LPIA: Label Preference Inference Attack Against Federated Graph Learning

Federated Graph Learning (FGL), as a technique that combines Graph Neural Networks (GNNs) and Federated Learning (FL), aims to protect graph data privacy. However, FGL still faces potential privacy threats. To uncover privacy vulnerabilities in FGL, we first propose Label Preference Inference Attack (LPIA) for this scenario. LPIA infers the label preference of target client by analyzing its uploaded model updates. Label preference refers to the label that has the highest or lowest sample count in the target client’s private dataset. Based on the difference in gradient changes between traditional FL and FGL, we design a new model sensitivity calculation method and a dual selective aggregation strategy, which are better suited to the FGL scenario. LPIA demonstrates excellent attack performance across three mainstream GNN models and four graph datasets. Additionally, we systematically investigate the key factors affecting LPIA performance, including preference level, attack round, and neuron size. We further evaluate mainstream defense strategies (e.g., dropout and differential privacy), and the results show that LPIA remains highly effective when the global model’s accuracy drop is minimal.