Graph neural networks enhanced with large language models scored better on node classification than a shallow text baseline, but they also gave privacy attacks stronger signals, according to a new computational study. The pattern appeared across six real-world graphs containing both network structure and text, spanning social, citation and e-commerce settings.
The study therefore describes a privacy-utility tension: the enhanced models had higher classification accuracy while also showing higher attack performance in the tested comparisons. The findings concern model outputs under specific settings and do not show that every LLM-enhanced graph model creates greater privacy risk or that particular people’s information was disclosed.
What the researchers tested
The systems combine text attached to each node with the links between nodes. Feature enhancers were paired with seven graph neural network backbones, producing 42 victim-model configurations for the evaluation.
The comparison was a shallow representation built from Bag-of-Words and Word2Vec, referred to in the study as Shallow. The datasets used a 10% training, 10% validation and 80% test split. Each experiment was repeated five times with different random seeds, and the results were averaged.
The privacy tests assumed a black-box attacker: someone able to query a model and see the probability scores it assigns to possible node classes, but not its internal parameters or architecture. The evaluation covered three attack surfaces: link inference, label inference and membership inference, using six representative attack methods.
The accuracy gain came with clearer signals
Across the evaluated datasets, the enhanced models consistently beat Shallow on node classification. One reported example comes from Cora with a GCN backbone: the Linq-enhanced model reached 84.8% accuracy, compared with 80.8% for Shallow. The paper also reports plus-or-minus values of 0.4 and 1.1 percentage points, but does not specify what those values represent or report inferential significance tests.
The three attack types look for different clues. Link-inference attacks test whether two nodes are connected. Label-inference attacks try to recover a node’s class. Membership-inference attacks try to distinguish nodes that belonged to the model’s training set from those that did not. In the GCN analyses, the enhanced variants generally produced higher attack performance than Shallow on all three fronts.
The enhanced models were relatively close to one another on link attacks, while their label and membership leakage varied by feature enhancer. In the Tape-Arxiv23 analysis, Linq showed a clearer separation between connected and unconnected pairs, a larger gap between nodes from the same and different classes, and a wider difference in prediction confidence between members and non-members.
Privacy defenses reduced attacks, but not for free
The researchers also tested differential privacy, using perturbations at the embedding, link and label levels. In the described embedding-level experiment, six local mechanisms were tested against link, label and membership attacks on Tape-Arxiv23, using a GCN with the Linq enhancer and an embedding privacy budget set at 5. The paper reports lower performance for all three attack types, alongside a significant drop in utility.
The budget mattered. Under the MB mechanism on Tape-Arxiv23 with the same model setting, both link-attack AUC, a score for attack performance, and utility accuracy declined as the embedding privacy budget decreased across the tested settings of 10.0, 5.0, 1.0, 0.5 and 0.1. The supplied findings give the direction of the change, not exact values at each setting.
Perturbing the graph structure or labels showed the same broad trade-off. Link-level randomized response reduced the effectiveness of the link attack but noticeably degraded utility, while label-level k-randomized response partly reduced label-attack performance and lowered classification accuracy.
What remains uncertain
The evaluation used black-box access to model outputs and measured attack AUC or accuracy under the selected datasets, models and threat settings. Its results do not provide calibrated probabilities of privacy loss or establish how the attack scores would translate into disclosure in a deployment.
The supplied analysis also flags unresolved documentation issues. One part of the dataset description names Pubmed, while the dataset table and results use CiteSeer. The defense discussion initially names Cora, but the detailed embedding-DP experiment refers to Tape-Arxiv23. Exact plotted values for parts of the defense results are not reliably recoverable from the supplied text.
The document is an arXiv preprint, version 1, dated 26 August 2026. The reported pattern remains limited to the six datasets, selected feature enhancers, seven backbones and tested attack settings; whether it holds across other graph domains, tasks, models or access regimes remains open.
Paper data and sources
Original title: Are LLM-Enhanced GNNs Privacy-Safe?
Authors: Longzhu He, Zelang Wen, Chaozhuo Li, Sen Su
Journal/Repository: arXiv
Status: Preprint, not yet peer-reviewed
First online: 2026-08-26
DOI: Not available
Original paper · Full text