A question about the black-box MIA?

[scottshufe]

Hi, thanks for your excellent work and codes first.

I have read the code in src/MIA/black-box/Shadow/graphsage_Cora and I have a question about it:

Usually, when we launch MIAs, we use an auxiliary dataset that completely disjoints with the target dataset to train the shadow model (as you claimed in your article - 'the datasets are assumed to be non-overlapping, i.e, 𝐺𝑡𝑟𝑎𝑖𝑛 ∩𝐺𝑎𝑢𝑥 = 𝜙'). But it seems that you didn't follow this setting in your experiments. When training the target model and the shadow model, you randomly sampled a set of nodes from the full graph, respectively, but didn't make sure that these two node sets are non-overlapping.

I feel confused about this problem and sincerely look forward to your reply. :)