Mapp: A model-agnostic privacy-preserving framework for two-party graph neural network inference

Graph neural networks (GNNs) have achieved remarkable success in critical domains such as healthcare and finance, yet deploying GNN-based prediction services raises privacy concerns for both clients’ sensitive graph data and servers’ proprietary models. Existing secure inference protocols for neural networks face significant challenges when applied to GNNs: CNN-oriented approaches cannot efficiently handle graph-specific operations, while GNN-specific protocols either make restrictive assumptions (e.g., public topology) or employ architecture-specific designs, necessitating substantial redesign for each new GNN variant and hindering broad deployment. We present MAPP, a model-agnostic privacy-preserving framework addressing these challenges through two innovations. First, we employ knowledge distillation to train lightweight proxy GNNs that replicate diverse target architectures. This enables a single optimized secure protocol to serve multiple GNN variants, eliminating architecture-specific redesign while reducing protocol complexity through lightweight proxy models. Second, we introduce graph-aware protocol optimizations that exploit sparsity to eliminate encrypted multiplications in neighborhood aggregation and move encrypted weight multiplications to the offline phase. Evaluation across 7 datasets and 4 target architectures demonstrates that 79% of proxy models match or exceed target accuracy, with improvements up to 5 percentage points. Our optimized protocol achieves 8.8-14.2 ×  online latency reduction and 4.8-7.6 ×  communication reduction, enabling efficient secure GNN inference.