Leaking Circuit Secrets: Gradient Leakage Attacks on Graph Neural Networks
arXiv:2606.25589v1 [cs.LG] 24 Jun 2026
Rupesh Raj Karn, Johann Knechtel Ozgur Sinanoglu Center for Cyber Security, New York University, Abu Dhabi, UAE. Email: {rupesh.k, johann, ozgursin}@nyu.edu
compression with quantization [20], and adversarial training [18]. We find that, while these techniques provide some resilience, as in increasing the reconstruction errors imposed onto attackers, they are not sufficient to thwart GLAs and furthermore impact performance. Our contributions are focused on quantifying this fundamental threat of GLAs on GNNs, forming the necessary first step for assessment of defense against end-to-end exploits. That is, rather than limiting ourselves to specific downstream attacks, we establish that sensitive circuit data can be reconstructed in general from GNNs used for circuit design/analysis. Our study not only confirms this threat, and the limitations of existing mitigation techniques, but also lays the groundwork for future attack/defense works. In summary, our contributions are as follows: 1) We formulate and systematically evaluate gradient leakage attacks against GNNs in the context of circuit design and hardware-security applications. 2) We quantify leakage across four GNN architectures, two representative circuit-analysis tasks, and ISCAS’85/EPFL/TrustHub-derived benchmarks. Index Terms—Gradient Leakage, Graph Neural Network 3) We analyze how leakage varies across gate types, Trojan (GNN), Hardware Security, ISCAS’85, EPFL, Netlists labels, and GNN architectures. 4) We evaluate common mitigation mechanisms and show I. I NTRODUCTION that their privacy–accuracy trade-offs are highly modelGraph neural networks (GNNs) [1], [2] are powerful tools and task-dependent. for reasoning over problems with inherent graph structures. We provide a full release at https://github.com/rkarn/ For circuit design, GNNs help to model complex relationships GradientAttackGNNs . among register-transfer level (RTL) or gate-level components, facilitating crucial tasks such as verification with high efficacy II. BACKGROUND AND M OTIVATION [3], [4], [5]. However, the use of GNNs can also induce security risks [6], [7], [8], with some overlooked so far. For example, A. Graph Neural Network (GNNs) in gradient leakage attacks (GLAs) [9], [10], [11], attackers Let G = (V, E) represent an undirected graph with N exploit the gradients computed during training to infer or nodes (V ) and edges (E). Each node v ∈ V has features i reconstruct sensitive information from the data, potentially x ∈ Rd , collectively forming X ∈ RN ×d . The graph structure i exposing information relevant to hardware security [12]. is encoded by an adjacency matrix A ∈ RN ×N and degree Here, we present the first comprehensive study of GLAs on matrix D (D = P A ) [26], [27]. à = A + I denote ii ij N GNNs in the context of circuit-design and hardware-security self-connections. The jhidden layer operates as: tasks, covering graph sample and aggregate (GraphSAGE) [13], H (l+1) = σ ÂH (l) W (l) (1) graph convolution network (GCN) [1], graph isomorphism (0) (l) dl ×dl+1 where H = X, W ∈ R are learnable weights, network (GIN) [14], and graph attention network (GAT) −1 −1 [15]. All GNNs are trained for gate classification [14] and  = D 2 ÃD 2 is the normalized adjacency matrix, and σ is detection of hardware Trojans (HTs) [16], respectively, which an activation function, e.g., ReLU. This operation aggregates serve as exemplary sensitive applications. We also benchmark information similarly to image convolution [28], [29] and can passing [30]: several SOTA defense techniques, namely differential privacy also be viewed as message n o (l+1) (l) (l) hi = σ W · AGG hj | j ∈ N (i) ∪ {i} (2) [17], gradient clipping [18], secure aggregation [19], model
Abstract—As graph neural networks (GNNs) become standard tools for critical tasks in circuit design and analysis, their security and privacy risks require careful attention. Here, we present the first comprehensive evaluation of gradient leakage attacks (GLAs) on GNNs in circuit-design and hardware-security tasks, a practical threat that has been largely overlooked. We assess state-of-the-art (SOTA) GNNs, including GraphSAGE, GCN, GIN, and GAT, trained on standard netlist benchmarks (ISCAS’85, EPFL, and TrustHub), for their fundamental vulnerability to GLAs. We find that GLAs can expose sensitive information, such as gate types and distinctive properties of hardware Trojans, which may assist adversaries in analyzing logic locking schemes or evading Trojan detection mechanisms. Our analysis shows that these risks are influenced by architectural features, with attention mechanisms (GAT) exacerbating leakage, while injective aggregation (GIN) provides comparatively stronger resilience. We further evaluate several SOTA defense techniques, including differential privacy, gradient clipping, secure aggregation, model compression with quantization, and adversarial training. We find that these techniques improve resilience only in specific settings and can also compromise model performance. Overall, our work provides key insights toward privacy-preserving GNNs and highlights the need for more robust and efficient defenses. We release our full methodology and artifacts.
TABLE I: Comparison of prior art and ours. Ref. Models [9] CNNs (LeNet, AlexNet)
Datasets MNIST, CIFAR-10
Metric rel l2 ≈ 0.01 (MNIST)
NA (visual reconstructions) [21] DNNs w/ GAN-based attack MNIST, CIFAR-10 in collab. learning [22] CNNs in federat. learning CIFAR-10, ImageNet sub- ≈ 0.03 (CIFAR-10), ≈ 0.05 (ImageNet) sets [23] DNNs in collab. learning CIFAR-10, IMDB NA (attribute inferences) [24] Various CNNs MNIST, CIFAR-10, Ima- Summarizes prior works (≈ 0.01–0.05) geNet [25] GNNs (GCN, GraphSAGE) Cora, Citeseer, PubMed ≈ 0.1–0.5 (node features) OursGNNs (GCN, GraphSAGE, ISCAS’85, GIN, GAT) TrustHub
Shows unintended leakage through gradients. Taxonomy of gradient inversion attacks, defenses.
Gradient inversion attacks on GNNs for node- and graph-level tasks in generic graph datasets. EPFL, ≈ 0.8–1.0 (gate classification), ≈ 1.2–2.2 First comprehensive study of GLAs on circuit-trained GNNs for hardware-security tasks (gate classification, (HT detection) HT detection).
where N (i) denotes node i’s neighbors and AGG aggregates features, typically via sum/mean/max operations [1]. The final layer H (L) uses softmax activation for node classification.
B. Gradient Leakage Attacks (GLAs)
Scope Recovers training data by inverting gradients from CNNs. Exploits shared gradients to reconstruct sensitive inputs. Attacks federated setups via gradient inversion.
Extract Model Parameters. Infer model parameters and/or reverse-engineering of proprietary ML algorithms [35], [18]. Attackers can reconstruct the learned feature space of GNNs used for security assessment, gaining adversarial insights for, e.g., bypassing detection of counterfeiting or tampering [36]. These motivational examples underscore the need for robust assessment of GLAs on GNNs applied to sensitive circuits. 2) Mathematical Formulation: Building upon the GNN formalism in Section II-A, we now define GLAs on GNNs. Let L : RN ×d → R denote the loss function used for training, e.g., the cross-entropy loss for node classification. Given the fixed parameters {W (l) }L−1 l=0 and the normalized adjacency matrix Â, the loss is computed as: L(X, Â, {W (l) }) = L H (L) (X, Â, {W (l) }) where H (L) is the network output defined in Equation (1). Now, suppose that adversaries have access to the gradients with respect to the model’s weights: G(l) = ∇W (l) L(X, Â, W (l) ), l = 0, 1, . . . , L − 1. The adversaries’ goal is to recover all or parts of the original features X. To do so, a dummy feature matrix X̃ ∈ RN ×d is introduced. The reconstruction of the original features is then posed as the following optimization problem: L−1 X 2 min ∇W (l) L(X̃, Â, W (l) ) − G(l) (3)
GLAs [9], [10], [11] refer to a class of malicious techniques where attackers exploit gradient information, collected during the training or inference process of an ML model, to reconstruct sensitive details of the underlying input data. GLAs have been studied extensively in domains like image recognition, e.g., showing that visually similar images can be recovered from leaked gradients [9]. More recently, gradient leakage has also been explored for graph neural networks in generic learning settings. For example, [25] study gradient inversion attacks on GNNs for node- and graph-classification tasks, while related works investigate reconstruction of graph structures and node features from gradients in federated learning settings. In contrast to these efforts, our work focuses on circuit-trained GNNs and hardware-security applications, including gate classification and hardware Trojan detection, and studies the interplay between GNN architectures, circuit-specific features, and defense mechanisms. Table I summarizes prior art and F X̃ ours. l=0 where ∥ · ∥ denotes the Frobenius norm. F 1) GLAs on GNNs for Circuit Design – An Overlooked For targeted reconstruction of a specific node vi ∈ V , we Threat: For circuit design, such attacks have been overlooked denote the true feature as xi ∈ Rd and the corresponding so far. To understand the motivation, an adversary might utilize dummy feature as x̃i . The localized reconstruction objective GLAs on GNNs trained for circuit design and analysis to: Reconstruct Sensitive Inputs. Recover design details embed- can be written as: 2 (l) min ∇W (l) L(x̃i , Â, W (l) ) − gi (4) ded in the training set [9], [12]. For example, attackers may 2 x̃i ∈Rd infer structural properties of security features like supervisor(l) where gi represents the contribution of node vi to the gradient mode logic, which may assist the analysis of such features in (l) G , and ∥ · ∥2 is the Euclidean norm. downstream attack scenarios. 3) Metrics: To quantify GLAs, various metrics help to Perform Membership Inference. Determine whether specific measure how closely the reconstructed node features x̃ i designs were used during training [31]. This may provide approximate the true features x for each node v ∈ V . i i information that could assist the analysis of logic locking Absolute L2 Error (abs l2). The absolute Euclidean distance schemes [32] by identifying whether particularly vulnerable between the reconstructed and true features is defined as: circuits or locking schemes were used for training [14]. abs l2i = ∥x̃i − xi ∥2 . (5) Execute Model Inversion. Extract representative features or The metric’s optimum is 0, i.e., for perfect reconstruction. typical instances [33]. For example, attackers could identify Relative L2 Error (rel l2). Normalizing reconstruction errors patterns associated with false negatives for HT detection relative to the magnitude of the true feature vector, we define: [4], which may inform the design of evasive structures to ∥x̃i − xi ∥2 rel l2i = , (6) evade detection [34]. For another example, by identifying true ∥xi ∥2 + ϵ positives for security assessment on logic locking, adversaries where ϵ > 0 is a small constant. As before, reaching 0 indicates can learn which gate structures are most promising to attack. that reconstructed features closely match the true features.
Cosine Similarity (cos sim). To evaluate the directional Differential Privacy. By injecting carefully calibrated noise alignment between reconstructed and true features, we define: into gradient updates, the training procedure ensures that the x̃i · xi cos simi = . (7) contribution of any individual data point is masked [17]. This ∥x̃i ∥2 ∥xi ∥2 + ϵ technique helps to prevent precise reconstruction of the original This metric ranges between −1 and 1, with 1 representing input while preserving general model performance1 perfect alignment, 0 indicating orthogonality (no directional Gradient Clipping and Perturbation. Clipping restricts the similarity), and −1 indicating inverse alignment. High cosine magnitude of gradients, preventing large-scale updates that similarity implies that the reconstructed feature preserves the may leak more information [18]. Along with perturbations, orientation of the original feature, even if the magnitude differs. this approach further obfuscates the training process. Together, these three metrics capture complementary aspects Secure Aggregation Protocols. In distributed/federated learnof reconstruction efforts: abs l2 measures absolute deviation, ing settings, secure aggregation allows the server to receive rel l2 normalizes the error relative to feature magnitude, only aggregated gradients from multiple participants [19]. By and cos sim evaluates directional similarity. A successful ensuring that individual gradient updates are never available in GLA aims to minimize both abs l2 and rel l2 to 0, while isolation, these protocols make it significantly more challenging maximizing cos sim to 1. for an adversary to reconstruct any specific data sample. These metrics are consistent with prior works on gradient Model Compression and Quantization. Such techniques inversion and leakage analysis [9], [22], [10], where recon- reduce the precision of gradient updates [20]. Lowering the struction quality is evaluated using L2-based errors and cosine resolution of the gradient information can inherently limit the similarity. In our context of circuit-trained GNNs, these metrics granularity of data that is leaked, though this may come at capture the extent to which structural node features, e.g., fan- cost for model accuracy. in/out, centrality, or distance-based attributes (node features are Adversarial Training. Integrating adversarial examples during described next in Section III), can be inferred from gradients. training not only makes models more robust to input perturHence, they serve as established proxies for quantifying feature- bations but also helps to obfuscate gradient signals [18]. This level information leakage from learned representations. approach deliberately alters learning dynamics so that extracted 4) Threat Model: For an attacker to exploit gradient leakage, gradients become less indicative of original input features. they must gain access to the gradients computed during training or inference. In this work, we consider a standard gradient III. M ETHODOLOGY leakage setting commonly adopted in prior literature [9], We devise an end-to-end methodology for security evaluation [10], where the attacker has access to model parameters and of GNNs used for circuit design and analysis against GLAs. corresponding gradients (e.g., for a given training step or target The workflow is outlined in Fig. 1 and explained next. node), and aims to reconstruct the underlying input features. A Input Processing. The workflow begins with processing This setting reflects a white-box or honest-but-curious scenario the circuit netlists, along with parameters for training etc. and serves as a canonical baseline to assess the inherent leakage B Graph Construction and Feature Setup for Sensitive of a model. This can be achieved through several means: Applications. Each netlist is converted into a graph where • Model Extraction: Attackers may gain access to pre- nodes represent gates and edges represent wires. While doing trained model weights post-deployment [37], allowing so, relevant features for the sensitive circuit design/analysis task them to compute gradients on select inputs. of interest are employed. As motivated in Section II-B1, adver• Side-Channel Attacks: Adversaries can monitor hardware- sarial techniques like membership inference or model inversion level computations during training, like memory-access can be employed against GNNs devised for security assessment patterns, power consumption, or timing variations, to infer of, e.g., logic locking and HT detection. Accordingly, we gradient updates without direct model access [38]. consider classification of gate types as a representative proxy • Federated Learning Scenarios: If the model operates in task relevant to logic locking analysis, and binary classification a distributed training environment, gradients exchanged of malicious vs. benign gates as a representative task for guiding between clients and servers may be intercepted [18]. adversarial efforts to bypass HT detection. • Adversarial Querying: Attackers interacting with a deFollowing [14], [16] and the wider literature, we use the ployed model can carefully craft queries to infer responses following node features: fan in, fan out, dist to output, that, when analyzed systematically [17], expose gradients. is primary input, is primary output, is internal, degree centrality, betweenness centrality, closeness centrality, Unlike direct data theft, these means and subsequent GLAs clustering coefficient, avg fan in neighbors, and can expose sensitive features in a stealthy manner, making avg fan out neighbors. The gate type and HT assignment, them difficult to detect and reinforcing the need for robust respectively, are encoded as numerical and binary labels. defenses. C GNN Training with GLA Mitigations. Training is 5) Mitigation Techniques: As explained, GLAs exploit performed using standard optimization techniques like gradient the information contained in gradient updates to reconstruct descent; a detailed description and implementation can be sensitive input data. To mitigate such vulnerabilities, researchers have proposed several strategies that aim to obscure or limit 1 In this work, differential privacy is implemented via gradient clipping and the information that gradients reveal. However, as we later noise injection following prior practice [39], where clipping bounds per-sample show, doing so is challenging for circuit-design tasks. gradients and noise is added to obscure individual contributions.
Defense Mechanism A
B
Verilog netlist files
Netlist to Graph Parser
Parameters
1. Differential Privacy 3. Secure Aggregation 5. Adversarial Training
2. Gradient Clip + Perturb 4. Model Compress + Quantize Gradient Extraction
GNN Training
C D
GCN
GAT
GraphSAGE
GIN
Attacker Gate Classification Trojan Detection
E Input Reconstruction & Evaluation
Compare
Fig. 1: Methodology for security evaluation of GNNs against GLAs.
Algorithm 1: Gradient Extraction Input: Graph G = (V, E), clean feature matrix X ∈ RN ×d , trained GNN model with parameters {W (l) }L−1 l=0 , target node index i, target label y true Output: Target gradients {G(l) }L−1 l=0 , true target feature xi 1 Initialize the clean feature matrix: Xclean ← X; 2 Compute the model output: Ŷ ← model(G, Xclean ); 3 Extract the target node’s output: ŷi ← Ŷ (i); 4 Compute the target loss: Ltarget ← L(ŷi , y); 5 Zero the model gradients; 6 Perform backpropagation to compute ∇W (l) Ltarget for all layers l; 7 For l = 0 to L − 1: 8 G(l) ← ∇W (l) Ltarget ; true ← Xclean (i); 9 Set xi (l) L−1 true 10 return {G }l=0 and xi ;
TABLE II: Hyper-parameters for GNNs and GLAs. Parameter Input Feature Dimension (d) Hidden Layer Units Number of Output Classes (C) Learning Rate Training Epochs Loss Function Optimizer Attack Iterations Dummy Optimizer Learning Rate Regularization Weight (L2)
Gate Classification 13 32 8 0.01 50 Cross-Entropy Adam 300 0.1 0.001
HT Detection 26 96 2 0.01 50 Cross-Entropy Adam 300 0.1 0.001
2) Comparison: At each iteration, compute the gradients for x̃i and measure the delta to the extracted gradients {G(l) }. 3) Optimization: Update x̃i , using gradient descent, to minimize the objective function. This step ensures that x̃i converges to a value that reproduces the leaked gradients. Finally, we compare the reconstructed x̃i with the true xtrue from Algorithm 1 (Line 9). Using the metrics defined in i Section II-B3, such comparison serves as independent security evaluation of GNNs against GLAs.
found in our release. At this stage, we also employ the GLA mitigation techniques outlined in Section II-B5. D Gradient Extraction. Here, we mimic attackers that extract gradients with respect to the model’s parameters based IV. E XPERIMENTS on the loss observed at a targeted node during training. 2 Algorithm 1 describes the extraction process. In brief, after A. Setup the GNN computes the output for the entire graph, the loss 1) Implementation: All experiments were implemented in is evaluated solely over the target node. Then, gradients Python, via Jupyter notebooks. For GNN models, we utilize {G(l) }L−1 l=0 are obtained by backpropagation, and serve as the Deep Graph Library (DGL) [40]. For a case study on leaked information for subsequent reconstruction. MNIST [41], which serves to contextualize the impact of E Input Reconstruction and Evaluation. Next, the leaked GLAs on traditional image classification and simpler models, gradients are used for input reconstruction as outlined in we use TensorFlow to devise a fully connected neural network Section II-B2. That is, attackers iteratively update the dummy (FCNN). We implement the proposed methodology (Section III) feature vector x̃i until its corresponding gradients closely match in full, including mitigation techniques. For the latter, we follow the leaked gradients {G(l) }. The attackers’ objective can also the default setups reported in their papers and codes. GNN be defined as: and GLA hyper-parameters are provided in Table II; further L−1 X 2 (l) details and source codes are available at https://github.com/rkarn/ min ∇W (l) L(x̃i , y) − G , x̃i 2 GradientAttackGNNs . l=0 where L is the loss function and ∇W (l) L(x̃i , y) denotes the 2) Datasets and Sensitive Applications: We utilize ISgradients computed using the dummy feature. CAS’85 [42] and EPFL [43] benchmarks, obtained via https: The iterative procedure for updating x̃i by attackers is below: //github.com/jpsety/verilog benchmark circuits . We perform node-level 1) Initialization: Set x̃i to a random vector. This is analogous splits for each constructed graph, with 80/20% train/test ratio. As indicated, we focus on logic locking and HT detection to an initial guess or random noise. as sensitive GNN applications. For logic locking, we consider gate classification. With this generic approach, we assess the 2 In more detail, line 1 initializes the clean feature matrix and line 2 computes the output for the given graph. The target node’s output is isolated in line 3, fundamental threat of GLAs without being limited to specific after which the target loss is computed in line 4. Gradients are cleared in locking techniques. For HT detection, likewise, we consider line 5, before performing backpropagation in line 6. Finally, gradients per detection of distinctive gate structures. For dataset preparation, layer are collected (line 8), the true target feature is recorded (line 9), and outputs are returned (line 10). we inject selected HT templates from the TrustHub suite,
namely Countermux, FSMor, and Andxor, into the ISCAS’85 and EPFL netlists. Each HT is implemented for rare trigger conditions. All HTs are included in our release. B. Results for Baseline GNNs First, we study the performance and GLA vulnerabilities for baseline models, i.e., without any mitigations in place. 1) Performance: Results for all baseline GNNs for both sensitive tasks (and for the MNIST FCNN) are given in Table III. Especially for GNNs, results are competitive with SOTA, confirming that our setup is practical and relevant. Given the security focus of this work, we refrain from further performance comparisons with prior art. 2) GLAs Overview: Recall that lower abs l2/rel l2 and higher cos sim values correspond to stronger leakage and better reconstruction of sensitive data by attackers (Section II-B3). Also recall that cos sim serves as an intuitive indicator of leakage, as it directly captures the alignment between reconstructed and original feature vectors. See the No Defense scenario in Table IV. Across GNNs and tasks, the success of GLAs varies notably, as discussed next. To support aggregate analysis, Table V summarizes GNN-wise mean leakage and relative defense effects, while Table VI reports class-wise no-defense means across GNNs. 3) GLAs on Gate Classification: On average across all GNNs (Table VI), OR gates are most vulnerable, with the highest cos sim (0.643) and relatively low rel l2 (0.89). NAND, OUTPUT, and XOR gates also show high cos sim values, but their cosine similarities remain slightly below OR; their rel l2 values are comparable, with NAND and XOR higher and OUTPUT slightly lower. Conversely, NOT gates yield the highest rel l2 (1.38) and the lowest cos sim (0.295), indicating the strongest resilience among gate types. These observations are consistent with the structural roles of the corresponding gates. Gates with more distinctive connectivity and functional behavior can induce more distinguishable gradient patterns, while unary and frequently occurring gates such as NOT provide less distinctive local signatures. Thus, the gate-wise results indicate that leakage is not uniform across circuit components, but depends on the structural and functional characteristics captured by the GNN. Regarding the different GNNs, on average across all gates (Table V), GAT is the most vulnerable architecture, with the highest cos sim (0.715) and the lowest abs l2 (5.380) and rel l2 (0.795). This aligns with the attention mechanism in GAT, which learns node-specific weighting and can produce more distinguishable gradients. GIN is the most resilient architecture, with the lowest cos sim (0.193) and the highest L2 errors (abs l2 7.061, rel l2 1.405). This is consistent with its injective aggregation and non-linear transformations, which reduce the direct interpretability of gradients. GraphSAGE demonstrates intermediate leakage behavior, consistent with its neighborhood sampling and aggregation mechanism, which preserves local structural information but does not expose it as strongly as GAT in this task. 4) GLAs on HT Detection: On average across all GNNs (Table VI), the Trojan class is more vulnerable, with cos sim
TABLE III: Baseline model performances. Metric [%] Train acc Test acc Precision Recall F1 Score
Gate Classification HT Detection MNIST GCN Gr.SAGE GIN GAT GCN Gr.SAGE GIN GAT FCNN 92.45 93.58 93.44 93.48 99.98 99.99 99.95 99.82 98.01 92.43 93.42 93.31 93.08 99.96 99.98 99.94 99.61 97.13 89.8 91.48 91.78 91.20 99.96 99.98 99.94 99.74 97.15 92.43 93.42 93.31 93.08 99.96 99.98 99.94 99.22 97.13 90.18 91.96 92.02 91.41 99.96 99.98 99.94 99.48 97.13
of 0.338, more than twice that of the Clean class (0.143). At the same time, the L2 errors are higher for the Trojan class (abs l2 6.5 vs. 4.848, rel l2 1.415 vs. 1.13). This indicates that GLAs recover stronger directional information for Trojanrelated features, while the numerical reconstruction remains less accurate. This trend is consistent with Trojan circuitry introducing distinctive structural patterns, such as trigger-related logic, that are reflected in the gradients. Regarding the different GNNs, on average across both classes (Table V), GIN is again the most resilient architecture, with cos sim of 0.05. GAT comes second, with cos sim of 0.065, whereas GraphSAGE is the most vulnerable, with the highest cos sim of 0.695 and the lowest rel l2 of 0.67. This differs from gate classification, showing that leakage behavior is taskdependent. For HT detection, GraphSAGE’s neighborhood aggregation captures localized structural patterns associated with Trojan insertion, which are reflected more strongly in the gradients. GIN remains comparatively resilient, consistent with the gradient-obfuscating effect of its non-linear injective aggregation. GAT shows lower leakage here than in gate classification, indicating that attention-based gradients are less exposed in this binary HT-detection setting than in the multiclass gate-classification setting. C. Results for GNNs with GLA Mitigations Second, we study GLA risks and performance in depth for hardened models with different mitigations in place. Test accuracies are given in Table VII and GLA results are given in Tables IV and V. 1) Performance for Gate Classification: For gate classification, several defenses slightly improve accuracy for selected models. In particular, GIN benefits from gradient clipping, secure aggregation, compression/quantization, and adversarial training, while GraphSAGE benefits from secure aggregation, reaching the largest gain of +2.15 percentage points (ppts). This indicates that these models were slightly underfitted initially, which is confirmed by Table III. Both GAT and GIN are remarkably robust across most defenses, with -1.84 ppts reduction at worst, whereas GraphSAGE suffers notably under differential privacy (-31.02 ppts) and gradient clipping (-15.35 ppts). This can be explained by the respective GNN mechanisms: for GAT and GIN, noises induced by defenses can be largely ‘overlooked’ in attention and injective aggregation mechanisms, whereas GraphSAGE’s accumulation approach also accumulates noise, leading to larger errors. 2) GLAs on Gate Classification: On average across all gates (Table V), secure aggregation is the most effective defense for GAT (cos sim -17.5%, rel l2 +15.6%), GraphSAGE (cos sim 20.3%), and GCN (cos sim -20.3%). For GIN, gradient clipping is most effective in reducing cos sim (-16.2%, with rel l2
TABLE IV: Comparison of GLA results across GNNs, tasks, and defenses. Aggregate GNN-wise averages and relative defense effects are summarized in Table V, while class-wise no-defense averages are summarized in Table VI. GNNs
GCN
Graph SAGE
GIN
GAT
GCN Graph SAGE GIN GAT
Class Type AND INPUT NAND NOR NOT OR OUTPUT XOR AND INPUT NAND NOR NOT OR OUTPUT XOR AND INPUT NAND NOR NOT OR OUTPUT XOR AND INPUT NAND NOR NOT OR OUTPUT XOR
No Defense abs l2 rel l2 cos sim 2.28 1.06 0.49 5.26 0.77 0.68 1.81 0.77 0.73 3.04 0.74 0.60 2.43 1.46 0.26 1.45 0.65 0.76 6.27 0.75 0.76 22.06 0.94 0.74 2.58 1.24 0.30 6.02 0.88 0.56 2.01 0.86 0.66 3.43 0.84 0.50 2.74 1.51 0.21 1.01 0.41 0.90 7.09 0.84 0.68 21.93 0.93 0.63 3.50 1.77 0.10 6.87 1.00 0.24 3.71 1.74 0.29 4.85 1.29 0.09 2.91 1.64 0.23 3.67 1.86 0.10 8.17 0.97 0.22 22.81 0.97 0.27 1.93 0.90 0.58 5.56 0.81 0.71 1.88 0.66 0.79 3.24 0.79 0.61 1.70 0.91 0.48 1.53 0.64 0.81 6.36 0.76 0.86 20.84 0.89 0.88
Diff. Priv. [17] abs l2 rel l2 cos sim 2.27 1.07 0.46 5.58 0.81 0.61 2.22 0.94 0.60 3.05 0.74 0.62 2.29 1.25 0.34 1.34 0.57 0.81 6.54 0.78 0.63 22.16 0.94 0.77 2.48 1.12 0.37 5.86 0.86 0.60 2.36 1.02 0.53 3.32 0.83 0.52 2.71 1.57 0.29 1.17 0.49 0.82 7.38 0.88 0.53 22.41 0.95 0.51 3.72 1.97 0.07 6.89 1.01 0.24 3.91 2.04 0.16 4.52 1.20 0.26 3.28 1.90 0.07 3.48 1.83 0.17 7.69 0.91 0.40 22.72 0.97 0.32 2.21 1.06 0.51 5.52 0.81 0.70 2.04 0.79 0.71 3.16 0.77 0.69 1.89 1.05 0.40 1.59 0.68 0.78 6.41 0.76 0.83 21.07 0.90 0.87
Clean HT Clean HT Clean HT Clean HT
7.59 6.48 3.34 4.95 4.66 8.07 3.8 6.5
7.16 6.73 4.69 1.02 4.33 4.69 4.2 5.0
1.57 2.22 0.85 0.49 1.20 1.55 0.9 1.4
0.17 0.13 0.50 0.89 -0.05 0.15 -0.05 0.18
1.38 2.26 1.41 0.40 1.24 1.41 1.0 1.3
0.22 0.04 0.22 0.94 -0.02 0.17 -0.03 0.17
Gate Classification Grad. Clip. [18] abs l2 rel l2 cos sim 2.41 1.14 0.41 5.43 0.79 0.65 2.30 1.01 0.60 3.35 0.81 0.61 1.89 1.06 0.49 1.36 0.50 0.87 6.42 0.76 0.73 22.62 0.96 0.62 2.57 1.27 0.34 6.23 0.91 0.44 2.37 1.04 0.64 3.56 0.88 0.51 2.62 1.51 0.12 1.29 0.53 0.86 7.32 0.87 0.59 22.21 0.95 0.54 3.68 1.92 0.13 6.51 0.95 0.36 4.29 2.12 0.09 5.15 1.36 0.03 3.47 2.08 0.13 4.19 2.11 -0.07 8.09 0.96 0.30 22.60 0.96 0.32 2.16 1.02 0.45 5.64 0.82 0.65 1.79 0.67 0.78 3.05 0.73 0.68 2.02 1.12 0.40 1.75 0.71 0.73 6.38 0.76 0.85 20.73 0.88 0.89 HT Detection 7.79 1.46 0.14 6.91 2.24 -0.04 3.34 1.02 0.38 0.99 0.41 0.91 3.93 1.19 -0.02 3.56 1.32 0.26 3.5 0.85 -0.02 5.8 1.35 0.22
Secure Aggr. [19] abs l2 rel l2 cos sim 2.50 1.12 0.33 5.55 0.81 0.60 2.70 1.18 0.40 3.54 0.89 0.46 2.32 1.34 0.29 2.03 0.92 0.55 6.41 0.76 0.69 22.43 0.96 0.68 3.28 1.70 0.14 6.06 0.88 0.54 2.84 1.24 0.42 3.71 0.93 0.44 2.28 1.30 0.26 1.70 0.75 0.65 7.36 0.88 0.55 22.32 0.95 0.54 3.43 1.83 0.18 6.64 0.97 0.29 4.11 2.02 0.09 5.11 1.36 0.10 3.27 1.99 0.20 3.67 1.85 0.21 8.41 1.00 0.18 22.78 0.97 0.28 2.36 1.08 0.38 5.66 0.83 0.65 2.45 0.94 0.48 3.54 0.92 0.53 1.87 1.03 0.38 2.09 0.91 0.57 6.34 0.75 0.85 20.96 0.89 0.88
Compr. & Quant. [20] abs l2 rel l2 cos sim 2.39 1.17 0.43 5.43 0.79 0.63 1.70 0.60 0.79 3.01 0.73 0.66 2.10 1.18 0.39 1.57 0.64 0.77 6.27 0.75 0.74 22.39 0.95 0.61 2.72 1.27 0.34 6.24 0.91 0.45 1.70 0.71 0.75 3.41 0.89 0.51 2.99 1.79 0.08 1.27 0.51 0.82 7.24 0.86 0.58 22.02 0.94 0.62 2.93 1.39 0.23 7.00 1.02 0.20 4.18 2.03 0.06 4.55 1.23 0.25 3.54 2.14 0.14 3.73 1.95 0.05 8.25 0.98 0.23 22.78 0.97 0.27 2.08 1.02 0.53 5.73 0.84 0.65 1.78 0.65 0.84 3.16 0.76 0.64 2.13 1.25 0.40 1.42 0.60 0.90 6.34 0.75 0.85 20.69 0.88 0.89
Adv. Train. [18] abs l2 rel l2 cos sim 2.54 1.14 0.39 5.38 0.78 0.66 1.87 0.75 0.70 3.03 0.74 0.66 2.13 1.13 0.33 1.21 0.52 0.87 6.14 0.73 0.77 22.29 0.95 0.69 2.52 1.24 0.32 5.98 0.87 0.53 1.85 0.80 0.72 3.39 0.83 0.52 2.76 1.53 0.16 0.99 0.44 0.88 7.29 0.87 0.58 22.03 0.94 0.62 3.79 1.95 0.10 6.76 0.98 0.28 4.15 2.02 0.04 4.88 1.30 0.12 2.92 1.75 0.28 3.27 1.65 0.19 8.41 1.00 0.17 22.82 0.97 0.29 2.21 1.11 0.45 5.60 0.82 0.68 1.89 0.71 0.73 3.16 0.77 0.65 1.86 0.98 0.42 1.51 0.63 0.85 6.39 0.76 0.85 20.72 0.88 0.89
8.09 6.49 5.57 8.63 5.55 5.42 5.0 7.2
7.74 6.59 4.24 1.88 3.99 4.78 4.0 5.5
7.79 6.70 2.82 1.40 4.24 3.77 3.2 4.5
1.49 2.12 1.30 2.57 1.36 1.37 1.2 1.45
0.10 0.05 0.19 0.17 -0.10 0.18 -0.08 0.16
1.50 2.08 1.34 0.69 1.12 1.42 0.95 1.35
0.11 0.00 0.34 0.87 0.02 0.19 0.01 0.19
1.41 2.22 0.83 0.45 1.23 1.22 0.8 1.1
-0.06 0.11 0.53 0.92 -0.06 0.21 -0.04 0.25
TABLE V: Mean GLA results and relative changes with respect to ‘no defense’ calculated from Table IV. For GLAs under defense, values are percentage changes averaged over all classes. Positive ∆rel l2 and negative ∆cos sim indicate reduced leakage. No Defense Mean Diff. Priv. Grad. Clip. Secure Aggr. Compr. & Quant. abs rel cos ∆rel ∆cos ∆rel ∆cos ∆rel ∆cos ∆rel ∆cos GCN 5.575 0.893 0.628 -0.6 -3.6 -1.5 -0.8 +11.8 -20.3 -4.6 0.0 GraphSAGE 5.851 0.939 0.555 +2.8 -6.1 +6.0 -9.0 +14.9 -20.3 +4.9 -6.5 Gate Type GIN 7.061 1.405 0.193 +5.2 +9.7 +10.9 -16.2 +6.7 -0.6 +4.2 -7.1 GAT 5.380 0.795 0.715 +7.2 -4.0 +5.5 -5.1 +15.6 -17.5 +6.1 -0.4 GCN 7.035 1.895 0.150 -4.0 -13.3 -2.4 -66.7 -4.7 -50.0 -5.5 -63.3 GraphSAGE 4.145 0.670 0.695 +35.1 -16.5 +6.7 -7.2 +188.8 -74.1 +51.5 -13.0 HT GIN 6.365 1.375 0.050 -3.6 +50.0 -8.7 +140.0 -0.7 -20.0 -7.6 +110.0 GAT 5.150 1.150 0.065 0.0 +7.7 -4.3 +53.8 +15.2 -38.5 0.0 +53.8 Task
GNN
TABLE VI: No-defense class-wise mean GLA results averaged across GNNs, calculated from Table IV. Task
Gate Type
HT
Class AND INPUT NAND NOR NOT OR OUTPUT XOR Clean Trojan
abs l2 2.572 5.927 2.352 3.640 2.445 1.915 6.972 21.910 4.848 6.500
rel l2 1.243 0.865 1.008 0.915 1.380 0.890 0.830 0.932 1.130 1.415
cos sim 0.368 0.548 0.618 0.450 0.295 0.643 0.630 0.630 0.143 0.338
+10.9%). Notably, differential privacy weakens the baseline resilience of GIN, increasing cos sim by +9.7%. Regarding different gates, vulnerable combinations of gates and models do not benefit from defenses, e.g., cos sim for OUTPUT gates
Adv. Train. ∆rel ∆cos -5.6 +1.0 +0.1 -2.5 +3.4 -4.5 +4.7 -3.5 -4.2 -83.3 -4.5 +4.3 -10.9 +50.0 -17.4 +61.5
on GAT can at best (using differential privacy) be reduced by only -3.5%. For inherently resilient gates like NOT, some defenses are counterproductive on less resilient models, e.g., gradient clipping on GCN increases cos sim from 0.26 to 0.49, whereas some defenses are effective on resilient models, e.g., gradient clipping on GIN reduces cos sim for NOT gates from 0.23 to 0.13. These diverse findings clearly show that defenses need to be carefully assessed before applying them to different GNN models for this sensitive task. Despite notable improvements for selected defenses, the final metrics still show significant leakage, suggesting that one cannot fully compensate for fundamental leakage arising from GNN architectures and their cores. Also, the ranking of different GNNs remains similar: GAT is still most vulnerable, with cos sim values around 0.59–0.7 across defenses (vs. 0.715
TABLE VII: Hardened model performances: test accuracy [%].
19 15 11 7 3 1 0.7 0.5 0.3 0.1 0.1 0.3 0.5 0.7
REL L2
ABS L2
Gate Classification Mechanism GCN Gr.SAGE GIN GAT No Defense 92.43 93.42 93.31 93.08 Diff. Priv. 89.23 62.40 92.04 91.68 Grad. Clip. 88.76 78.07 93.97 92.00 Secure Aggr. 83.96 95.57 95.23 94.52 Compr. & Quant. 91.23 84.96 95.29 91.24 Adv. Train. 91.32 88.82 95.27 91.36
GCN 99.96 53.59 99.94 99.91 99.86 99.95
HT Detection Gr.SAGE GIN 99.98 99.94 42.63 24.95 75.05 99.73 24.95 24.95 75.09 99.94 75.05 49.89
GAT 99.61 82.24 86.93 93.45 91.24 83.42
3.6 3.0 2.4 1.8 1.2 0.6 0.0
TABLE VIII: GLA results on MNIST FCNN, for reference/context. This experiment serves as a sanity check for our implementation and as a baseline from prior gradient inversion literature. Defense Mechanism None Differential Privacy Gradient Clip Model Quantization Adversarial Training Secure Aggregation
Abs L2 3.0350 2.9191 8.7740 3.1581 2.3308 14.4771
Rel L2 0.3926 0.3755 1.0425 0.4061 0.3027 1.6368
Cosine Sim. 0.9209 0.9270 0.7045 0.9185 0.9468 0.3406
COS SIM
The ranking of GNNs shifts after mitigations are applied, indicating that one can partially compensate for GNN-inherent leakage for HT detection, which differs from gate classification. CLEAN TROJAN CLEAN TROJAN For example, secure aggregation applied on GraphSAGE reduces its average cos sim to approximately 0.18, substantially Defenses No Defense Secure Aggr. narrowing the gap to the more resilient models. Even more Diff. Priv. Compr. & Quant. significant is adversarial training applied on GCN, which Grad. Clip. Adv. Train. ranked in the middle for baseline resilience, pushing its average cos sim to a near-zero value of 0.025. See also Fig. 2 for more CLEAN TROJAN detailed results for GCN, and note that further plots for other Fig. 2: GLA results on GCN trained for HT detection. models and settings are provided in Appendix. 6) Trade-Offs for HT Detection: For this task, trade-offs are without defenses), and GIN is still most resilient with cos sim more difficult to navigate. For example, both the performance as low as 0.161 (vs. 0.193 without defenses). and resilience of inherently resilient models can be undermined 3) Trade-Offs for Gate Classification: The performance cost by some defenses, e.g., adversarial training on GIN. Still, one induced by defenses are generally manageable, but security ‘tower of strength’ arises: GCN almost always achieves high gains are also moderate. Best trade-offs are achieved with resilience with high performance. For example, adversarial secure aggregation for GAT, GCN, GraphSAGE, and with training on GCN is highly effective (reducing leakage by gradient clipping for GIN. 83.3%) while maintaining near-perfect accuracy (99.95%). 4) Performance for HT Detection: All defenses lead to significant performance drops for at least some GNNs, ne- D. GLAs in Circuits vs. Image Domain cessitating their careful assessment before application. For To contextualize the vulnerability of circuit-trained GNNs example, secure aggregation undermines both GraphSAGE and against GLAs, we also report on an established GLA benchGIN by approximately 75 percentage points, dropping their mark, namely MNIST image detection, while attacking a accuracies to 24.95%. Interestingly, GCN is the most robust simpler FCNN, in Table VIII. We note low errors (abs l2 architecture under most defenses, maintaining approximately ≈ 2.3–14.5, rel l2 ≈ 0.3–1.6) with high cos sim values (> 0.7 99.9% accuracy except under differential privacy. This suggests in most cases), indicating strong gradient leakage. In contrast, that its built-in, structural aggregation approach – unlike secure in the circuit domain, we saw generally higher abs l2 and aggregation applied on top of other models – is highly stable. In rel l2 values and lower cos sim values. any case, recall that all defenses were applied with their default This can be attributed to the discrete and sensitive nature settings, possibly leaving room for further improvements.3 of circuit features. For example, consider fan in: even a small 5) GLAs on HT Detection: As summarized in Table V, absolute difference can lead to a significant shift/error in the secure aggregation is by far the most effective defense for reconstruction of the underlying circuit structures, whereas GraphSAGE (which showed the greatest baseline vulnerability), in the image domain, a small difference between true and namely reducing cos sim by -74.1% and increasing rel l2 by reconstructed pixel values would be largely imperceptible (at +188.8%, respectively, on average. Secure aggregation is also least to humans). Thus, while GLAs threaten both domains, the effective for GIN and GAT (cos sim -20.0% and -38.5%). For circuit domain exhibits some degree of inherent resilience. Still, GCN, adversarial training is most effective (cos sim -83.3%), we must caution again here that this does not hold universally followed by gradient clipping and compression (cos sim - true: we found significant variability for leakage across GNN 66.7% and -63.3%). Notably, multiple defenses can worsen models, defenses, and sensitive tasks. the leakage across different GNNs, e.g., adversarial training on We include MNIST only as a sanity check for our impleGraphSAGE increases cos sim by +4.3% or, representing the mentation; all main conclusions in this work are based on worst offender, gradient clipping on GIN increases cos sim by circuit-trained GNNs. +140%. Thus, even more than with gate classification, defenses need to be carefully assessed. V. C ONCLUSION AND F UTURE W ORK 3 The corresponding, significant effort to explore hyper-parameter tuning vs.
accuracy vs. resilience, for all defenses and across all GNNs, can be scope for future work.
We have shown that circuit-tailored GNNs introduce fundamental leakage risks. Our work provides multiple key findings. First, GLAs can reveal sensitive input features across different
GNN architectures and circuit-analysis tasks. These risks should be evaluated in an architecture- and data-specific context. For example, attention mechanisms (GAT) show high leakage in gate classification, whereas non-linear injective aggregation (GIN) provides stronger resilience across both studied tasks. Second, the benefits of SOTA defense techniques are highly specific and require careful assessment. While some techniques can significantly improve resilience, such as secure aggregation for GraphSAGE on HT detection, they do not consistently mitigate architecture-dependent leakage across tasks. Third, SOTA defenses can even be detrimental, both to performance and resilience, for selected models such as GIN. Consequently, future privacy-sensitive GNN settings for circuit design should prioritize robust backbones, carefully evaluate add-on defenses, and consider accuracy–privacy trade-offs. To support future work in this direction, we release our evaluation methodology in full. Future work includes extending this analysis to end-to-end attack scenarios and systematically exploring defense configurations through hyperparameter tuning. Another promising direction is the development of inherently privacy-preserving GNN architectures tailored for circuit design and hardwaresecurity applications. R EFERENCES [1] S. Zhang, H. Tong, J. Xu, and R. Maciejewski, “Graph convolutional networks: a comprehensive review,” Computational Social Networks, vol. 6, no. 1, pp. 1–23, 2019. [2] R. R. Karn and O. Sinanoglu, “Benchmarking backdoor attacks on graph convolution neural networks: A comprehensive analysis of poisoning techniques,” in International Conference on Security, Privacy, and Applied Cryptography Engineering. Springer, 2024, pp. 149–174. [3] G. Zhang, H. He, and D. Katabi, “Circuit-gnn: Graph neural networks for distributed circuit design,” in International conference on machine learning. PMLR, 2019, pp. 7364–7373. [4] K. Kunal, T. Dhar, M. Madhusudan, J. Poojary, A. K. Sharma, W. Xu, S. M. Burns, J. Hu, R. Harjani, and S. S. Sapatnekar, “Gnn-based hierarchical annotation for analog circuits,” IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, vol. 42, no. 9, pp. 2801–2814, 2023. [5] A. Shahane, S. Swapna Manjiri, A. Jain, and S. Kumar, “Graph of circuits with gnn for exploring the optimal design space,” Advances in Neural Information Processing Systems, vol. 36, pp. 6014–6025, 2023. [6] H. Zhang, B. Wu, X. Yuan, S. Pan, H. Tong, and J. Pei, “Trustworthy graph neural networks: Aspects, methods, and trends,” Proceedings of the IEEE, 2024. [7] L. Alrahis, S. Patnaik, M. A. Hanif, M. Shafique, and O. Sinanoglu, “Poisonedgnn: Backdoor attack on graph neural networks-based hardware security systems,” IEEE Transactions on Computers, vol. 72, no. 10, pp. 2822–2834, 2023. [8] F. Guan, T. Zhu, W. Zhou, and K.-K. R. Choo, “Graph neural networks: a survey on the links between privacy and security,” Artificial Intelligence Review, vol. 57, no. 2, p. 40, 2024. [9] L. Zhu, Z. Liu, and S. Han, “Deep leakage from gradients,” Advances in neural information processing systems, vol. 32, 2019. [10] H. Gong, L. Jiang, X. Liu, Y. Wang, O. Gastro, L. Wang, K. Zhang, and Z. Guo, “Gradient leakage attacks in federated learning,” Artificial Intelligence Review, vol. 56, no. Suppl 1, pp. 1337–1374, 2023. [11] D. Scheliga, P. Mäder, and M. Seeland, “Dropout is not all you need to prevent gradient leakage,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 37, no. 8, 2023, pp. 9733–9741. [12] H. Fang, Y. Qiu, H. Yu, W. Yu, J. Kong, B. Chong, B. Chen, X. Wang, S.-T. Xia, and K. Xu, “Privacy leakage on dnns: A survey of model inversion attacks and defenses,” arXiv preprint arXiv:2402.04013, 2024. [13] P. Lu, C. Jing, and X. Zhu, “Graphsage-based multi-path reliable routing algorithm for wireless mesh networks,” Processes, vol. 11, no. 4, p. 1255, 2023.
[14] L. Alrahis, S. Patnaik, M. Shafique, and O. Sinanoglu, “Omla: An oracleless machine learning-based attack on logic locking,” IEEE Transactions on Circuits and Systems II: Express Briefs, vol. 69, no. 3, pp. 1602–1606, 2021. [15] W. Hu, X. Zhan, and M. Tong, “Parsing netlists of integrated circuits from images via graph attention network,” Sensors, vol. 24, no. 1, p. 227, 2023. [16] H. Lashen, L. Alrahis, J. Knechtel, and O. Sinanoglu, “Trojansaint: Gate-level netlist sampling-based inductive learning for hardware trojan detection,” in 2023 IEEE International Symposium on Circuits and Systems (ISCAS), 2023. [17] Y. Li, S. Cheng, H. Su, and J. Zhu, “Defense against adversarial attacks via controlling gradient leaking on embedded manifolds,” in European Conference on Computer Vision. Springer, 2020, pp. 753–769. [18] W. Wei and L. Liu, “Gradient leakage attack resilient deep learning,” IEEE Transactions on Information Forensics and Security, vol. 17, pp. 303–316, 2021. [19] Z. Wang, Z. Chang, J. Hu, X. Pang, J. Du, Y. Chen, and K. Ren, “Breaking secure aggregation: Label leakage from aggregated gradients in federated learning,” in IEEE INFOCOM 2024-IEEE Conference on Computer Communications. IEEE, 2024, pp. 151–160. [20] Q. Liu and W. Wen, “Model compression hardens deep neural networks: A new perspective to prevent adversarial attacks,” IEEE Transactions on Neural Networks and Learning Systems, vol. 34, no. 1, pp. 3–14, 2021. [21] B. Hitaj, G. Ateniese, and F. Perez-Cruz, “Deep models under the gan: information leakage from collaborative deep learning,” in Proceedings of the 2017 ACM SIGSAC conference on computer and communications security, 2017, pp. 603–618. [22] J. Geiping, H. Bauermeister, H. Dröge, and M. Moeller, “Inverting gradients-how easy is it to break privacy in federated learning?” Advances in neural information processing systems, vol. 33, pp. 16 937–16 947, 2020. [23] L. Melis, C. Song, E. De Cristofaro, and V. Shmatikov, “Exploiting unintended feature leakage in collaborative learning,” in 2019 IEEE symposium on security and privacy (SP). IEEE, 2019, pp. 691–706. [24] R. Zhang, S. Guo, J. Wang, X. Xie, and D. Tao, “A survey on gradient inversion: Attacks, defenses and future directions,” arXiv preprint arXiv:2206.07284, 2022. [25] D. A. Sinha, R. Du, Y. Liu, A. Markopolou, and Y. Shen, “Gradient inversion attack on graph neural networks,” arXiv preprint arXiv:2411.19440, 2024. [26] P. Veličković, “Everything is connected: Graph neural networks,” Current Opinion in Structural Biology, vol. 79, p. 102538, 2023. [27] G. Lachaud, P. Conde-Cespedes, and M. Trocan, “Mathematical expressiveness of graph neural networks,” Mathematics, vol. 10, no. 24, p. 4770, 2022. [28] K. Han, Y. Wang, J. Guo, Y. Tang, and E. Wu, “Vision gnn: An image is worth graph of nodes,” Advances in neural information processing systems, vol. 35, pp. 8291–8303, 2022. [29] H. Hu, M. Yao, F. He, and F. Zhang, “Graph neural network via edge convolution for hyperspectral image classification,” IEEE Geoscience and Remote Sensing Letters, vol. 19, pp. 1–5, 2021. [30] F. Gama, E. Isufi, G. Leus, and A. Ribeiro, “Graphs, convolutions, and neural networks: From graph filters to graph neural networks,” IEEE Signal Processing Magazine, vol. 37, no. 6, pp. 128–138, 2020. [31] H. Hu, Z. Salcic, L. Sun, G. Dobbie, P. S. Yu, and X. Zhang, “Membership inference attacks on machine learning: A survey,” ACM Computing Surveys (CSUR), vol. 54, no. 11s, pp. 1–37, 2022. [32] H. M. Kamali, K. Z. Azar, F. Farahmandi, and M. Tehranipoor, “Advances in logic locking: Past, present, and prospects,” Cryptology ePrint Archive, 2022. [33] J. Song and D. Namiot, “A survey of the implementations of model inversion attacks,” in International Conference on Distributed Computer and Communication Networks. Springer, 2022, pp. 3–16. [34] A. Bhattacharyay, S. Yang, J. Cruz, P. Chakraborty, S. Bhunia, and T. Hoque, “An automated framework for board-level trojan benchmarking,” IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, vol. 42, no. 2, pp. 397–410, 2022. [35] R. Torrance and D. James, “The state-of-the-art in ic reverse engineering,” in International Workshop on Cryptographic Hardware and Embedded Systems. Springer, 2009, pp. 363–381. [36] T. Meade, S. Zhang, and Y. Jin, “Netlist reverse engineering for highlevel functionality reconstruction,” in 2016 21st Asia and South Pacific Design Automation Conference (ASP-DAC). IEEE, 2016, pp. 655–660. [37] H. Wen, Y. Li, Z. Zhang, S. Jiang, X. Ye, Y. Ouyang, Y. Zhang, and Y. Liu, “Adaptivenet: Post-deployment neural architecture adaptation for diverse
ABS L2
20
10
0 4 3 2 1 0
A. Differential Privacy
F
1.00 0.75
COS SIM
To mitigate the risk of sensitive information being recovered via gradient inversion, we integrate a differential-privacy mechanism into the gradient extraction process, by perturbing the computed gradients with Gaussian noise. Let (l) Gtrue = ∇W (l) L(Ŷ , Y ) denote the true gradient of the loss function L with respect to the model parameters W (l) at layer l, where Ŷ and Y are the model’s prediction and the ground truth, respectively. We then make the gradient private by adding Gaussian noise: (l) (l) Gdp = Gtrue + N (0, σ 2 I), where N (0, σ 2 I) denotes Gaussian noise with zero mean and covariance σ 2 I, and I is the identity matrix. In our experiments, we set σ = 0.1, i.e., the privacy noise multiplier is 0.1. Consequently, the reconstruction objective for the gradient leakage attack is modified to minimize the difference between (l) the noisy gradients Gdp and the gradients computed from the dummy input X̃, given by: L−1 X 2 (l) min ∇W (l) L(X̃) − Gdp . l=0
15
5
A PPENDIX
X̃
GBLAs for Gate Classification on GCN
25
REL L2
edge environments,” in Proceedings of the 29th Annual International Conference on Mobile Computing and Networking, 2023, pp. 1–17. [38] H. Chabanne, J.-L. Danger, L. Guiga, and U. Kühne, “Side channel attacks for architecture extraction of neural networks,” CAAI Transactions on Intelligence Technology, vol. 6, no. 1, pp. 3–16, 2021. [39] M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang, “Deep learning with differential privacy,” in Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, 2016, pp. 308–318. [40] M. Wang, D. Zheng, Z. Ye, Q. Gan, M. Li, X. Song, J. Zhou, C. Ma, L. Yu, Y. Gai et al., “Deep graph library: A graph-centric, highly-performant package for graph neural networks,” arXiv preprint arXiv:1909.01315, 2019. [41] A. Baldominos, Y. Saez, and P. Isasi, “A survey of handwritten character recognition with mnist and emnist,” Applied Sciences, vol. 9, no. 15, p. 3169, 2019. [42] M. C. Hansen, H. Yalcin, and J. P. Hayes, “Unveiling the iscas-85 benchmarks: A case study in reverse engineering,” IEEE Design & Test of Computers, vol. 16, no. 3, pp. 72–80, 1999. [43] L. Amarú, P.-E. Gaillardon, and G. De Micheli, “The epfl combinational benchmark suite,” in Proceedings of the 24th International Workshop on Logic & Synthesis (IWLS), 2015.
0.50 0.25 0.00 0.25 0.50
and
input none grad_clip
nand
nor
not
Gate Type Defense
diff_privacy secure_agg
or
output
xor
quantization adv_training
Fig. 3: Gate Classification: Reconstruction errors under different defense mechanism for GCN.
with α = 0.05 and I being the identity matrix. The reconstruction objective then becomes L−1 X 2 (l) min ∇W (l) L(X̃) − Gdef , X̃
F
l=0 In short, by injecting Gaussian noise with σ = 0.1 into the gradients, we seek to obscure sensitive information while where X̃ is the dummy input being optimized. This two-fold maintaining sufficient utility for model training and evaluation. defense – clipping gradients to a maximum norm of 1.0 and perturbing them with a noise multiplier of 0.05 – effectively degrades the precision of the gradient signal available to the B. Gradient Clipping and Perturbation attacker, leading to higher reconstruction errors and improved Here, we implement a defense mechanism that combines privacy protection. gradient clipping with perturbation. Let (l) Gtrue = ∇W (l) L(Ŷ , Y ) denote the true gradient of the loss L with respect to the model C. Secure Aggregation Protocols parameters W (l) at layer l. We first clip these gradients to restrict their magnitudes by enforcing ! Here, we apply secure aggregation protocols, wherein C gradients are computed and averaged over multiple nodes (l) (l) Gclip = min 1, Gtrue , (l) instead of individual samples. This aggregated approach limits ∥Gtrue ∥2 where the clipping threshold is set to C = 1.0. To further the attacker’s ability to reconstruct specific node features while obscure the leaked information, we add Gaussian noise to preserving the integrity of model updates. produce the defended gradient: Let a group of Ngroup nodes be selected from a given class, (l) (l) Gdef = Gclip + N (0, α2 I), each with its corresponding feature Xi . The aggregated feature
GBLAs for Gate Classification on GraphSAGE
20
20
15
15
10
GBLAs for Gate Classification on GIN
25
ABS L2
ABS L2
25
10
5
5
0
0
4 4
REL L2
REL L2
3 2
2 1
0
0
1.00 0.75 0.50 0.25 0.00 0.25 0.50 0.75
1.0 0.5
COS SIM
COS SIM
1
3
0.0 0.5
and
input none grad_clip
nand
nor
not
Gate Type Defense
diff_privacy secure_agg
or
output
xor
quantization adv_training
Fig. 4: Gate Classification: Reconstruction errors under different defense mechanism for GraphSAGE.
for the group is computed as: Ngroup 1 X Xagg = Xi . Ngroup i=1 Similarly, the aggregated gradients for the group are computed using the mean loss over all selected nodes: Ngroup 1 X G(l) = ∇ (l) L(Xi , Yi ), agg Ngroup i=1 W where L(Xi , Yi ) represents the loss function for node i. In our implementation, we set Ngroup = 5 and simulate an attacker attempting to reconstruct Xagg rather than individual node features. The reconstruction objective now becomes: L−1 X 2 ∇W (l) L(X̃agg ) − G(l) . min agg X̃agg
l=0
F
Since the attacker is only provided with the averaged gradient and feature information, individual variations within the group are masked, notably degrading inversion performance. D. Model Compression and Quantization Here, we use model compression and quantization techniques to restrict the precision of model parameters, obfuscating
1.0
and
input none grad_clip
nand
nor
not
Gate Type Defense
diff_privacy secure_agg
or
output
xor
quantization adv_training
Fig. 5: Gate Classification: Reconstruction errors under different defense mechanism for GIN.
critical information that could be exploited by an attacker. This approach involves two key defenses: (1) quantization, where model outputs are discretized to lower precision, and (2) compression through weight pruning, where small-valued parameters are removed to minimize information leakage. 1) Quantization: During the forward pass of the GCNN, numerical outputs are quantized using: round(X · Q) Xquant = , Q where Q = 255 simulates 8-bit fixed-point representation. This transformation limits the granularity of feature updates, reducing inversion fidelity. 2) Compression via Pruning: After backpropagation, smallmagnitude model weights ( are set to zero: 0, if |W (l) | < τ (l) Wcompressed = (l) W , otherwise where τ = 0.01 is the pruning threshold. This process eliminates weak connections in the NN, making gradient inversion less effective.
GBLAs for Gate Classification on GAT
25
8 6
15
ABS L2
ABS L2
20
10 5
2
1.5
REL L2
2.0
REL L2
4
0
0
1.5 1.0
1.0 0.5
0.5 0.0
0.0
1.0
1.0
0.8
0.8
0.6
0.6
COS SIM
COS SIM
GBLAs for Hardware Trojan Detection on GraphSAGE
0.4 0.2 0.0
0.4 0.2 0.0
0.2
0.2 and
input
nand
nor
Gate Type Defense
none grad_clip
not
diff_privacy secure_agg
or
output
xor
quantization adv_training
clean none grad_clip
Class Type Defense
diff_privacy secure_agg
trojan quantization adv_training
Fig. 6: Gate Classification: Reconstruction errors under different defense mechanism for GAT.
Fig. 7: Hardware Trojan Detection: Reconstruction errors under different defense mechanism for GraphSAGE.
E. Adversarial Training
The box plots for different metrics (abs_l2, rel_l2, and cos_sim) for both the gate classification and the hardware Trojan detection on GCN, GraphSAGE, GIN, and GAT models are shown in Figs. 3, 4, 5, 6, 7, 8, and 9 respectively.
Here, we introduce adversarial perturbations into the model’s training process to improve its resilience against GBLAs. By exposing the model to carefully crafted perturbations during training, it learns representations that are less susceptible to inversion attacks. 1) Generating Adversarial Perturbations: To generate adversarial examples, we use the Fast Gradient Sign Method (FGSM), where the perturbation applied to the feature matrix X is computed as: Xadv = X + ϵ · sign(∇X L(X, Y )), where ϵ is the perturbation strength (set to 0.1 in our experiments), L(X, Y ) is the loss function, and ∇X L represents the gradient of the loss with respect to the input features. 2) Adversarial Training Procedure: During training, instead of using the original features, we compute adversarial perturbations and feed the model with Xadv , reinforcing its ability to generalize across perturbed data: N X min L(fW (Xadv,i ), Yi ). W
i=1
This forces the model to optimize for robustness rather than merely fitting the clean training data.
30 20 10 0 10 20 30
20
ABS L2
10 5 0 5 10
3.0
2.5
2.5
2.0
REL L2
2.0 1.5 1.0
1.5 1.0
0.5
0.5
0.0
0.0
0.8 0.6 0.4 0.2 0.0 0.2 0.4 0.6
GBLAs for Hardware Trojan Detection on GAT
15
0.6 0.4
COS SIM
COS SIM
REL L2
ABS L2
GBLAs for Hardware Trojan Detection on GIN
0.2 0.0 0.2 0.4
clean none grad_clip
Class Type Defense
diff_privacy secure_agg
trojan
clean
quantization adv_training
none grad_clip
Fig. 8: Hardware Trojan Detection: Reconstruction errors under different defense mechanism for GIN.
Class Type Defense
diff_privacy secure_agg
trojan quantization adv_training
Fig. 9: Hardware Trojan Detection: Reconstruction errors under different defense mechanism for GAT.