Defense method for inferring attack process based on simulated diagram properties
By simulating the graph property inference attack process and graph embedding perturbation technology, the defense problem of missing auxiliary data sets in graph data applications is solved, which significantly improves the defense ability of graph embedding vector leakage, reduces the success rate of inferred attacks, and is suitable for practical purposes. Application scenario.
Patent Information
- Application Number
- CN202411340348.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-25
- Publication Date
- 2025-01-07
AI Technical Summary
The prior art lacks effective defense measures in graph data applications to prevent inference attacks based on graph embedding vectors, especially in the absence of auxiliary data sets, attackers can infer the properties of the original graph data in reverse by stealing graph embedding vectors. , leading to intellectual property and privacy security threats.
Adopt the defense method based on the simulated graph properties inferring the attack process, and train the graph data generator through the data-free graph knowledge distillation model framework to generate a diverse graph data set, and use graph embedding perturbation technology to process the graph embedding vectors to reduce attackers inference ability.
It effectively improves the defense ability of graph embedding vector leakage, reduces the success rate of inferred attacks, makes it difficult for attackers to obtain accurate properties of original graph data through reverse inference, and is suitable for potential attack risk prediction in practical application scenarios.
Smart Images
Figure CN119272839A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the field of graph data application and relates to a defense method for inferring an attack process based on simulated graph properties. Background Art
[0002] In today's society, many data are presented in the form of graph data. For example, atoms in drug compounds can be regarded as nodes in graph data, and chemical bonds between atoms can be represented by edges in graph data. For another example, in a hospital database, the patient's identity information and health status can be regarded as nodes in graph data, and the patient's medical records can be regarded as edges in the graph. These data stored in graph structures often contain huge commercial value or personal privacy information. Once part of the information or structure of the graph data is leaked during application, it will bring serious harm. For example, if some chemical bonds (edges of the graph) or structures in drug compounds developed by a pharmaceutical company are inferred by attackers, it will threaten the intellectual property rights of the pharmaceutical company. For another example, if an individual's medical records are inferred by attackers, it will cause great damage to the individual's privacy security. Therefore, people need to pay attention to the attacks and infringements that graph data may suffer during application.
[0003] At present, the application of graph structured data has penetrated into many fields of society (such as social networks, financial networks, medical records, development of molecular compounds, etc.). The most commonly used and most efficient technology for processing and analyzing graph structured data is graph neural networks (GNNs). Graph neural networks use deep learning technology to convert raw graph data into graph embedding vectors that are easy to store, process, and analyze, and then use these graph embedding vectors for downstream task analysis (such as graph classification tasks, etc.). However, when using graph neural networks to process and analyze graph data, once an attacker steals the graph embedding vector of the intermediate process, the attacker can reversely infer some properties of the original graph data (such as the number of nodes in the graph, the number of edges in the graph, the density of the graph, etc.) through the information contained in the graph embedding vector. This scenario where the graph embedding vector may be leaked to the attacker exists in actual applications. For example, the Embedding Project service provided by Google allows users to provide the platform with graph embedding vectors, and the platform returns the corresponding graph properties to the user.
[0004] At present, most of the attacks based on graph embedding vectors to infer the corresponding original graph data require an auxiliary dataset, and the auxiliary dataset is required to have the same distribution as the training dataset of the target graph neural network. Although this attack method is difficult to implement due to the need for a high-quality and large-volume auxiliary dataset, from a practical application perspective, this risk still exists, and there is no corresponding prevention method in the face of this attack method. Therefore, defense methods for graph data need to be studied. Summary of the invention
[0005] In view of this, the purpose of the present invention is to provide a defense method based on simulating a graph property inference attack process. In order to pay more attention to graph property inference attacks in the absence of auxiliary sets (i.e., a broader and more realistic scenario), the present invention simulates a graph property inference attack process based on graph embedding that does not require additional auxiliary data sets, and proposes a targeted defense method based on graph embedding perturbation technology for this simulation process to prevent possible graph property inference attacks.
[0006] In order to achieve the above object, the present invention provides the following technical solutions:
[0007] A defense method for inferring an attack process based on the properties of a simulation graph, comprising at least the following steps:
[0008] S1. Simulate an attacker to establish a dataless graph knowledge distillation model framework, and train the graph data generator in it by combining the teacher graph encoder and the student graph encoder in the framework;
[0009] S2. Generate a graph data set through the trained graph data generator, obtain corresponding graph properties and graph embedding vector sets from the graph data set, and train the graph property inference attack network according to the corresponding graph properties and graph embedding vector sets;
[0010] S3, steal the target graph embedding vector from the attacker's perspective, and input it into the graph property inference attack network to obtain the graph property data of the target graph;
[0011] S4. Filter out target graphs that are vulnerable to inference attacks by simulating the graph property inference attack process, and perform pre-defense processing on the filtered target graphs.
[0012] Further, in step S1, a graph data generator is established from the perspective of simulating an attacker. Specifically include:
[0013] S11. Construct a data-free graph knowledge distillation model framework, which includes a teacher graph encoder Student Image Encoder And graph data generator Among them, the teacher graph encoder For graph encoders that can be directly accessed, student graph encoders The graph encoder constructed for simulating an attacker, where the student graph encoder is constructed under white-box conditions Figure Coder with Teachers The same structure, the student encoder built under black box conditions Compared to the teacher image encoder The structure is simpler and the number of parameters is smaller;
[0014] S12. Using Graph Data Generator Generate graph data, which includes:
[0015] S121. From the standard normal distribution Sampling a random vector Feed it into the graph data generator Get a graph data represented by a matrix Where N represents the number of nodes in the graph, and H represents the feature vector dimension of the node;
[0016] S122. Calculate the adjacency matrix of the graph: A = σ(MM T ), where σ(·) is the logistic sigmoid function;
[0017] S123. From the attacker's perspective, a threshold value τ is set to convert each value in the adjacency matrix A from [0,1] to {0,1}, expressed as: Among them, a ij Represents the value in the adjacency matrix A;
[0018] S13. Training graph data generator From the standard normal distribution Continuously sample to obtain several random vectors, and input several random vector sets into the graph data generator Get the graph dataset and input the graph dataset into the teacher graph encoder Student Image Encoder By Teacher Chart Coder and the student graph encoder Output difference pair graph data generator and Student Graph Encoder Conduct training.
[0019] Further, in step S13, the student graph encoder is trained using a min-max adversarial training method. and graph data generator For training, it is expressed as:
[0020]
[0021] in, Indicates measurement and The loss function KL is commonly used for knowledge distillation of output differences. The KL divergence is expressed as D(P||Q), which represents the information loss generated when the probability distribution Q is used to fit the true distribution P:
[0022]
[0023] Among them, P and Q represent two probability distributions respectively, x represents the event in the probability distribution, and the smaller the value of KL divergence, the more similar the two probability distributions are; the larger the value, the more dissimilar the two probability distributions are;
[0024] In the adversarial training process, the back propagation algorithm is used for information propagation. The back propagation paths are different under black box and white box conditions. Under black box conditions, the back propagation gradient flow passes through the student graph encoder. In the white-box case, the back-propagated gradient flows through the teacher graph encoder
[0025] Further, in step S2, from the attacker's perspective, the following steps are implemented:
[0026] S21. Using the trained graph data generator Generate a graph dataset Each graph data in the graph dataset The input graph property extraction module statistically calculates the corresponding graph properties: the number of nodes in the graph The number of edges in the graph Graph Density
[0027] S22. Through the graph data generator Generated graph dataset Input Teacher Graph Encoder Output is the graph embedding vector set Embed the corresponding graph into a vector Paired with the extracted graph properties, we get the training dataset:
[0028] S23, input the obtained training data set into the GPI-Net training module, and train the graph property inference attack network GPI-Net through supervised learning training.
[0029] Further, in step S3, the attacker is simulated to steal the embedding vector of the target graph, and the stolen target graph is embedded into the vector Etarget Input the trained graph property inference attack network GPI-Net In the above example, we can infer the graph properties of the original corresponding graph data: the number of nodes in the graph The number of edges in the graph Graph Density
[0030] Further, in step S4, according to the number of nodes actually extracted from the graph The number of edges in the graph Graph Density And the number of nodes in the graph obtained by simulated attack: The number of edges in the graph Graph Density Screen out the target graphs that are vulnerable to inference attacks, and perform pre-defense on the screened target graphs that are vulnerable to inference attacks from the perspective of the defender. The pre-defense means are: embedding the graph generated in the process of using the graph application E target When , the graph embedding vector perturbation technique is used to process the graph embedding vector.
[0031] Further, in step S4, the graph embedding vector perturbation technique at least includes: a vector channel value preservation method: sorting the channel values in a graph embedding vector i =(a1,a2,…,a n-1 ,a n ), where a1>a2>…>a n-1 >a n , keep the channel values of the previous preset ratio in this order, and set the remaining channel values to zero; vector channel value precision adjustment method: adjust the precision of each channel value of a graph embedded in a vector; add noise perturbation method: embed a graph into a vector e i =(a1,a2,…,a n-1 ,a n ) is added with Gaussian noise.
[0032] The beneficial effects of the present invention are:
[0033] By simulating the attacker's inference attack process and training the data-free graph knowledge distillation model framework, the graph data generator can generate diversified graph data, which helps to improve the generalization ability of subsequent graph property inference attack models, making them more adaptable to actual application scenarios and able to predict potential attack risks in advance.
[0034] Aiming at the predicted potential inference attack risks, the present invention proposes graph embedding perturbation technology (GE-T, GE-R, GE-N), which can effectively change the characteristics of graph embedding vectors, making it difficult for attackers to obtain the accurate properties of original graph data through reverse inference, thereby reducing the success rate of inference attacks and significantly improving the defense capability against leakage of graph embedding vectors.
[0035] Other advantages, objectives and features of the present invention will be described in the following description to some extent, and to some extent, will be obvious to those skilled in the art based on the following examination and study, or can be taught from the practice of the present invention. The objectives and other advantages of the present invention can be realized and obtained through the following description. BRIEF DESCRIPTION OF THE DRAWINGS
[0036] In order to make the purpose, technical solutions and advantages of the present invention more clear, the present invention will be described in detail below in conjunction with the accompanying drawings, wherein:
[0037] Figure 1 The present invention provides a flowchart of a simulated attacker performing a graph property inference attack to obtain a vulnerable target graph. DETAILED DESCRIPTION
[0038] The following describes the embodiments of the present invention by specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the illustrations provided in the following embodiments only illustrate the basic concept of the present invention in a schematic manner, and the following embodiments and features in the embodiments can be combined with each other without conflict.
[0039] Among them, the drawings are only used for illustrative explanations, and they only represent schematic diagrams rather than actual pictures, and should not be understood as limitations on the present invention. In order to better illustrate the embodiments of the present invention, some parts of the drawings may be omitted, enlarged or reduced, and do not represent the size of actual products. For those skilled in the art, it is understandable that some well-known structures and their descriptions in the drawings may be omitted.
[0040] The same or similar numbers in the drawings of the embodiments of the present invention correspond to the same or similar parts; in the description of the present invention, it should be understood that if the terms "upper", "lower", "left", "right", "front", "rear", etc. indicate the orientation or position relationship, they are based on the orientation or position relationship shown in the drawings, which is only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operate in a specific orientation. Therefore, the terms describing the position relationship in the drawings are only used for illustrative purposes and cannot be understood as limiting the present invention. For ordinary technicians in this field, the specific meanings of the above terms can be understood according to specific circumstances.
[0041] See also Figure 1, which is a defense method based on inferring the attack process based on the properties of the simulation graph.
[0042] Before introducing the content of the solution, two essential concepts in the present invention are first stated.
[0043] 1. Graph knowledge distillation. Knowledge distillation is a teaching and model compression technique that aims to transfer knowledge from complex models to simplified models to reduce computational and storage overhead and improve model efficiency. This method was first proposed by Hinton et al. in 2015. In knowledge distillation, there are usually two models: a teacher model and a student model. The teacher model is usually a large, complex model with strong performance and generalization capabilities, but with high computational and storage costs. The student model is a small, simplified model that aims to "distill" knowledge from the teacher model so that it can still maintain good performance in resource-limited environments. Graph knowledge distillation is an extension of the knowledge distillation method, especially for graph neural networks (GNNs). In graph knowledge distillation, it usually involves extracting knowledge from a complex GNN model and then transferring this knowledge to a simpler GNN model. This helps to simplify the model structure, improve computational efficiency, and achieve high performance on resource-constrained devices. Through graph knowledge distillation, researchers can reduce computational and storage costs without sacrificing model performance, thereby promoting the application of GNN models deployed on edge devices and resource-constrained environments. This method has broad application prospects in graph data mining, recommendation systems, social network analysis and other fields.
[0044] 2. Graph Neural Networks and Graph Encoders: Graph Neural Networks (GNNs) are a type of neural network model that is specially designed for machine learning models that process graph structured data. Unlike traditional neural networks that process regularized data (such as images or text), GNNs are designed to capture and utilize the topological structure information of nodes and edges in the graph.
[0045] Taking the graph classification task as an example, in the graph classification task, the graph neural network GNNs can be represented as a function mapping: f:G→Y. Among them, G is the input graph data and Y is the output category label. GNNs can be seen as a combination of two modules f=f_cl°f_enc. Among them, f_enc:G→R^D is the graph encoder, which is used to encode the graph data into a low-dimensional vector representation (graph embedding vector) for subsequent machine learning tasks; f_cl:R^D→Y represents the downstream classifier, which classifies the graph embedding vector into the corresponding label.
[0046] Example
[0047] This embodiment provides a defense method based on inferring the attack process based on simulated graph properties. In this invention, the attacker's "no data" attack method is simulated: by constructing a no data graph knowledge distillation framework, a well-trained graph generator is obtained through adversarial training. pass Generate a dataset as a subsequent graph property inference attack model Training data set, and then training attack model Furthermore, the present invention proposes a defense method based on graph embedding perturbation based on the simulated inference attack process. Specifically, the present invention proposes a defense method based on the simulated graph property inference attack process, which finds the target graph that is vulnerable to inference attack by simulating the simulated graph property inference attack process, and then takes targeted prevention measures on the found target graph, such as Figure 1 As shown, it at least includes the following steps:
[0048] S1. Simulate an attacker to establish a dataless graph knowledge distillation model framework, and train the graph data generator in it by combining the teacher graph encoder and the student graph encoder in the framework;
[0049] S2. Graph data generator completed through training Generate graph dataset And from the graph dataset The corresponding graph properties and graph embedding vector sets are obtained According to the corresponding graph properties and graph embedding vector sets Train the graph property inference attack network GPI-Net-F;
[0050] S3. Steal the target graph embedding vector E from the attacker’s perspective target , and input it into the graph property inference attack network Obtain graph property data of the target graph;
[0051] S4. Filter out target graphs that are vulnerable to inference attacks by simulating the graph property inference attack process, and perform pre-defense processing on the filtered target graphs.
[0052] In this embodiment, step S1 establishes a graph data generator from the perspective of simulating an attacker. Specifically include:
[0053] S11. Simulate an attacker to build a data-free graph knowledge distillation model framework, which contains two graph encoders (“teacher graph encoder” "Student Image Encoder" ) and a graph data generator In the data-free graph knowledge distillation model framework built by the attacker, the accessible graph encoder is regarded as the “teacher graph encoder” Under white-box conditions, since we know the internal details of the graph encoder that we can access, we can construct a “student graph encoder” Structure and Same; under black box conditions, the attacker constructs a structure that is comparable to Simpler, with fewer parameters The current graph encoder API interface can be roughly divided into two types: black-box and white-box. Under the black-box condition, users can only input graph data and return the corresponding graph embedding vector through the API. Under the white-box condition, users can not only obtain the graph embedding vector but also know the internal details of the graph encoder. Attackers can access the graph encoder API interface like ordinary users.
[0054] S12. Generate graph data through the graph data generator. Assume that Sampling a random vector Feed it into the graph data generator Get a graph data represented by a matrix Where N represents the number of nodes in the graph, and H represents the dimension of the node's feature vector is H. The adjacency matrix of the graph is calculated as follows:
[0055] A=σ(MM T )
[0056] Where σ(·) is the logistic sigmoid function. Next, from the attacker’s perspective, a threshold τ (usually τ=0.5) is selected to transform each value in the adjacency matrix A from [0,1] to {0,1}, as follows:
[0057]
[0058] Among them, a ij Represents the adjacency matrix A.
[0059] S13. Training graph data generator By taking the standard normal distribution Continuously sample to get many random vectors. Input the random vector set into the graph data generator Get the graph data set and input these graph data into the "teacher graph encoder" respectively "Student Image Encoder" pass as well as The output difference of and Perform training. The mathematical expression of training is as follows:
[0060]
[0061] in, Indicates measurement and The loss function KL divergence (Kullback-Leibler divergence) is commonly used for knowledge distillation of output differences. KL divergence is represented by D(P||Q), which represents the information loss when the probability distribution Q is used to fit the true distribution P. The formula of KL divergence is as follows:
[0062]
[0063] Here, P and Q represent two probability distributions, and x represents an event in the probability distribution. The smaller the value of KL divergence, the closer the two probability distributions are; the larger the value, the less similar the two probability distributions are.
[0064] In this step, the attacker adopts an adversarial training strategy. In this iterative training process, in order to make the “student graph encoder” More and more able to learn "Teacher Picture Coder" The knowledge of the two should make the difference between the outputs smaller and smaller; and in order to speed up the training process, the graph data generator The distribution of the training data will be very different between the two. Therefore, the adversarial training is in the form of min-max. After continuous iterative training, The generated data distribution will be similar to the "teacher graph encoder" Distribution of the original training dataset, “Student Graph Encoder” Also because of learning The "knowledge", function and similar.
[0065] It is worth noting that the BP algorithm (Backpropagation algorithm) used in the adversarial training process has different backpropagation paths under black-box and white-box conditions. Under black-box conditions, the backpropagation gradient flows through the "student graph encoder" Under white-box conditions, the back-propagated gradient flows through the "teacher graph encoder"
[0066] In this embodiment, step S2 also implements the following steps from the attacker's perspective:
[0067] S21. Using the trained graph data generator Generate a graph dataset Each graph data in the graph dataset The input graph property extraction module statistically calculates the corresponding graph properties: the number of nodes in the graph The number of edges in the graph Graph Density
[0068] S22. Using the trained graph data generator Generated graph dataset Enter the "Teacher Picture Encoder" Output is the graph embedding vector set The attacker embeds the corresponding graph into vector Paired with the extracted graph properties, we get It is used as a training dataset for training the graph property inference attack network GPI-Net.
[0069] S23. Using the GPI-Net training module, according to the standard process of supervised learning, the graph property inference attack network GPI-Net-F is trained.
[0070] In this embodiment, in step S3, the attacker is simulated to steal the embedding vector of the target graph, and the stolen target graph is embedded into the vector E target Input your trained graph property inference attack network GPI-Net The graph properties of the original corresponding graph data can be inferred: the number of nodes in the graph The number of edges in the graph Graph Density In actual scenarios, the attacker can obtain the target graph embedding vector E target There are many ways to obtain graph data, for example: the currently popular service Encoder-as-a-Service (EaaS), users upload graph data to the platform, and the platform returns the graph embedding vector, which is at risk of being stolen by attackers; some companies will release graph encoders and some graph embedding vectors for users to use, at which time attackers can directly obtain the graph embedding vector.
[0071] In step S4 of this embodiment, firstly, according to the actually extracted graph property data: the number of nodes in the graph The number of edges in the graph Graph Density And the graph property data obtained by simulating attacks: the number of nodes in the graph The number of edges in the graph Graph Density Filter out target graphs that are vulnerable to inference attacks, that is, target graphs that are successfully attacked during simulated attacks.
[0072] The defender (usually a user or platform) performs pre-defense on the selected target graphs that are easy to be inferred and attacked. The specific method is: embedding E in the graph generated during the graph application processtarget When the graph embedding vector is returned (such as when the EaaS service platform returns the graph embedding vector), the graph embedding vector perturbation technology is first used, such as: retaining most of the vector channel values (Graph Embedding Thresholding, hereinafter referred to as GE-T), adjusting the vector value accuracy (Graph Embedding Rounding, hereinafter referred to as GE-R), adding slight noise perturbation (Graph Embedding Noising, hereinafter referred to as GE-N), and processing the graph embedding vector. The common principle of these three perturbation methods is that attackers who infer graph properties all use the information contained in the graph embedding vector to reversely infer the graph properties in the original graph data. Then, by slightly perturbing the graph embedding vector and generating an offset in the vector space, it is possible to increase the difficulty of reverse inference for attackers and greatly reduce the accuracy of inference attacks.
[0073] The following briefly introduces three types of disturbance:
[0074] Keep most of the vector channel values (GE-T): Sort the channel values in a graph embedding vector by a i =(a1,a2,…,a n-1 ,a n ), where a1>a2>…>a n-1 >a n For example, GE-T (TOP75%) means that only 75% of the maximum values are retained, and the remaining channel values are set to zero.
[0075] Adjust vector value precision (GE-R): adjust the precision of each channel value in a graph embedding vector. For example, GE-R (0.1) means adjusting the precision of each channel value a i Only one decimal place is retained.
[0076] Add slight noise perturbation (GE-N): embed a graph into a vector e i =(a1,a2,…,a n-1 ,a n ) adds slight Gaussian noise. For example, GE-N(2×STD) represents the i Add Gaussian noise with twice the standard deviation of the original.
[0077] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solution of the present invention can be modified or replaced by equivalents without departing from the purpose and scope of the technical solution, which should be included in the scope of the claims of the present invention.
Claims
1. A defense method for inferring an attack process based on the properties of a simulation graph, characterized in that: At least the following steps are included: S1. Simulate an attacker to establish a dataless graph knowledge distillation model framework, and train the graph data generator in it by combining the teacher graph encoder and the student graph encoder in the framework; S2. Generate a graph data set through the trained graph data generator, obtain corresponding graph properties and graph embedding vector sets from the graph data set, and train the graph property inference attack network according to the corresponding graph properties and graph embedding vector sets; S3, steal the target graph embedding vector from the attacker's perspective, and input it into the graph property inference attack network to obtain the graph property data of the target graph; S4. Filter out target graphs that are vulnerable to inference attacks by simulating the graph property inference attack process, and perform pre-defense processing on the filtered target graphs.
2. A defense method for inferring an attack process based on the properties of a simulation graph according to claim 1, characterized in that: In step S1, a graph data generator is established from the perspective of an attacker Specifically include: S11. Construct a data-free graph knowledge distillation model framework, which includes a teacher graph encoder Student Image Encoder And graph data generator Among them, the teacher graph encoder For graph encoders that can be directly accessed, student graph encoders The graph encoder constructed for the simulated attacker, where the student graph encoder constructed under white-box conditions Figure Coder with Teachers The same structure, the student encoder built under black box conditions Compared to the teacher image encoder The structure is simpler and the number of parameters is smaller; S12. Using Graph Data Generator Generate graph data, which includes: S121. From the standard normal distribution Sampling a random vector Feed it into the graph data generator Get a graph data represented by a matrix Where N represents the number of nodes in the graph, and H represents the feature vector dimension of the node; S122. Calculate the adjacency matrix of the graph: A = σ(MM T ), where σ(·) is the logistic sigmoid function; S123. From the attacker's perspective, a threshold value τ is set to convert each value in the adjacency matrix A from [0,1] to {0,1}, expressed as: Among them, a ij Represents the value in the adjacency matrix A; S13. Training graph data generator From the standard normal distribution Continuously sample to obtain several random vectors, and input several random vector sets into the graph data generator Get the graph dataset and input the graph dataset into the teacher graph encoder Student Image Encoder By Teacher Chart Coder and the student graph encoder Output difference pair graph data generator and Student Graph Encoder Conduct training.
3. A defense method for inferring an attack process based on the properties of a simulation graph according to claim 2, characterized in that: In step S13, the student graph encoder is trained using a min-max adversarial training method. and graph data generator For training, it is expressed as: in, Indicates measurement and The loss function KL is commonly used for knowledge distillation of output differences. The KL divergence is expressed as D(P||Q), which represents the information loss generated when the probability distribution Q is used to fit the true distribution P: Among them, P and Q represent two probability distributions respectively, x represents the event in the probability distribution, and the smaller the value of KL divergence, the more similar the two probability distributions are; the larger the value, the more dissimilar the two probability distributions are; In the adversarial training process, the back propagation algorithm is used for information propagation. The back propagation paths are different under black box and white box conditions. Under black box conditions, the back propagation gradient flow passes through the student graph encoder. In the white-box case, the back-propagated gradient flows through the teacher graph encoder 4. The method for defending against attack processes based on inferring the properties of simulation graphs according to claim 2, characterized in that: In step S2, from the attacker's perspective, the following steps are performed: S21. Using the trained graph data generator Generate a graph dataset Each graph data in the graph dataset The input graph property extraction module statistically calculates the corresponding graph properties: the number of nodes in the graph The number of edges in the graph Graph Density S22. Through the graph data generator Generated graph dataset Input Teacher Graph Encoder Output is the graph embedding vector set Embed the corresponding graph into a vector Paired with the extracted graph properties, we get the training dataset: S23, input the obtained training data set into the GPI-Net training module, and train the graph property inference attack network GPI-Net through supervised learning training.
5. The method for defending against attack processes based on inferring the properties of simulation graphs according to claim 4, characterized in that: In step S3, the attacker is simulated to steal the embedding vector of the target graph, and the stolen target graph is embedded into the vector E target Input the trained graph property inference attack network GPI-Net In the above example, we can infer the graph properties of the original corresponding graph data: the number of nodes in the graph The number of edges in the graph Graph Density 6. The method for defending against attack processes based on inferring the properties of simulation graphs according to claim 5, characterized in that: In step S4, according to the number of nodes actually extracted from the graph The number of edges in the graph Graph Density And the number of nodes in the graph obtained by simulated attack: The number of edges in the graph Graph Density Screen out the target graphs that are vulnerable to inference attacks, and perform pre-defense on the screened target graphs that are vulnerable to inference attacks from the perspective of the defender. The pre-defense means are: embedding the graph generated in the process of using the graph application E target When , the graph embedding vector perturbation technique is used to process the graph embedding vector.
7. The method for defending against attack processes based on inferring the properties of simulation graphs according to claim 6, characterized in that: In step S4, the graph embedding vector perturbation technique at least includes: Vector channel value preservation method: sort the channel values of a graph embedding vector i =(a1,a2,…,a n-1 ,a n ), where a1>a2>…>a n-1 >a n , in this order, retain the channel values of the previous preset proportion, and set the remaining channel values to zero; Vector channel value precision adjustment method: embed a graph into a vector and adjust the precision of each channel value; Add noise perturbation method: embed a graph into vector e i =(a1,a2,…,a n-1 ,a n ) is added with Gaussian noise.