Robust GNN Watermarking via Implicit Perception of Topological Invariants

Jipeng Li, Yanning Shen

Keywords: Graph neural networks, Model watermarking, Ownership verification, Topological invariants

Abstract: Graph Neural Networks (GNNs) are valuable intellectual property, yet most watermarks use backdoor triggers that break under common model edits and create ownership ambiguity. To tackle this challenge, we present InvGNN-WM, which ties ownership to a model’s implicit perception of a graph invariant, enabling trigger-free, black-box verification with negligible task impact. A lightweight head predicts normalized algebraic connectivity in an owner-private carrier set; a sign-sensitive decoder outputs bits, and a calibrated threshold $\tau(\alpha)$ controls the false-positive rate. Across diverse node and graph classification datasets and backbones, InvGNN-WM matches clean accuracy while yielding higher watermark accuracy than trigger- and explanation-based baselines. It remains strong under unstructured pruning, fine-tuning, and post-training quantization; plain knowledge distillation (KD) weakens the mark, while KD with a watermark loss (KD+WM) restores it. We provide guarantees for imperceptibility and robustness, and prove that exact removal is NP-complete.

Primary Area: learning on graphs and other geometries & topologies

Submission Number: 23834