Taipan: A Query-free Transfer-based Multiple Sensitive Attribute Inference Attack Solely from Publicly Released Graphs

Graph-structured data underpin a wide spectrum of modern applications. However, complex graph topologies and homophilic patterns can facilitate attribute inference attacks (AIAs) by enabling sensitive information leakage to propagate across local neighborhoods. Existing AIAs predominantly assume that adversaries can probe sensitive attributes through repeated model queries. Such assumptions are often impractical in real-world settings due to stringent data protection regulations, prohibitive query budgets, and heightened detection risks, especially when inferring multiple sensitive attributes. More critically, this model-centric perspective obscures a pervasive blind spot: $\mathbf{\text{intrinsic}}\mathbf{\text{multiple}}\mathbf{\text{sensitive}}\mathbf{\text{information}}\mathbf{\text{leakage}}\mathbf{\text{arising}}\mathbf{\text{solely}}\mathbf{\text{from}}\mathbf{\text{publicly}}\mathbf{\text{released}}\mathbf{\text{graphs.}}$ To exploit this unexplored vulnerability, we introduce a new attack paradigm and propose $\mathbf{\text{Taipan,}}\mathbf{\text{the}}\mathbf{\text{first}}\mathbf{\text{query-free}}\mathbf{\text{transfer-based}}\mathbf{\text{attack}}\mathbf{\text{framework}}\mathbf{\text{for}}\mathbf{\text{multiple}}\mathbf{\text{sensitive}}\mathbf{\text{attribute}}\mathbf{\text{inference}}\mathbf{\text{attacks}}\mathbf{\text{on}}\mathbf{\text{graphs}}\mathbf{\text{(G-MSAIAs).}}$ Taipan integrates \emph{Hierarchical Attack Knowledge Routing} to capture intricate inter-attribute correlations, and \emph{Prompt-guided Attack Prototype Refinement} to mitigate negative transfer and performance degradation. We further present a systematic evaluation framework tailored to G-MSAIAs. Extensive experiments on diverse real-world graph datasets demonstrate that Taipan consistently achieves strong attack performance across same-distribution settings and heterogeneous similar- and out-of-distribution settings with mismatched feature dimensionalities, and remains effective even under rigorous differential privacy guarantees. Our findings underscore the urgent need for more robust multi-attribute privacy-preserving graph publishing methods and data-sharing practices.