{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,28]],"date-time":"2026-05-28T00:02:40Z","timestamp":1779926560413,"version":"3.53.1"},"reference-count":41,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:00:00Z","timestamp":1785542400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:00:00Z","timestamp":1785542400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:00:00Z","timestamp":1785542400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-017"},{"start":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:00:00Z","timestamp":1785542400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"},{"start":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:00:00Z","timestamp":1785542400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-012"},{"start":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:00:00Z","timestamp":1785542400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:00:00Z","timestamp":1785542400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-004"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100010877","name":"Shenzhen Science and Technology Innovation Commission","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100010877","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Computer Standards & Interfaces"],"published-print":{"date-parts":[[2026,8]]},"DOI":"10.1016\/j.csi.2026.104154","type":"journal-article","created":{"date-parts":[[2026,3,2]],"date-time":"2026-03-02T20:35:22Z","timestamp":1772483722000},"page":"104154","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"C","title":["CGNNStealer: Cooperative data-free model extraction attack on graph neural networks"],"prefix":"10.1016","volume":"98","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-7952-7136","authenticated-orcid":false,"given":"Yulin","family":"Wu","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zelin","family":"Li","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Aiwei","family":"Liu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xiaozhen","family":"Sun","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yuxin","family":"Wang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8045-5264","authenticated-orcid":false,"given":"Junyi","family":"Li","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xuan","family":"Wang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"78","reference":[{"key":"10.1016\/j.csi.2026.104154_b1","doi-asserted-by":"crossref","first-page":"18","DOI":"10.1186\/s40537-023-00876-4","article-title":"A review of graph neural networks: concepts, architectures, techniques, challenges, datasets, applications, and future directions","volume":"11","author":"Khemani","year":"2024","journal-title":"J. Big Data"},{"key":"10.1016\/j.csi.2026.104154_b2","series-title":"Proc. Int. Conf. Mach. Learn.","first-page":"1263","article-title":"Neural message passing for quantum chemistry","author":"Gilmer","year":"2017"},{"key":"10.1016\/j.csi.2026.104154_b3","series-title":"Proc. Adv. Neural Inf. Process. Syst.","first-page":"14501","article-title":"Recipe for a general, powerful, scalable graph transformer","volume":"Vol. 35","author":"Ramp\u00e1\u0161ek","year":"2022"},{"key":"10.1016\/j.csi.2026.104154_b4","series-title":"Proc. Adv. Neural Inf. Process. Syst.","first-page":"64753","article-title":"Sgformer: Simplifying and empowering transformers for large-graph representations","volume":"Vol. 36","author":"Wu","year":"2023"},{"key":"10.1016\/j.csi.2026.104154_b5","series-title":"Polynormer: Polynomial-expressive graph transformer in linear time","author":"Deng","year":"2024"},{"key":"10.1016\/j.csi.2026.104154_b6","series-title":"Proc. Int. Conf. Artif. Intell. Smart Commun.","first-page":"1039","article-title":"GNN model based on node classification forecasting in social network","author":"Awasthi","year":"2023"},{"key":"10.1016\/j.csi.2026.104154_b7","article-title":"Graph neural networks and their current applications in bioinformatics","volume":"12","author":"Zhang","year":"2021","journal-title":"Front. Genet."},{"issue":"2","key":"10.1016\/j.csi.2026.104154_b8","doi-asserted-by":"crossref","first-page":"494","DOI":"10.1109\/TCCN.2023.3235719","article-title":"MAGNNETO: A graph neural network-based multi-agent system for traffic engineering","volume":"9","author":"Bern\u00e1rdez","year":"2023","journal-title":"IEEE Trans. Cogn. Commun. Netw."},{"key":"10.1016\/j.csi.2026.104154_b9","series-title":"Intellectual property in graph-based machine learning as a service: Attacks and defenses","author":"Li","year":"2025"},{"issue":"9","key":"10.1016\/j.csi.2026.104154_b10","doi-asserted-by":"crossref","first-page":"8729","DOI":"10.1109\/TKDE.2022.3207915","article-title":"Model inversion attacks against graph neural networks","volume":"35","author":"Zhang","year":"2022","journal-title":"IEEE Trans. Knowl. Data Eng."},{"key":"10.1016\/j.csi.2026.104154_b11","series-title":"Proc. IEEE\/CVF Conf. Comput. Vis. Pattern Recognit.","first-page":"4954","article-title":"Knockoff nets: Stealing functionality of black-box models","author":"Orekondy","year":"2019"},{"key":"10.1016\/j.csi.2026.104154_b12","series-title":"Marich: A query-efficient distributionally equivalent model extraction attack","first-page":"72412","author":"Karmakar","year":"2023"},{"key":"10.1016\/j.csi.2026.104154_b13","series-title":"Proc. IEEE\/CVF Conf. Comput. Vis. Pattern Recognit.","first-page":"4771","article-title":"Data-free model extraction","author":"Truong","year":"2021"},{"key":"10.1016\/j.csi.2026.104154_b14","series-title":"Proc. IEEE\/CVF Conf. Comput. Vis. Pattern Recognit.","first-page":"13814","article-title":"MAZE: Data-free model stealing attack using zeroth-order gradient estimation","author":"Kariyappa","year":"2021"},{"key":"10.1016\/j.csi.2026.104154_b15","series-title":"Proc. AAAI Conf. Artif. Intell.","first-page":"9614","article-title":"Disguide: Disagreement-guided data-free model extraction","volume":"Vol. 37","author":"Rosenthal","year":"2023"},{"key":"10.1016\/j.csi.2026.104154_b16","series-title":"MEGA: Model stealing via collaborative generator-substitute networks","author":"Hong","year":"2022"},{"key":"10.1016\/j.csi.2026.104154_b17","series-title":"Proc. USENIX Secur. Symp.","first-page":"5251","article-title":"Unveiling the secrets without data: Can graph neural networks be exploited through data-free model extraction attacks?","author":"Zhuang","year":"2024"},{"key":"10.1016\/j.csi.2026.104154_b18","series-title":"Proc. Int. Conf. Mach. Learn.","first-page":"33674","article-title":"Towards understanding generalization of graph neural networks","volume":"Vol. 202","author":"Tang","year":"2023"},{"issue":"11","key":"10.1016\/j.csi.2026.104154_b19","doi-asserted-by":"crossref","first-page":"139","DOI":"10.1145\/3422622","article-title":"Generative adversarial networks","volume":"63","author":"Goodfellow","year":"2020","journal-title":"Commun. ACM"},{"key":"10.1016\/j.csi.2026.104154_b20","series-title":"Proc. USENIX Secur. Symp.","first-page":"1309","article-title":"Exploring connections between active learning and model extraction","author":"Chandrasekaran","year":"2020"},{"key":"10.1016\/j.csi.2026.104154_b21","series-title":"Adversarial model extraction on graph neural networks","author":"DeFazio","year":"2019"},{"key":"10.1016\/j.csi.2026.104154_b22","series-title":"Proc. ACM Asia Conf. Comput. Commun. Secur.","first-page":"337","article-title":"Model extraction attacks on graph neural networks: Taxonomy and realisation","author":"Wu","year":"2022"},{"key":"10.1016\/j.csi.2026.104154_b23","doi-asserted-by":"crossref","DOI":"10.1016\/j.knosys.2024.112144","article-title":"A realistic model extraction attack against graph neural networks","volume":"300","author":"Guan","year":"2024","journal-title":"Knowl.-Based Syst."},{"key":"10.1016\/j.csi.2026.104154_b24","series-title":"Proc. IEEE Symp. Secur. Priv.","first-page":"1175","article-title":"Model stealing attacks against inductive graph neural networks","author":"Shen","year":"2022"},{"key":"10.1016\/j.csi.2026.104154_b25","series-title":"Proc. Adv. Neural Inf. Process. Syst.","first-page":"19314","article-title":"Iterative deep graph learning for graph neural networks: Better and robust node embeddings","volume":"Vol. 33","author":"Chen","year":"2020"},{"key":"10.1016\/j.csi.2026.104154_b26","series-title":"Efficient model-stealing attacks against inductive graph neural networks","author":"Podhajski","year":"2024"},{"key":"10.1016\/j.csi.2026.104154_b27","series-title":"Proc. Adv. Neural Inf. Process. Syst.","first-page":"22667","article-title":"SLAPS: Self-supervision improves structure learning for graph neural networks","volume":"Vol. 34","author":"Fatemi","year":"2021"},{"key":"10.1016\/j.csi.2026.104154_b28","series-title":"Proc. IEEE\/CVF Conf. Comput. Vis. Pattern Recognit.","first-page":"15115","article-title":"Towards efficient data free black-box adversarial attack","author":"Zhang","year":"2022"},{"key":"10.1016\/j.csi.2026.104154_b29","series-title":"Proc. AAAI Conf. Artif. Intell.","first-page":"667","article-title":"Exploring query efficient data generation towards data-free model stealing in hard label setting","volume":"Vol. 39","author":"Pei","year":"2025"},{"key":"10.1016\/j.csi.2026.104154_b30","series-title":"Semi-supervised classification with graph convolutional networks","author":"Kipf","year":"2016"},{"key":"10.1016\/j.csi.2026.104154_b31","series-title":"Proc. Adv. Neural Inf. Process. Syst.","article-title":"Inductive representation learning on large graphs","volume":"Vol. 30","author":"Hamilton","year":"2017"},{"key":"10.1016\/j.csi.2026.104154_b32","series-title":"Graph attention networks","author":"Veli\u010dkovi\u0107","year":"2017"},{"key":"10.1016\/j.csi.2026.104154_b33","series-title":"Proc. ACM Web Conf.","first-page":"1392","article-title":"Towards unsupervised deep graph structure learning","author":"Liu","year":"2022"},{"key":"10.1016\/j.csi.2026.104154_b34","series-title":"Active learning for graph embedding","author":"Cai","year":"2017"},{"key":"10.1016\/j.csi.2026.104154_b35","series-title":"Proc. ACM Southeast Conf.","first-page":"252","article-title":"Feature selection and extraction for graph neural networks","author":"Acharya","year":"2020"},{"key":"10.1016\/j.csi.2026.104154_b36","series-title":"Proc. IEEE\/CVF Conf. Comput. Vis. Pattern Recognit.","first-page":"9211","article-title":"Exploiting edge features for graph neural networks","author":"Gong","year":"2019"},{"key":"10.1016\/j.csi.2026.104154_b37","series-title":"Proc. ACM SIGKDD Int. Conf. Knowl. Discov. Data Min.","first-page":"338","article-title":"Towards deeper graph neural networks","author":"Liu","year":"2020"},{"key":"10.1016\/j.csi.2026.104154_b38","series-title":"Proc. Adv. Neural Inf. Process. Syst.","first-page":"22118","article-title":"Open graph benchmark: Datasets for machine learning on graphs","volume":"Vol. 33","author":"Hu","year":"2020"},{"key":"10.1016\/j.csi.2026.104154_b39","series-title":"Proc. Adv. Neural Inf. Process. Syst.","first-page":"97650","article-title":"Classic gnns are strong baselines: Reassessing gnns for node classification","volume":"Vol. 37","author":"Luo","year":"2024"},{"key":"10.1016\/j.csi.2026.104154_b40","series-title":"Proc. ACM Asia Conf. Comput. Commun. Secur.","first-page":"1231","article-title":"Model extraction attacks revisited","author":"Liang","year":"2024"},{"key":"10.1016\/j.csi.2026.104154_b41","series-title":"Proc. AAAI Conf. Artif. Intell.","first-page":"3438","article-title":"Measuring and relieving the over-smoothing problem for graph neural networks from the topological view","volume":"Vol. 34","author":"Chen","year":"2020"}],"container-title":["Computer Standards & Interfaces"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0920548926000280?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0920548926000280?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,5,27]],"date-time":"2026-05-27T23:07:35Z","timestamp":1779923255000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0920548926000280"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,8]]},"references-count":41,"alternative-id":["S0920548926000280"],"URL":"https:\/\/doi.org\/10.1016\/j.csi.2026.104154","relation":{},"ISSN":["0920-5489"],"issn-type":[{"value":"0920-5489","type":"print"}],"subject":[],"published":{"date-parts":[[2026,8]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"CGNNStealer: Cooperative data-free model extraction attack on graph neural networks","name":"articletitle","label":"Article Title"},{"value":"Computer Standards & Interfaces","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.csi.2026.104154","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 Elsevier B.V. All rights are reserved, including those for text and data mining, AI training, and similar technologies.","name":"copyright","label":"Copyright"}],"article-number":"104154"}}