3.9 MEA2 63.3±2.6 70.2±1.8 74.3±1.8 76.6±0.3 77.2±0.3 MEA3 68.8±5.0 72.9±1.2 76.4±0.6 76.4±0.3 78.0±0.5 MEA4 43.5±15.2 69.3±0.5 74.9±1.6 76.5±1.1 77.2±1.0 MEA5 69.1±3.1 75.9±1.0 76.5±1.1 76.8±0.8 76.9±0.8 AdvMEA 56.1±10.3 60.4±7.9 58.8±5.1 62.0±2.4 61.8±1.8 CEGA 74.0±2.1 77.1±1.2 77.4±0.5 77.8±0.5 77.8±0.3 Realistic 69.0±0.9 71.2±1.9 74.6±0.6 75.7±0.9 76.1±0.3 DFEA_I 77.5±0.2 77.8±0.3 77.7±0.2 77.7±0.4 78.0±0.2 DFEA_II 78.0±0.4 78.5±0.6 79.1±0.4 79.0±0.4 78.5±0.2 DFEA_III 77.6±0.1 77.8±0.4 78.0±0.1 78.2±0.2 78.2±0.1

0.05

0.10

0.25

0.50

1.00

MEA0 16.2±4.3 19.5±0.0 19.4±0.1 19.4±0.1 19.4±0.1 MEA1 19.5±0.0 19.5±0.0 19.5±0.0 19.5±0.0 19.5±0.0 MEA2 65.1±0.8 69.9±0.9 74.7±0.4 76.5±0.4 77.2±0.3 MEA3 20.2±1.2 16.9±4.8 16.4±4.4 19.4±0.1 19.4±0.1 MEA4 19.3±0.0 16.2±4.3 16.3±4.3 16.3±4.3 19.4±0.1 MEA5 10.3±0.2 19.4±0.1 14.0±3.9 13.3±4.2 20.2±1.2 AdvMEA 59.5±8.3 64.7±1.6 63.6±5.3 60.1±8.6 61.3±3.4 CEGA 75.0±2.2 77.3±1.1 77.8±0.4 77.4±0.4 77.7±0.3 Realistic 75.4±0.4 76.6±0.4 75.9±0.6 75.7±0.7 75.4±0.5 DFEA_I 77.5±0.2 77.8±0.3 77.7±0.2 77.7±0.4 78.0±0.2 DFEA_II 78.0±0.5 78.5±0.6 79.1±0.4 79.0±0.4 78.5±0.2 DFEA_III 77.6±0.1 77.8±0.4 78.0±0.1 78.2±0.2 78.2±0.1

Table 31: RQ1 detailed for dataset=PubMed, metric=Fidelity (%). Rows are attacks; columns are budgets. Mean ± std across seeds; best per column is bold. (a) Regime=both Attack

0.05

0.10

0.25

(b) Regime=x_only 0.50

Attack

1.00

0.05

0.10

0.25

0.50

1.00

MEA0 80.0±0.6 87.1±2.4 90.6±1.8 92.9±0.8 94.2±0.6 MEA1 72.9±2.0 79.0±6.1 81.9±3.4 83.2±4.5 85.3±4.6 MEA2 80.5±2.0 85.3±0.2 91.3±0.6 94.5±0.7 96.8±0.3 MEA3 80.8±2.1 83.3±1.5 87.0±1.4 89.6±0.7 89.7±1.3 MEA4 71.6±1.9 77.7±4.1 83.5±1.1 87.7±0.9 89.1±0.9 MEA5 82.2±4.6 86.4±1.6 89.3±1.3 90.6±1.1 90.9±0.9 AdvMEA 63.5±6.4 70.6±3.6 69.5±4.2 65.1±8.9 69.8±4.5 CEGA 89.5±0.4 89.9±1.3 92.6±0.3 94.4±0.4 94.2±0.3 Realistic 81.2±1.3 83.5±1.1 88.1±1.0 89.5±1.6 91.4±0.8 DFEA_I 94.5±0.3 94.5±0.4 94.6±0.3 94.9±0.3 94.8±0.6 DFEA_II 89.7±1.4 91.1±1.5 92.9±1.3 93.6±1.0 93.5±1.1 DFEA_III 93.5±0.6 93.9±0.7 94.8±0.6 95.2±0.4 95.1±0.4

MEA0 82.9±0.9 87.5±1.5 91.7±0.7 92.6±0.3 93.3±1.1 MEA1 72.9±2.0 79.0±6.1 81.9±3.4 83.2±4.5 85.3±4.6 MEA2 78.4±0.8 85.8±0.6 91.6±0.0 94.8±0.4 96.8±0.3 MEA3 82.8±2.2 84.8±2.4 88.7±0.6 88.7±2.3 90.8±0.8 MEA4 52.8±4.6 72.6±5.9 86.0±1.4 87.2±1.4 89.2±0.9 MEA5 80.0±3.1 84.7±2.4 88.0±0.8 89.9±0.8 90.4±0.5 AdvMEA 67.8±11.8 66.1±8.4 65.7±8.6 65.2±6.3 64.1±5.7 CEGA 85.4±2.4 91.0±0.9 93.5±0.4 93.5±1.3 95.3±0.7 Realistic 77.6±3.0 83.8±2.8 88.1±2.9 90.8±0.9 91.7±0.4 DFEA_I 94.5±0.3 94.5±0.4 94.6±0.3 94.9±0.3 94.8±0.6 DFEA_II 89.7±1.4 91.1±1.5 92.9±1.3 93.6±1.0 93.5±1.1 DFEA_III 93.5±0.6 93.9±0.7 94.8±0.6 95.2±0.4 95.1±0.4

(c) Regime=a_only

(d) Regime=data_free

Attack

0.05

0.10

0.25

0.50

Attack

1.00

0.05

0.10

0.25

0.50

1.00

MEA0 30.7±9.8 45.5±0.5 40.0±3.6 40.0±3.6 40.0±3.6 MEA1 45.5±0.5 45.5±0.5 45.5±0.5 45.5±0.5 45.5±0.5 MEA2 78.4±1.4 84.7±0.9 91.0±0.5 94.9±0.5 96.8±0.3 MEA3 37.6±6.1 32.8±11.7 36.0±13.6 40.0±3.6 40.0±3.6 MEA4 37.7±0.5 31.0±10.0 33.7±12.4 33.4±12.1 43.2±3.6 MEA5 16.9±0.1 40.0±3.6 24.4±9.8 23.6±9.5 43.4±3.7 AdvMEA 63.9±8.6 70.4±2.9 69.9±6.7 64.5±8.3 64.1±6.5 CEGA 87.2±2.8 90.9±1.0 93.4±0.6 93.8±0.3 94.4±0.2 Realistic 92.2±1.3 92.3±0.2 92.1±1.0 91.4±0.9 92.1±1.3 DFEA_I 94.5±0.3 94.5±0.4 94.6±0.3 94.9±0.3 94.8±0.6 DFEA_II 89.7±1.4 91.1±1.5 92.9±1.3 93.6±1.0 93.5±1.1 DFEA_III 93.5±0.6 93.9±0.7 94.8±0.6 95.2±0.4 95.1±0.4

MEA0 79.6±1.8 89.5±0.4 92.7±0.9 91.8±0.5 93.4±0.6 MEA1 72.9±2.0 79.0±6.1 81.9±3.4 83.2±4.5 85.3±4.6 MEA2 77.7±2.2 84.8±0.8 91.1±0.8 94.6±0.4 96.8±0.3 MEA3 79.1±2.3 84.5±1.3 88.1±0.9 89.3±0.4 90.7±0.2 MEA4 59.3±7.1 78.5±1.7 84.9±1.5 86.8±1.5 89.2±0.9 MEA5 80.9±2.2 86.6±1.4 89.4±0.4 89.8±0.8 90.6±0.4 AdvMEA 59.0±9.8 66.2±9.0 66.4±8.2 69.1±3.4 65.6±4.6 CEGA 84.7±2.2 91.8±1.3 93.2±0.4 93.0±1.2 94.8±0.5 Realistic 79.7±2.2 82.7±2.3 89.0±0.7 91.0±1.3 92.4±1.6 DFEA_I 94.5±0.3 94.5±0.4 94.6±0.3 94.9±0.3 94.8±0.6 DFEA_II 89.7±1.3 91.0±1.4 92.9±1.3 93.6±1.0 93.5±1.1 DFEA_III 93.5±0.6 93.9±0.7 94.8±0.6 95.2±0.4 95.1±0.4

Wall-clock cost. Figure 9 aggregates total wall-clock time across all datasets for the twelve attacks (panel a) and the five watermarking defenses (panel b), again on a symmetric-log scale because the workloads span more than three orders of magnitude. The median bars and IQR error bars summarise Tables 4–5, and three patterns are sharper here than in the per-dataset tables. First, on the attack side the cost cleaves into three groups. The fast MEA family and CEGA sit between 0.7 and 2 minutes per run, the data-free DFEA family and MEA2 sit slightly above at 1–3 minutes, and only Realistic and (more variably) AdvMEA sit one to three orders of magnitude higher; the upper IQR of Realistic reaches ∼ 1000 minutes which is the largest single value in the benchmark. The cost gap is large enough that the cost–fidelity ordering is non-trivial, since RQ1 shows that simple attacks already 31

Ownership verification (%)

Utility drop (pp)

60 40 20 0

d Ran

Back

Surv

Imp

g Inte

100 always 100%

80 60 40 20 0

d

Ran

(a) Utility drop.

Back

Surv

Imp

Inte

g

(b) Ownership verification.

Figure 5: Defense effectiveness across all ten datasets: (a) utility drop and (b) ownership verification. Each box aggregates one point per (dataset, seed), giving 30 points per defense. Dataset

backdoorwm

randomwm

survivewm

imperceptiblewm

integrity

Cora CiteSeer PubMed Computers Photo CoauthorCS CoauthorPhysics

79.37 ± 0.45 64.74 ± 0.35 77.00 ± 0.59 55.39 ± 2.89 57.47 ± 2.27 69.13 ± 1.21 76.23 ± 1.03

76.06 ± 0.81 64.99 ± 0.69 73.77 ± 0.26 58.49 ± 2.93 52.15 ± 5.30 66.09 ± 6.69 57.32 ± 12.15

79.07 ± 0.33 67.47 ± 0.27 25.32 ± 1.19 37.62 ± 24.96 58.47 ± 3.84 72.75 ± 0.46 81.11 ± 0.89

71.94 ± 0.27 58.07 ± 0.79 76.00 ± 0.17 67.04 ± 1.66 61.90 ± 0.43 72.52 ± 0.73 80.50 ± 0.75

75.39 ± 0.36 57.61 ± 0.38 75.68 ± 0.37 14.08 ± 6.63 23.47 ± 21.57 73.43 ± 0.32 80.91 ± 0.81

Table 32: Defense results: F1 (mean ± std, in %). saturate near 0.25× budget. Second, the defense panel separates into a fast tier (1–60 s) and a slow tier (∼ 500 s): BackdoorWM, SurviveWM, and Integrity train in seconds, RandomWM sits one order of magnitude higher because of its independent watermark graph training, and ImperceptibleWM sits two orders of magnitude higher because of its representation-level losses. Third, the IQR error bars are narrow on every fast method and wide only on Realistic and ImperceptibleWM, which means that empirical efficiency is essentially deterministic for the recommended configurations and that the cost numbers in the per-dataset tables are reproducible across hardware. F.7

Extended statistical analysis of attack effectiveness (RQ1)

We complement the per-dataset RQ1 tables (Tables 10–31 and Tables 36–38) with eight aggregated views (Figure 10, Figure 11, and Figures 12–15) which average across datasets, regimes, or seeds to expose patterns that are hard to read off the raw tables. Full ten-dataset budget–metric grid. Figure 10 reports the budget–metric curves on all ten datasets, in the same format as the six-dataset main-text Figure 2. The four datasets which the main text omits (CiteSeer, Photo, CoauthorCS, AmazonRatings) reproduce the qualitative behaviour of the chosen six: CiteSeer and Photo track the homophilic-citation/coauthor pattern of Cora and CoauthorPhysics; CoauthorCS sits between them; and AmazonRatings reproduces the heterophilic behaviour of RomanEmpire although its ordinal 5-class label space inflates absolute fidelity. The qualitative conclusions of RQ1 therefore hold uniformly across all ten datasets. Regime sensitivity heatmap. Figure 11 reports the regime sensitivity across the standard fivebudget grid: each cell is the ratio between fidelity in a constrained regime (x_only, a_only, data_free) and fidelity in the both regime for the same attack at the same budget, aggregated over all ten datasets. The heatmap exposes two patterns. First, the left two blocks (x_only, a_only) are uniformly green at ratio ≈ 1.0 for every attack at every budget: removing one input modality is essentially a no-op for the strong attacks, because the surrogate is trained on the target’s labelled responses and label information dominates whichever single input remains. Second, the right block (data_free) is bimodal: the strong-MEA family (rows MEA0/3/4/5) drops to ratios in the 0.42–0.53 band across every budget, while AdvMEA, CEGA, Realistic, and the three DFEA variants stay at ratios around 1.0. The data-driven attacks (MEA family) collapse without a real graph because they rely on the target’s responses to real-graph queries; the data-free attacks (DFEA, Realistic) by design synthesize their own queries and so are insensitive to the absence of a real graph; CEGA and AdvMEA 32

Dataset

backdoorwm

randomwm

survivewm

imperceptiblewm

integrity

Cora CiteSeer PubMed Computers Photo CoauthorCS CoauthorPhysics

80.07 ± 0.40 67.47 ± 0.40 77.60 ± 0.79 68.27 ± 2.74 92.73 ± 1.50 88.43 ± 0.77 89.33 ± 0.37

76.13 ± 1.17 67.90 ± 0.57 74.13 ± 0.26 71.47 ± 2.49 85.33 ± 6.07 89.27 ± 2.46 68.60 ± 10.96

79.93 ± 0.26 70.87 ± 0.12 39.17 ± 1.01 45.97 ± 31.21 93.20 ± 3.89 91.70 ± 0.36 90.97 ± 0.33

71.97 ± 0.31 60.30 ± 1.00 76.37 ± 0.12 78.90 ± 0.73 96.70 ± 0.08 89.63 ± 0.76 90.20 ± 0.40

76.03 ± 0.37 60.10 ± 0.29 76.33 ± 0.38 11.97 ± 5.56 61.80 ± 20.58 90.97 ± 0.12 90.60 ± 0.65

Table 33: Defense results: Fidelity (mean ± std, in %). Dataset Cora CiteSeer PubMed Computers Photo CoauthorCS CoauthorPhysics

backdoorwm

randomwm

survivewm

imperceptiblewm

integrity

100.00 ± 0.00 100.00 ± 0.00 100.00 ± 0.00 93.33 ± 9.43 100.00 ± 0.00 100.00 ± 0.00 100.00 ± 0.00

75.33 ± 9.98 72.00 ± 4.32 64.00 ± 11.31 94.67 ± 1.89 98.67 ± 0.94 45.33 ± 3.77 56.67 ± 13.70

54.07 ± 5.79 55.72 ± 4.51 34.97 ± 0.71 11.08 ± 0.81 13.25 ± 1.10 8.51 ± 0.34 21.76 ± 0.49

100.00 ± 0.00 100.00 ± 0.00 100.00 ± 0.00 100.00 ± 0.00 100.00 ± 0.00 100.00 ± 0.00 100.00 ± 0.00

100.00 ± 0.00 100.00 ± 0.00 100.00 ± 0.00 100.00 ± 0.00 66.67 ± 47.14 33.33 ± 47.14 66.67 ± 47.14

Table 34: Defense results: Owner. verif. (WM Acc, %) (mean ± std, in %). retrain a query selector on whichever input is provided, including a synthetic graph, and so also stay near ratio 1.0. The map therefore answers a benchmark-design question: the data_free regime is the only regime that meaningfully discriminates attack families, which justifies including it in the standard RQ1 protocol despite its much lower absolute fidelity. Per-attack budget curves across all ten datasets. Figure 12 shows, for each of the twelve attacks, a small panel containing the surrogate fidelity vs. budget curve on every dataset (regime both). Three observations stand out. First, the strong data-driven attacks (MEA0, MEA1, MEA3, MEA4, MEA5, Realistic, CEGA) saturate by 0.25× on the seven small homophilic graphs, with curves that are visually indistinguishable above this budget; this is the empirical justification for using 0.25× as the medium budget in the joint evaluation of RQ5. Second, the OGBN-Arxiv curve is consistently ∼ 10–15 % below the homophilic graphs across all data-driven attacks at every budget, which is consistent with the larger label space (40 classes) and not with a budget ceiling. Third, the data-free variants (DFEA_I, DFEA_II, DFEA_III) and the noisy MEA2 have curves that are largely flat across budgets and reach high fidelity on most datasets, with DFEA_II on the high-degree product graphs (Computers and Photo) as the main outlier; this confirms that data-free extraction is broadly robust under our protocol while showing dataset-specific sensitivity. Regime sensitivity: per-attack fidelity loss when one input is removed. Figure 13a reports, per attack, the mean fidelity drop relative to the both regime when only features (x_only), only structure (a_only), or no real input (data_free) is provided to the extractor. The bars expose a clear separation: the data-driven attacks lose only a few percentage points when one modality is removed (because they still receive the target’s labels for real-graph queries), but lose 30–70 pp in the data_free regime; CEGA loses the most in a_only (its centrality-based selection becomes ill-defined without the real graph), and AdvMEA is the most robust to removing structure. Figure 13b provides the absolute view that complements these drops: it shows the absolute mean fidelity in each regime per attack, with error bars that aggregate across datasets, budgets, and seeds. The two views together motivate the four-regime protocol used in RQ1. Runtime and resource distribution across attacks. Figure 14 shows the distribution of per-run wall-clock attack time in minutes, on a log scale, aggregated across all (dataset, regime, budget, seed) combinations. Three groups separate cleanly: (i) the lightweight MEA0/MEA1/MEA3/MEA4/MEA5/CEGA family, with median runtime under one minute and tail below ten minutes, (ii) the adaptive AdvMEA and DFEA_I/II/III family in the one-to-twenty-minute band, and (iii) the heavyweight Realistic pipeline, whose tail extends two orders of magnitude above the rest because it trains an auxiliary edge-prediction model. This distributional view supplements the per-dataset time tables in the main text (Tables 4–5): the overall ordering between groups is preserved on every dataset, but the absolute magnitude scales with graph size. 33

Watermark defense profile (radar; higher = better on all axes) Fidelity

Verification

20

Utility-kept

40

60

80

100

F1

BackdoorWM ImperceptibleWM Integrity RandomWM SurviveWM

Speed

Mem-efficient

Figure 6: Radar profile of the five watermarking and integrity defenses across six axes. F1, fidelity, verification, and utility-kept come from Tables 32–34; speed and memory-efficiency are obtained from the RQ4 numbers (Tables 4–5 and Figure 8) by inverting and log-normalising to a 0–100 scale. Higher is better on every axis. No defense dominates; BackdoorWM is the largest envelope, Integrity is the only defense in the fast-and-light corner with non-trivial verification, and ImperceptibleWM pays for perfect verification with the worst speed and memory profile. Table 35: Baseline utility (test accuracy, %) for an undefended target across three backbones. Mean ± standard deviation over three seeds. Dataset Cora CiteSeer PubMed Computers Photo CoauthorCS CoauthorPhysics OGBN-Arxiv RomanEmpire AmazonRatings

GCN (DGL, hidden=16)

GraphSAGE (DGL, hidden=128)

GCN (PyG, hidden=128)

79.4 ± 0.5 67.8 ± 1.1 78.0 ± 0.6 44.6 ± 22.4 90.1 ± 4.8 87.4 ± 0.3 89.3 ± 0.4 37.7 ± 3.2 42.8 ± 0.2 41.7 ± 0.3

79.1 ± 0.3 70.1 ± 0.2 77.1 ± 0.3 59.8 ± 18.4 94.5 ± 0.5 92.9 ± 0.3 91.2 ± 0.1 54.9 ± 0.0 77.5 ± 0.5 45.5 ± 0.5

80.7 ± 0.4 70.9 ± 0.4 79.5 ± 0.2 75.2 ± 0.7 95.3 ± 0.2 90.3 ± 0.2 89.8 ± 0.2 52.3 ± 0.1 46.0 ± 0.3 43.4 ± 0.3

Inter-attack similarity across (dataset, budget) profiles. Figure 15 reports the pairwise Pearson correlation of attacks, where each attack is represented by its fifty-dimensional fidelity vector (ten datasets × five budgets, regime both). Three structural blocks emerge. The first is the strong-MEA cluster (MEA0, MEA1, MEA3, MEA4, MEA5, Realistic, and CEGA), with pairwise correlations above 0.9 and a single shared profile across datasets. The second is the data-free cluster (DFEA_I, DFEA_II, DFEA_III, plus MEA2), with correlations near 0.95 within the cluster and below 0.5 with the strongMEA cluster. The third is AdvMEA, which sits between the two clusters and correlates only weakly with both, consistent with its hybrid adaptive-query design. The block structure suggests that, for benchmarking purposes, a representative subset that contains one element from each block (for example MEA0, DFEA_I, and AdvMEA) would already capture the qualitative behaviour of the full twelve-attack set, which we leave to future work as a benchmark-design recommendation. Per-dataset utility cost of information-limiting defenses. Figure 16 reports the per-dataset utility loss of each of the seven information-limiting and query-detection defenses, computed as undefended GCN baseline accuracy minus the defended-model accuracy reported in Tables 39–40. The figure exposes three patterns that the per-row tables hide. First, the four output-perturbation/rounding defenses (OP_low, OP_high, PR_2bit, PR_top1) cost essentially nothing on the seven homophilic graphs (bars within ±3 pp of zero), which is consistent with the design intent of these defenses: they perturb the returned scores at inference time without retraining, so the underlying classifier is unchanged. Second, query-detection defenses split into two cost regimes. GradRedir stays close to the no-defense baseline on most datasets (it perturbs only flagged queries), but on Photo it costs about 23 pp because the defense’s gradient-redirection threshold flags many benign queries on the 34

Table 36: Detailed RQ1 results on RomanEmpire. Fidelity (%) at five budget multipliers across four regimes. Mean ± standard deviation over three seeds. (b) Regime=x_only

(a) Regime=both Attack

0.05

0.10

0.25

0.50

Attack

1.00

0.05

0.10

0.25

0.50

1.00

MEA0 72.9±0.4 75.9±1.7 77.0±0.8 77.2±1.5 77.4±1.5 MEA1 54.0±2.2 59.7±3.5 68.7±1.1 72.6±1.0 77.4±1.5 MEA2 27.0±0.1 34.0±1.3 47.8±0.7 49.8±1.9 32.7±9.8 MEA3 61.2±1.0 65.2±1.1 74.1±1.1 77.2±1.6 77.4±1.5 MEA4 63.6±1.0 70.9±2.1 73.3±2.6 76.0±1.1 77.4±1.5 MEA5 65.8±1.2 70.0±0.9 76.7±1.2 77.6±1.0 77.4±1.5 AdvMEA 22.0±6.5 23.5±6.5 21.9±6.2 19.1±3.3 15.7±3.7 CEGA 72.1±0.5 73.3±1.2 73.4±2.3 71.4±2.1 71.4±2.1 Realistic 53.7±2.3 57.5±2.1 58.2±1.5 57.9±1.9 75.4±1.9 DFEA_I 71.7±1.1 71.4±2.1 72.1±2.7 72.3±2.7 72.7±2.2 DFEA_II 69.2±0.7 74.9±0.5 80.8±1.0 83.3±0.4 84.3±0.3 DFEA_III 73.4±0.3 76.2±0.6 75.7±2.1 77.2±1.1 77.3±1.4

MEA0 72.5±1.1 76.5±0.6 75.8±2.6 77.4±0.6 77.4±1.5 MEA1 54.0±2.2 59.7±3.5 68.7±1.1 72.6±1.0 77.4±1.5 MEA2 26.9±0.6 33.4±0.3 47.1±1.4 47.3±2.5 32.7±9.8 MEA3 61.2±0.4 65.2±0.9 74.3±1.1 77.4±1.4 77.4±1.5 MEA4 63.8±0.4 70.9±2.1 73.4±2.6 76.0±1.1 77.4±1.5 MEA5 65.9±0.5 69.9±0.3 76.1±2.5 77.2±1.5 77.4±1.5 AdvMEA 23.2±7.3 23.0±7.1 21.5±4.3 19.3±3.8 16.2±3.9 CEGA 72.1±1.3 72.0±2.9 73.6±2.9 71.4±2.1 71.4±2.1 Realistic 54.4±1.5 56.7±1.7 58.3±2.0 57.9±2.0 75.7±1.8 DFEA_I 71.7±1.1 71.4±2.1 72.1±2.7 72.3±2.7 72.7±2.2 DFEA_II 69.2±0.7 74.9±0.5 80.8±1.0 83.3±0.4 84.3±0.3 DFEA_III 73.4±0.3 76.2±0.6 75.7±2.1 77.2±1.1 77.3±1.4

(c) Regime=a_only

(d) Regime=data_free

Attack

0.05

0.10

0.25

0.50

Attack

1.00

MEA0 73.3±0.8 75.4±0.3 77.4±0.4 77.3±1.7 77.4±1.5 MEA1 54.0±2.2 59.7±3.5 68.7±1.1 72.6±1.0 77.4±1.5 MEA2 25.5±1.2 33.7±0.2 47.7±0.8 50.5±2.1 32.7±9.8 MEA3 62.1±1.3 66.7±0.4 75.2±0.7 77.4±1.7 77.4±1.5 MEA4 63.3±1.0 70.6±2.4 73.4±2.5 76.0±1.1 77.4±1.5 MEA5 65.5±0.4 70.3±1.0 76.7±1.3 77.5±1.1 77.4±1.5 AdvMEA 22.4±6.5 22.8±5.9 20.8±6.3 17.8±4.2 15.1±4.1 CEGA 71.5±2.6 72.9±2.9 73.4±2.7 71.4±2.1 71.4±2.1 Realistic 55.3±2.2 58.1±1.0 56.8 58.1±1.9 75.7±1.7 DFEA_I 71.7±1.1 71.4±2.1 72.1±2.7 72.3±2.7 72.7±2.2 DFEA_II 69.2±0.7 74.9±0.5 80.8±1.0 83.3±0.4 84.3±0.3 DFEA_III 73.4±0.3 76.2±0.6 75.7±2.1 77.2±1.1 77.3±1.4

0.05

0.10

0.25

0.50

1.00

MEA0 72.8±1.1 74.7±1.3 76.0±1.5 76.9±2.1 77.4±1.5 MEA1 54.0±2.2 59.7±3.5 68.7±1.1 72.6±1.0 77.4±1.5 MEA2 26.4±0.5 33.8±0.8 47.4±0.5 51.1±2.1 32.7±9.8 MEA3 62.6±0.3 65.8±0.7 74.0±1.5 77.2±1.5 77.4±1.5 MEA4 63.1±1.1 71.1±1.7 73.3±2.3 75.8±1.5 77.4±1.5 MEA5 64.8±1.2 69.5±1.0 76.2±2.3 77.2±1.3 77.4±1.5 AdvMEA 23.4±6.6 23.0±7.1 21.7±6.9 18.3±4.6 15.3±4.4 CEGA 71.2±2.2 73.0±1.9 73.3±2.7 71.4±2.1 71.4±2.1 Realistic 54.4±2.3 56.3±2.4 58.3±1.4 57.8±2.5 75.6±1.6 DFEA_I 71.7±1.1 71.4±2.1 72.1±2.7 72.3±2.7 72.7±2.2 DFEA_II 69.2±0.7 74.9±0.5 80.8±1.0 83.3±0.4 84.3±0.3 DFEA_III 73.4±0.3 76.2±0.6 75.7±2.1 77.2±1.1 77.3±1.4

Table 37: Detailed RQ1 results on AmazonRatings. Fidelity (%) at five budget multipliers across four regimes. Mean ± standard deviation over three seeds. (a) Regime=both Attack

0.05

0.10

0.25

(b) Regime=x_only 0.50

Attack

1.00

0.05

0.10

0.25

0.50

1.00

MEA0 92.3±0.6 93.1±1.4 93.8±0.7 93.9±0.5 94.4±1.0 MEA1 88.8±1.0 91.9±0.5 94.2±0.6 94.8±0.7 94.4±1.0 MEA2 82.0±1.4 87.3±0.6 92.4±0.8 93.9±1.3 94.5±0.5 MEA3 88.0±0.7 91.2±1.3 93.8±1.3 94.6±1.0 94.4±1.0 MEA4 85.1±0.4 87.1±0.5 90.1±0.8 92.4±1.1 94.4±1.0 MEA5 89.9±0.6 91.4±1.1 94.7±0.9 94.5±0.9 94.4±1.0 AdvMEA 70.4±1.5 66.2±7.3 68.7±3.4 70.1±1.3 66.9±5.4 CEGA 87.1±0.9 87.3±1.2 89.1±1.2 89.7±2.0 89.7±2.0 Realistic 89.9±2.7 90.8±3.0 90.6±2.6 92.8±1.0 94.9±0.3 DFEA_I 88.6±1.1 89.2±2.3 89.6±1.7 89.6±1.4 89.4±1.3 DFEA_II 90.4±1.2 92.6±0.6 94.5±0.7 95.1±0.6 95.6±0.2 DFEA_III 92.4±0.9 93.5±1.2 94.6±0.5 94.5±0.6 94.5±0.7

MEA0 92.1±0.6 93.5±0.9 94.1±1.2 94.3±0.9 94.4±1.0 MEA1 88.8±1.0 91.9±0.5 94.1±0.7 94.8±0.7 94.4±1.0 MEA2 82.7±1.5 86.9±1.7 91.8±0.9 93.7±1.3 94.5±0.5 MEA3 87.4±2.1 90.5±1.3 93.8±0.4 94.6±1.1 94.4±1.0 MEA4 85.8±0.5 86.7±0.5 90.1±0.8 92.4±1.1 94.4±1.0 MEA5 89.1±1.4 92.0±1.2 94.4±0.6 94.2±0.9 94.4±1.0 AdvMEA 69.1±2.4 68.0±5.5 69.5±1.7 65.3±7.2 67.0±4.1 CEGA 88.2±0.7 87.4±1.1 89.5±1.7 89.7±2.0 89.7±2.0 Realistic 90.7±1.9 91.0±2.4 92.2±1.0 93.5±0.5 94.9±0.4 DFEA_I 88.6±1.1 89.2±2.3 89.6±1.7 89.6±1.4 89.4±1.3 DFEA_II 90.4±1.2 92.5±0.6 94.5±0.7 95.1±0.6 95.6±0.2 DFEA_III 92.4±1.0 93.5±1.2 94.6±0.5 94.4±0.7 94.5±0.7

(c) Regime=a_only

(d) Regime=data_free

Attack

0.05

0.10

0.25

0.50

Attack

1.00

MEA0 92.3±0.6 93.0±0.7 94.6±0.9 94.2±0.9 94.4±1.0 MEA1 88.8±1.0 91.9±0.5 94.1±0.7 94.8±0.7 94.4±1.0 MEA2 82.2±0.7 87.0±1.8 92.2±0.8 94.1±1.2 94.5±0.5 MEA3 88.6±0.1 90.7±1.2 94.0±0.9 94.7±1.1 94.4±1.0 MEA4 85.3±0.3 87.2±0.4 90.1±0.8 92.4±1.1 94.4±1.0 MEA5 89.4±0.9 91.5±1.7 94.3±0.8 94.5±1.0 94.4±1.0 AdvMEA 70.4±1.5 69.5±3.0 67.3±5.8 63.9±9.1 68.2±3.5 CEGA 87.5±1.2 88.8±1.9 88.8±2.0 89.7±2.0 89.7±2.0 Realistic 89.5±2.2 92.3±0.7 92.7±1.0 93.6±0.3 95.0±0.3 DFEA_I 88.6±1.1 89.2±2.3 89.6±1.7 89.6±1.4 89.4±1.3 DFEA_II 90.4±1.3 92.5±0.6 94.5±0.7 95.2±0.5 95.6±0.2 DFEA_III 92.4±0.9 93.5±1.3 94.6±0.5 94.5±0.6 94.5±0.7

0.05

0.10

0.25

0.50

1.00

MEA0 91.7±0.5 93.3±1.0 93.5±0.7 94.3±0.9 94.4±1.0 MEA1 88.8±1.0 91.9±0.5 94.1±0.7 94.8±0.7 94.4±1.0 MEA2 81.8±0.9 86.6±0.7 91.9±1.0 93.9±1.0 94.5±0.6 MEA3 87.9±0.5 91.0±1.5 94.0±1.0 94.6±1.0 94.4±1.0 MEA4 85.4±0.4 87.0±0.6 90.1±0.8 92.4±1.1 94.4±1.0 MEA5 89.5±1.0 91.5±1.6 94.4±0.7 94.6±0.9 94.4±1.0 AdvMEA 70.0±2.0 67.3±5.0 68.0±3.5 64.7±8.0 67.5±4.0 CEGA 87.6±1.0 87.8±1.5 89.1±1.5 89.7±2.0 89.7±2.0 Realistic 89.7±2.4 91.5±2.0 91.7±1.5 93.0±0.7 94.9±0.4 DFEA_I 88.6±1.1 89.2±2.3 89.6±1.7 89.6±1.4 89.4±1.3 DFEA_II 90.3±1.3 92.6±0.6 94.5±0.7 95.2±0.5 95.6±0.2 DFEA_III 92.4±1.0 93.5±1.2 94.6±0.5 94.4±0.7 94.5±0.7

high-degree product graph; on Computers the loss is even larger (∼ 45 pp). Third, AdaptMisinfo consistently costs 30–45 pp across every dataset, which is the highest among all seven and reflects the fact that the defense actively returns wrong labels on a large fraction of queries; users of the GraphIPBench API should treat AdaptMisinfo as a high-cost defense even when its verification proxy reaches 100 %. The plot also surfaces a useful negative finding: PRADA on RomanEmpire loses 23 pp because the heterophilic structure makes random-query rejection blunt, suggesting that PRADA’s distance-based query filter needs adaptation for graphs with low edge homophily. 35

Table 38: Detailed RQ1 results on OGBN-Arxiv. Fidelity (%) at five budget multipliers across four regimes. Mean ± standard deviation over three seeds. The 169,343-node graph requires sub-sampled edge construction at large budgets for the Realistic attack and the data-free variants. (a) Regime=both Attack

0.05

0.10

0.25

(b) Regime=x_only 0.50

Attack

1.00

0.05

0.10

0.25

0.50

1.00

MEA0 77.2±4.2 77.4±4.7 77.1±4.6 77.2±4.7 77.2±4.8 MEA1 74.2±1.2 79.0±1.3 81.7±2.9 81.6±3.4 77.2±4.8 MEA2 52.8±3.6 52.8±3.6 52.8±3.6 52.8±3.6 52.8±3.6 MEA3 64.0±4.5 66.9±5.4 74.2±5.1 77.5±4.8 77.3±4.8 MEA4 62.2±4.8 63.2±5.2 65.5±6.0 70.6±4.9 77.1±5.1 MEA5 64.9±4.1 69.5±4.8 77.2±4.8 77.6±4.4 77.3±4.8 AdvMEA 26.9±22.7 28.7±21.1 26.2±21.2 23.0±17.1 20.4±17.2 CEGA 77.9±3.0 77.7±4.1 77.4±4.6 75.5±4.2 75.5±4.2 Realistic 74.5±3.7 74.4±2.7 75.3±2.7 75.6±3.0 75.0±3.2 DFEA_I 80.7±4.5 80.8±4.6 81.0±4.2 81.1±4.0 81.0±3.9 DFEA_II 75.1±1.2 76.0±1.6 76.4±1.5 76.3±1.3 76.7±1.3 DFEA_III 76.9±4.5 77.6±4.4 77.7±4.6 77.6±4.5 77.1±4.7

MEA0 76.6±4.7 77.5±4.6 77.4±4.1 77.3±4.8 77.2±4.8 MEA1 74.2±1.2 79.0±1.2 81.7±2.9 81.6±3.4 77.3±4.8 MEA2 52.8±3.5 52.8±3.6 52.8±3.6 52.8±3.6 52.8±3.6 MEA3 64.5±4.8 67.3±4.7 74.3±4.8 77.4±4.8 77.2±4.8 MEA4 62.6±4.8 63.3±5.1 65.4±5.6 70.6±5.0 77.1±5.0 MEA5 64.8±4.6 69.4±4.8 77.2±4.8 77.5±4.7 77.2±4.8 AdvMEA 20.7±20.4 23.1±21.9 24.9±23.1 22.7±23.9 18.8±16.7 CEGA 77.6±4.9 78.0±4.8 77.1±5.1 75.5±4.2 75.5±4.2 Realistic 73.9±2.5 74.9±1.9 74.9±2.4 75.6±3.0 75.0±3.1 DFEA_I 80.7±4.5 80.7±4.7 81.0±4.2 81.1±4.0 81.0±3.9 DFEA_II 75.1±1.3 76.0±1.3 76.3±1.6 76.3±1.6 76.8±1.2 DFEA_III 76.9±4.5 77.6±4.4 77.7±4.5 77.6±4.5 77.1±4.7

(c) Regime=a_only

(d) Regime=data_free

Attack

0.05

0.10

0.25

0.50

Attack

1.00

MEA0 77.1±5.2 77.5±4.3 77.3±4.1 77.1±4.9 77.3±4.8 MEA1 74.2±1.2 79.0±1.2 81.7±2.9 81.6±3.4 77.3±4.8 MEA2 52.8±3.6 52.8±3.6 52.8±3.6 52.8±3.6 52.8±3.6 MEA3 64.1±4.7 67.9±4.9 74.5±4.9 77.5±4.4 77.3±4.8 MEA4 62.6±4.5 63.4±5.6 65.2±6.0 70.6±4.8 77.1±5.0 MEA5 65.3±4.7 69.7±4.4 77.2±4.7 77.3±4.7 77.2±4.8 AdvMEA 23.1±18.5 24.8±18.8 24.4±20.2 24.0±19.1 21.4±16.3 CEGA 77.6±4.5 77.3±4.6 76.7±4.5 75.5±4.2 75.5±4.2 Realistic 74.3±3.3 74.6±2.1 75.2±2.5 74.9±2.3 75.1±3.2 DFEA_I 80.7±4.5 80.7±4.6 81.0±4.2 81.1±4.0 81.0±3.9 DFEA_II 75.0±1.4 75.8±1.4 76.4±1.5 76.5±1.5 76.6±1.3 DFEA_III 76.9±4.5 77.6±4.4 77.7±4.5 77.6±4.5 77.1±4.8

0.05

0.10

0.25

0.50

1.00

MEA0 77.2±4.2 77.0±4.7 77.2±4.9 77.3±4.8 77.3±4.8 MEA1 74.2±1.2 79.0±1.3 81.7±2.9 81.6±3.4 77.2±4.8 MEA2 52.8±3.6 52.8±3.6 52.8±3.6 52.8±3.6 52.8±3.6 MEA3 64.4±4.8 66.9±5.0 74.4±4.8 77.4±4.7 77.2±4.8 MEA4 63.0±5.1 63.4±5.5 65.1±6.0 70.1±5.5 77.1±5.0 MEA5 65.0±4.8 69.3±5.0 77.4±4.5 77.6±4.4 77.3±4.8 AdvMEA 30.4±21.8 26.0±20.8 24.4±22.6 22.0±21.7 22.6±18.2 CEGA 77.9±4.8 77.5±4.8 76.7±4.9 75.5±4.2 75.5±4.2 Realistic 74.2±3.1 75.1±3.3 75.4±3.0 74.8±2.2 75.1±3.1 DFEA_I 80.7±4.5 80.8±4.5 81.0±4.2 81.1±4.0 81.0±3.9 DFEA_II 75.2±1.3 76.0±1.3 76.3±1.4 76.6±1.8 76.5±1.5 DFEA_III 76.9±4.5 77.7±4.3 77.7±4.6 77.7±4.5 77.1±4.7

Table 39: Detailed results for the four output-perturbation and prediction-rounding defenses across all ten datasets. Each cell reports protected-model accuracy (%) with the verification proxy (%) in parentheses, both as mean ± standard deviation over three seeds. The target backbone is a DGL GCN with hidden dimension 16. Dataset

OP_low

OP_high

PR_2bit

PR_top1

Cora 79.4±0.7 (98.6±0.7) 79.2±1.5 (93.9±1.3) 73.3±0.8 (83.7±0.1) 79.6±0.5 (100.0±0.0) CiteSeer 67.6±0.8 (97.8±0.6) 66.3±0.8 (91.0±1.5) 53.9±3.4 (70.3±5.1) 68.8±0.4 (100.0±0.0) PubMed 77.9±0.2 (99.0±0.4) 75.9±0.7 (94.7±0.3) 77.6±0.4 (93.4±1.0) 78.2±0.3 (100.0±0.0) Computers 44.0±21.1 (89.2±13.0) 37.6±27.0 (55.3±37.8) 36.1±26.4 (61.7±37.1) 34.8±23.6 (100.0±0.0) Photo 89.1±3.7 (98.9±0.5) 90.7±5.7 (96.6±3.7) 90.4±2.6 (96.7±2.1) 95.5±0.6 (100.0±0.0) CoauthorCS 87.8±0.1 (99.5±0.2) 88.2±0.7 (98.8±0.4) 87.5±0.8 (98.1±0.7) 88.1±0.7 (100.0±0.0) CoauthorPhysics 89.4±0.3 (99.8±0.2) 89.1±0.2 (99.3±0.1) 90.2±0.1 (98.7±0.4) 89.5±0.6 (100.0±0.0) OGBN-Arxiv 37.7±2.9 (95.5±0.3) 37.8±0.7 (81.2±1.0) 30.2±2.0 (59.6±3.8) 39.5±0.5 (100.0±0.0) RomanEmpire 42.7±0.3 (95.3±0.1) 40.6±1.4 (82.2±1.3) 35.2±0.7 (56.4±1.2) 42.7±0.5 (100.0±0.0) AmazonRatings 42.0±0.3 (94.8±0.6) 41.2±0.1 (80.0±0.7) 39.4±0.6 (70.6±2.8) 41.6±0.2 (100.0±0.0)

F.8

Joint evaluation and watermark survival per dataset

This subsection provides the full numerical record together with the analyses which anchor the cross-dataset claims of RQ5. We first show the consolidated Computers heatmap (Figure 17) which is referenced from the main text, and then the per-dataset tables. The tables form three groups; all values use the standard medium budget 0.25× and the mean and standard deviation are taken over three seeds. Group 1 (joint surrogate fidelity, watermarking defenses). Tables 41–45 cover all ten datasets for the five watermarking and integrity defenses (BackdoorWM, SurviveWM, Integrity, RandomWM, ImperceptibleWM). Three patterns emerge across the group. First, on the seven homophilic graphs (Cora, CiteSeer, PubMed, Computers, Photo, CoauthorCS, CoauthorPhysics) the strong data-driven attacks (MEA0, MEA1, MEA3, MEA4, MEA5, Realistic, and CEGA) reach surrogate fidelity in the 80– 95 % band against every watermark, which is within ∼ 5 pp of the undefended baseline reported in RQ1. Second, the noise-driven MEA2 and the data-free DFEA_I/II/III variants reach 65–95 % on most homophilic datasets and remain in the same band as the data-driven attacks, while degrading more sharply on the high-degree product graphs Computers and Photo (DFEA_II drops to ∼ 11–65 % there); the residual gap is largely explained by the underlying attack rather than by the defense, mirroring the RQ1 pattern against undefended targets. Third, the heterophilic and large-scale graphs 36

Table 40: Detailed results for the three query-detection defenses across all ten datasets. Each cell reports protected-model accuracy (%) with the verification proxy (%) in parentheses, both as mean ± standard deviation over three seeds. Dataset Cora CiteSeer PubMed Computers Photo CoauthorCS CoauthorPhysics OGBN-Arxiv RomanEmpire AmazonRatings

PRADA

AdaptMisinfo

GradRedir

40.2±2.1 (43.0±1.3) 69.3±0.7 (100.0±0.0) 78.0±0.7 (100.0±0.0) 46.0±18.0 (100.0±0.0) 87.0±10.6 (100.0±0.0) 75.0±0.8 (79.6±1.3) 83.4±0.7 (89.0±0.9) 37.0±0.3 (100.0±0.0) 19.7±0.2 (25.4±0.7) 41.8±0.4 (100.0±0.0)

41.0±0.1 (48.5±0.0) 39.8±0.3 (52.5±0.0) 44.1±0.8 (48.6±0.0) 28.0±13.9 (64.3±0.0) 46.3±0.4 (49.6±0.0) 52.4±0.5 (58.7±0.0) 59.0±0.2 (63.1±0.0) 19.9±0.3 (52.3±0.0) 22.5±0.4 (50.8±0.0) 33.9±0.1 (48.9±0.0)

79.8±0.2 (100.0±0.0) 68.4±0.9 (100.0±0.0) 78.3±0.5 (100.0±0.0) 52.4±20.9 (100.0±0.0) 66.6±17.6 (100.0±0.0) 88.2±0.7 (100.0±0.0) 89.7±0.3 (100.0±0.0) 38.2±1.0 (100.0±0.0) 42.5±0.3 (100.0±0.0) 41.7±0.3 (100.0±0.0)

(a) Protected-model accuracy (%)

(b) Verification proxy (%)

Cora

79

79

73

80

40

41

80

CiteSeer

68

66

54

69

69

40

68

90 80

100

99

94

84

100

43

48

100

98

91

70

100

100

52

100

90

99

95

93

100

100

49

100

80

89

55

62

100

100

64

100

PubMed

78

76

78

78

78

44

78

Computers

44

38

36

35

46

28

52

Photo

89

91

90

96

87

46

67

60

99

97

97

100

100

50

100

CoauthorCS

88

88

88

88

75

52

88

50

100

99

98

100

80

59

100

CoauthorPhysics

89

89

90

90

83

59

90

100

99

99

100

89

63

100

50

96

81

60

100

100

52

100

40

95

82

56

100

25

51

100

95

80

71

100

100

49

100

OGBN-Arxiv

38

38

30

40

37

20

38

RomanEmpire

43

41

35

43

20

22

42

AmazonRatings

42

41

39

42

42

34

42

w

_lo

OP

h

hig

_ OP

it

2b

_ PR

p1

to

_ PR

A

AD

PR

M

pt

a Ad

70

40 30 20

R

ad

Gr

OP

t R w p1 tM DA igh _2bi ad _lo ap _h _to PRA Gr PR Ad PR OP

70 60

30 20

Figure 7: Heatmap view of the seven information-limiting and query-detection defenses across all ten datasets. Left panel: protected-model accuracy (%); right panel: verification proxy (%). Numbers are the same as in Tables 39–40. The two-panel view makes explicit that verification splits into two regimes: output-perturbation/rounding defenses and GradRedir verify at high rates, whereas PRADA and AdaptMisinfo are more variable and often closer to random; protected accuracy is largely flat across defenses except on Computers. (RomanEmpire, AmazonRatings, OGBN-Arxiv) compress the spread between attacks: the strong attacks lose about 10–25 pp of absolute fidelity, while the data-free attacks gain a few points on AmazonRatings (where five ordinal classes inflate any classifier), as already observed in RQ1. Group 2 (joint surrogate fidelity, information-limiting defenses). Tables 41–48 cover all ten datasets for the seven information-limiting and query-detection defenses (OP_low, OP_high, PR_2bit, PR_top1, PRADA, AdaptMisinfo, GradRedir). Two cross-dataset patterns hold. First, the relative ordering between defenses is highly stable: PRADA and AdaptMisinfo consistently produce the largest fidelity drop relative to the undefended baseline on every dataset and every attack, while the four output-perturbation and rounding variants (OP_low, OP_high, PR_top1, GradRedir) leave fidelity within ∼ 5 pp of the undefended baseline. Second, prediction rounding to two bits (PR_2bit) is the only output-perturbation defense whose effect depends sharply on the attack: it has near-zero impact on the strong data-driven attacks (which already operate on label-like signal) but reduces MEA2 and the DFEA family by an additional 5–15 pp on most datasets, which is consistent with the link-prediction behaviour reported in Appendix F.10. Group 3 (watermark survival on the surrogate). Tables 41–50 cover all ten datasets for watermark verification on the extracted surrogate. The five watermarks split sharply across groups. The querybased Integrity fingerprint survives at 50–100 % on the data-driven attacks across most homophilic datasets and remains the strongest survivor on the heterophilic ones; the in-model marker BackdoorWM is more heterogeneous: it collapses for several data-driven attacks on Cora, but partially survives on the larger graphs (Computers, Photo, CoauthorCS) and for some DFEA variants; SurviveWM produces a stable but small (∼ 10–15 %) survival rate that does not exceed the random-guess marker on most datasets; RandomWM yields 10–20 % survival across the board, again essentially indistinguishable from random; and ImperceptibleWM drops to zero on Cora, CiteSeer, PubMed, Computers, Photo, and on every data-free attack across all datasets, with sporadic non-zero survival appearing only 37

5

10

Peak GPU mem (GB)

1 0.5

0.1 0.05

(a) Attacks: peak memory.

dR ra G

A D A

da pt M

PR

A

bi t

op 1 _t

PR

hi gh

_2

P_ O

PR

g

lo w O

P_

p Im

In te

k

rv Su

d an R

ac

I

II

_I

_I

A

A

FE

FE

D

0.1 0.05

D

c

_I

ti

A FE

D

G A E C

A

R

dv

lis

E M

E M

ea

5

A

4

A

3 M

E

A

2 M

E

A

1 M

E

A

0

A

A

E

E

M

1 0.5

0.01 0

0

M

5

B

Peak GPU mem (GB)

10

(b) Defenses: peak memory.

Figure 8: Peak GPU memory (GB) on a symmetric-log scale, aggregated across all ten datasets. Bars show median and error bars show the inter-quartile range across (dataset, seed) combinations. Panel (b) covers all twelve defenses; the dashed line separates the five watermarking defenses (Rand, Back, Surv, Imp, Integ) on the left from the seven information-limiting / query-detection defenses on the right. (a) Total attack time at 1.00 × budget

(b) Total defense time

Defense time (s, log scale)

Attack time (min, log scale)

103

102

101

100

102

101

A

ea A lis ti c D FE A _I D FE A _ D FE II A _I II

Surv

Imp

Integ

R

E

Back

E C

M dv

A

Rand

G

5 A

4

E M

3

A E M

2

A

A

E M

1

E M

A E M

M

E

A

0

100

Figure 9: Wall-clock cost summary on a log scale. (a) Total attack time (min) at 1.00× budget; bars are median and error bars are the inter-quartile range across the seven homophilic datasets. (b) Total defense time (s); same conventions. Numbers from Tables 4–5. Three groupings emerge on the attack side (fast MEA/CEGA, intermediate DFEA/MEA2, slow Realistic/AdvMEA) and two on the defense side (fast watermarks vs. ImperceptibleWM). on the heterophilic graphs. The aggregate picture is identical to the one reported in the main text Figure 17: only watermarks that anchor verification in a query-time mechanism survive extraction reliably. The figures at the end of this subsection (Figures 18a–20) provide complementary statistical views: a violin plot of survival distributions per defense, a scatter that links survival to graph-level structural properties, an empirical CDF of surrogate fidelity stratified by defense family, and a per-dataset heatmap grid for joint fidelity.

Statistical views on the joint evaluation. We complement the per-dataset tables of this subsection with four statistical figures that aggregate the same per-seed records across all 10 datasets, 12 attacks, and 5 watermarking defenses. Figure 18a shows the full distribution of watermark survival on the surrogate as a violin plot per defense; the violin shape exposes that ImperceptibleWM concentrates almost all of its mass at 0 %, that SurviveWM and RandomWM sit at a thin band around 10–20 % that does not exceed the random-guess marker on most datasets, that BackdoorWM is multi-modal with a heavy mass at 0 % and a secondary mode near 50–100 % on the larger graphs, and that Integrity is the only watermark with a substantial probability mass above 50 %. Figure 18b relates this distribution to graph structure: each marker is the mean watermark survival on one dataset for one defense, plotted against the dataset’s edge homophily; the trend lines show that BackdoorWM and Integrity have a moderate positive association between homophily and survival on the homophilic graphs, while ImperceptibleWM stays at 0 % across the homophily range and only deviates on the heterophilic graphs. 38

MEA0

Acc (%) Fidelity (%)

MEA5 100

AdvMEA

CEGA

PubMed

Realistic 100

DFEA_I

DFEA_II

Computers

DFEA_III

80

60

60

60

60

60

40

40

40

40

40

20

20

20

20

20

0

0

0

0

CoauthorCS

CoauthorPhysics

100

80

80

60

60

40

40

0

OGBNArxiv

RomanEmpire

40

AmazonRatings 42

40

40

30 30

38 20

20

36 20

0

Cora

CiteSeer

100

10

PubMed

100

Computers

100

80

80

80

80

60

60

60

60

60

40

40

40

40

40

20

20

20

20

20

0

0

0

0

CoauthorCS

80

80

60

60

40

40

20

20

0

0

Cora

100

CoauthorPhysics

100

0

OGBNArxiv

RomanEmpire

80

AmazonRatings

80 90

60

60

40

40

20

CiteSeer

100

80 70

20

PubMed

100

Computers

100

80

80

80

80

60

60

60

60

60

40

40

40

40

40

20

20

20

20

20

0

0

0

0

CoauthorCS

80

80

60

60

40

40

20

20

0

0.0

0.2

0.4

0.6

Budget ×

0.8

CoauthorPhysics

100

1.0

0

0

OGBNArxiv

15

Photo

100

80

100

Photo

100

80

100

Photo

100

80

100

Fidelity (%)

MEA4

80

0

F1 (%)

MEA3

CiteSeer

80

20

F1 (%)

MEA2

100

80

100

Acc (%)

MEA1

Cora

100

RomanEmpire

AmazonRatings

30 10

20

20 15

5

0.0

0.2

0.4

0.6

Budget ×

0.8

1.0

0

10

0.0

0.2

0.4

0.6

Budget ×

0.8

1.0

0

10 0.0

0.2

0.4

0.6

Budget ×

0.8

1.0

0.0

0.2

0.4

0.6

0.8

1.0

Budget ×

Figure 10: Budget–metric curves on all ten datasets (columns) for accuracy, fidelity, and macro F1 (rows). Lines are the twelve attacks (mean over three seeds, shaded bands ±1 std). The seven homophilic graphs share a 0–100% y-axis; OGBN-Arxiv, RomanEmpire, and AmazonRatings use per-subplot ranges since their target accuracy is bounded by intrinsic task difficulty. The six-dataset version that appears in the main text (Figure 2) is a subset of this figure.

Figure 19a shifts attention from watermark survival to surrogate fidelity. The empirical CDF of fidelity, separated by defense, makes the joint statement of RQ5 visually explicit: for every watermarking defense the fidelity CDF lies very close to the undefended baseline, with the curves crossing the 80 % mark at a similar quantile around 0.6–0.7. In other words, the fraction of (attack, dataset, seed) runs that yield a high-fidelity surrogate is essentially independent of which watermark protects the target. Figure 19b plots surrogate accuracy against surrogate fidelity to defended target as a 2D density (left) and a per-defense scatter (right). The diagonal in both panels is the line on which a surrogate’s accuracy on ground truth equals its fidelity to the protected model. Two observations follow. First, the bulk of the density lies above the diagonal, which means that on most defended targets the surrogate matches the defended model more closely than it matches ground truth; this is the expected behaviour for a black-box mimicry attack and is independent of the defense. Second, the per-defense group means cluster tightly in the high-accuracy / high-fidelity corner for every watermark and overlap with the density of Integrity, which confirms quantitatively that the choice of watermark does not move the surrogate away from the defended-model behaviour. Finally, Figure 20 renders the joint surrogate fidelity as a per-dataset heatmap grid, one 12 × 5 panel per dataset. The grid makes the cross-dataset uniformity of the picture visible at a glance: the strong-attack rows (MEA0, MEA1, MEA3, MEA4, MEA5, Realistic, CEGA) are saturated green on every homophilic dataset and remain in the orange-to-yellow range on RomanEmpire and AmazonRatings, while MEA2 and the DFEA variants form a separate block: they remain strong on many homophilic and large-scale graphs, but show visible degradation on specific high-variance product-graph settings, especially DFEA_II on Computers and Photo. The five-defense column structure is essentially repeated across the ten datasets, which is the visual analogue of the empirical-CDF and density observations above. 39

0.45

0.51

0.44

0.47

0.46

1.00

1.17

0.62

0.53

0.50

0.48

MEA2

1.01

0.99

0.99

1.00

1.00

0.98

1.02

1.00

1.01

1.00

1.00

1.00

1.00

1.01

1.00

MEA3

1.02

1.00

1.00

1.00

1.00

1.00

1.01

1.00

0.99

1.00

0.53

0.49

0.47

0.49

0.46

MEA4

0.89

0.99

1.00

1.00

1.00

0.95

1.00

0.98

0.98

1.00

0.51

0.46

0.44

0.43

0.42

MEA5

1.00

1.00

1.01

1.00

1.01

0.98

1.01

1.01

1.00

1.01

0.47

0.51

0.46

0.44

0.46

AdvMEA

0.96

1.02

1.01

0.97

1.10

0.98

1.08

0.98

0.99

0.97

1.05

1.07

0.96

0.96

1.09

CEGA

1.00

1.00

1.01

0.96

1.00

1.01

1.01

1.02

0.99

1.00

0.96

0.97

1.02

0.98

1.00

Realistic

1.02

0.99

0.99

1.02

1.03

0.98

0.99

1.00

1.00

1.03

1.09

1.04

1.00

0.95

0.97

DFEA_I

1.00

1.00

1.00

1.00

1.00

1.00

1.00

1.00

1.00

1.00

1.00

1.00

1.00

1.00

1.00

DFEA_II

1.00

1.00

1.00

1.00

1.00

1.00

1.00

1.00

1.04

1.00

1.00

1.00

1.00

1.00

1.00

DFEA_III

1.00

1.00

1.00

1.00

1.00

1.00

1.00

1.00

1.00

1.00

1.00

1.00

1.00

1.00

1.00

1.2 1.1 1.0 0.9 0.8 0.7 0.6 0.5

1.

5/ 0.

0/

f /d 25

1/ 0.

0.

0.

f /d 05

0/

0.

1.

5/

/a 0.

0.

0.

25

1/

/a 05

0/ 1.

5/ 0.

/x 0.

25

1/ 0.

05 0.

1.3

Fidelity ratio vs both

1.00

1.00

df

1.00

1.00

df

1.00

1.00

df

1.01

1.00

a

1.08

1.00

a

0.99

1.00

a

1.00

1.00

x

1.01

1.00

x

1.00

1.00

x

1.06

MEA1

/x

MEA0

Budget × / Regime

Figure 11: Regime sensitivity across budgets. Cells show the ratio between the average fidelity in a constrained regime and the average fidelity in the features-and-structure (both) regime for the same attack at the same budget; darker red indicates larger drops. The map aggregates over all ten datasets (seven homophilic plus OGBN-Arxiv, RomanEmpire, AmazonRatings) and separates dependence on features (x) and adjacency (a) from raw budget effects.

Fidelity (%)

MEA0

MEA1

Fidelity (%)

MEA3

100

100

100

80

80

80

80

60

60

60

60

40

40

40

40

20

20

20

20

0

0

0

MEA4

0

MEA5

AdvMEA

CEGA

100

100

100

100

80

80

80

80

60

60

60

60

40

40

40

40

20

20

20

20

0

0

0

Realistic

Fidelity (%)

MEA2

100

0

DFEA_I

DFEA_II

DFEA_III

100

100

100

100

80

80

80

80

60

60

60

60

40

40

40

40

20

20

20

20

0

0

0

5 0 0.00.1

5

0.2

0

0

0.5

5 0 0.00.1

1.0

5

0.2

Budget (×)

0

0

0.5

1.0

0 5 0 0.00.1

5

0.2

Budget (×)

Cora

CiteS

PubMed

Comp

0

0.5

0

1.0

5 0 0.00.1

Budget (×)

Photo

CS

Phys

OGBN-A

5

0.2

0

0.5

0

1.0

Budget (×)

RomanE

AmazR

Figure 12: Per-attack surrogate-fidelity curves on all ten datasets in the both regime. Each panel is one attack; lines are mean over three seeds at five budgets (0.05, 0.10, 0.25, 0.50, 1.00). The strong data-driven attacks (top two rows) saturate near 0.25× on the homophilic graphs; the data-free attacks (DFEA_I/II/III, bottom row) are competitive across most datasets and only degrade noticeably on the high-degree product graphs (Computers and Photo) for DFEA_II, indicating that data-free extraction is largely robust under our protocol but sensitive to specific graph structures. F.9

RQ5 watermark survival under each paper’s original setup

The headline RQ5 finding is that two graph watermarks (SurviveWM and BackdoorWM) appear to survive extraction in their source papers but reach much lower surrogate-side verification under our 12-attack joint protocol. Two reasonable rebuttals must be ruled out: (a) the gap is an artefact of our broader protocol diverging from the original setups, and (b) our re-implementations fail to embed the watermark on the protected target in the first place. This appendix runs each watermark under the original paper’s own protocol and shows that the gap survives both rebuttals. 40

Per-attack fidelity by regime, averaged over all datasets, budgets, and seeds 100

Regime features only

structure only

Regime

data-free

both

10

features only

structure only

data-free

80

Mean fidelity (%)

Mean fidelity drop vs.\ \texttt{both} (pp)

Regime sensitivity: fidelity loss when one input modality is removed 15

5 0 −5 −10

60

40

20

−15 −20 A0

ME

A1

ME

A2

ME

A3

ME

A4

A5

ME

ME

GA CE

EA

vM

Ad

_I EA

c sti

ali

Re

DF

_II

EA

DF

0

I _II

A0

ME

EA

DF

A1

ME

A2

ME

A3

ME

A4

ME

A5

ME

EA

vM

Ad

GA

CE

ali Re

sti

c

_I

EA

DF

_II

EA

DF

I _II

EA

DF

(a) Mean fidelity drop relative to the both regime, per (b) Absolute mean fidelity per attack, grouped by attack and per restricted regime. regime; error bars are ± std over (dataset, budget, seed).

Figure 13: Regime sensitivity from two complementary views: differential (left) and absolute (right). Both panels aggregate over all ten datasets, five budgets, and three seeds.

Attack wall-clock time (min, log scale)

Per-attack runtime distribution across all (dataset, regime, budget, seed) runs

101

100

10−1

10−2

A0

ME

A1

ME

A2

ME

A3

ME

A4

ME

A5

ME

EA vM

Ad

GA

CE

Re

c sti

ali

DF

_I

EA

DF

_II

EA

DF

I

_II

EA

Figure 14: Distribution of per-run attack wall-clock time (log scale, in minutes) across all (dataset, regime, budget, seed) runs. Boxes show the inter-quartile range, whiskers extend to 1.5× IQR, and dots show outlier runs. The Realistic pipeline has the longest tail because it includes an auxiliary edge-prediction model. Setup mismatch with prior watermark papers. Table 51 compares our main-text RQ5 protocol against each watermark paper’s reported setup. Both papers evaluate against a single, narrowly defined extraction attack and a different task or dataset family, while our protocol evaluates against twelve attacks on the same node-classification graphs. Any direct numerical comparison must therefore be made under either protocol’s setup, not across them. SurviveWM under the paper-faithful graph-classification protocol. We re-implement SurviveWM on the original three graph-classification datasets (MSRC-9, ENZYMES, PROTEINS) with the paper’s hyperparameters (SAGE host, L=4, hidden 160, dropout 0.05, 200 clean + 200 watermark epochs, SNNL coefficient α=0.1, key-input ratio a=0.1, Topt =20) and the paper’s effectivewatermark metric Eave , defined as the fraction of trials in which Esin (M ) > Esin (Mclean ) and Esin (M ) > Esin (Mrandom ). We use 80/20 stratified splits with ten seeds per dataset, and we evaluate the watermark against the same twelve attacks as in the main RQ5 (rather than only the samearchitecture hard-label MEA the original paper considered). Headline aggregates and per-attack numbers on the paper’s own MSRC-9 dataset are in Table 52 and Table 53. Three findings follow. First, SurviveWM’s target embedding is fully reproducible. Under the paperfaithful protocol the watermark embeds on the protected target with Eave,T =1.00 on every dataset and every attack, and the protected target’s watermark accuracy reaches 88.2% on MSRC-9 (vs. a random-classifier floor of 12.9%); the embedding step is therefore not the source of the gap. Second, surrogate survival on the same dataset is highly attack-dependent and median surrogate Eave,S never reaches the paper’s reported > 0.9. On MSRC-9, the same-architecture hard-label attacks (MEA0, MEA3, MEA4) and the structure-aware Realistic attack reach Eave,S =0.00–0.20, i.e. the watermark is completely washed out, even though the original paper’s setup is closest to MEA0. Third, an attack-regime asymmetry exists. Data-free attacks (DFEA_I/II/III) reach Eave,S =1.00 on MSRC-9 because the SNNL training step pulls the watermark distribution into a region that off-manifold synthetic queries also activate; this is the unique attack regime in which SurviveWM’s watermark survives, and it is the inverse of the data-driven setting that the paper reports. The headline finding of 41

Attack-attack correlation across (dataset, budget) profiles 1.00

0.91

0.36

0.95

0.94

0.96

0.97

0.96

0.78

-0.45

-0.41

-0.41

MEA1

0.91

1.00

0.38

0.93

0.84

0.91

0.85

0.89

0.87

-0.38

-0.37

-0.37

MEA2

0.36

0.38

1.00

0.35

0.25

0.36

0.43

0.33

0.62

0.56

0.57

0.58

MEA3

0.95

0.93

0.35

1.00

0.97

0.99

0.88

0.88

0.78

-0.43

-0.38

-0.39

MEA4

0.94

0.84

0.25

0.97

1.00

0.97

0.87

0.87

0.69

-0.52

-0.46

-0.47

MEA5

0.96

0.91

0.36

0.99

0.97

1.00

0.90

0.90

0.76

-0.42

-0.37

-0.38

AdvMEA

0.97

0.85

0.43

0.88

0.87

0.90

1.00

0.96

0.79

-0.40

-0.38

-0.37

CEGA

0.96

0.89

0.33

0.88

0.87

0.90

0.96

1.00

0.79

-0.50

-0.50

-0.49

1.00

0.75

0.50

0.25

0.00

Realistic

0.78

0.87

0.62

0.78

0.69

0.76

0.79

0.79

1.00

-0.11

-0.11

-0.10

DFEA_I

-0.45

-0.38

0.56

-0.43

-0.52

-0.42

-0.40

-0.50

-0.11

1.00

0.99

0.99

DFEA_II

-0.41

-0.37

0.57

-0.38

-0.46

-0.37

-0.38

-0.50

-0.11

0.99

1.00

1.00

DFEA_III

-0.41

-0.37

0.58

-0.39

-0.47

-0.38

-0.37

-0.49

-0.10

0.99

1.00

1.00

A0

A1

A2

A3

A4

A5

EA

−0.25

−0.50

Pearson correlation of fidelity vectors

MEA0

−0.75

−1.00

E

M

E

M

E

M

M

E

E

M

M

E

vM

Ad

I c _I III _I GA isti EA A_ EA CE eal DF DF DFE R

Figure 15: Pairwise Pearson correlation between the twelve attacks, where each attack is represented by its fifty-dimensional vector of mean fidelity over (ten datasets × five budgets) in the both regime. Two strong blocks (data-driven and data-free) and one outlier (AdvMEA) emerge. Per-dataset utility cost of the seven information-limiting and query-detection defenses

Utility loss (pp): undefended acc − defended acc

50

Defense OPlo

OPhi

PR2b

PRtop1

PRADA

AdaptM

GradR

to

CS

40

30

20

10

0

−10

a

Cor

eS

Cit

d

Me

Pub

p Com

Pho

s

Phy

BN

OG

-A

anE Rom

azR

Am

Figure 16: Per-dataset utility loss of the seven information-limiting and query-detection defenses (undefended GCN accuracy − defended accuracy, in percentage points; mean over three seeds). Output-perturbation and prediction-rounding defenses (OP_low, OP_high, PR_2bit, PR_top1) sit close to zero on the homophilic graphs, while AdaptMisinfo consistently loses 30–45 pp on every dataset because it actively returns wrong labels. RQ5 — that SurviveWM’s extracted surrogate does not preserve the watermark under a broad attack panel — therefore holds even on the paper’s own dataset and under the paper’s own metric, and the gap to the paper’s > 0.9 reflects the fact that the paper’s effective-rate result is reported only on the protected target M1 rather than on the extracted surrogate M2 .

BackdoorWM under the paper-faithful KD protocol. Xu et al. (2023) evaluate watermark transferability under same-architecture knowledge distillation: a freshly initialised GCN student is trained on the teacher’s softened logits over half of the held-out test mask. We replay this exact setup on the protocol’s default BackdoorWM configuration (trigger rate 0.01, ℓ=20 trigger feature dimensions at value 0.99, α=0.3, 100 pretrain + 200 defense epochs) with KL distillation at T =4.0 for 200 epochs, on five node-classification datasets (Computers, Photo, PubMed, CiteSeer, RomanEmpire) and five seeds each. Results in Table 54. 42

Watermark survival on surrogate

Information-limiting defenses

80

83

100

88

88

MEA0 73 63 76 82 25 53 82

MEA0

60

10

100

16

0

MEA1

78

78

100

92

88

MEA1 73 67 85 84 35 55 84

MEA1

52

10

100

15

0

MEA2

69

68

100

73

71

MEA2

70

0

100

0

0

MEA3

60

10

100

15

0

MEA4

58

10

100

15

0

MEA5

55

10

100

12

0

AdvMEA

65

10

100

12

0

CEGA

62

10

67

16

0

Realistic

5

10

13

9

0

DFEA_I

63

9

100

10

0

DFEA_II

17

10

100

11

0

10

100

16

teg

nd

84

100

89

85

82

80

100

89

86

MEA5

80

81

100

87

84

AdvMEA

49

54

100

56

42

CEGA

70

68

67

84

85

Realistic

40

34

44

44

80

DFEA_I

72

72

100

77

82

DFEA_II

46

66

100

35

49

DFEA_III

69

87

100

86

87

teg

nd

k ac

B

v ur

S

In

Ra

80

80

MEA4 78 64 77 81 31 54 84 60

40

20

60

MEA5 72 56 84 82 28 50 82 AdvMEA

43 34 45 34 23 37 28

40

Fidelity (%)

84

MEA4

MEA3 80 68 84 82 31 53 84

Fidelity (%)

MEA3

100

MEA2 62 50 72 65 27 55 64

100

CEGA 56 44 49 82 28 39 72 20

Realistic 80 76 89 84 38 57 88 DFEA_I 58 56 51 72 29 43 66

0

0

DFEA_II 38 22 52 48 18 35 48 DFEA_III 67 57 79 74 28 39 75

I

30

DFEA_III

w h it p1 A M R _lo _hig _2b _to AD apt rad OP OP PR PR PR Ad G

mp

k ac

B

S

v ur

In

Ra

100

80

60

40

Survival (%)

Watermark defenses MEA0

20

0

0

mp

I

(a) Joint fidelity vs. watermarking (b) Joint fidelity vs. information- (c) Watermark survival on the surrodefenses. limiting defenses. gate.

Figure 17: RQ5 joint evaluation on Computers at 0.25× (mean over three seeds). (a) Surrogate fidelity (%) against the five watermarks. (b) Surrogate fidelity (%) against the seven informationlimiting defenses; PRADA and AdaptMisinfo reduce the strongest attacks from 80–92% to 25–55%. (c) Watermark verification rate (%) on the extracted surrogate; Integrity survives at near 100% on most attacks, whereas SurviveWM, RandomWM, and ImperceptibleWM collapse. Watermark survival vs. graph homophily (per defense)

100

Defense

100

mean

Mean watermark survival (%)

Watermark survival on surrogate (%)

Survival distribution across all (dataset, attack, seed) runs

80

60

40

20

0

Back Surv Integ

80

Rand Imp

60

40

20

0 Back

Surv

Integ

Rand

Imp

0.3

Defense

0.4

0.5

0.6

0.7

0.8

0.9

Edge homophily of dataset

(a) Violin: distribution of watermark survival per defense across all (dataset, attack, seed) runs.

(b) Scatter: edge homophily of the dataset vs. mean watermark survival on the surrogate (one marker per dataset × defense).

Figure 18: Distribution and structural correlates of watermark survival. Two findings follow. First, the paper’s KD-transfer claim replicates where teacher training is stable. On Computers, the median KD student reaches surrogate watermark 70% versus a random-classifier floor of 2% (all five seeds rated effective); on PubMed the median is 100% versus a 20% floor. This neutralises the rebuttal that our re-implementation is unfaithful to the paper’s setup — the watermark genuinely transfers under same-architecture KD on the dataset GraphIP-Bench reports its main RQ5 result on. Second, even under the paper’s own setup, KD-style transferability is dataset-sensitive. On CiteSeer and RomanEmpire the surrogate watermark drops to 0.0% across all five seeds, even though target embedding still reaches 100%. The headline RQ5 number on Computers (55% surrogate verification) and the paper-faithful KD number on Computers (70%) are consistent: the KD recipe is the most favourable extraction setting BackdoorWM was ever evaluated against, and even there the surrogate watermark is below the protected-target 90%. The broader 12-attack benchmark therefore reports the gap rather than contradicting the paper. ‡ Caveat. Two of the five Computers seeds had the watermark joint loss (α=0.3) collapse the teacher to a constant-label predictor (TeacherAcc < 10%). Their high SurWM reflects the student trivially mimicking the constant teacher rather than genuine watermark transfer. Excluding the two collapsed seeds the Computers surrogate-watermark median is still 70% (seeds 1, 2, 4: 80, 70, 30), so the aggregate finding is unchanged. 43

Table 41: RQ5 joint evaluation on Cora at budget 0.25×. (a) Surrogate fidelity (%) on defended targets for the five watermarking defenses. (b) Surrogate fidelity (%) on defended targets for the seven information-limiting and query-detection defenses. (c) Watermark verification rate (%) on the surrogate. Mean ± standard deviation over three seeds. (a) Joint fidelity on Cora, watermarking defenses Attack

BackdoorWM

SurviveWM

Integrity

RandomWM

ImperceptibleWM

MEA0 MEA1 MEA2 MEA3 MEA4 MEA5 AdvMEA CEGA Realistic DFEA_I DFEA_II DFEA_III

92.5 ± 0.7 91.5 ± 1.3 83.9 ± 1.3 91.2 ± 1.7 91.4 ± 0.6 91.4 ± 1.6 75.6 ± 2.6 87.4 ± 2.3 91.5 ± 1.1 89.4 ± 0.5 88.6 ± 1.1 90.3 ± 0.7

92.3 ± 0.7 93.7 ± 1.1 83.8 ± 0.5 91.9 ± 0.6 91.4 ± 0.9 92.2 ± 0.9 76.8 ± 5.0 85.2 ± 2.7 90.1 ± 1.4 88.3 ± 3.2 88.9 ± 0.5 89.9 ± 0.8

91.9 ± 8.1 89.9 ± 9.8 96.8 ± 4.5 87.8 ± 12.9 94.0 ± 4.9 91.9 ± 10.2 72.3 ± 39.7 54.1 ± 51.5 72.3 ± 41.6 89.5 ± 7.4 94.5 ± 7.7 87.1 ± 2.5

91.7 ± 3.4 90.9 ± 3.7 84.1 ± 1.2 90.2 ± 3.2 89.9 ± 2.6 91.9 ± 1.7 77.6 ± 3.7 79.9 ± 5.6 91.2 ± 1.7 82.7 ± 1.2 90.0 ± 0.1 92.0 ± 1.3

92.9 ± 2.2 92.9 ± 2.3 87.5 ± 0.3 91.9 ± 3.9 91.9 ± 3.9 91.9 ± 3.9 76.4 ± 2.5 88.5 ± 2.4 91.0 ± 1.0 89.2 ± 1.8 91.3 ± 0.5 91.2 ± 1.2

(b) Joint fidelity on Cora, information-limiting and query-detection defenses Attack

OP_low

OP_high

PR_2bit

PR_top1

PRADA

AdaptMisinfo

GradRedir

MEA0 MEA1 MEA2 MEA3 MEA4 MEA5 AdvMEA CEGA Realistic DFEA_I DFEA_II DFEA_III

92.3 ± 0.4 92.0 ± 0.5 83.5 ± 1.3 91.4 ± 0.3 91.0 ± 0.7 89.9 ± 2.5 78.4 ± 1.5 87.7 ± 1.0 90.9 ± 1.4 88.8 ± 0.3 87.9 ± 0.8 88.1 ± 2.0

89.7 ± 0.5 88.9 ± 1.0 81.5 ± 0.5 89.3 ± 0.7 89.3 ± 0.8 88.6 ± 2.1 76.4 ± 1.9 86.4 ± 0.5 89.4 ± 1.4 87.2 ± 0.1 85.2 ± 0.4 86.4 ± 0.6

86.8 ± 0.1 86.2 ± 0.7 80.9 ± 0.8 84.0 ± 2.4 86.5 ± 0.6 83.2 ± 1.8 70.4 ± 0.5 81.3 ± 2.7 83.6 ± 9.9 79.5 ± 2.3 85.9 ± 0.7 84.5 ± 1.4

92.9 ± 0.3 92.4 ± 0.6 84.6 ± 1.2 91.4 ± 0.7 92.4 ± 0.6 90.3 ± 2.9 72.4 ± 3.5 91.9 ± 1.0 83.8 ± 2.6 89.2 ± 2.6 88.4 ± 0.2 90.0 ± 2.1

42.4 ± 1.4 41.4 ± 0.8 30.1 ± 1.7 44.1 ± 2.1 43.2 ± 1.2 43.3 ± 1.1 40.4 ± 1.3 40.3 ± 2.1 54.5 ± 0.9 42.4 ± 0.6 32.4 ± 2.2 39.0 ± 1.8

59.2 ± 0.2 57.7 ± 2.3 57.6 ± 1.4 56.1 ± 0.6 58.5 ± 1.2 57.4 ± 0.5 43.7 ± 1.3 55.2 ± 0.9 58.2 ± 1.0 53.8 ± 2.1 62.0 ± 2.3 57.2 ± 0.6

92.9 ± 0.3 92.4 ± 0.6 85.6 ± 1.2 91.4 ± 0.7 92.4 ± 0.6 90.3 ± 2.9 77.4 ± 1.9 89.4 ± 0.9 91.7 ± 1.0 87.1 ± 0.8 88.4 ± 0.2 90.0 ± 2.1

(c) Watermark survival on the surrogate, Cora Attack

BackdoorWM

SurviveWM

Integrity

RandomWM

ImperceptibleWM

MEA0 MEA1 MEA2 MEA3 MEA4 MEA5 AdvMEA CEGA Realistic DFEA_I DFEA_II DFEA_III

0.0 ± 0.0 0.0 ± 0.0 33.3 ± 57.7 16.7 ± 40.8 16.7 ± 40.8 50.0 ± 54.8 50.0 ± 54.8 16.7 ± 40.8 16.7 ± 40.8 66.7 ± 57.7 100.0 ± 0.0 33.3 ± 57.7

14.9 ± 2.4 14.6 ± 1.8 0.0 ± 0.0 14.2 ± 1.5 14.2 ± 1.3 13.6 ± 1.4 15.0 ± 1.4 13.7 ± 1.8 13.6 ± 1.8 14.1 ± 2.3 13.8 ± 1.9 14.0 ± 3.2

42.3 ± 36.8 20.6 ± 35.7 0.0 ± 0.0 28.6 ± 30.3 0.0 ± 0.0 11.5 ± 19.9 13.3 ± 23.1 0.0 ± 0.0 0.0 ± 0.0 37.9 ± 33.0 19.8 ± 34.2 39.3 ± 34.0

12.0 ± 2.8 18.7 ± 2.1 0.0 ± 0.0 15.3 ± 3.3 13.7 ± 2.3 13.7 ± 3.4 13.7 ± 5.9 15.7 ± 6.1 17.7 ± 8.4 14.0 ± 3.5 13.3 ± 8.3 18.0 ± 3.5

0.0 ± 0.0 0.0 ± 0.0 0.0 ± 0.0 0.0 ± 0.0 0.0 ± 0.0 0.0 ± 0.0 66.7 ± 57.7 0.0 ± 0.0 33.3 ± 57.7 0.0 ± 0.0 0.0 ± 0.0 0.0 ± 0.0

Combined statement. The two paper-faithful replays close the most credible rebuttals to the RQ5 finding. SurviveWM’s embedding step is reproducible (Eave,T =1.00 on every dataset including the paper’s own MSRC-9), but the surrogate-side Eave,S is 0.42–0.67 in median across the three datasets and reaches 0.00–0.20 on the same-architecture attacks the original paper most closely matches; the watermark survival the paper claims is therefore a target-side claim, not a surrogate-side one. BackdoorWM’s KD-transfer claim replicates on the GraphIP-Bench RQ5 dataset (Computers: surrogate WM 70% vs. 2% random floor), but is dataset-sensitive (0% on CiteSeer/RomanEmpire) even within the paper’s own setup; the broader 12-attack benchmark reports a 55% surrogate verification on Computers, which is consistent with the KD ceiling and not in tension with it. Together these results sharpen the load-bearing finding of the paper: a watermark’s reported transferability under one narrow extraction setting (same-arch hard-label MEA, or same-arch KD) does not generalise to a broader black-box extraction protocol, and ownership-tracing designs should be evaluated on the surrogate as the primary metric across attack families. F.10

Generalisation across structure, architecture, and tasks

This subsection contains the generalisation analysis which complements the five main-text research questions. We collect four complementary studies, each of which varies one dimension of the protocol 44

Table 42: Surrogate fidelity (%) on defended targets (5 watermarking defenses) for CiteSeer and PubMed. Mean ± standard deviation over three seeds. (a) CiteSeer Attack

BackdoorWM

SurviveWM

Integrity

RandomWM

ImperceptibleWM

MEA0 MEA1 MEA2 MEA3 MEA4 MEA5 AdvMEA CEGA DFEA_I DFEA_II DFEA_III Realistic

91.1 ± 1.0 90.1 ± 2.8 74.6 ± 0.6 88.2 ± 1.0 86.8 ± 2.4 86.6 ± 0.5 60.2 ± 5.6 84.7 ± 1.1 85.6 ± 1.7 85.8 ± 0.5 88.0 ± 0.9 86.7 ± 1.1

87.3 ± 2.4 87.6 ± 2.9 75.2 ± 1.2 85.6 ± 1.8 82.1 ± 6.7 85.0 ± 1.8 61.2 ± 6.0 62.8 ± 2.9 67.0 ± 5.0 85.4 ± 0.2 86.2 ± 0.8 84.2 ± 0.9

99.3 ± 1.3 100.0 ± 0.0 91.3 ± 12.3 88.1 ± 10.4 84.6 ± 7.5 93.5 ± 11.3 69.3 ± 53.2 92.7 ± 12.7 85.9 ± 10.0 89.6 ± 7.4 94.4 ± 4.0 59.0 ± 52.4

92.3 ± 3.8 91.3 ± 3.0 74.7 ± 0.8 88.6 ± 2.2 88.8 ± 1.8 88.5 ± 1.9 62.4 ± 1.9 73.9 ± 5.0 73.7 ± 8.0 88.2 ± 0.7 88.5 ± 0.9 88.7 ± 3.4

90.9 ± 0.3 91.0 ± 0.4 78.6 ± 0.9 89.1 ± 1.5 89.5 ± 1.4 89.2 ± 1.2 61.8 ± 4.8 86.7 ± 1.0 84.9 ± 1.7 90.0 ± 0.6 88.2 ± 0.7 86.3 ± 0.7

(b) PubMed Attack

BackdoorWM

SurviveWM

Integrity

RandomWM

ImperceptibleWM

MEA0 MEA1 MEA2 MEA3 MEA4 MEA5 AdvMEA CEGA DFEA_I DFEA_II DFEA_III Realistic

95.0 ± 0.8 94.8 ± 0.4 92.2 ± 1.1 93.3 ± 1.4 92.9 ± 1.8 93.3 ± 0.8 68.0 ± 2.4 94.9 ± 0.3 94.6 ± 0.7 92.9 ± 0.9 94.6 ± 0.6 93.2 ± 1.3

95.2 ± 4.9 94.9 ± 5.4 91.7 ± 3.5 89.7 ± 8.6 89.8 ± 8.2 90.7 ± 5.4 43.4 ± 42.1 98.7 ± 1.2 98.4 ± 1.0 85.3 ± 9.1 94.4 ± 4.2 35.5 ± 9.2

95.5 ± 7.7 94.9 ± 4.4 100.0 ± 0.0 92.5 ± 2.3 93.9 ± 0.1 98.0 ± 3.5 83.2 ± 19.2 61.4 ± 53.2 95.5 ± 3.2 97.0 ± 4.2 96.2 ± 2.8 92.8 ± 6.5

94.5 ± 0.3 95.3 ± 1.1 91.1 ± 1.5 93.9 ± 0.6 93.8 ± 0.3 93.5 ± 0.8 62.5 ± 5.4 93.5 ± 0.3 94.1 ± 0.4 94.2 ± 0.1 94.1 ± 0.2 91.7 ± 1.4

95.1 ± 0.5 95.0 ± 0.4 93.8 ± 0.6 94.7 ± 0.4 94.7 ± 0.4 94.7 ± 0.4 60.8 ± 2.7 95.9 ± 0.3 95.9 ± 0.3 94.3 ± 0.2 94.6 ± 0.1 93.9 ± 0.7

Distribution of surrogate fidelity (all attacks, datasets, seeds) 1.0

Pooled density across all (defense, attack, dataset, seed)

Defense Back Surv Integ

0.2

0.0

0

20

40

60

80

Surrogate fidelity to defended target (%)

Rand Imp

100

120

80

100

80 60 60 40 40 20

20

Per-defense cloud (X = group mean)

100

# runs

0.4

100

Surrogate fidelity to defended (%)

0.6

Surrogate fidelity to defended (%)

Empirical CDF

0.8

80

60

40

Defense 20

Back Surv Integ

fidelity = accuracy 0

0

20

40

60

Surrogate test accuracy (%)

80

100

0

0

20

40

60

Rand Imp

80

100

Surrogate test accuracy (%)

(a) Empirical CDF of surrogate fidelity per defense. (b) Surrogate accuracy vs. fidelity to defended target, pooled (left) and per defense (right).

Figure 19: Distributional views of surrogate fidelity. (a) shows that fidelity distributions are nearly defense-invariant; (b) shows that runs concentrate above the accuracy-equals-fidelity diagonal regardless of which watermark protects the target. at a time: graph structural properties, which separate the role of the underlying graph from the role of attack or defense design; the GNN backbone, which separates the role of model architecture from the role of attack design; the prediction task, which checks whether the same protocol transfers from node classification to link prediction and graph classification; and the query-budget grid, which checks whether the standard five-budget grid omits a relevant inflection point. Across the four studies the qualitative conclusions of the main-text experiments transfer: extraction effectiveness correlates positively with edge homophily, a backbone mismatch reduces but does not prevent successful extraction, the relative ordering of attacks is preserved across tasks, and only label-quantising or query-detection defenses substantively change surrogate fidelity on the additional tasks. Structural properties. For every dataset we compute the number of nodes and edges, the average degree, the edge density, and the edge homophily [19]; Table 58 reports all five quantities. The structural numbers connect to RQ1 and RQ5 in three concrete ways. First, fidelity at the medium budget is positively associated with edge homophily: on RomanEmpire and AmazonRatings (homophily 0.291 and 0.452), the strongest data-driven attacks reach lower fidelity than on the homophilic graphs at the same budget, which is consistent with the hypothesis that homophilic neighbourhoods make it 45

Table 43: Surrogate fidelity (%) on defended targets (5 watermarking defenses) for Computers and Photo. Mean ± standard deviation over three seeds. (a) Computers Attack

BackdoorWM

SurviveWM

Integrity

RandomWM

ImperceptibleWM

MEA0 MEA1 MEA2 MEA3 MEA4 MEA5 AdvMEA CEGA DFEA_I DFEA_II DFEA_III Realistic

80.0 ± 6.6 78.3 ± 15.8 69.3 ± 8.4 84.2 ± 4.7 82.5 ± 3.7 80.0 ± 15.5 48.7 ± 22.8 70.3 ± 16.4 71.9 ± 7.7 46.5 ± 19.9 69.3 ± 19.4 39.6 ± 30.8

82.6 ± 8.4 77.7 ± 12.4 67.6 ± 2.2 83.5 ± 10.1 80.2 ± 8.6 81.0 ± 12.2 54.5 ± 16.9 68.4 ± 27.4 71.6 ± 10.4 65.7 ± 15.8 86.7 ± 5.5 33.9 ± 31.3

99.6 ± 1.1 100.0 ± 0.0 100.0 ± 0.0 100.0 ± 0.0 100.0 ± 0.0 99.9 ± 0.3 100.0 ± 0.0 66.7 ± 50.0 100.0 ± 0.0 100.0 ± 0.0 100.0 ± 0.0 43.5 ± 44.2

88.4 ± 5.5 92.0 ± 1.7 73.0 ± 3.8 88.7 ± 6.2 89.1 ± 3.4 87.4 ± 2.8 56.0 ± 11.5 84.5 ± 10.7 76.8 ± 9.3 34.8 ± 8.1 86.1 ± 5.3 44.2 ± 17.6

88.4 ± 5.1 87.9 ± 7.7 70.8 ± 5.1 84.7 ± 12.5 85.9 ± 10.6 83.9 ± 10.1 42.1 ± 17.0 85.1 ± 8.1 81.7 ± 9.3 49.0 ± 14.2 86.7 ± 2.4 79.6 ± 6.0

(b) Photo Attack

BackdoorWM

SurviveWM

Integrity

RandomWM

ImperceptibleWM

MEA0 MEA1 MEA2 MEA3 MEA4 MEA5 AdvMEA CEGA DFEA_I DFEA_II DFEA_III Realistic

92.0 ± 4.0 91.4 ± 2.4 91.1 ± 1.4 90.0 ± 6.1 94.2 ± 1.3 94.0 ± 0.9 79.1 ± 7.0 92.1 ± 3.2 88.5 ± 7.3 42.1 ± 31.1 93.7 ± 1.9 88.5 ± 7.6

94.8 ± 1.7 96.5 ± 2.5 94.8 ± 1.0 96.1 ± 2.7 97.6 ± 0.3 96.9 ± 1.1 42.9 ± 27.4 96.2 ± 1.3 76.3 ± 27.6 22.1 ± 13.6 96.8 ± 1.1 95.0 ± 3.2

96.8 ± 5.5 96.8 ± 5.5 96.5 ± 4.9 96.8 ± 5.4 96.8 ± 5.4 96.8 ± 5.4 88.0 ± 20.7 62.4 ± 54.4 63.8 ± 45.2 100.0 ± 0.0 95.0 ± 7.0 9.7 ± 8.8

98.1 ± 0.5 93.6 ± 5.6 94.4 ± 0.6 96.8 ± 1.5 96.2 ± 3.9 97.8 ± 0.8 67.2 ± 10.7 93.2 ± 1.6 95.4 ± 0.4 23.1 ± 8.3 94.2 ± 1.3 63.4 ± 50.0

98.9 ± 0.5 98.3 ± 1.5 95.6 ± 0.5 97.8 ± 1.5 69.3 ± 48.8 97.8 ± 2.2 75.4 ± 13.4 95.7 ± 5.4 96.7 ± 1.4 65.3 ± 31.4 97.2 ± 1.0 91.7 ± 6.2

easier to learn the target’s local decision rule from a small set of queries. Second, average degree drives the variance of CEGA: its high variance on Computers coincides with the highest average degree (36.8) in the benchmark, which supports the explanation that centrality-based selection is unstable when the degree distribution is dominated by a small number of hubs. Third, scale alone does not block extraction: on OGBN-Arxiv (169,343 nodes, 40 classes) the strongest data-driven and data-free attacks reach 75–82% fidelity at 0.25×, with AdvMEA’s adversarial pipeline as the only attack that drops to ∼ 26% on the long-tailed 40-class label space (Table 38). Cross-architecture extraction (undefended targets). We vary the target backbone and the surrogate backbone independently across GCN, GAT, and GraphSAGE on four representative datasets and run MEA0 at the medium budget. Table 55 reports the 3 × 3 fidelity matrix on Computers, and Table 59 extends the matrix to Cora, OGBN-Arxiv, and RomanEmpire. The diagonal cells are typically the highest, but the off-diagonal cells remain practical: on Cora the worst off-diagonal fidelity is 83.3%, only 4 pp below the matched case, so an adversary who does not know the target backbone still extracts a useful surrogate. The matrix is also asymmetric and dataset-specific: on Computers some off-diagonal cells drop by more than 30 pp, while on Cora the loss is small. The defended-target extension in Tables 60–62 is consistent with RQ5: existing defenses do not reduce surrogate fidelity in a substantive way once we control for the target backbone. Transfer to link prediction and graph classification. We adapt the same protocol to two further tasks. For link prediction we use Cora with eleven attacks and four perturbation defenses plus a no-defense baseline; the results are in Table 56. For graph classification we use the ENZYMES and PROTEINS datasets from TUDataset [16] with six attacks and six defenses; the results are in Table 57. Two observations follow. First, the relative ordering of attacks transfers across tasks while the absolute scale changes. On link prediction the strongest attacks reach fidelity in the 90–98% range when no defense is applied, which matches the node-classification results, while MEA3 alone is markedly weaker. On graph classification the high baseline accuracy of the target on PROTEINS (67.5%) is reproduced by surrogate models with fidelity above 95% for most attacks, while ENZYMES (target accuracy 24.8%) shows a wider range. Second, prediction rounding to two bits is the only defense which yields a consistent fidelity drop across these two additional tasks. On link prediction PR_2bit reduces MEA2 and the data-free variants to about 28.9%, which equals the marginal probability of a positive edge in the test split; on ENZYMES it reduces MEA0 from 92.2% to 16.7%. Other defenses 46

Table 44: Surrogate fidelity (%) on defended targets (5 watermarking defenses) for CoauthorCS and CoauthorPhysics. Mean ± standard deviation over three seeds. (a) CoauthorCS Attack

BackdoorWM

SurviveWM

Integrity

RandomWM

ImperceptibleWM

MEA0 MEA1 MEA2 MEA3 MEA4 MEA5 AdvMEA CEGA DFEA_I DFEA_II DFEA_III Realistic

98.7 ± 0.2 98.4 ± 0.4 73.5 ± 0.8 97.4 ± 0.5 97.5 ± 0.5 97.6 ± 0.4 86.9 ± 0.8 96.2 ± 0.7 94.2 ± 0.7 92.4 ± 0.7 94.1 ± 0.4 92.5 ± 0.4

99.5 ± 0.4 99.5 ± 0.4 77.9 ± 1.8 99.0 ± 0.4 98.8 ± 0.2 98.7 ± 0.2 91.6 ± 0.5 97.2 ± 0.8 96.1 ± 0.2 94.5 ± 0.4 95.6 ± 0.4 94.6 ± 0.2

99.4 ± 1.1 98.7 ± 1.2 72.4 ± 24.5 99.1 ± 1.5 98.2 ± 1.4 98.2 ± 3.1 87.2 ± 0.5 3.7 ± 6.4 66.2 ± 38.2 95.0 ± 3.5 93.3 ± 5.6 97.4 ± 4.6

98.5 ± 1.2 98.9 ± 0.8 77.9 ± 3.4 98.5 ± 0.3 97.7 ± 1.4 98.3 ± 0.8 91.1 ± 1.6 96.4 ± 1.1 96.8 ± 0.7 94.5 ± 1.9 96.2 ± 0.4 91.7 ± 1.1

99.6 ± 0.1 99.6 ± 0.1 78.9 ± 0.4 98.9 ± 0.3 98.9 ± 0.3 98.9 ± 0.3 91.4 ± 1.6 98.6 ± 0.3 96.8 ± 0.3 95.4 ± 0.6 97.1 ± 0.5 93.5 ± 0.5

(b) CoauthorPhysics Attack

BackdoorWM

SurviveWM

Integrity

RandomWM

ImperceptibleWM

MEA0 MEA1 MEA2 MEA3 MEA4 MEA5 AdvMEA CEGA DFEA_I DFEA_II DFEA_III Realistic

99.1 ± 0.3 99.2 ± 0.4 68.4 ± 1.9 98.7 ± 0.2 98.6 ± 0.2 98.7 ± 0.3 89.4 ± 0.3 98.3 ± 0.3 97.6 ± 0.4 96.8 ± 0.6 97.0 ± 0.1 94.8 ± 1.2

99.2 ± 0.5 99.3 ± 0.4 69.2 ± 2.0 98.8 ± 0.1 98.9 ± 0.3 99.0 ± 0.3 91.9 ± 1.3 98.4 ± 0.5 98.2 ± 0.4 97.1 ± 0.3 98.1 ± 0.2 95.3 ± 0.8

98.9 ± 2.0 99.2 ± 0.6 80.6 ± 13.7 99.0 ± 0.1 99.4 ± 1.0 97.3 ± 3.0 93.5 ± 5.8 52.7 ± 49.8 97.2 ± 2.3 98.0 ± 1.4 98.4 ± 1.1 96.2 ± 3.4

98.0 ± 1.1 99.2 ± 0.1 48.5 ± 14.3 97.2 ± 1.4 98.6 ± 0.7 98.0 ± 0.9 89.0 ± 2.9 98.2 ± 0.1 97.0 ± 0.4 95.2 ± 2.0 97.2 ± 0.7 85.8 ± 2.0

99.6 ± 0.2 99.6 ± 0.2 64.7 ± 1.0 99.4 ± 0.2 99.4 ± 0.2 99.4 ± 0.2 93.2 ± 1.0 99.4 ± 0.2 98.3 ± 0.8 97.9 ± 1.0 98.0 ± 0.6 95.0 ± 0.6

largely preserve fidelity at levels comparable to the undefended baseline. The conclusion is that the joint pattern observed on node classification, in which only label-quantisation or query-detection defenses change surrogate fidelity in a substantive way, also transfers to link prediction and graph classification. Figure 21 reports the same numbers as Tables 56–57 as a three-panel heatmap: link prediction on Cora and graph classification on ENZYMES and PROTEINS. The heatmap view exposes two regularities which the per-task tables show only column by column. First, the column for PR_2bit is the only column which is uniformly dark across the three tasks: it cuts MEA2 and the DFEA family to about 28.9% on link prediction (the marginal probability of a positive edge) and to about 17% on ENZYMES, while the four sibling output-perturbation defenses (OP_low, OP_high, PR_top1, GradRedir) leave fidelity within 5 pp of the undefended baseline on every cell. This is the same label-quantisation effect identified in Appendix F.8 on node classification, and it transfers across tasks because all three target outputs are categorical. Second, the row for MEA1 is uniformly faint on ENZYMES (fidelity around 30% regardless of defense), which means the weakness is intrinsic to the attack on the small ENZYMES task rather than caused by any defense; the same attack reaches above 95% on link prediction and around 63% on PROTEINS, so the row is task-bound rather than defense-bound. The cross-task panel therefore confirms the conclusion of RQ5 in a setting where neither the protocol nor the dataset matches the original: the only defense that meaningfully reduces surrogate fidelity is the one which constrains the information content of every query, regardless of the underlying task.

Budget grid. To verify that the standard five-budget grid does not omit a relevant inflection point, we run MEA0 at three additional budgets (0.02, 0.75, 2.00) on four representative datasets; the full table is Table 63. These additional budgets do not change the qualitative conclusions of RQ1: the very small budget at 0.02× already reaches a fidelity which is close to the value at 0.05×, the medium budget at 0.75× reaches a fidelity which is close to the value at 1.00×, and the large budget at 2.00× yields a small further gain on Cora only. On RomanEmpire the curve flattens at about 64%, well below the homophilic baselines and consistent with the structural-property analysis above. The five-budget grid therefore covers the small, medium, and saturation ranges and does not omit a relevant inflection point. 47

Table 45: Surrogate fidelity (%) on defended targets (5 watermarking defenses) for OGBN-Arxiv, RomanEmpire, and AmazonRatings. Mean ± standard deviation over three seeds. (a) OGBN-Arxiv Attack

BackdoorWM

SurviveWM

Integrity

RandomWM

ImperceptibleWM

MEA0 MEA1 MEA2 MEA3 MEA4 MEA5 AdvMEA CEGA DFEA_I DFEA_II DFEA_III Realistic

76.2 ± 3.9 75.7 ± 3.2 52.8 ± 1.8 76.4 ± 3.6 76.1 ± 3.3 76.0 ± 3.5 8.2 ± 1.1 76.2 ± 2.5 79.5 ± 0.9 74.0 ± 2.4 76.4 ± 3.4 74.4 ± 1.6

67.8 ± 2.0 67.8 ± 2.0 25.8 ± 6.8 67.7 ± 2.1 67.9 ± 1.6 66.9 ± 3.2 25.8 ± 9.5 63.1 ± 3.1 65.6 ± 5.2 82.6 ± 0.5 67.7 ± 2.0 54.2 ± 4.1

90.0 ± 11.3 91.1 ± 14.4 63.3 ± 22.6 91.1 ± 15.4 67.2 ± 6.8 85.9 ± 15.9 48.0 ± 36.8 24.5 ± 38.8 28.2 ± 35.8 81.5 ± 11.1 85.3 ± 10.7 45.3 ± 39.3

80.1 ± 1.9 81.9 ± 2.5 48.4 ± 12.4 80.1 ± 3.4 81.9 ± 3.1 79.8 ± 1.5 49.0 ± 9.2 76.8 ± 3.9 82.5 ± 1.4 79.4 ± 1.8 82.6 ± 1.9 60.7 ± 14.9

78.5 ± 1.1 78.2 ± 0.8 55.8 ± 1.9 79.9 ± 0.8 78.3 ± 0.9 79.7 ± 0.8 30.7 ± 8.0 75.4 ± 1.4 82.3 ± 1.4 76.2 ± 0.1 78.2 ± 1.1 77.8 ± 3.3

(b) RomanEmpire Attack

BackdoorWM

SurviveWM

Integrity

RandomWM

ImperceptibleWM

MEA0 MEA1 MEA2 MEA3 MEA4 MEA5 AdvMEA CEGA DFEA_I DFEA_II DFEA_III Realistic

76.8 ± 0.5 76.9 ± 0.9 46.0 ± 0.7 76.9 ± 0.5 77.0 ± 0.8 77.0 ± 0.2 18.0 ± 4.1 70.8 ± 1.5 70.7 ± 1.3 80.3 ± 0.5 76.4 ± 0.6 74.1 ± 0.9

78.7 ± 0.9 78.7 ± 1.1 48.9 ± 1.6 78.6 ± 1.1 78.6 ± 1.1 78.6 ± 1.1 37.9 ± 3.7 70.7 ± 2.6 72.3 ± 2.4 80.7 ± 0.5 78.4 ± 0.6 73.4 ± 0.6

86.3 ± 15.6 82.0 ± 13.6 68.7 ± 23.6 80.4 ± 17.6 90.6 ± 13.6 83.9 ± 12.9 30.1 ± 27.3 62.5 ± 37.7 88.3 ± 16.6 91.6 ± 11.9 72.1 ± 7.3 27.8 ± 38.6

79.4 ± 2.2 79.6 ± 0.7 51.4 ± 1.6 80.0 ± 0.7 80.1 ± 2.3 79.6 ± 0.7 18.4 ± 11.2 78.3 ± 1.3 78.8 ± 1.2 84.0 ± 0.4 80.4 ± 1.1 70.7 ± 4.0

78.6 ± 1.1 78.7 ± 1.6 49.8 ± 1.6 78.6 ± 0.9 78.5 ± 1.3 78.7 ± 1.2 18.6 ± 7.5 76.8 ± 1.2 76.7 ± 0.9 81.6 ± 0.8 78.2 ± 1.6 67.3 ± 1.6

(c) AmazonRatings Attack

BackdoorWM

SurviveWM

Integrity

RandomWM

ImperceptibleWM

MEA0 MEA1 MEA2 MEA3 MEA4 MEA5 AdvMEA CEGA DFEA_I DFEA_II DFEA_III Realistic

91.4 ± 1.0 91.8 ± 1.2 86.3 ± 2.3 91.3 ± 1.3 91.8 ± 0.5 91.4 ± 0.6 41.2 ± 15.8 89.3 ± 1.3 88.8 ± 0.6 92.8 ± 0.5 91.7 ± 0.4 88.8 ± 0.7

94.1 ± 1.4 94.2 ± 1.1 91.6 ± 0.8 93.8 ± 1.4 93.8 ± 1.9 94.2 ± 1.3 47.1 ± 19.6 88.3 ± 2.0 87.2 ± 1.5 94.0 ± 0.8 94.0 ± 0.7 94.3 ± 0.9

80.8 ± 1.2 80.5 ± 1.2 92.2 ± 5.5 78.2 ± 4.0 82.7 ± 3.6 94.0 ± 10.4 60.1 ± 35.0 86.4 ± 18.2 86.3 ± 14.7 86.6 ± 1.9 100.0 ± 0.0 91.3 ± 9.9

92.7 ± 2.1 93.5 ± 2.1 91.6 ± 2.8 93.0 ± 3.1 93.6 ± 1.4 93.6 ± 1.9 47.9 ± 34.6 94.7 ± 4.0 88.0 ± 4.2 95.1 ± 0.2 93.6 ± 2.0 76.2 ± 19.0

92.6 ± 1.5 92.0 ± 1.1 87.6 ± 1.6 93.7 ± 1.1 92.8 ± 0.4 92.9 ± 0.9 58.7 ± 17.6 91.5 ± 1.3 92.9 ± 1.6 94.9 ± 0.2 92.6 ± 1.0 93.2 ± 1.8

Defended-target tables. Tables 60–62 below report the cross-architecture experiment with the same three backbones but on every defended target across the ten datasets, where the surrogate is fixed to GCN. The cross-architecture-on-defended-target tables (Tables 60–62) yield four deep observations that complement the cross-architecture analysis above. First, on the homophilic citation, coauthor, and product graphs the fidelity numbers are nearly identical across the five defenses (None, OP_low, OP_high, PR_top1, GradRedir). The within-row variation across defenses is typically ≤ 3 pp on Cora, CiteSeer, PubMed, and Photo, which means that the perturbation defenses do not reduce surrogate fidelity beyond the variation that the backbone itself introduces. The implication is that, on these datasets, the value of an information-limiting defense as a fidelity-reducing mechanism is essentially zero once we control for the target backbone. Second, the diagonal of every 3 × 3 withindefense block is the highest cell on the homophilic graphs but flips to non-diagonal on OGBN-Arxiv and RomanEmpire. On OGBN-Arxiv the ⟨GAT victim, GraphSAGE surrogate⟩ cell reaches 90.9 %, exceeding the matched ⟨GAT, GAT⟩ cell at 80.7 % by ten percentage points; on RomanEmpire the ⟨GCN victim, GraphSAGE surrogate⟩ cell reaches 82.7 %, also above the matched ⟨GCN, GCN⟩ cell at 63.1 %. This means that on large or heterophilic graphs, an attacker who guesses the wrong surrogate backbone may actually do better than one who matches the target — a counterintuitive finding that overturns the intuition that backbone matching always helps. Third, GradRedir is the only defense that consistently reduces fidelity below the no-defense baseline, and only on graphs 48

Table 46: Surrogate fidelity (%) on defended targets (7 information-limiting and query-detection defenses) for CiteSeer, PubMed, and Computers. Mean ± standard deviation over three seeds. (a) CiteSeer Attack

OP_low

OP_high

PR_2bit

PR_top1

PRADA

AdaptMisinfo

GradRedir

MEA0 MEA1 MEA2 MEA3 MEA4 MEA5 AdvMEA CEGA DFEA_I DFEA_II DFEA_III Realistic

90.3±0.7 90.3±0.7 73.9±1.0 87.6±0.8 87.6±0.8 87.6±0.8 60.3±7.4 83.6±0.5 83.5±3.5 85.0±1.1 87.8±0.3 88.1±2.0

86.2±1.3 86.2±1.3 70.3±1.4 84.0±0.9 84.0±0.9 84.0±0.9 64.0±8.3 81.1±1.1 80.8±4.0 79.2±1.5 84.2±0.3 85.3±1.3

83.2±2.0 83.2±2.0 69.3±0.2 72.5±9.1 72.5±9.1 72.5±9.1 39.0±4.2 65.4±0.2 64.5±0.9 78.4±1.0 79.1±0.4 97.6±1.4

91.6±1.0 91.6±1.0 75.5±1.3 88.5±1.6 88.5±1.6 88.5±1.6 59.7±0.7 90.9±2.0 87.7±0.5 86.1±1.9 87.8±1.2 79.6±4.7

33.5±2.8 33.5±2.8 23.5±1.8 33.6±1.3 33.6±1.3 33.6±1.3 32.4±1.5 34.4±1.8 33.3±2.6 26.1±0.9 30.5±1.7 45.5±1.8

60.3±0.5 60.3±0.5 54.9±1.4 56.2±1.3 56.2±1.3 56.2±1.3 35.9±3.1 52.1±2.0 50.4±0.8 61.1±2.0 56.8±1.9 57.5±1.7

91.6±1.0 91.6±1.0 75.1±1.2 88.5±1.6 88.5±1.6 88.5±1.6 60.5±3.1 81.2±2.2 81.2±1.2 86.1±1.9 87.8±1.2 91.2±2.7

(b) PubMed Attack

OP_low

OP_high

PR_2bit

PR_top1

PRADA

AdaptMisinfo

GradRedir

MEA0 MEA1 MEA2 MEA3 MEA4 MEA5 AdvMEA CEGA DFEA_I DFEA_II DFEA_III Realistic

94.9±0.9 94.9±0.9 91.2±0.7 92.9±1.1 92.9±1.1 92.9±1.1 67.3±12.9 94.8±0.6 94.0±0.4 92.8±0.8 94.0±0.1 95.2±0.6

92.9±0.9 92.9±0.9 89.1±1.5 91.0±1.1 91.0±1.1 91.0±1.1 64.1±5.2 92.9±1.0 92.4±0.4 90.4±1.2 92.5±0.4 94.1±0.5

94.3±1.0 94.3±1.0 91.4±0.3 93.3±1.0 93.3±1.0 93.3±1.0 70.5±5.4 92.6±0.7 93.0±0.3 93.2±1.4 94.2±1.5 89.5±0.6

94.9±0.7 94.9±0.7 91.3±1.1 93.0±0.8 93.0±0.8 93.0±0.8 67.1±6.1 94.8±0.7 94.3±0.6 92.7±1.2 94.7±0.7 92.7±0.8

59.9±1.0 59.9±1.0 53.0±0.6 59.8±1.3 59.8±1.2 59.8±1.3 48.8±3.8 59.5±1.1 58.1±1.9 55.5±1.1 59.5±0.8 70.7±2.5

62.1±0.4 62.1±0.4 62.4±1.6 61.1±0.7 61.1±0.7 61.1±0.7 45.4±4.3 60.1±0.8 60.0±0.7 67.9±1.2 61.9±0.4 63.0±1.4

94.9±0.7 94.9±0.7 91.2±0.8 93.0±0.8 93.0±0.8 93.0±0.8 72.4±10.3 94.5±0.6 94.3±0.2 92.7±1.2 94.7±0.7 94.3±0.2

(c) Computers Attack

OP_low

OP_high

PR_2bit

PR_top1

PRADA

AdaptMisinfo

GradRedir

MEA0 MEA1 MEA2 MEA3 MEA4 MEA5 AdvMEA CEGA DFEA_I DFEA_II DFEA_III Realistic

73.4±11.3 72.9±25.7 62.5±6.1 79.7±12.3 77.5±11.6 71.8±9.7 43.3±13.4 55.8±39.6 58.1±12.3 38.3±22.6 66.8±10.1 80.1±6.7

62.6±25.0 66.6±26.1 49.7±16.7 67.9±27.5 64.4±25.5 56.3±32.3 34.4±13.4 44.3±32.8 56.1±15.7 21.9±8.5 57.3±18.4 76.4±7.0

75.7±13.3 84.8±5.3 71.9±5.5 83.5±2.4 77.4±12.4 84.4±0.9 44.7±21.6 48.7±29.4 51.2±22.2 51.5±26.1 79.2±6.9 88.7±11.8

82.5±3.1 83.7±6.2 64.8±2.3 82.5±5.6 80.9±4.9 81.6±2.1 34.3±27.8 82.2±4.5 72.0±5.7 48.1±25.7 74.5±8.5 83.5±10.7

24.9±9.1 34.6±16.9 27.2±9.5 31.4±16.9 31.3±17.3 27.5±17.3 23.1±7.3 27.8±14.1 29.4±8.7 18.2±4.9 27.6±10.7 38.5±21.5

52.9±9.2 55.4±5.8 54.8±0.9 52.6±9.3 54.2±6.1 50.1±8.1 37.1±10.2 38.7±7.8 42.8±8.1 35.1±8.9 39.2±6.0 56.9±7.2

82.0±3.1 84.3±6.0 64.2±1.9 84.3±3.0 84.0±3.2 82.0±2.5 28.5±26.1 71.7±15.2 66.4±8.6 47.6±26.6 74.6±8.7 87.7±4.1

where the GCN target is itself fragile (Computers and OGBN-Arxiv); on the heterophilic graphs and on the high-utility graphs it leaves fidelity unchanged or slightly increases it, which suggests that gradient-redirection’s filter triggers more often when the target’s confidence is already volatile. Fourth, PR_top1 (top-1 label-only output) shows the largest defense-induced gain on RomanEmpire, where ⟨GCN, GCN⟩ rises from 63.1 % undefended to 71.6 % with PR_top1; this is consistent with our finding in RQ5 that on heterophilic graphs the noise in the soft scores of an undefended GCN actually hurts the surrogate, so quantizing them helps the attacker. Together, these four observations imply that practitioners cannot treat “defense” as a single axis: the protection effect of each information-limiting defense flips sign as a function of (i) the target backbone, (ii) the graph homophily, and (iii) the surrogate’s choice of backbone. The budget-grid table exposes three deep findings that the standard five-budget grid in the main text does not surface. First, the marginal value of doubling the budget collapses near 0.75×. On Cora, fidelity grows by ∼ 19 pp from 0.02× to 0.75× (68.5 → 87.5) but only by 1.2 pp from 0.75× to 2.00× (87.5 → 88.7); the same flattening appears on CiteSeer (where 2.00× even underperforms 0.75× within one standard deviation). This is direct empirical evidence that no realistic operator should query beyond ∼ 0.5–0.75× of the train set — the cost-per-pp curve becomes essentially flat. Second, the very small budget of 0.02× already extracts a non-trivial surrogate. With only 54 Cora queries the surrogate reaches 68.5 % fidelity, which is approximately 77 % of the maximum fidelity at 2.00×; this is consistent with the homophily-driven local-decision-rule hypothesis of the structural-properties analysis and quantifies an extraction floor that no current API rate-limiter is likely to defeat. Third, on RomanEmpire the curve is essentially flat across all four orders of magnitude of the budget multiplier (61.6 → 61.9 → 64.7), which is the strongest single piece of evidence that the heterophilic ceiling of ∼ 64 % is structural and not budget-driven. The observation also tightens 49

Table 47: Surrogate fidelity (%) on defended targets (7 information-limiting and query-detection defenses) for Photo, CoauthorCS, and CoauthorPhysics. Mean ± standard deviation over three seeds. (a) Photo Attack

OP_low

OP_high

PR_2bit

PR_top1

PRADA

AdaptMisinfo

GradRedir

MEA0 MEA1 MEA2 MEA3 MEA4 MEA5 AdvMEA CEGA DFEA_I DFEA_II DFEA_III Realistic

93.9±3.8 93.9±3.8 92.7±2.2 93.9±3.9 93.9±3.9 93.9±3.9 68.9±11.7 93.9±1.0 80.5±17.7 12.1±6.0 92.5±4.5 96.9±0.7

77.3±29.6 77.3±29.6 90.4±3.4 77.4±29.7 77.4±29.7 77.4±29.7 48.6±32.2 93.3±2.7 78.3±13.5 12.0±6.0 93.3±2.6 96.3±1.5

93.3±5.1 93.3±5.1 92.5±2.1 93.3±5.2 93.3±5.2 93.3±5.2 73.9±6.8 92.8±1.3 86.0±2.9 18.7±4.6 93.2±2.6 94.1±6.6

94.9±3.2 94.9±3.2 92.8±2.0 94.8±3.4 94.8±3.4 94.8±3.4 78.4±3.3 93.2±2.9 89.7±3.6 13.2±5.2 93.4±3.4 96.1±6.8

64.5±25.7 64.5±25.7 71.9±7.5 64.6±25.8 64.6±25.8 64.6±25.8 51.5±24.9 76.6±7.9 74.2±7.2 24.0±22.5 74.4±7.5 86.7±8.7

50.0±8.6 50.0±8.6 59.1±1.0 50.2±8.7 50.2±8.7 50.2±8.7 42.1±1.6 52.8±5.0 49.6±4.0 35.6±9.5 50.6±3.0 47.6±0.6

94.8±3.3 94.8±3.3 92.2±2.8 94.8±3.4 94.8±3.4 94.8±3.4 77.3±3.4 78.2±28.2 67.0±13.3 13.2±5.2 93.4±3.4 75.6±27.2

(b) CoauthorCS Attack

OP_low

OP_high

PR_2bit

PR_top1

PRADA

AdaptMisinfo

GradRedir

MEA0 MEA1 MEA2 MEA3 MEA4 MEA5 AdvMEA CEGA DFEA_I DFEA_II DFEA_III Realistic

98.8±0.2 98.8±0.2 74.3±1.0 97.7±0.2 97.6±0.2 97.7±0.2 88.2±0.9 96.5±1.0 95.1±0.8 93.1±0.4 94.6±0.2 95.3±0.6

97.8±0.4 97.8±0.4 75.8±0.8 97.0±0.2 97.0±0.2 97.0±0.2 88.5±0.8 96.2±0.7 95.1±0.5 93.1±0.2 94.2±0.6 95.0±1.0

98.8±0.2 98.8±0.2 75.4±0.8 97.9±0.2 97.9±0.2 97.9±0.2 87.7±1.4 95.9±0.7 94.0±0.4 93.7±0.9 95.1±0.6 100.0±0.0

99.0±0.0 99.0±0.0 76.1±1.2 97.9±0.1 97.9±0.1 97.9±0.1 88.3±0.6 98.8±0.1 94.4±0.2 93.9±0.9 94.9±1.1 90.8±5.3

79.8±1.4 79.9±1.4 63.1±0.2 79.7±1.4 79.8±1.4 79.8±1.4 75.4±2.0 81.3±1.1 79.0±0.4 75.8±0.3 76.8±0.4 88.4±1.5

75.1±1.4 75.2±1.4 51.7±1.8 73.0±0.2 73.1±0.1 73.0±0.1 52.9±0.6 73.5±0.7 63.6±0.3 73.2±1.8 64.6±1.4 71.6±1.2

99.0±0.0 99.0±0.0 76.3±0.4 97.9±0.1 97.9±0.1 97.9±0.1 88.2±0.7 97.8±0.5 94.0±0.3 93.9±0.9 94.9±1.1 96.5±0.7

(c) CoauthorPhysics Attack

OP_low

OP_high

PR_2bit

PR_top1

PRADA

AdaptMisinfo

GradRedir

MEA0 MEA1 MEA2 MEA3 MEA4 MEA5 AdvMEA CEGA DFEA_I DFEA_II DFEA_III Realistic

98.4±0.9 98.4±0.9 70.2±0.2 98.0±0.7 98.0±0.7 98.0±0.7 90.9±0.4 98.1±0.9 97.1±0.4 95.8±1.0 96.8±0.6 96.8±0.3

98.4±0.5 98.4±0.5 69.4±1.3 98.2±0.6 98.2±0.6 98.2±0.6 91.3±0.5 98.1±0.6 96.9±0.4 95.5±0.5 96.7±0.6 96.2±0.1

98.9±0.4 98.9±0.4 70.9±3.1 98.6±0.3 98.6±0.3 98.6±0.3 91.4±0.6 98.1±0.6 97.4±0.4 96.7±0.1 97.0±0.2 100.0±0.0

98.6±0.5 98.6±0.5 68.8±3.9 98.2±0.6 98.2±0.6 98.2±0.6 91.1±1.0 98.5±0.6 96.5±0.7 95.9±0.5 96.7±0.6 95.4±2.6

89.1±0.4 89.1±0.4 64.8±0.9 89.0±0.7 89.0±0.7 89.0±0.7 85.7±0.8 88.6±0.8 86.8±0.6 85.4±0.6 87.5±0.7 93.1±0.6

61.3±1.4 61.6±1.8 43.0±1.7 63.1±2.2 63.0±2.5 63.9±1.6 58.7±0.9 60.6±2.3 58.5±0.5 76.7±0.4 58.6±0.8 60.8±2.0

98.5±0.5 98.5±0.5 69.7±1.1 98.2±0.6 98.2±0.6 98.2±0.6 91.1±1.0 98.0±0.6 96.7±0.8 95.9±0.5 96.7±0.6 97.1±0.2

the budget-grid recommendation: the five-budget grid does not omit a relevant inflection point, and extending beyond 1.00× does not change qualitative conclusions on any of the four datasets. F.11

Defense hyperparameter ablation

To complement the protection-utility analysis in the main text, we sweep the key hyperparameter of each defense and report the protected-model accuracy together with the verification proxy on Cora and Computers. The sweep covers BackdoorWM (trigger rate), OutputPerturbation (noise scale σ), PredictionRounding (precision in bits), RandomWM (number of watermark nodes), and SurviveWM (defense ratio). Tables 64–65 report the results. The hyperparameter sweep yields three observations. First, BackdoorWM has a clean stabilityprotection split. On Cora the protected-model accuracy stays in the 77–79% range and the verification rate stays at 100% across the full trigger-rate range, while on Computers the same defense produces highly variable accuracy and protection at every setting we tested, which is consistent with the structural-property analysis in Appendix F.10. Second, OutputPerturbation and PredictionRounding show a smooth utility-verification trade-off on Cora. Smaller noise and more bits preserve both accuracy and verification, while larger noise and fewer bits reduce verification before they reduce accuracy in a substantive way. Third, RandomWM and SurviveWM are sensitive to the size of the watermark set. Increasing the number of watermark nodes or the defense ratio reduces verification on Cora from above 95% to below 35%, which suggests that larger watermark capacity dilutes the verification signal under our protocol.

50

Table 48: Surrogate fidelity (%) on defended targets (7 information-limiting and query-detection defenses) for OGBN-Arxiv, RomanEmpire, and AmazonRatings. Mean ± standard deviation over three seeds. (a) OGBN-Arxiv Attack

OP_low

OP_high

PR_2bit

PR_top1

PRADA

AdaptMisinfo

GradRedir

MEA0 MEA1 MEA2 MEA3 MEA4 MEA5 AdvMEA CEGA DFEA_I DFEA_II DFEA_III Realistic

77.3±4.5 77.3±4.5 52.4±2.9 77.3±4.5 77.3±3.7 77.3±4.5 31.6±3.7 76.2±3.9 81.5±3.0 75.7±0.9 77.7±4.1 74.1±2.5

71.9±3.5 72.0±3.6 48.1±2.4 72.0±3.6 71.9±2.9 71.9±3.6 36.5±5.8 69.5±2.7 73.6±1.8 69.3±0.3 71.8±2.7 70.0±2.6

73.7±5.2 73.8±5.3 41.9±1.9 73.8±5.3 73.8±4.3 73.7±5.2 33.8±2.8 52.6±2.2 54.4±2.0 71.1±1.4 73.5±4.8 99.8±0.1

77.8±4.7 77.9±4.8 52.8±2.9 77.9±4.8 77.9±3.9 77.9±4.8 34.2±2.5 73.5±5.4 77.3±2.5 76.2±1.2 77.7±3.8 70.4±9.6

16.1±1.0 16.1±1.0 8.9±0.1 16.1±1.0 16.1±0.8 16.1±1.0 9.8±0.6 15.7±0.8 16.0±0.6 15.4±0.9 16.1±0.8 24.7±0.9

44.1±1.7 44.1±1.8 28.9±1.5 44.1±1.7 44.1±1.4 44.1±1.7 17.1±1.6 34.8±1.1 37.0±0.5 57.3±1.4 44.7±1.8 41.4±0.6

77.9±4.8 77.9±4.8 52.8±2.9 77.9±4.8 77.9±3.9 77.9±4.8 28.8±1.6 72.0±2.5 76.5±1.9 76.2±1.2 77.8±3.7 79.9±2.2

(b) RomanEmpire Attack

OP_low

OP_high

PR_2bit

PR_top1

PRADA

AdaptMisinfo

GradRedir

MEA0 MEA1 MEA2 MEA3 MEA4 MEA5 AdvMEA CEGA DFEA_I DFEA_II DFEA_III Realistic

76.8±0.6 76.6±0.5 46.6±0.1 76.9±0.8 77.0±1.0 76.6±0.6 17.1±3.9 72.1±1.8 73.6±1.1 79.5±0.3 76.4±0.8 73.3±0.7

71.8±0.7 71.3±0.8 41.6±0.5 71.6±0.6 71.8±0.6 71.5±0.7 19.5±5.8 67.5±2.0 68.7±1.1 72.3±0.1 70.9±0.8 68.5±0.7

74.3±0.3 74.4±0.3 51.2±1.3 74.5±0.4 74.3±0.3 74.0±0.7 41.0±1.0 57.1±1.2 57.0±2.0 78.7±0.6 74.7±0.5 94.9±4.5

77.7±0.3 77.5±0.3 47.4±0.6 77.8±0.4 77.8±0.4 77.4±0.6 16.5±3.5 78.2±0.8 77.3±0.7 81.0±0.5 77.0±0.5 75.2±6.9

24.3±0.8 24.5±0.7 15.9±0.4 24.6±0.7 24.6±0.7 24.6±0.7 13.6±3.2 25.6±0.1 25.2±0.4 21.4±0.3 24.7±0.6 33.6±0.5

49.6±0.5 49.6±0.5 39.7±0.4 49.5±0.4 49.2±0.7 49.2±0.7 11.4±3.3 43.8±0.2 43.1±0.3 65.5±0.5 48.8±0.7 55.3±0.3

77.7±0.3 77.5±0.3 47.6±0.8 77.8±0.4 77.8±0.4 77.4±0.6 18.0±4.6 65.2±0.3 64.7±0.9 81.0±0.5 77.0±0.5 78.0±0.5

(c) AmazonRatings Attack

OP_low

OP_high

PR_2bit

PR_top1

PRADA

AdaptMisinfo

GradRedir

MEA0 MEA1 MEA2 MEA3 MEA4 MEA5 AdvMEA CEGA DFEA_I DFEA_II DFEA_III Realistic

91.9±0.7 91.8±0.8 88.7±0.5 91.8±0.8 91.9±0.7 91.8±0.7 42.9±24.3 87.6±2.0 88.4±2.2 91.9±0.7 91.4±1.7 92.0±0.8

78.3±0.7 78.3±0.7 71.1±4.5 78.3±0.7 78.3±0.7 78.3±0.7 40.5±21.6 76.8±1.0 76.7±1.2 77.9±1.4 78.4±1.6 79.3±0.6

90.0±0.5 89.9±0.5 90.4±0.8 90.0±0.5 90.0±0.5 90.0±0.5 55.9±1.1 69.2±3.7 73.4±2.2 88.7±0.4 90.0±0.4 100.0±0.0

94.0±1.1 94.1±1.1 91.3±1.9 94.0±1.1 94.1±1.0 94.0±1.1 44.5±23.3 94.1±1.0 93.7±0.5 94.1±0.5 93.2±1.2 65.2±15.3

33.6±0.3 33.6±0.3 31.0±0.9 33.6±0.3 33.6±0.3 33.6±0.4 29.6±3.6 34.3±0.9 32.9±0.4 29.1±0.6 33.1±0.2 43.0±0.6

63.7±0.8 63.7±0.8 62.0±0.9 63.7±0.8 63.7±0.8 63.7±0.8 27.3±10.7 52.8±1.5 51.7±0.7 77.2±1.4 63.5±0.5 64.3±0.6

94.1±1.1 94.1±1.1 90.4±0.8 94.1±1.1 94.1±1.0 94.0±1.1 47.8±21.8 93.3±0.9 92.9±0.8 94.1±0.5 93.2±1.2 94.5±0.4

Table 49: Watermark verification rate (%) on the surrogate produced by each attack against each watermarking defense, on CiteSeer, PubMed, Computers, and Photo. Higher is better. Mean ± standard deviation over three seeds. (a) CiteSeer

(b) PubMed

Attack

BackdoorWM

SurviveWM

Integrity

RandomWM

Impercept.

MEA0 MEA1 MEA2 MEA3 MEA4 MEA5 AdvMEA CEGA DFEA_I DFEA_II DFEA_III Realistic

0.0±0.0 33.3±57.7 33.3±47.1 0.0±0.0 33.3±57.7 33.3±57.7 0.0±0.0 33.3±57.7 0.0±0.0 33.3±47.1 0.0±0.0 0.0±0.0

17.5±1.4 17.7±1.9 0.0±0.0 18.8±3.0 15.9±1.3 17.5±0.8 15.1±0.5 19.0±1.4 17.9±2.0 19.1±0.9 18.3±2.8 16.4±1.8

33.3±57.7 0.0±0.0 17.5±24.7 72.8±23.6 16.6±28.7 20.1±34.8 0.0±0.0 48.3±50.1 31.3±22.3 71.5±20.2 5.2±7.4 14.8±25.6

17.3±7.6 22.0±4.0 0.0±0.0 20.7±2.3 17.3±2.3 16.7±3.1 17.3±6.1 17.3±1.2 14.0±4.9 18.0±2.8 20.0±8.6 15.3±1.2

0.0±0.0 0.0±0.0 0.0±0.0 0.0±0.0 0.0±0.0 0.0±0.0 0.0±0.0 0.0±0.0 0.0±0.0 0.0±0.0 0.0±0.0 0.0±0.0

Attack

BackdoorWM

SurviveWM

Integrity

RandomWM

Impercept.

MEA0 MEA1 MEA2 MEA3 MEA4 MEA5 AdvMEA CEGA DFEA_I DFEA_II DFEA_III Realistic

33.3±57.7 33.3±57.7 0.0±0.0 0.0±0.0 33.3±57.7 33.3±57.7 66.7±57.7 66.7±57.7 33.3±47.1 66.7±47.1 0.0±0.0 33.3±57.7

33.9±0.6 34.1±0.6 0.0±0.0 34.6±0.6 34.7±0.4 34.7±0.2 34.4±0.3 35.1±0.9 34.6±0.2 34.4±1.3 34.1±0.2 33.0±1.4

6.0±10.5 45.6±39.5 33.3±47.1 59.0±13.2 67.2±2.0 22.7±39.4 35.0±30.7 44.9±38.9 44.9±31.8 21.4±30.3 22.8±32.2 42.5±37.0

36.0±6.0 36.7±1.2 0.0±0.0 42.7±6.4 34.7±6.4 30.7±9.2 30.7±2.3 37.3±5.0 38.7±5.0 36.7±3.4 42.7±4.1 32.7±5.0

66.7±57.7 66.7±57.7 0.0±0.0 100.0±0.0 100.0±0.0 100.0±0.0 38.9±53.6 66.7±57.7 66.7±47.1 100.0±0.0 66.7±47.1 100.0±0.0

(c) Computers

(d) Photo

Attack

BackdoorWM

SurviveWM

Integrity

RandomWM

Impercept.

MEA0 MEA1 MEA2 MEA3 MEA4 MEA5 AdvMEA CEGA DFEA_I DFEA_II DFEA_III Realistic

60.0±20.0 51.7±35.4 70.0±24.5 60.0±21.9 58.3±30.6 55.0±27.4 65.0±26.6 61.7±33.1 63.3±12.5 16.7±23.6 30.0±35.6 5.0±8.4

9.9±0.6 9.6±0.8 0.0±0.0 10.0±0.7 10.1±0.6 10.2±0.9 10.4±0.6 9.8±0.7 9.2±0.8 9.7±0.1 10.5±0.4 10.2±0.9

100.0±0.0 100.0±0.0 100.0±0.0 100.0±0.0 100.0±0.0 100.0±0.0 100.0±0.0 66.7±57.7 100.0±0.0 100.0±0.0 100.0±0.0 13.2±18.7

15.7±5.6 15.3±5.3 0.0±0.0 14.7±7.8 14.7±3.7 12.0±2.5 12.3±6.1 16.0±5.4 10.0±0.0 10.7±2.5 16.0±2.8 9.0±3.9

0.0±0.0 0.0±0.0 0.0±0.0 0.0±0.0 0.0±0.0 0.0±0.0 0.0±0.0 0.0±0.0 0.0±0.0 0.0±0.0 0.0±0.0 0.0±0.0

51

Attack

BackdoorWM

SurviveWM

Integrity

RandomWM

Impercept.

MEA0 MEA1 MEA2 MEA3 MEA4 MEA5 AdvMEA CEGA DFEA_I DFEA_II DFEA_III Realistic

33.3±7.2 54.2±19.1 66.7±11.8 29.2±7.2 50.0±25.0 58.3±7.2 62.5±33.1 50.0±21.7 25.0±20.4 45.8±41.2 45.8±21.2 16.7±7.2

12.3±0.3 12.7±1.1 0.0±0.0 12.4±0.9 12.3±0.8 12.3±0.8 12.2±0.6 12.1±0.3 12.1±0.3 12.5±0.6 12.2±0.3 12.6±0.7

90.1±17.1 90.1±17.1 89.2±15.3 90.2±17.0 90.2±17.0 90.2±17.0 84.8±26.3 54.8±50.7 56.6±41.9 66.7±47.1 87.7±17.4 15.3±21.4

17.3±4.2 10.0±4.0 0.0±0.0 14.0±2.0 12.7±4.2 14.7±2.3 18.0±2.0 16.0±2.0 17.3±1.9 19.3±2.5 12.0±3.3 12.7±3.1

0.0±0.0 0.0±0.0 0.0±0.0 0.0±0.0 0.0±0.0 33.3±57.7 0.0±0.0 0.0±0.0 0.0±0.0 0.0±0.0 0.0±0.0 0.0±0.0

Table 50: Watermark verification rate (%) on the surrogate produced by each attack against each watermarking defense, on CoauthorCS, CoauthorPhysics, RomanEmpire, and AmazonRatings. Higher is better. Mean ± standard deviation over three seeds. (a) CoauthorCS

(b) CoauthorPhysics

Attack

BackdoorWM

SurviveWM

Integrity

RandomWM

Impercept.

Attack

BackdoorWM

SurviveWM

Integrity

RandomWM

Impercept.

MEA0 MEA1 MEA2 MEA3 MEA4 MEA5 AdvMEA CEGA DFEA_I DFEA_II DFEA_III Realistic

42.2±20.4 55.6±10.2 35.6±8.3 48.9±16.8 44.4±13.9 53.3±20.0 11.1±10.2 37.8±20.4 40.0±9.4 33.3±5.4 42.2±11.3 2.2±3.8

7.2±0.2 7.0±0.3 0.0±0.0 7.1±0.4 7.1±0.3 6.9±0.4 7.3±0.8 7.0±0.4 6.9±0.3 6.5±0.3 6.8±0.3 6.7±0.3

61.2±53.6 54.9±47.6 60.4±29.3 27.0±46.8 54.5±47.2 25.9±44.9 57.9±1.0 0.0±0.0 46.7±33.1 78.3±15.5 45.2±32.6 88.7±19.6

9.3±1.2 10.0±4.0 0.0±0.0 7.3±4.2 6.0±2.0 4.7±5.0 4.7±2.3 9.3±6.1 12.0±3.3 6.7±2.5 9.3±0.9 6.0±3.5

33.3±57.7 33.3±57.7 0.0±0.0 33.3±57.7 33.3±57.7 33.3±57.7 0.0±0.0 33.3±57.7 0.0±0.0 0.0±0.0 0.0±0.0 0.0±0.0

MEA0 MEA1 MEA2 MEA3 MEA4 MEA5 AdvMEA CEGA DFEA_I DFEA_II DFEA_III Realistic

80.0±20.0 53.3±11.5 26.7±18.9 53.3±11.5 66.7±30.6 80.0±0.0 26.7±30.6 86.7±11.5 80.0±16.3 73.3±9.4 73.3±18.9 13.3±11.5

20.5±0.6 20.5±0.6 0.0±0.0 20.3±0.7 20.4±0.6 20.3±0.7 19.4±1.0 20.1±0.7 20.4±0.2 19.6±0.7 20.4±0.5 20.2±0.8

64.4±50.0 91.3±6.1 38.7±27.5 86.5±7.4 62.3±54.3 0.0±0.0 56.5±51.2 30.9±53.6 52.1±37.1 26.7±37.8 28.4±40.2 86.0±12.1

26.7±3.1 25.3±4.6 0.0±0.0 25.3±2.3 23.3±4.2 22.0±3.5 19.3±10.3 34.7±4.2 29.3±2.5 22.7±1.9 26.0±6.5 26.7±7.0

33.3±57.7 33.3±57.7 0.0±0.0 33.3±57.7 33.3±57.7 33.3±57.7 33.3±57.7 33.3±57.7 33.3±47.1 66.7±47.1 33.3±47.1 33.3±57.7

(c) RomanEmpire

(d) AmazonRatings

Attack

BackdoorWM

SurviveWM

Integrity

RandomWM

Impercept.

Attack

BackdoorWM

SurviveWM

Integrity

RandomWM

Impercept.

MEA0 MEA1 MEA2 MEA3 MEA4 MEA5 AdvMEA CEGA DFEA_I DFEA_II DFEA_III Realistic

5.8±2.1 4.8±2.8 0.9±0.7 5.8±2.8 8.3±2.9 7.1±3.9 26.3±22.8 1.0±1.4 0.9±0.7 31.9±5.9 4.7±1.1 0.5±1.0

5.5±0.1 5.5±0.1 0.0±0.0 5.5±0.1 5.5±0.1 5.5±0.1 5.5±0.2 5.4±0.2 5.4±0.1 5.4±0.1 5.4±0.1 5.4±0.1

50.7±50.0 33.1±17.6 11.9±16.0 0.0±0.0 16.7±28.1 18.6±26.0 21.7±10.8 33.3±57.7 13.1±18.5 19.1±27.1 33.4±21.3 16.0±23.7

6.8±3.0 4.4±3.8 0.0±0.0 8.4±2.6 8.8±5.4 5.6±2.6 10.0±2.0 8.7±4.4 4.0±1.6 6.0±1.6 6.0±1.6 8.0±4.2

100.0±0.0 66.7±57.7 0.0±0.0 66.7±57.7 33.3±57.7 66.7±57.7 0.0±0.0 66.7±57.7 0.0±0.0 0.0±0.0 33.3±47.1 0.0±0.0

MEA0 MEA1 MEA2 MEA3 MEA4 MEA5 AdvMEA CEGA DFEA_I DFEA_II DFEA_III Realistic

70.8±10.2 68.0±12.8 15.0±2.7 69.1±8.7 73.2±6.0 74.3±8.2 94.0±7.0 66.1±1.7 68.3±4.5 99.2±0.7 71.9±4.8 43.7±6.2

20.0±1.0 20.0±1.2 0.0±0.0 20.1±1.2 20.3±1.1 20.0±1.1 20.0±0.7 20.0±0.7 20.0±0.6 19.7±0.9 20.0±0.9 20.4±0.9

67.7±4.4 65.5±2.6 59.9±43.2 54.6±23.8 51.6±27.2 90.5±16.4 24.7±42.5 34.0±30.0 54.6±31.6 69.8±3.8 66.7±47.1 75.1±28.4

22.7±6.4 32.7±4.2 0.0±0.0 26.0±3.5 20.7±1.2 22.7±4.6 20.7±7.6 23.3±4.2 18.7±4.1 26.7±4.7 21.3±3.4 18.0±6.0

0.0±0.0 0.0±0.0 0.0±0.0 0.0±0.0 0.0±0.0 0.0±0.0 33.3±57.7 0.0±0.0 0.0±0.0 0.0±0.0 0.0±0.0 0.0±0.0

Joint surrogate fidelity per dataset (rows: attacks, cols: watermarking defenses)

CiteS.

PubMed

Comp.

Photo

92

92

92

92

93

91

87

99

92

91

95

95

96

95

95

80

83

100

88

88

92

95

97

98

99

MEA1

91

94

90

91

93

90

88

100

91

91

95

95

95

95

95

78

78

100

92

88

91

97

97

94

98

MEA2

84

84

97

84

88

75

75

91

75

79

92

92

100

91

94

69

68

100

73

71

91

95

96

94

96

MEA3

91

92

88

90

92

88

86

88

89

89

93

90

92

94

95

84

83

100

89

85

90

96

97

97

98

MEA4

91

91

94

90

92

87

82

85

89

90

93

90

94

94

95

83

80

100

89

86

94

98

97

96

69

MEA5

91

92

92

92

92

87

85

93

89

89

93

91

98

93

95

80

81

100

87

84

94

97

97

98

98

AdvMEA

76

77

72

78

76

60

61

69

62

62

68

43

83

62

61

49

54

100

56

42

79

43

88

67

75

CEGA

87

85

54

80

89

85

63

93

74

87

95

99

61

94

96

70

68

67

84

85

92

96

62

93

96

Realistic

91

90

72

91

91

87

84

59

89

86

93

35

93

92

94

40

34

44

44

80

89

95

10

63

92

DFEA_I

89

88

90

83

89

86

67

86

74

85

95

98

96

94

96

72

72

100

77

82

89

76

64

95

97

DFEA_II

89

89

95

90

91

86

85

90

88

90

93

85

97

94

94

47

66

100

35

49

42

22

100

23

65

DFEA_III

90

90

87

92

91

88

86

94

89

88

95

94

96

94

95

69

87

100

86

87

94

97

95

94

ck

Ba

rv Su

teg In

nd

CS

Ra

p

Im

ck

Ba

rv Su

teg In

nd

Ra

p

Im

Phys.

ck

Ba

rv

teg

Su

In

nd

Ra

p

Im

OGBN-A

ck

Ba

rv

teg

Su

In

nd

Ra

p

Im

RomanE

ck

Ba

rv

Su

teg

In

nd

Ra

97

AmazR

99

100

99

99

100

99

99

99

98

100

76

68

90

80

79

77

79

86

79

79

91

94

81

93

93

98

99

99

99

100

99

99

99

99

100

76

68

91

82

78

77

79

82

80

79

92

94

81

94

92

MEA2

73

78

72

78

79

68

69

81

49

65

53

26

63

48

56

46

49

69

51

50

86

92

92

92

88

MEA3

97

99

99

98

99

99

99

99

97

99

76

68

91

80

80

77

79

80

80

79

91

94

78

93

94

MEA4

98

99

98

98

99

99

99

99

99

99

76

68

67

82

78

77

79

91

80

78

92

94

83

94

93

MEA5

98

99

98

98

99

99

99

98

98

99

76

67

86

80

80

77

79

84

80

79

91

94

94

94

93

AdvMEA

87

92

87

91

91

89

92

86

89

93

8

26

48

49

31

18

38

30

18

19

41

47

60

48

59

CEGA

96

97

4

96

99

98

98

43

98

99

76

63

24

77

75

71

71

62

78

77

89

88

86

95

91

Realistic

93

95

97

92

94

95

95

95

86

95

74

54

45

61

78

74

73

28

71

67

89

94

91

76

93

DFEA_I

94

96

66

97

97

98

98

97

97

98

80

66

28

83

82

71

72

88

79

77

89

87

86

88

93

DFEA_II

92

95

95

95

95

97

97

98

95

98

74

83

81

79

76

80

81

92

84

82

93

94

87

95

95

DFEA_III

94

96

93

96

97

97

98

98

97

98

76

68

85

83

78

76

78

72

80

78

92

94

100

94

rv Su

teg In

nd

Ra

p

Im

ck

Ba

rv Su

teg In

nd

Ra

p

Im

ck

Ba

rv

Su

teg

In

nd

Ra

p

Im

ck

Ba

rv

Su

teg

In

nd

Ra

p

Im

60

p

MEA1

ck

80

Im

MEA0

Ba

100

ck

Ba

rv

Su

teg

In

nd

Ra

40

Surrogate fidelity (%)

Cora MEA0

20

0

93

p

Im

Figure 20: Per-dataset heatmap grid of joint surrogate fidelity (%). Each panel is a 12 × 5 matrix on one dataset (rows: attacks; columns: watermarking defenses); a single shared colormap (RdYlGn, 0–100 %) supports cross-panel comparison. The cross-dataset uniformity in row patterns confirms the empirical CDF in Figure 19a: the surrogate-fidelity profile depends primarily on the attack and very little on the watermarking defense.

Table 51: Protocol mismatch between the two graph-watermark papers most directly affected by RQ5 and the GraphIP-Bench joint protocol. Axis

SurviveWM [26]

Task Graph classification Datasets MSRC-9, ENZYMES Attack family Same-arch hard-label MEA Verification metricĒ binary effective rate

BackdoorWM [32]

GraphIP-Bench RQ5

Node + graph classification Cora, CiteSeer, NCI1, COLLAB, REDDIT-BINARY Same-arch knowledge distillation WM accuracy on trigger nodes

Node classification 10 datasets, incl. Computers 12 black-box attacks (MEA0–5, AdvMEA, CEGA, Realistic, DFEA_I/II/III Surrogate-side verification rate

52

Table 52: SurviveWM under its paper-faithful protocol on the three graph-classification datasets it was originally evaluated on. medFid / medTgtWM / medSurWM are medians over 10 seeds × 12 attacks (120 rows per dataset). Eave,T is the binary effective rate of the watermark on the protected target; Eave,S is the same metric on the extracted surrogate. “Random floor” is 1/C for a C-class task. Dataset

medFid (%)

medTgtWM (%)

medSurWM (%)

Eave,T

Eave,S

Random floor

88.9 37.5 80.7

88.2 57.3 83.1

5.9 16.7 65.2

1.00 1.00 1.00

0.42 0.51 0.67

12.5 % (1/8) 16.7 % (1/6) 50.0 % (1/2)

MSRC-9 (paper’s own) ENZYMES PROTEINS

Table 53: SurviveWM on MSRC-9 (the paper’s own dataset) under twelve attacks. TgtWM is the verification rate on the protected target (paper’s Esin ); SurWM is the verification rate on the extracted surrogate; Eave,S is the paper’s binary effective rate on the surrogate, averaged over 10 seeds. Bold rows mark Eave,S =1.00 (every seed effective). Attack

Family

MEA0 MEA1 MEA2 MEA3 MEA4 MEA5 AdvMEA CEGA Realistic DFEA_I DFEA_II DFEA_III

Same-arch hard label Shuffled-order hard label Soft label, T =3 Soft label, T =1 Cross-arch SAGE, hard Cross-arch SAGE, soft 10 % adversarial flip Centrality / entropy, soft Edge-graph reconstruction (0.3×) Data-free, GCN Data-free, SAGE Data-free, GIN

TgtWM (%)

SurWM (%)

Eave,S

88.2 88.2 88.2 88.2 88.2 88.2 88.2 88.2 88.2 88.2 88.2 88.2

0.0 14.7 2.9 0.0 0.0 5.9 0.0 5.9 0.0 47.1 41.2 47.1

0.00 0.60 0.30 0.20 0.10 0.30 0.20 0.30 0.00 1.00 1.00 1.00

Table 54: BackdoorWM under its paper-faithful same-architecture knowledge-distillation extraction. TeachAcc / StuAcc are protected-target / surrogate test accuracy; Fid is fidelity to the teacher; TgtWM / SurWM are watermark verification on the teacher / on the KD student; RandFloor is the verification rate of a freshly initialised GCN; Eave,S is the surrogate-side effective rate (per-seed binary SurWM > max(RandFloor, TgtWM/2), averaged over 5 seeds). ‡ flags two seeds on Computers where joint training collapsed (TeacherAcc<10%); their high SurWM is not genuine watermark transfer (see caveat below). Dataset ‡

Computers Photo PubMed CiteSeer RomanEmpire

TeachAcc (%)

StuAcc (%)

Fid (%)

TgtWM (%)

SurWM (%)

RandFloor (%)

Eave,T

Eave,S

55.8 87.2 77.8 69.2 43.2

45.4 86.6 77.2 68.6 31.6

78.4 88.2 94.0 83.0 59.8

90.0 87.5 100.0 100.0 100.0

70.0 37.5 100.0 0.0 0.0

2.0 10.0 20.0 20.0 7.3

1.00 1.00 0.80 1.00 1.00

1.00 0.60 0.60 0.00 0.00

Table 55: Cross-architecture extraction on Computers. Surrogate fidelity (%); rows are the target backbone, columns are the surrogate backbone (mean ± std over three seeds). Results for Cora, OGBN-Arxiv, and RomanEmpire are reported in Table 59. Target \ Surrogate GCN GAT GraphSAGE

GCN

GAT

GraphSAGE

75.8 ± 13.6 76.1 ± 3.0 60.7 ± 16.3

60.5 ± 27.4 89.8 ± 0.4 81.2 ± 3.7

45.9 ± 27.8 77.0 ± 3.8 72.9 ± 8.9

Table 56: Link prediction on Cora at 0.25×. Surrogate fidelity (%), mean over three seeds; standard deviations are zero or near-zero because Cora link prediction uses a fixed positive/negative split. Defense

MEA0 MEA1 MEA2 MEA3 MEA4 MEA5 AdvMEA CEGA DFEA_I DFEA_II DFEA_III

None OP_low OP_high PR_2bit GradRedir

95.3 96.1 94.2 84.9 70.9

94.8 93.7 92.8 87.2 71.9

95.6 92.8 90.4 28.9 94.3

73.1 71.0 70.2 68.8 70.4

85.3 84.4 81.6 28.9 79.2

93.8 92.4 89.3 81.9 71.1

53

97.9 96.0 93.1 82.4 80.7

92.1 92.0 92.8 87.8 71.0

94.4 94.4 89.9 28.9 92.6

94.0 92.1 91.3 28.9 93.4

94.4 92.9 91.1 28.9 28.9

Table 57: Graph classification on ENZYMES (target accuracy 24.8±1.3) and PROTEINS (target accuracy 67.5±1.5) at budget 0.25×. Surrogate fidelity (%), mean ± std over three seeds. ENZYMES

PROTEINS

Attack

None

OPlo

OPhi

PR2b

PRt1

GR

None

OPlo

OPhi

PR2b

PRt1

GR

MEA0 MEA1 AdvMEA CEGA DFEA_I DFEA_II

92.2±1.7 29.4±3.8 84.6±3.3 88.7±3.1 93.0±0.3 90.6±3.8

88.9±3.9 28.1±5.2 85.6±0.6 92.2±0.6 91.3±0.3 90.2±2.1

86.9±5.0 24.4±8.6 83.0±4.2 90.2±4.5 91.1±1.5 84.1±3.9

16.7±2.9 3.1±5.5 16.5±3.2 59.1±6.4 60.0±4.9 16.7±4.5

91.1±2.9 32.4±6.1 86.1±2.0 90.9±1.4 91.3±0.8 91.3±1.2

90.9±0.8 29.6±4.2 85.6±2.4 85.0±2.4 83.0±1.2 91.7±1.5

95.5±2.9 63.4±2.1 90.2±1.2 97.1±1.2 97.5±0.7 96.3±0.6

90.9±3.5 61.9±3.0 88.7±0.5 96.8±2.0 97.4±0.7 94.7±1.2

96.2±2.7 63.3±2.7 89.9±2.7 97.5±0.2 97.9±0.6 94.2±2.8

83.8±2.6 62.4±2.5 85.0±6.7 94.7±1.6 95.0±2.4 84.9±0.3

96.2±1.0 65.1±4.8 91.6±0.8 97.8±0.3 97.7±0.2 95.9±1.4

94.9±1.6 63.2±2.3 92.5±2.2 97.1±0.9 96.6±0.5 95.5±1.4

Cross-task generalisation: surrogate fidelity (%) at budget 0.25 × (b) Graph Class. (ENZYMES)

MEA0

95

96

94

85

71

MEA1

95

94

93

87

72

MEA2

96

93

90

29

94

MEA3

73

71

70

69

70

MEA4

85

84

82

29

79

MEA5

94

92

89

82

71

AdvMEA

98

96

93

82

81

CEGA

92

92

93

88

71

DFEA_I

94

94

90

29

93

DFEA_II

94

92

91

29

93

DFEA_III

94

e on

N

93

w _lo

OP

91

h hig

_

OP

29

it 2b

_

PR

29

(c) Graph Class. (PROTEINS)

100

MEA0

92

89

87

17

91

91

MEA0

96

91

96

84

96

95

MEA1

29

28

24

3

32

30

MEA1

63

62

63

62

65

63

AdvMEA

85

86

83

16

86

86 AdvMEA

90

89

90

85

92

92

CEGA

89

92

90

59

91

85

CEGA

97

97

98

95

98

97

DFEA_I

93

91

91

60

91

83

DFEA_I

98

97

98

95

98

97

DFEA_II

91

90

84

17

91

92

DFEA_II

96

95

94

85

96

96

80

60

40

Fidelity (%)

(a) Link Prediction (Cora)

20

ne

R ad

No

Gr

w

_lo

OP

igh

_h

OP

bit

_2

PR

p1

_to PR

R

ad Gr

ne

No

_lo

OP

w

igh

_h

OP

bit

_2

PR

p1

_to

PR

R

0

ad Gr

Figure 21: Cross-task heatmap of surrogate fidelity (%) on three task settings: link prediction on Cora (left, attacks × five defenses) and graph classification on ENZYMES (centre) and PROTEINS (right). Colour saturation encodes fidelity (darker = lower fidelity, higher protection). Numbers are taken from Tables 56–57. The PR_2bit column is the only column which is uniformly dark across the three tasks; the MEA1 row on ENZYMES is uniformly faint, which is intrinsic to the attack rather than caused by any defense. Table 58: Structural properties of the ten graphs used in our benchmark. Edge homophily is the fraction of edges whose endpoints share the same label. Dataset

# Nodes

# Edges

# Classes

Avg. degree

Density

Edge homophily

Cora CiteSeer PubMed Computers Photo CoauthorCS CoauthorPhysics OGBN-Arxiv RomanEmpire AmazonRatings

2,708 3,327 19,717 13,752 7,650 18,333 34,493 169,343 22,662 24,492

5,278 4,614 44,325 252,737 122,906 81,894 247,962 667,793 44,258 105,296

7 6 3 10 8 15 5 40 18 5

3.9 2.8 4.5 36.8 32.1 8.9 14.4 7.9 3.9 8.6

0.00144 0.00083 0.00023 0.00267 0.00420 0.00049 0.00042 0.00005 0.00017 0.00035

0.810 0.739 0.802 0.783 0.833 0.808 0.931 0.699 0.291 0.452

Table 59: Cross-architecture extraction (undefended targets) on the three datasets not shown above. Surrogate fidelity (%); rows are the target backbone, columns are the surrogate backbone. Mean ± std over three seeds. The Computers matrix is in the main text (Table 55). (b) OGBN-Arxiv

(a) Cora Target \ Surrogate GCN GAT GraphSAGE

GCN

GAT

GraphSAGE

Target \ Surrogate

87.5 ± 1.4 83.3 ± 4.5 84.0 ± 1.1

89.4 ± 1.1 90.6 ± 2.0 86.0 ± 0.6

88.5 ± 0.1 87.0 ± 2.6 96.0 ± 0.7

GCN GAT GraphSAGE

GCN

GAT

GraphSAGE

83.1 ± 5.0 44.9 ± 0.4 41.9 ± 0.8

62.4 ± 0.7 80.7 ± 0.2 71.4 ± 0.1

63.0 ± 1.4 90.9 ± 0.3 90.3 ± 1.5

(c) RomanEmpire Target \ Surrogate GCN GAT GraphSAGE

GCN

GAT

GraphSAGE

63.1 ± 3.1 53.9 ± 1.3 38.5 ± 0.6

74.4 ± 0.2 76.7 ± 1.5 47.9 ± 0.9

82.7 ± 0.4 78.3 ± 0.5 92.3 ± 0.3

54

Table 60: Surrogate fidelity (%) when MEA0 extracts a defended target with three victim backbones across Cora, CiteSeer, PubMed, and Computers. The surrogate is fixed to GCN. Mean ± standard deviation over three seeds. (b) CiteSeer

(a) Cora Victim GCN GAT GraphSAGE

None

OP_low

OP_high

PR_top1

GradRedir

Victim

87.5±1.4 82.8±3.9 84.0±1.2

85.1±3.9 82.8±4.5 83.3±2.0

85.2±3.5 82.9±4.4 83.5±1.7

87.4±0.2 85.3±2.1 84.1±1.0

87.7±0.4 83.0±3.4 81.0±3.2

GCN GAT GraphSAGE

None

OP_low

OP_high

PR_top1

GradRedir

79.7±4.9 76.7±1.7 80.8±0.5

81.7±2.3 76.1±2.5 81.1±0.7

81.5±2.9 76.6±3.3 80.9±1.2

87.6±0.3 83.0±1.8 83.6±0.9

79.7±1.7 73.2±2.1 78.1±0.4

(c) PubMed Victim GCN GAT GraphSAGE

(d) Computers

None

OP_low

OP_high

PR_top1

GradRedir

Victim

94.9±0.3 92.1±1.1 88.9±0.5

95.0±0.5 92.2±0.8 88.8±0.7

95.0±0.5 92.2±0.8 88.8±0.8

94.6±1.4 92.7±0.6 88.8±0.7

94.3±0.3 91.6±1.0 88.3±0.3

GCN GAT GraphSAGE

None

OP_low

OP_high

PR_top1

GradRedir

75.9±13.8 73.1±5.5 66.0±20.2

71.6±11.7 76.0±3.3 74.8±3.4

73.0±9.8 77.1±5.1 75.6±4.9

69.4±6.7 82.7±1.5 79.2±3.5

56.7±4.0 69.1±3.2 75.2±4.1

Table 61: Surrogate fidelity (%) when MEA0 extracts a defended target with three victim backbones across Photo, CoauthorCS, CoauthorPhysics, and OGBN-Arxiv. The surrogate is fixed to GCN. Mean ± standard deviation over three seeds. (a) Photo Victim GCN GAT GraphSAGE

(b) CoauthorCS

None

OP_low

OP_high

PR_top1

GradRedir

Victim

95.3±2.0 96.5±0.6 94.7±1.3

95.2±1.7 96.5±0.3 92.7±3.7

95.5±1.7 96.2±0.9 94.8±1.1

93.2±3.9 95.7±1.3 94.3±1.2

92.0±4.7 96.1±0.5 94.0±1.5

GCN GAT GraphSAGE

None

OP_low

OP_high

PR_top1

GradRedir

94.9±1.1 95.5±1.0 94.1±0.7

94.9±1.5 95.4±0.9 94.1±0.7

94.9±1.4 95.8±0.5 94.1±0.9

93.9±0.7 95.0±0.5 94.4±0.3

93.7±1.5 95.0±0.7 93.5±0.8

(c) CoauthorPhysics Victim GCN GAT GraphSAGE

(d) OGBN-Arxiv

None

OP_low

OP_high

PR_top1

GradRedir

Victim

97.1±1.0 96.6±1.1 97.6±0.6

97.0±1.0 97.0±0.8 97.6±0.6

97.1±1.1 96.1±1.2 97.5±0.5

96.2±1.2 95.9±0.3 97.2±0.6

96.2±1.2 96.2±1.1 97.3±0.5

GCN GAT GraphSAGE

None

OP_low

OP_high

PR_top1

GradRedir

83.6±4.2 45.3±0.8 41.7±1.0

83.6±3.9 45.1±0.8 42.0±0.8

83.6±3.9 45.2±0.8 41.6±0.3

78.7±6.8 50.4±2.0 47.6±1.9

75.6±2.8 37.5±1.5 38.8±1.7

Table 62: Surrogate fidelity (%) when MEA0 extracts a defended target with three victim backbones across Cora, Computers, RomanEmpire, and AmazonRatings. The surrogate is fixed to GCN. Mean ± standard deviation over three seeds. (Cora and Computers cells are duplicated from Tables 60 for a self-contained 2×2 layout.) (a) Cora Victim GCN GAT GraphSAGE

(b) Computers

None

OP_low

OP_high

PR_top1

GradRedir

Victim

87.5±1.4 82.8±3.9 84.0±1.2

85.1±3.9 82.8±4.5 83.3±2.0

85.2±3.5 82.9±4.4 83.5±1.7

87.4±0.2 85.3±2.1 84.1±1.0

87.7±0.4 83.0±3.4 81.0±3.2

GCN GAT GraphSAGE

None

OP_low

OP_high

PR_top1

GradRedir

75.9±13.8 73.1±5.5 66.0±20.2

71.6±11.7 76.0±3.3 74.8±3.4

73.0±9.8 77.1±5.1 75.6±4.9

69.4±6.7 82.7±1.5 79.2±3.5

56.7±4.0 69.1±3.2 75.2±4.1

(c) RomanEmpire Victim GCN GAT GraphSAGE

(d) AmazonRatings

None

OP_low

OP_high

PR_top1

GradRedir

Victim

63.1±3.0 54.8±1.5 38.6±0.4

63.2±3.0 54.5±1.4 38.6±0.4

63.2±3.1 54.5±1.5 38.5±0.4

71.6±1.0 63.3±0.1 43.1±0.4

57.5±1.2 48.1±0.9 36.0±0.6

GCN GAT GraphSAGE

None

OP_low

OP_high

PR_top1

GradRedir

87.5±2.3 85.3±1.4 64.0±0.8

87.6±1.3 85.2±1.4 56.1±1.3

87.9±1.8 85.1±1.4 61.9±3.0

91.8±1.2 89.8±1.0 64.5±2.9

92.8±0.8 90.2±0.7 62.3±2.0

Table 63: Budget-grid sensitivity for the MEA0 attack on four representative datasets at three additional budget multipliers (0.02, 0.75, 2.00). Each row reports the number of query nodes induced by the budget multiplier, the surrogate fidelity, the surrogate accuracy, and the victim test accuracy. All values are mean ± standard deviation over three seeds. Dataset Cora Cora Cora CiteSeer CiteSeer CiteSeer Computers Computers Computers RomanEmpire RomanEmpire RomanEmpire

Budget

# Query nodes

Fidelity (%)

Accuracy (%)

Victim acc. (%)

0.02 0.75 2.00 0.02 0.75 2.00 0.02 0.75 2.00 0.02 0.75 2.00

54 2,031 2,708 66 2,495 3,327 275 10,314 13,752 453 16,996 22,662

68.5 ± 3.7 87.5 ± 2.1 88.7 ± 1.9 60.7 ± 5.9 82.6 ± 2.3 81.9 ± 5.6 50.6 ± 33.2 82.6 ± 4.5 73.6 ± 8.0 61.6 ± 1.6 61.9 ± 1.5 64.7 ± 1.8

67.1 ± 3.0 77.7 ± 1.6 78.9 ± 0.7 56.4 ± 6.7 68.4 ± 1.9 69.0 ± 2.0 37.8 ± 28.8 41.2 ± 25.3 42.0 ± 18.8 31.5 ± 0.7 31.3 ± 1.0 32.4 ± 0.6

79.4 ± 0.5 79.4 ± 0.5 79.4 ± 0.5 67.8 ± 1.1 67.8 ± 1.1 67.8 ± 1.1 44.6 ± 22.4 44.6 ± 22.4 44.6 ± 22.4 42.8 ± 0.3 42.8 ± 0.3 42.8 ± 0.3

55

Table 64: Defense hyperparameter ablation on Cora. Each row reports protected-model accuracy and the verification proxy as mean ± standard deviation over multiple seeds. Defense

Hyperparameter

Acc (%)

WM Acc (%)

BackdoorWM BackdoorWM BackdoorWM BackdoorWM

trigger_rate=0.005 trigger_rate=0.01 trigger_rate=0.05 trigger_rate=0.1

78.7±2.0 78.6±2.1 78.8±1.2 77.4±0.4

100.0±0.0 100.0±0.0 100.0±0.0 100.0±0.0

OutputPerturbation OutputPerturbation OutputPerturbation OutputPerturbation OutputPerturbation

sigma=0.01 sigma=0.05 sigma=0.1 sigma=0.2 sigma=0.5

79.4±0.4 80.0±0.7 79.5±0.4 78.8±0.4 72.9±1.3

99.8±0.2 98.6±0.5 97.2±0.2 94.4±0.4 84.3±1.5

PredictionRounding PredictionRounding PredictionRounding PredictionRounding

precision_bits=1 precision_bits=2 precision_bits=4 precision_bits=8

77.5±0.2 72.8±0.4 80.1±0.0 79.9±0.8

90.6±1.6 82.2±1.1 96.8±0.4 99.7±0.2

RandomWM RandomWM RandomWM RandomWM

wm_node=10 wm_node=50 wm_node=100 wm_node=200

77.5±3.0 78.8±0.4 78.8±0.8 78.3±0.6

95.0±7.1 67.0±21.2 53.5±10.6 34.2±1.1

SurviveWM SurviveWM SurviveWM SurviveWM

defense_ratio=0.05 defense_ratio=0.1 defense_ratio=0.2 defense_ratio=0.3

81.0±1.3 80.0±0.4 78.4±1.1 77.0±2.5

79.3±3.1 39.4±2.9 20.2±0.1 17.9±0.8

Table 65: Defense hyperparameter ablation on Computers. Each row reports protected-model accuracy and the verification proxy as mean ± standard deviation over multiple seeds. Single-value entries indicate runs with one seed. Defense

Hyperparameter

Acc (%)

WM Acc (%)

BackdoorWM BackdoorWM BackdoorWM BackdoorWM

trigger_rate=0.005 trigger_rate=0.01 trigger_rate=0.05 trigger_rate=0.1

33.1±43.4 2.7±2.4 16.4±21.1 27.4±0.7

100.0±0.0 95.0±7.1 82.0±17.0 55.0±0.0

OutputPerturbation OutputPerturbation OutputPerturbation OutputPerturbation OutputPerturbation

sigma=0.01 sigma=0.05 sigma=0.1 sigma=0.2 sigma=0.5

48.2 38.6 67.6 37.4 18.5

99.6 77.0 97.3 61.1 21.4

RandomWM RandomWM RandomWM RandomWM

wm_node=10 wm_node=50 wm_node=100 wm_node=200

44.8±9.7 67.2±4.1 68.8±0.1 70.2±2.2

100.0±0.0 100.0±0.0 71.5±3.5 30.5±7.1

SurviveWM SurviveWM SurviveWM SurviveWM

defense_ratio=0.05 defense_ratio=0.1 defense_ratio=0.2 defense_ratio=0.3

13.6±15.0 32.2±24.0 43.7±32.9 55.0±24.2

10.9±0.0 11.1±0.8 10.5±0.9 10.1±0.6

56