Leaking Circuit Secrets: Gradient Leakage Attacks on Graph Neural Networks

Abstract: As graph neural networks (GNNs) become standard tools for critical tasks in circuit design and analysis, their security and privacy risks require careful attention. Here, we present the first comprehensive evaluation of gradient leakage attacks (GLAs) on GNNs in circuit-design and hardware-security tasks, a practical threat that has been largely overlooked. We assess state-of-the-art (SOTA) GNNs, including GraphSAGE, GCN, GIN, and GAT, trained on standard netlist benchmarks (ISCAS'85, EPFL, and TrustHub), for their fundamental vulnerability to GLAs. We find that GLAs can expose sensitive information, such as gate types and distinctive properties of hardware Trojans, which may assist adversaries in analyzing logic locking schemes or evading Trojan detection mechanisms. Our analysis shows that these risks are influenced by architectural features, with attention mechanisms (GAT) exacerbating leakage, while injective aggregation (GIN) provides comparatively stronger resilience. We further evaluate several SOTA defense techniques, including differential privacy, gradient clipping, secure aggregation, model compression with quantization, and adversarial training. We find that these techniques improve resilience only in specific settings and can also compromise model performance. Overall, our work provides key insights toward privacy-preserving GNNs and highlights the need for more robust and efficient defenses. We release our full methodology and artifacts.

• The paper shows that gradient leakage attacks can reconstruct highly sensitive circuit information from model gradients in GNNs.
• It empirically benchmarks multiple architectures like GCN, GraphSAGE, GIN, and GAT under tasks such as gate classification and Trojan detection.
• It evaluates defense mechanisms, revealing that standard mitigations often trade privacy for accuracy and are not uniformly effective.

Gradient Leakage Attacks on Circuit-Based Graph Neural Networks

Introduction

The paper "Leaking Circuit Secrets: Gradient Leakage Attacks on Graph Neural Networks" (2606.25589) presents the first in-depth, empirical evaluation of gradient leakage attacks (GLAs) against GNNs within the circuit design and hardware security domains. GNNs, particularly architectures such as GCN, GraphSAGE, GIN, and GAT, have become central to logic-level tasks including gate-type classification and hardware Trojan (HT) detection. This widespread adoption introduces privacy and security vulnerabilities that had not been adequately quantified for circuit-trained models. The central thesis is that model gradients, as exposed during standard training or federated learning, are sufficient to reconstruct highly sensitive logic-level information—rendering GNN-based circuit analysis tools vulnerable to model inversion and data extraction attacks. The work further rigorously benchmarks mitigation strategies and exposes their limits, providing actionable insights for trustworthy GNN deployments in hardware-centric ML pipelines.

Methodological Framework

The work operationalizes GLAs on GNNs through a structured, end-to-end security evaluation pipeline. Netlists from widely used ISCAS’85, EPFL, and TrustHub suites are converted to graph representations with nodes corresponding to gates and edges to interconnections; domain-relevant features include fan-in/out, centrality measures, and flags for primary I/O or suspicious (trojan) gates. Both gate classification (multi-class) and binary HT detection tasks are targeted. The attacker’s pipeline formalizes gradient inversion as a differentiable optimization routine where dummy input features are optimized to minimize the $\ell_2$-distance between gradients computed from the dummies and those intercepted from the victim model.

The primary leakage quantification metrics are:

• Absolute and relative $\ell_2$ errors between reconstructed and ground-truth node features;
• Cosine similarity between feature and reconstruction vectors (highlighting alignment of sensitive substructures, which is especially meaningful in the context of sparse logic features).

Multiple GNNs (GCN, GraphSAGE, GIN, GAT) are investigated under both default and “hardened” settings, with hardened designs employing defenses: differential privacy, gradient clipping/perturbation, secure aggregation, model quantization/pruning, and adversarial training. The evaluation covers both overall- and class-wise vulnerabilities.

Empirical Findings: Leakage Profiles

GNN Architectural Vulnerabilities

GLA success rates are highly architecture-dependent. For the gate classification task, GAT is most susceptible to feature inversion (cosine similarity $\sim$0.72), followed by GraphSAGE and GCN. GIN—utilizing injective aggregation—displays marked resilience with substantially higher $\ell_2$ errors and much lower cosines ($\sim$0.19). The susceptibility correlates with the architectural mechanism: attention in GAT over-characterizes local neighborhoods, amplifying gradient identifiability, while GIN's nonlinearity and injectivity impair inversion.

In the HT detection domain, the leakage hierarchy inverts—GraphSAGE becomes the most vulnerable, exhibiting a mean cosine similarity of $\sim$0.70, whereas GIN and GAT are less susceptible ($<0.07$). This underscores the task- and topology-dependence of architectural privacy profiles. Notably, the “Trojan” class is consistently more reconstructable than benign logic gates (HT class cosine $\sim$0.34 vs. clean $\sim$0.14), exposing a path for adversarial model analysis of rare, high-significance structures.

Figure 1: GLA results on GCN trained for HT detection, showing distribution of reconstruction errors for clean and trojan nodes under various defense mechanisms.

Defense Mechanisms: Effectiveness and Tradeoffs

Evaluation of standard GLA defenses demonstrates that mitigation is neither uniform nor monotonic with privacy or accuracy. Secure aggregation proves most impactful for GraphSAGE running HT detection (reducing cosine similarity by 74% and tripling relative $\ell_2$ error), but yields only moderate improvements for GAT and can dramatically decrease model accuracy when misapplied (severe accuracy loss on GIN and GraphSAGE for HT detection). Gradient clipping is sometimes effective (notably for GIN on gate classification, reducing cosine similarity by 16%), but is counterproductive for some classes or models, occasionally decreasing privacy and damaging accuracy.

Differential privacy consistently degrades model performance, sometimes by over 30 percentage points (GraphSAGE, HT detection), yet does not systematically yield privacy gains, and on GIN can actually increase inversion alignment. Compression and quantization are modestly effective but not sufficient, with most architectures still leaking critical structural logic information post-quantization.

Figure 2: Gate classification reconstruction error metrics (abs/rel L2, cosine similarity) for GCN under all defense mechanisms.

Figure 3: Gate classification gradients inversion efficacy for GraphSAGE under all tested defenses.

Figure 4: Defense mechanism effects on GIN, revealing consistent resilience but highlighting cases with adverse impacts on privacy.

Figure 5: Impact of defenses on inversion errors for GAT, the most vulnerable model for gate classification.

Per-Class Leakage and Circuit Implications

Leakage varies not only by GNN type but also by node/gate class. OR, XOR, and OUTPUT gates are consistently more vulnerable, with cosine similarity for OR nodes reaching 0.64, compared to NOT gates (0.30). The information-theoretic rationale is that gates with distinctive topological and feature signatures (high connectivity, rare configuration) are more readily inverted from gradients. This is subsequently reflected in HT detection, with trojan gates revealing directional information (high cosine) even if the absolute feature error remains large.

Theoretical, Practical, and Future Implications

The results demonstrate that the privacy attack surface for circuit GNNs is a function of both architectural choice and application, invalidating the idea that standard hardening mechanisms (e.g., differential privacy, quantization) are sufficient without explicit model/task-specific validation. No evaluated defense consistently nullifies GLA risk across the hardware security lifecycle. Thus, the choice of backbone (e.g., favoring GIN for sensitivity-critical environments) is as significant as add-on defense selection, and in some configurations, only tradeoffs with significant utility loss are possible.

From a hardware trust and supply chain threat modeling perspective, the finding that GNNs for HT detection can have trojan logic features actively reconstructed from model gradients is critical: intellectual property can be exfiltrated, logic locking reverse-engineered, and adversarial evasion against detection models facilitated. For federated or multi-tenant learning, GLAs enable powerful membership and model inversion attacks.

The study motivates future research into:

• Architecturally private GNNs: end-to-end invertibility-aware designs rather than layered wrappers.
• Robustness–accuracy–privacy co-optimization: using multi-objective search for deployment pipelines in design-automation and sovereign hardware settings.
• Hyperparameter and defense scheduling: adaptive privacy regularization during GNN training dependent on threat assessment and task.

Figure 6: Defense impact on HT detection for GraphSAGE, illustrating the strong benefit of secure aggregation and variable effectiveness of other approaches.

Figure 7: Distribution of inversion errors for GIN under HT detection, with medians indicating strong baseline privacy.

Figure 8: GAT under various defenses for HT detection, again showing that attention mechanisms remain a significant risk even with extant defenses.

Conclusion

The paper establishes that gradient-leakage-based inversion attacks represent a fundamental, data-dependent risk for GNNs in circuit analysis and security tasks. The architecture-task-threat synergy governs risk, with GAT and GraphSAGE more vulnerable than GIN, and high-stakes classes (e.g., Trojan nodes and rare gate types) most at risk. Defenses offer incomplete and non-monotonic mitigation, emphasizing the need for next-generation privacy-aware GNNs and careful defense–utility calibration for hardware security ML deployments. The open release of methodology and benchmarks from this work will be of high value for subsequent research into robust GNNs for sensitive domains.