Appendices

1 Dataset Statistics

Here we list the statistics of 7 public dataset in Table 1.

	Nodes	Edges	Classes	Features
Cora	2,708	5,429	7	1,433
Citeseer	3,327	4,732	6	3,703
Polblogs	1,490	19,025	2	-
USA	1,190	13,599	4	-
Brazil	131	1,038	4	-
AIDS	31,385	64,780	38	4
ENZYMES	19,580	74,564	3	18

Table 1: Dataset statistics

2 Details of Random Sampling

Algorithm 1 Random sampling from probabilistic vector to binary adjacency matrix

Input: Probabilistic vector $\mathbf{a}$ , number of trials $K$
Parameter: Edge density $\rho$
Output: Binary matrix $A$ ;

1: Normalize probabilistic vector:

\hat{\mathbf{a}}

=

\mathbf{a}/\|\mathbf{a}\|_{1}

2: for k = 1,2

\cdots

K do Draw binary vector

\mathbf{a}^{(k)}

by sampling

\lfloor\rho n\rfloor

edges according to probabilistic vector

\hat{\mathbf{a}}

.

3: end for

4: Choose a vector

\mathbf{a}^{*}

from

\{\mathbf{a}^{(k)}\}

which yields the smallest loss

\mathcal{L}_{attack}

.

5: Convert

\mathbf{a}^{*}

to binary adjacency matrix

A

6: return

A

3 Proof of Edge Influence

Theorem 1.

The adversary advantage is greater for edges with greater influence.

The proof is based on the lemma 1 from wu2016methodology.

Lemma 1.

Suppose the target model $f$ is trained on data distribution $p(\mathcal{X},\mathcal{Y})$ . $\mathcal{X}=(x_{s},x_{ns})$ , where $x_{s}$ and $x_{ns}$ denote the sensitive and non-sensitive part of feature respectively. The optimal adversary advantage is

P_{\mathcal{X}\sim p(\mathcal{X},\mathcal{Y})}[f(x_{s}=1,x_{ns})\neq f(x_{s}=0,x_{ns})].

Proof.

In our graph setting, $x_{ns}$ refers to feature matrix $X$ and $x_{s}$ refers to edges. Set $P[f^{i}_{\theta^{*}}(A,X)=y_{i}]$ = $P_{f_{\theta^{*}}}(y_{i}~{}|~{}A,X)=p$ ; $P[f^{i}_{\theta^{*}}(A_{-e},X)=y_{i}]=P_{f_{\theta^{*}}}(y_{i}~{}|~{}A_{-e},X)=q$ . Without loss of generality, the prediction accuracy is higher with edge $e$ . So, we set $q\leq p$ . The adversary advantage is $Adv=[p(1-q)+q(1-p)]$ . Through variable substitution ( $x=p-q,y=p+q$ ), we have $Adv=(y+\frac{x^{2}-y^{2}}{2})$ and $\frac{\partial Adv}{\partial\mathcal{I}(e)}=\frac{\partial Adv}{\partial x}=p-q\geq 0$ . ∎