A systematic study of model extraction attacks against graph foundation models

The paper systematically studies model extraction attacks (MEA) against graph foundation models (GFM), and the authors say this is the first systematic study in this direction. The study formalizes a black-box threat model and defines six practical attack scenarios, covering domain-level and graph-level extraction targets, architecture mismatch, limited query budgets, partial node access, and differences in training data. To carry out the attacks, the authors propose a lightweight extraction method that trains an attacker encoder through supervised regression on graph embeddings, so that even without contrastive pretraining data it can stay aligned with the victim text encoder and retain zero-shot inference capability on unseen graphs. Experiments on seven datasets show that the attacker can approximate the victim model at only a small fraction of the original training cost, with almost no loss in accuracy. The authors point out that GFMs greatly expand the attack surface of MEA, and that large-scale graph learning systems need deployment-oriented security defenses.