DRGW: Learning Disentangled Representations for Robust Graph Watermarking

TL;DR

DRGW presents a disentangled representation learning framework for robust graph watermarking, addressing entanglement and discretization flaws by separating an invariant structural representation $h_s$ from an independent watermark carrier $h_w$, coupled with a graph-aware INN for lossless watermark transformation and a structure-aware editor for durable discrete edits. The methodology yields high detectability, strong robustness under structural and adaptive attacks, and superior transparency compared with structure-space and latent-space baselines, validated across 18 real-world graphs. A statistical verification protocol based on a matched-filter statistic ensures principled ownership attribution with controlled false-positive rates. The work offers a scalable, topology-agnostic approach to watermarking that preserves graph utility and generalizes across diverse graph domains, with clear practical implications for IP protection and provenance in graph-structured data.

Abstract

Graph-structured data is foundational to numerous web applications, and watermarking is crucial for protecting their intellectual property and ensuring data provenance. Existing watermarking methods primarily operate on graph structures or entangled graph representations, which compromise the transparency and robustness of watermarks due to the information coupling in representing graphs and uncontrollable discretization in transforming continuous numerical representations into graph structures. This motivates us to propose DRGW, the first graph watermarking framework that addresses these issues through disentangled representation learning. Specifically, we design an adversarially trained encoder that learns an invariant structural representation against diverse perturbations and derives a statistically independent watermark carrier, ensuring both robustness and transparency of watermarks. Meanwhile, we devise a graph-aware invertible neural network to provide a lossless channel for watermark embedding and extraction, guaranteeing high detectability and transparency of watermarks. Additionally, we develop a structure-aware editor that resolves the issue of latent modifications into discrete graph edits, ensuring robustness against structural perturbations. Experiments on diverse benchmark datasets demonstrate the superior effectiveness of DRGW.

Figures (5)

• Figure 1: Conceptual comparison of our method with existing scheme. The prevailing latent-space watermarking is constrained by two fundamental flaws: information entanglement, which compromises transparency and robustness, and discretization-induced watermark degradation, where the faint signal is discarded during conversion from continuous latent representation to a discrete graph structure. Our DRGW framework resolves these issues through representation disentanglement and structure-aware editing.
• Figure 2: Architecture of the DRGW. The top in the figure illustrates the watermark embedding and verification pipelines. The bottom in the figure details the mechanisms of our key components: the Disentangled Encoder (left) uses contrastive and orthogonality losses to separate representations; the Graph-aware INN (middle) conditions its transformation on the structural representation $h_s$; and the structure-aware Editor (right) uses the learned representations to predict robust graph edits.
• Figure 3: Analysis of Controllability. The heatmaps illustrate the trade-off between (a) Robustness and (b) Fidelity Loss as a function of watermark strength ($\alpha$) and editing budget ($k$). The star indicates our default operating point, which offers high robustness for low fidelity loss.
• Figure 4: Mechanism Verification: Visual proof of latent space disentanglement. (a) In the entangled subspace, information is mixed. (b, c) DRGW successfully separates structural ($h_s$) and carrier ($h_w$) information, preventing mutual interference.
• Figure 5: Resilience of the Carrier Subspace $h_w$: The distribution maintains its structural integrity even under severe 50% node deletion (a) and edge flipping (b) attacks. The macroscopic structure is preserved, enabling effective watermark recovery.