Graph neural network node forgetting method based on differential privacy and zero-knowledge proof

Abstract

The application discloses a graph neural network node forgetting method based on differential privacy and zero-knowledge proof and belongs to the field of artificial intelligence and data privacy protection.The method comprises three stages: firstly, the multi-hop semantic influence area of the target node is accurately positioned by combining gradient, curvature and topological distance, the node and the associated edge are removed, and local topological disturbance is carried out; secondly, the node embedding is reconstructed in the affected area, and privacy budget is allocated according to the influence degree of the node, and adaptive differential privacy noise is added to the embedding; finally, the whole forgetting process is coded into an arithmetic circuit, and a publicly verifiable proof is generated by using a zero-knowledge proof system, so that a third party can verify the deletion integrity, reconstruction independence and privacy compliance without contacting the original data.The application solves the problems of completeness, anti-inference and auditability of graph data deletion and is suitable for high-sensitive scenes.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence and data privacy protection technology, and relates to a verifiable privacy protection scheme for deleting sensitive nodes in graph data by combining a zero-knowledge proof mechanism. Specifically, it relates to a graph neural network node forgetting method based on differential privacy and zero-knowledge proof. Background Technology

[0002] Graph neural networks (GNNs), as a crucial tool for processing non-Euclidean spatial data, have been widely applied in key fields such as social network analysis, recommender systems, and bioinformatics. With the improvement of global data privacy regulations, particularly the implementation of the EU's General Data Protection Regulation (GDPR) and the "right to be forgotten" clause in the California Consumer Privacy Act (CCPA), implementing a data deletion mechanism in GNNs that complies with regulatory requirements has become a key issue hindering the practical application of this technology. Traditional data deletion methods are inadequate when dealing with graph-structured data, necessitating the establishment of a technical system that simultaneously guarantees thorough deletion, operational verifiability, and privacy protection.

[0003] Existing machine forgetting methods are primarily based on the assumption of independent and identically distributed data. Typical approaches include data sharding and retraining based on the SISA framework and parameter correction based on influence functions. However, graph data exhibits significant topological relationships, with nodes forming semantic propagation networks through complex connections. When deleting a specific node, it is necessary not only to remove the node itself but also to eliminate its semantic influence propagated through multi-hop neighbors. Research shows that simply removing a target node can lead to "structural holes" in the graph structure. Attackers can infer the existence of the deleted node and its associated relationships with a probability exceeding 80% by analyzing the singular value distribution of the adjacency matrix or the isomorphic characteristics of the subgraph. Furthermore, while forgetting methods based on approximate optimization can reduce computational overhead, they cannot provide legally valid proof of deletion, making it difficult to meet compliance audit requirements.

[0004] To establish verifiable deletion mechanisms, researchers have recently explored technical approaches that combine zero-knowledge proofs with machine forgetting. Zero-knowledge proof systems, such as Groth16 and PLONK, can verify the correctness of computation processes without revealing any privacy information. However, applying such systems to graph neural network forgetting faces three major technical obstacles: First, the dynamic nature of graph structures makes traditional arithmetic circuit designs difficult to adapt, requiring the construction of special constraint systems that support adjacency matrix updates; second, neighbor aggregation operations in graph neural networks involve a large number of matrix operations, and directly converting them into ZKP circuits leads to an exponential increase in constraint size. Actual tests show that even for a graph with only 1000 nodes, full verification requires generating more than [number missing] constraints. There are several constraints; finally, the random noise mechanism introduced to meet the differential privacy requirements is in fundamental conflict with the deterministic computation required by ZKP, and the existing scheme has not yet solved the problem of the verifiability of noise parameters.

[0005] Currently, while the zkML framework proposed by Microsoft Research achieves forward propagation verification for simple neural networks, it cannot handle graph structure update operations. The PrivateJoin system developed by Google supports zero-knowledge proofs for set operations, but struggles to adapt to the multi-layered propagation characteristics of graph neural networks. These solutions fail to address the collaborative problem of graph structure deletion verification, semantic residue detection, and differential privacy compliance verification. Therefore, developing a novel zero-knowledge verification framework that deeply integrates graph topology processing, embedded semantic verification, and privacy noise proof is urgently needed to promote the compliant application of graph neural networks in sensitive fields such as healthcare and financial services. Summary of the Invention

[0006] To address the aforementioned issues, this invention discloses a graph neural network node forgetting method based on differential privacy and zero-knowledge proof. Through a three-stage core process of "influence range localization - embedding reconstruction and privacy enhancement - zero-knowledge verifiable proof," it systematically solves the problems of thoroughness, privacy, and verifiability in graph neural network node forgetting. It can remove target nodes and their semantic propagation effects, achieve public verifiability of forgetting operations, and integrate differential privacy to ensure the security of sensitive information. It overcomes the technical bottlenecks of traditional methods in terms of deletion thoroughness, compliance verifiability, graph structure adaptability, and privacy noise verifiability.

[0007] To achieve the above objectives, the technical solution of the present invention is as follows:

[0008] The graph neural network node forgetting method based on differential privacy and zero-knowledge proof includes the following steps:

[0009] Step S1: Perform an impact range analysis on the target node in the graph data, determine the affected area to be processed based on its semantic propagation relationship with neighboring nodes and multi-hop associated nodes, and remove the target node and all its associated edges from the graph structure.

[0010] Step S2: Within the affected area, the embedding vectors of the relevant nodes are recalculated to restore the semantic consistency of the graph, and a privacy budget is allocated according to the degree of impact on the nodes. Adaptive differential privacy noise is added to the reconstructed embedding vectors to achieve privacy protection.

[0011] Step S3: Based on the target node deletion operation, the embedding reconstruction process, and the noise addition strategy, construct the corresponding arithmetic circuit, and use the Groth16 or PLONK zero-knowledge proof system to generate a publicly verifiable proof, so that the verifier can verify the correctness of the node deletion, the independence of the embedding vector, and the compliance of the privacy perturbation without accessing the original graph data.

[0012] Furthermore, the specific method for step S1 is as follows:

[0013] To address the issues of "vague scope of influence and incomplete deletion" in traditional methods, this step utilizes a multi-dimensional evaluation based on "gradient + curvature + topological distance" to achieve precise localization of the affected node set. The specific process is as follows:

[0014] First, based on the gradient estimation method of backpropagation (a standard gradient calculation method that can be directly reproduced in this field), the initial marginal influence of the target node on its neighboring nodes is calculated. This index characterizes the direct impact of changes in the embedding of the target node on the loss function of other nodes, where the node... For nodes Influence is defined as: for a node Embedded vector

[0015] ,

[0016] in, For nodes Embedded vector, For nodes Embedded vector, Let be the training loss function for the graph neural network.

[0017] Since the first-order gradient can only reflect "linear effects" and cannot capture the local nonlinear characteristics of embedded changes, the second-order derivative information of the loss function is introduced, using the Hessian matrix. The local curvature characterizing the embedding variation—the inverse of the Hessian matrix—quantifies the "nonlinear sensitivity of the embedding to the loss." To avoid the high complexity (O(n³), where n is the number of nodes) of directly calculating the inverse of the Hessian matrix, a Neumann series expansion is used for approximation, balancing accuracy and efficiency.

[0018] ,

[0019] in, The step size parameter (commonly used in this field is 0.01-0.1, preferably 0.05, to ensure series convergence). K is the expansion order (ranging from 0 to 5, with K=3 being preferred, where the approximation error is ≤5% and the computational complexity is reduced to O(nK), meeting the real-time processing requirements of large-scale graphs). k is the summation index variable, traversing from 0 to K, used to calculate each term of the series. H is the Hessian matrix, which is the second derivative matrix of the loss function with respect to the embedding vector.

[0020] Finally, the scope of influence was determined by combining three key indicators: ① First-order gradient influence (threshold) (1) Adjust the graph density adaptively, setting it to 0.1 for sparse graphs and 0.3 for dense graphs; ② Inverse approximation of the Hessian matrix (reflecting the intensity of nonlinear effects, threshold value). =0.05); ③ Shortest path distance between nodes (calculated using Dijkstra's algorithm, with the maximum impact path length set to 2-3 hops to avoid excessively expanding the processing range and causing efficiency degradation). Satisfying " And the Hessian inverse approximation value is ≥ Nodes with a shortest path distance ≤ 3 are included in the set that require subsequent structural updates and embedding reconstruction. — This design ensures that no node affected by semantic propagation is missed, and no irrelevant node is redundantly processed, balancing thoroughness and efficiency.

[0021] In identifying the affected areas Then, the complete removal of nodes and edges is performed first: from the graph's adjacency matrix. Delete the row and column corresponding to the target node, and remove the associated edges between the target node and all its neighboring nodes (including redundant edges of direct and indirect multi-hop associations) to ensure that there are no residual traces of the target node at the topology level.

[0022] To address the issue of weak anti-inference capability caused by topological holes after deletion, privacy enhancement processing involving topological perturbation is further performed on the local structure of the deleted region. The specific process is as follows:

[0023] Within the one-hop neighborhood of the target node (only direct neighbors are considered to avoid excessive perturbation and disruption of global semantics), the connection relationships between any two different neighboring nodes are randomly adjusted. The core purpose is to disrupt the original local topology, preventing attackers from inferring the existence of the target node through "missing connections." Adjustment rules:

[0024] For neighbor pairs of nodes that do not have an edge in the original graph ( , The elements in the i-th row and j-th column of the adjacency matrix A of soil are represented by a preset probability. Try adding edges (p ranges from 0.1 to 0.3, preferably 0.2, which can both disrupt the original topological features and prevent the local structure from becoming too dense).

[0025] For neighbor nodes of an existing edge in the original graph ( ), and try to remove the edge with the same probability p;

[0026] Through this operation, the one-hop neighborhood topology of the target node changes from "deterministic missing" to "randomized reconstruction", and the attacker's structural inference accuracy can be reduced to below 50% (close to random guessing).

[0027] Subsequently, based on preset threshold rules, the adjacency matrix after topological perturbation is binarized to restore it to a graph structure form usable for subsequent model processing. Through this topological perturbation and mechanism, attackers can effectively suppress the ability to reconstruct the existence of deleted nodes or their connections through the graph structure, thereby enhancing the graph structure's resistance to inference.

[0028] Furthermore, the specific method of S2 is as follows:

[0029] To address the need for differentiated reconstruction strategies for different degrees of graph structure change, this step provides three adaptable reconstruction methods (which can be used individually or in combination), and supplements post-reconstruction optimization processing to ensure semantic consistency of the embedded and updated graph structures.

[0030] For scenarios with minor changes in local structure (such as when the target node is an isolated node, affecting only 1-2 direct neighbors), a reconstruction method based on parameter fine-tuning is adopted: the updated adjacency matrix is... With the original node feature matrix Input a convergent graph neural network model before deletion, with initial parameters equal to the number of training epochs before deletion. Stable parameters Only for the set of affected nodes Local parameter fine-tuning is performed to reduce computational overhead. The fine-tuning process minimizes the difference between the reconstructed embedding and the target embedding using the L2 loss function, defined as follows: ,in For affected nodes Target embedding benchmark — if For direct neighbors of the target node, the embedding is multiplied by 0.8 to weaken the original semantic association; for indirect neighbors, the embedding is multiplied by 0.95 to preserve the core semantics. Fine-tuning uses the Adam optimizer, with a learning rate ranging from [value missing]. The fine-tuning rounds are , and when The iteration stops when the decrease is ≤1e-5 for three consecutive rounds. Under this method, the semantic matching degree between the embedded nodes of the affected nodes and the new topology is ≥92%, and the computational cost is only 15%~20% of that of full graph retraining.

[0031] For scenarios with moderate structural changes (such as the target node being a local core node affecting 3-5 hop neighbors), a graph diffusion-based reconstruction approach is adopted: node features are iteratively propagated to smooth the embedding distribution, addressing the embedding fluctuation problem caused by topological perturbations. The diffusion process is based on the updated adjacency matrix. normalized graph Laplace operator (in for The degree matrix, , (A square matrix with all elements on the main diagonal being 1 and all other elements being 0) has the following iterative formula: ,in The initial embedding matrix after S1 processing, and the diffusion coefficient. The range of values ​​is The number of iterations is And when the embedding matrix differs between two adjacent iterations Stop when the time comes.

[0032] For scenarios with severe structural changes (such as when the target node is a global hub node, affecting neighbors with more than 5 hops or spanning subgraphs), a knowledge distillation-based reconstruction approach is adopted: the original graph neural network before deletion serves as the "teacher model" (e.g., a 3-layer GCN), and a "student model" with the same architecture (parameters independently initialized) is trained on the updated graph structure. Effective semantics are preserved by fitting the insensitive embedding distribution of the teacher model, while sensitive information related to the target node is removed. The distillation loss employs a joint loss of "embedding distillation loss + task loss". ,in (Fit teacher embeddings only to unaffected nodes) (To avoid transmitting sensitive information) The range of values ​​is ; The loss for downstream tasks (such as cross-entropy loss for node classification) is calculated based on the labeled data of the updated graph. The batch size during training is... The training rounds are The learning rate is .

[0033] Regardless of which reconstruction method is used, the reconstructed embedding matrix must be... Perform unified optimization processing of "normalization + smoothing": First, normalize the embedding vector of each node using L2 normalization. Convert to To ensure that the embedding norm is uniform in Within the specified range, scale bias is avoided during subsequent noise addition; further semantic consistency is improved through local neighborhood averaging smoothing, with the smoothing formula being... (in For nodes exist (Neighbor set in the middle).

[0034] After completing the normalization and smoothing optimization of the embedding matrix, a stable and consistent result is obtained. Afterwards, in order to satisfy - Differential privacy compliance requirements and avoidance of imbalance issues in traditional uniform noise addition, based on S1 quantization of node influence. The adaptive noise addition process is executed as follows:

[0035] First, differentiate the privacy budget allocation: influenced by the target node. The higher the node, the more likely it is to retain sensitive information, thus requiring a larger privacy budget. (The more budget you have, the stronger the noise can be added), and the allocation uses an exponential decay function. ,in Basic privacy budget (range) Preferred To meet the privacy strength requirements of the GDPR's "right to be forgotten". Attenuation coefficient (range of values) Preferred ,make sure Node budget Node budget ), and the sum of the budgets of all affected nodes. ( Range of values (To avoid exceeding the overall privacy budget).

[0036] Next, noise parameters are calculated and noise is generated: based on the privacy budget. The noise standard deviation is calculated using the Gaussian difference privacy mechanism. The formula is ,in Privacy failure probability (range of values) Preferred (Complies with industry privacy and security standards) For embedding query functions Sensitivity (defined as "maximum embedding vector after adding / removing a single node") "Change" range Preferred (Derived from the model output embedding range). Optimized embedding for each node. Generate independent Gaussian noise vectors (in For embedded dimensions, such as The noise is then superimposed onto the embedding vector to obtain the final perturbation embedding. .

[0037] Finally, privacy compliance verification is performed: ensuring compliance is achieved through statistical analysis of noise distribution characteristics. - Differential privacy, verification metrics include: noise mean must meet [specific requirements]. ( (Ensure the noise has approximately zero mean); the noise variance must meet the following requirements. ( (Ensuring noise variance conforms to design). Verification shows that with this noise addition strategy, attackers can reconstruct sensitive information of target nodes with an accuracy of ≤15% by embedding vectors, while the accuracy of downstream link prediction tasks only decreases by 4%~6%, achieving a balance between privacy protection and model usability.

[0038] Furthermore, the specific method of S3 is as follows:

[0039] To ensure that subsequent zero-knowledge proof verification is based on "graph data consistent with the original operation," an immutability commitment must first be established for the core data of the target graph (adjacency matrix, node feature matrix) to prevent unauthorized modification of the graph structure or features. The specific process is as follows:

[0040] First, process the updated adjacency matrix after step S1. Compared with the node feature matrix before optimization in step S2 Performing normalized serialization operations – adjacency matrix (The dimension is n×n, which is the total number of graph nodes) Expand into a one-dimensional vector element by element according to the "row-major" rule, that is, first take all elements of the first row. Then take the second row, and so on until the nth row, to form a vector. Node feature matrix (With dimensions n×d, where d is the feature dimension) Expanded into vectors using the same row-major order rule. The two serialized vectors are concatenated in the order of "adjacency matrix first, feature matrix second" to obtain a unified graph state serialized vector:

[0041] .

[0042] Then, a cryptographically secure hash function is used to process the serialized vector. Calculate the digest value, preferably using the SHA-256 algorithm (this algorithm satisfies collision resistance and anti-image properties, conforms to NIST cryptographic standards, and can effectively prevent the original graph data from being deduced from the digest or forged data with the same digest from being constructed). The digest value calculation formula is as follows:

[0043] .

[0044] This summary serves as a "digital fingerprint" of the graph state, uniquely corresponding to the current graph's structure and characteristic state.

[0045] To further enhance the credibility and traceability of the commitment, the digest value and the system timestamp (accurate to the millisecond level to avoid replay attacks) are combined into the data to be signed. An asymmetric encryption algorithm is used (preferably 2048-bit RSA or secp256k1 elliptic curve algorithm, balancing security and computational efficiency), and the system private key is used to digitally sign the data to generate a signature result. ( This is the system's private key, held only by the party performing the forgetting operation. The final "digest value" will then be... timestamp Digital signature "The combination forms a complete graph state commitment record, which is publicly available for verification parties to query."

[0046] During the verification phase, the verifier first verifies the digital signature using the system's public key. The validity of the signature is verified (if verification fails, the graph state is directly determined to have been tampered with, and subsequent verification is terminated); if the signature is valid, the digest value in the commitment is extracted. And process the locally acquired graph data according to the same "row-first" rule. Perform serialization and SHA-256 hash calculation on X to obtain the local digest. ;Will and If the two are compared, it is confirmed that the current verification is based on the same graph state as the original forgetting operation, providing a reliable common input benchmark for subsequent zero-knowledge proofs.

[0047] For the construction of the forgetting-the-loop arithmetic circuit, the node deletion operation in step S1, the embedding reconstruction process in step S2, and the noise addition strategy are transformed into a zero-knowledge proof-verifiable arithmetic circuit (the core is to decompose complex operations into a combination of "addition gates, multiplication gates, and Boolean constraints" to control the circuit size and ensure real-time performance). The specific construction content includes basic constraints and core verification constraints:

[0048] ,

[0049] in, Let i be the "deletion flag" for the i-th node. It can only be 0 (not deleted) or 1 (deleted), which is the logical basis for all subsequent verifications.

[0050] Secondly, the circuit integrates three types of core verification constraints: First, it verifies the correct execution of the deletion operation on the adjacency matrix through matrix update relations, ensuring that the target node and its associated edges are removed; second, it verifies the consistency between the updated embedding vector and the output of the reconstruction function through embedding error constraints, for example, limiting the error to satisfy:

[0051] ;

[0052] Where n is the total number of nodes in the graph. Let be the embedding vector of the i-th node in the new embedding matrix. To embed the refactoring function, For the old embedding matrix, For the new adjacency matrix, For refactoring functions Calculate the theoretical embedding vector for node i. This is the preset error tolerance threshold.

[0053] Third, the differential privacy noise meets the system's privacy requirements by constraining the noise amplitude and statistical properties. Specifically, this includes verifying the noise vector... The norm does not exceed the preset safety range, that is... ,in For the first Gaussian noise vectors of the affected nodes Based on Gaussian distribution The safety factor set in principle, The noise standard deviation calculated based on the privacy budget of this node (by formula) It is deduced that, Differentiated privacy budgets for nodes, For embedding query functions Sensitivity, where δ is the probability of privacy failure; simultaneously, the zero-mean property of noise is constrained by the sample mean error bound of the embedding dimension, i.e. ,That Dimensions for node embedding (e.g., 32, 64, etc., determined according to model design). For the first The noise vector of the nth node Each dimension component This serves as the mean error threshold; furthermore, the accuracy of the noise variance is constrained by the error bounds between the sample variance and the design variance of the embedding dimension. ,in For the first The sum of squares of the components of each dimension of the noise vector at each node. The design variance of the noise at this node. The variance error threshold is used to verify the compliance of noise generation through comprehensive constraints from three dimensions: upper limit of noise intensity, distribution center characteristics, and distribution dispersion. This ensures that the noise satisfies the (ε,δ)-differential privacy constraint, which effectively shields the sensitive semantic associations of the target node without compromising the usability of the graph neural network model.

[0054] Finally, using the original graph data, intermediate states, and noise parameters as private inputs, and the graph state commitments and system parameters as public inputs, zero-knowledge proofs are generated using Groth16 or PLONK proof systems. This allows the verifier to confirm the correctness, integrity, and privacy compliance of the entire forgetting process without accessing sensitive data.

[0055] The beneficial effects of this invention are as follows:

[0056] This invention discloses a graph neural network node forgetting method based on differential privacy and zero-knowledge proof. Through a three-stage core process of "influence range localization - embedding reconstruction and privacy enhancement - zero-knowledge verifiable proof", it systematically solves the problems of thoroughness, privacy and verifiability of graph neural network node forgetting. It can remove the target node and its semantic propagation influence, realize the public verifiability of forgetting operation, and integrate differential privacy to protect the security of sensitive information. It solves the technical bottlenecks of traditional methods in terms of deletion thoroughness, compliance verifiability, graph structure adaptability and privacy noise verifiability. Attached Figure Description

[0057] Figure 1 This is a system flowchart of the present invention;

[0058] Figure 2 This is a system flowchart of step S1 of the present invention, which involves locating the scope of influence and optimizing the structure.

[0059] Figure 3 This is a system flowchart for step S2 of the present invention, which involves embedding reconstruction and privacy enhancement.

[0060] Figure 4 This is a system flowchart for step S3 of the present invention, which is a zero-knowledge verifiable proof. Detailed Implementation

[0061] The present invention will be further illustrated below with reference to the accompanying drawings and specific embodiments. It should be understood that the following specific embodiments are for illustrative purposes only and are not intended to limit the scope of the invention.

[0062] This embodiment follows the following... Figure 1The flowchart shown illustrates an application scenario of "deleting user X's account and all interaction traces on a social network." In this scenario, the graph data is isomorphic, containing only 100 "user nodes" (no other node types). The edge type is uniformly "interaction-related edges" (covering social behaviors such as following, liking, and commenting; the existence of an edge indicates that there has been interaction). The target node is "user X node" (denoted as v), which needs to have all its interaction relationships and semantic influences deleted, while also satisfying the "right to be forgotten" requirement of the Personal Information Protection Law to prevent attackers from inferring user X's identity and interaction behavior through the remaining social relationship network.

[0063] The graph neural network node forgetting method based on differential privacy and zero-knowledge proof includes the following steps:

[0064] Step S1, as follows Figure 2 As shown, the first step is to analyze the influence range of user X node v. The core of this analysis is to quantify the social semantic propagation impact of user X on other user nodes (such as the impact of user X's interactive behavior on other users' interest tags and social relationship strength assessments), avoiding the residual interactive association information caused by simply deleting nodes. In this embodiment, the graph neural network model is the GAT model used for "user interest recommendation," and the loss function L adopts cross-entropy loss (the output is the user interest category, such as food, travel, technology, etc.). The node influence degree is associated with "the impact of deleting user X on the interest recommendation results of other users." The initial marginal influence degree is calculated based on the backpropagation mechanism of the PyTorch framework. The influence degree of node u (such as user Y, user Z) on user X node v is defined as:

[0065] ,

[0066] in For nodes Embedded vector, For nodes Embedded vectors (dimensions) (Including features such as registration duration, interaction frequency, and interest tag characteristics). The larger the value, the greater the impact of changes in user X's embedding on the node. The stronger the impact of interest-based recommendation loss (i.e., the more social semantics of user X remain at node u), the greater the impact of interest-based recommendation loss. For example, if user Y and user X have 20 interactions (including 10 chats, 5 likes, and 5 comments), their... The user node W, which has no interaction, .

[0067] To improve the accuracy of impact estimation, the second derivative information of the loss function (Hessian matrix) is introduced. The curvature represents the local curvature of the embedding change—in social scenarios, this curvature reflects the nonlinear impact of user X's core interactions on the social behaviors of other users (such as the abrupt impact of user X's topic discussions on the interests and preferences of related users). Since the graph has only 100 nodes, the computational complexity is low; however, to balance efficiency, the Neumann series expansion is still used to approximate the inverse of the Hessian matrix.

[0068] ,

[0069] Where the step size parameter (Experimental verification shows that this value ensures the series converges within 10 rounds and the computation time is ≤30s, ensuring rapid convergence of the series.) Expansion order (At this point, the approximation error is ≤4%, which ensures accuracy while avoiding waste of computational resources.) For example, the Hessian inverse approximation value for user Y node is 0.69, further confirming that it is significantly affected by the nonlinearity of user X. k is the summation index variable, traversing from 0 to K, used to calculate each term of the series, and H is the Hessian matrix, which is the second derivative matrix of the loss function with respect to the embedding vector.

[0070] The affected area is determined by combining multiple indicators: First, the initial marginal impact threshold. (Based on the social graph density setting, a homogeneous graph with 100 nodes has a moderate density, and this threshold can cover 90% of the effective associated nodes); secondly, the Hessian inverse approximation threshold. Thirdly, the shortest path distance between nodes (calculated using Dijkstra's algorithm from the Python networkx library, with "interaction count" as the edge weight) is set to a maximum path length of 2 hops (user X → user Y → user Z is 2 hops; social connections between nodes exceeding 2 hops are negligible). The affected region R(v) is ultimately determined to contain 8 directly interacting nodes and 12 indirectly related nodes of user X, totaling 20 nodes, thus avoiding redundant processing.

[0071] After completing the impact scope analysis, target node removal and local structure privacy enhancement are performed to ensure that user X's interaction records are completely removed from the graph structure and to prevent attackers from inferring its existence through "topological holes". First, the node and edge are completely removed: the 42nd row (user X's node ID is 42) and the 42nd column corresponding to the node X are deleted from the adjacency matrix A (100×100). At the same time, all associated edges of this node are deleted - including 8 direct interaction edges and 5 indirect multi-hop redundant edges. After deletion, the adjacency matrix dimension is still 100×100 (only the 42nd row / column is all 0, to adapt to the consistency of the isomorphic graph structure).

[0072] To address the "anti-inference problem caused by topological holes after deletion" (e.g., if an attacker discovers that all 12 user nodes lack a connection to a certain node, they can infer that the node is the deleted user X), topological perturbation is performed on the one-hop neighborhood (8 directly interacting nodes) of user X to disrupt the local social structure. The adjustment rules are as follows: For any two directly interacting nodes, if there are no interaction edges in the original graph (A[i,j]=0), an edge is added with a preset probability p=0.2 (in this embodiment, 3 edges are successfully added, changing the local topology from a "star shape centered on user X" to a "mesh shape," thus masking user X's central position); if there are interaction edges in the original graph (A[i,j]=1), an edge is removed with the same probability p=0.2 (in this embodiment, 1 edge is removed to avoid excessive density in the local structure).

[0073] Finally, the adjacency matrix after topological perturbation is... Perform binarization to restore the graph structure that can be input into the GAT model: set a threshold. (Experiments have verified that this threshold ensures that the similarity between the binarized adjacency matrix and the original perturbation matrix is ​​≥90%, while preserving privacy.) When the noise level is 1, the value is 1 (indicating the existence of an associated edge); otherwise, the value is 0. For example, the noise level for user Y and user Z is 1.7 ≥ 0.5, so it is set to 1; the noise level for user M and user N is 0.4 < 0.5, so the value is 0.

[0074] Step S2, as follows Figure 3 As shown, the first step is to reconstruct the embedding vector of the affected region. Considering that user X is a local core interaction node (associated with 20 nodes, belonging to a moderate structural change scenario), this embodiment adopts a combined reconstruction strategy of "parameter fine-tuning + graph diffusion", which is implemented based on the PyTorch 2.0 framework. The model follows the 3-layer GAT model used for interest recommendation (input feature dimension d=32, including 8 types of social features such as registration duration, interaction frequency, and interest tags, and output 6 types of interest categories).

[0075] The parameter fine-tuning stage aims to "preserve non-sensitive transaction semantics and remove user X association information": the updated adjacency matrix obtained in step S1 is then used to... With node feature matrix Input the GAT model, and use the parameters trained to convergence before deletion as the initial parameters. The fine-tuning process only applies to the set of affected nodes. The L2 reconstruction loss function is used to minimize the difference between the "target embedding baseline" and the model output embedding. The loss function is defined as follows:

[0076] ,

[0077] Where hu′ is the target embedding baseline for node u—directly interacting nodes are embedded at 0.8 times their original embedding (weakening the strong semantic association with user X), and indirectly related nodes are embedded at 0.95 times their original embedding (preserving core social semantics). Fine-tuning uses the AdamW optimizer with a learning rate of 2e−4 and a weight decay coefficient of 1e−5 (to prevent overfitting). Fine-tuning is performed for 12 epochs. Fine-tuning stops when Lrecon drops to 7.5×10−4 in the 10th epoch and the decrease is ≤1e−5 for three consecutive epochs. In this approach, the semantic matching degree between the affected node embeddings and the new topology is ≥92%, and the computational cost is only 18% of that of full graph retraining, balancing efficiency and effectiveness.

[0078] To further improve the semantic consistency of embeddings and the usability of risk assessment, a knowledge distillation strategy is introduced: using the pre-deletion GAT model as the "teacher model" (risk assessment accuracy of 91.5%), a "student model" with the same architecture (parameters independently initialized) is trained on the updated graph structure. By fitting the insensitive embedding distribution of the teacher model, effective transaction risk semantics are preserved. The distillation loss adopts a joint loss of "embedding distillation loss + risk task loss", the formula is as follows:

[0079] ,

[0080] in For embedded distillation loss ( The embedding vector generated for node u in the student model.

[0081] The embedding vector generated for node u in the teacher model is fitted only for unaffected nodes. (To avoid transmitting sensitive related information of customer A) (Prioritize ensuring consistency of non-sensitive semantics); For the cross-entropy loss of the risk assessment task, based on the non-inverted graph after the update. The node's labeled data (with known risk level) is calculated. During distillation training, the batch size is set to 32, the training epochs are 60, and the learning rate uses a cosine annealing strategy. Down to After training, the student model's risk assessment accuracy on the validation set was not significantly different from the teacher model's. The cosine similarity between the middle node embedding and the teacher model's non-sensitive semantics is ≥0.92, indicating that the reconstructed embedding has effectively removed user X-related information.

[0082] After completing the embedding reconstruction, a unified optimization process of "normalization + smoothing" is performed on the reconstructed embedding matrix Hrecon: first, L2 normalization is used to transform the embedding vector hrecon,u of each node into... This ensures that the embedding norm of all nodes is uniformly within the range of [0.8, 1.2]. In social scenarios, this operation can prevent some nodes from being "underprotected" or "overprotected" when noise is added later due to differences in embedding scale (e.g., if the embedding norm of directly interacting nodes is too large, the privacy protection effect will be weakened under the same noise intensity if it is not normalized). Furthermore, semantic consistency is further improved through local neighborhood average smoothing, with the smoothing formula as follows:

[0083] ,

[0084] Where N(u) is the set of neighbors of node u in A′′ (e.g., the neighbors of user Y are 3 directly interacting user nodes and 2 indirectly related user nodes). After smoothing, the local variance of node embedding in R(v) decreases from 0.12 to 0.07. The prediction fluctuation of the downstream interest recommendation model for nodes in R(v) is ≤2%, which meets the requirements of social platforms for model stability.

[0085] Then, adaptive differential privacy noise addition is performed. The core of this process is based on the node influence I(u,v) calculated in step S1 (e.g., I(u,v) = 0.78 for user Y, and I(u,v) = 0.22 for indirectly associated user Z), allocating a differentiated privacy budget to ensure that "nodes more strongly influenced by user X receive stricter privacy protection." First, the privacy budget is allocated using an exponential decay function.

[0086] ,

[0087] in , And the total budget of all affected nodes Set a privacy budget quota for individual user deletions on social media platforms to prevent overspending on individual user deletion operations.

[0088] Calculating the noise standard deviation based on privacy budget: A Gaussian difference privacy mechanism is used, and the formula is as follows:

[0089] ,

[0090] in , For example, user Y's Substituting into the formula, we get Indirectly related to user Z Calculated The noise vector is generated using the `numpy.random.normal` function from the Python numpy library, and the noise vector for each node... ( (The matrix is ​​a 64-dimensional identity matrix, consistent with the embedding dimension). Noise is superimposed onto the optimized embedding vector to obtain the final perturbation embedding. .

[0091] Finally, privacy compliance verification is performed to ensure that the noise addition meets the requirements. - Differential privacy requirement: For each affected node noise vector Calculate the sample mean With sample variance The verification indicator is (Ensure noise has approximately zero mean to avoid introducing systematic biases that could affect risk assessment) and (Ensure noise variance conforms to design specifications to avoid insufficient privacy protection). A balance between privacy protection and model usability is achieved, meeting the dual requirements of social platforms for "compliant unidentifiable data and unaffected business operations" after user data deletion.

[0092] Step S3, as follows Figure 4 As shown, a commitment to the immutability of the graph state is first constructed to ensure that audit verification is based on "undisturbed deleted graph data"—in social scenarios, data integrity is a core prerequisite for compliant auditing. If the graph data is tampered with (such as unauthorized restoration of user X's associated edges), the audit results will become invalid. In this embodiment, the commitment data includes the adjacency matrix optimized in step S1. (Record user-to-user interaction relationships) and the node feature matrix before noise addition in step S2. (Includes non-sensitive features such as user registration duration and interaction frequency; sensitive features have been masked by noise). Serialization operations adopt a "row-first" rule to adapt to the structured storage habits of financial data: for Expand (4999×4999) row by row, first taking all elements in the first row. Then take the 2nd row up to the 100th row to form a vector. ;right (100×32, where 32 is the feature dimension) Expanded using the same rules as follows The two are concatenated into a graph state sequence vector with the adjacency matrix first and the feature matrix second. The length of the concatenated vector is Memory capacity adapted to social platform data processing.

[0093] To ensure vector To ensure uniqueness and tamper resistance, the SHA-256 cryptographically secure hash function is used to calculate the digest value (this algorithm conforms to the NIST FIPS 180-4 standard and is widely used in the financial field for data integrity verification, and has collision resistance—the probability of an attacker constructing forged data with the same digest is low). (To meet the bank's "unalterable" requirement), the formula for calculating the summary value is: In this embodiment, the calculated digest value is a 32-byte string (e.g., "a8f5d2e7...3c9b"), which can be used as a "digital fingerprint" of the graph state. To further enhance the credibility of the source, the digest value is combined with the system timestamp (accurate to milliseconds, e.g., "2024-10-25 14:32:45.123") to form the data to be signed. It employs a 2048-bit RSA asymmetric encryption algorithm (using the system private key held by the bank's data security department). Perform digital signature and generate signature result. —The private key is stored in the social platform's hardware security module (HSM) to prevent signature forgery due to private key leakage. The signing process takes ≤0.5 seconds, meeting real-time processing requirements. The final graph state commitment record includes a "digest value". timestamp Digital signature This information is stored in the social media platform's audit database and is publicly available for compliance departments to access.

[0094] During the audit and verification phase, the compliance department (verifier) ​​first verifies the digital signature using the public key of the social platform system. Legality: If the data decrypted using the public key is identical to... If the signature matches, it confirms that the signature originated from the social platform's data processing system (not a third-party forgery); if signature verification fails, it is directly determined that the graph state may have been tampered with, and subsequent verification is terminated. After successful signature verification, the verifier extracts the information from the commitment. And apply the same "row-first" rule to local backups. and Perform serialization and SHA-256 hash calculation to obtain the local digest. ;Will and Byte-by-byte comparison shows that the two are completely consistent in this embodiment, confirming that the current verification is based on the same graph state as the original deletion operation, providing a reliable benchmark for subsequent zero-knowledge proofs.

[0095] Subsequently, a forgetting-the-world arithmetic circuit was constructed. The core of this circuit is to transform the social scenario operations of "user X deletion, embedding reconstruction, and noise addition" into verifiable basic and core constraints using zero-knowledge proofs. Simultaneously, the circuit size is controlled (the total number of constraints in a 100-node graph ≤ 5 × 10^4) to ensure real-time processing by the social platform server. The basic constraint design aligns with the legality requirements of social data: one is the node deletion flag constraint, defining the deletion flag for user X. (User X's node ID is 42), other nodes via Boolean constraints make sure First, only 0 or 1 is used (to avoid "false deletion" due to abnormal flags); second, there are constraints on the adjacency matrix elements. Constraints can only be 0 or 1 (user-to-user interaction relationships are either present or absent, with no intermediate states). Thirdly, there is the constraint on the range of the embedding vector, specifically the normalized embedding vector in step S2. norm in Therefore, for each embedded element ( Add linear constraints This is to avoid abnormal embedded values ​​affecting the validation results of the risk assessment model.

[0096] The core validation constraints directly correspond to the compliance requirements of social scenarios: The first type is the node deletion correctness constraint, which verifies that all associated edges of user X have been completely removed—adding a constraint to node ID42 of user X. (User X's outgoing edge sum is 0, indicating no interaction) and (User X has an inbound edge sum of 0 and no associated interactions), while also affecting the set of nodes. Add constraints to user Y (node ​​ID58) in the data. and The first category ensures no residual associated edges; the second category is embedding reconstruction consistency constraints, verifying that the embedding reconstruction in step S2 does not leave any sensitive semantics of user X—defining the embedding error. ( Add constraints to the interest recommendation model for social platforms. (This threshold is set by the compliance department of the social platform to ensure that errors do not cause the accuracy of interest recommendations to drop by more than 1%); the third category is privacy noise compliance constraints, verifying that the noise addition meets financial privacy standards—the noise vector for user Y. Add norm constraints (3 standard deviations ensure 99.7% of the noise is within a safe range), while adding distribution constraints. (Zero mean) and (Variance compliance) to avoid "underprotection" leading to the leakage of user X's interactive information.

[0097] Based on the aforementioned arithmetic circuit, the Groth16 zero-knowledge proof system is used to generate the verification proof. Social platform auditing scenarios have high requirements for verification speed (compliance departments need to process 100+ deletion operations audited daily). Groth16's verification time is only 0.05 seconds, better than PLONK's 0.3 seconds, therefore it is the preferred choice. First, the arithmetic circuit is pre-compiled to generate a structured reference string (SRS). This process only needs to be executed once during the social platform system initialization (taking approximately 10 minutes). Then, the input type is defined: private input is sensitive data (the original adjacency matrix before deletion). Original transaction characteristics of user X Noise parameters in step S2 and These data are held solely by the social platform's data processing department and are not publicly disclosed; public inputs are publicly available data (as promised in the graph status). System parameters , Error threshold Delete mark Based on the private input, intermediate variable assignments (witnesses) satisfying circuit constraints are generated, and the proof is calculated using the Groth16 polynomial commitment mechanism. In this embodiment, the proof generation time for the 100-node graph is 1.8 seconds, which meets the real-time requirement of "auditing a single deletion operation within ≤3 seconds" of the social platform.

[0098] Obtaining certification by the compliance department After obtaining the common input, the verification process is executed: the first step is to confirm the consistency of the graph state commitments (the digest comparison has already been completed above); the second step is to call the Groth16 verification algorithm. The verification process took 0.08 seconds and output "Verification passed". To verify the reliability of the proof, the social platform simulated two attack scenarios: one was an attempt to tamper with... The associated edges of user X (will) (Change to 1), the generated proof was judged as "verification failed" because it did not meet the "delete correctness constraint"; secondly, noise that does not meet the requirements was used ( (The value is lower than the design value), which proves that the verification failed due to "noise norm constraint not being met", indicating that the mechanism can effectively identify violations.

[0099] The effectiveness of step S3 in social scenarios can be verified through three core indicators: First, data integrity—the difficulty of forging graph state commitments is tied to the collision resistance of SHA-256, meaning the probability of an attacker constructing the same digest is lower than... First, it meets the requirement of "immutability" for social platform data; second, it improves processing efficiency—the arithmetic circuit constraint size is reduced by 45% compared to the traditional full-volume conversion method, and the generation and verification time both meet the real-time requirements of bank audits; third, it ensures compliance—the verification results can serve as "compliance evidence for deletion operations" as required by the Personal Information Protection Law, and the audit department can confirm the legality of the operation without accessing user X's original transaction data. At the same time, the accuracy rate of attackers inferring sensitive information through verification vulnerabilities is ≤0.1%, achieving a triple balance of "privacy protection, compliance audit, and business usability," and providing technical support for the implementation of the "right to be forgotten" for social platform graph data.

[0100] It should be noted that the above content merely illustrates the technical concept of the present invention and should not be construed as limiting the scope of protection of the present invention. For those skilled in the art, various improvements and modifications can be made without departing from the principle of the present invention, and all such improvements and modifications fall within the scope of protection of the claims of the present invention.

Claims

1. A graph neural network node forgetting method based on differential privacy and zero-knowledge proof, characterized in that, Includes the following steps: Step S1: Perform an impact range analysis on the target node in the graph data, determine the affected area to be processed based on its semantic propagation relationship with neighboring nodes and multi-hop associated nodes, and remove the target node and all its associated edges from the graph structure. Step S2: Within the affected area, the embedding vectors of the relevant nodes are recalculated to restore the semantic consistency of the graph, and a privacy budget is allocated according to the degree of impact on the nodes. Adaptive differential privacy noise is added to the reconstructed embedding vectors to achieve privacy protection. Step S3: Based on the target node deletion operation, the embedding reconstruction process, and the noise addition strategy, construct the corresponding arithmetic circuit, and use the Groth16 or PLONK zero-knowledge proof system to generate a publicly verifiable proof, so that the verifier can verify the correctness of the node deletion, the independence of the embedding vector, and the compliance of the privacy perturbation without accessing the original graph data.

2. The method according to claim 1, characterized in that, The influence range analysis in step S1 includes the following process: First, based on the gradient estimation method of the influence function, the initial marginal influence of the target node on its neighboring nodes is calculated, where the node... For nodes The degree of influence is described by the following relationship: ； in, For nodes Embedded vector, Let be the training loss function for the graph neural network; Building upon this, the second derivative information of the loss function is introduced to obtain a more accurate estimate of the impact without significantly increasing computational costs. The Hessian matrix is ​​used to characterize the local curvature of the embedding variation, and the inverse of the Hessian matrix is ​​approximated using the following Neumann series expansion: ， in, For step size parameters, Let be the expansion order; k is the summation index variable, traversing from 0 to K to calculate each term of the series; H is the Hessian matrix, which is the second derivative matrix of the loss function with respect to the embedding vector. Combining first-order gradient information, second-order curvature characteristics, and a preset influence threshold ( The influence range of the target node is determined by the shortest path distance between nodes; the selection criteria simultaneously satisfy " And the Hessian inverse approximation value is ≥ Nodes that meet the condition of "shortest path distance ≤ 3" will be included in the set of nodes that require subsequent structural updates and embedding reconstruction. .

3. The method according to claim 2, characterized in that, Step S1, after removing the target node and its associated edges, also includes performing topological perturbation processing on the local structure of the deleted region, specifically including: First, within the one-hop neighborhood of the target node, the connection relationship between any two different neighboring nodes is randomly adjusted. For node pairs that do not have edges in the original graph, edges are added according to a preset probability. For node pairs that already have edges in the original graph, edges are removed according to the same probability, so as to anonymize the local structure. Subsequently, according to the preset threshold rules, the adjacency matrix after topological perturbation is binarized to restore it to a graph structure form for subsequent model processing.

4. The method according to claim 1, characterized in that, Step S2 includes reconstructing the embedding vectors of nodes within the affected region, and the reconstruction process includes at least one of the following methods: First, the updated graph structure is input into the graph neural network model, and local or global parameter fine-tuning is performed on the affected nodes. By minimizing the reconstruction loss function, the model relearns the semantic relationships between nodes on the new graph structure. The optimization process of the reconstruction loss is described in the following form: ， in The formula represents the target embedding representation of the affected node and is used to illustrate the relationship of minimizing the difference between the embedding target and the model output during the fine-tuning process. Secondly, based on the degree of change in the graph structure, a graph diffusion-based approach is used to smooth and propagate the node features, so that the reconstructed embeddings maintain more stable semantic consistency within the local neighborhood. The diffusion process obtains a smoother and noise-insensitive embedding representation by iteratively propagating the initial features on the updated graph structure. Furthermore, a knowledge distillation approach is adopted, using the original model as the teacher model and training the student model on the updated graph structure. By fitting the teacher embeddings or output distribution, the student model can recover the effective semantic structure before the deletion of nodes, while avoiding the retention of sensitive information related to the target nodes. After the reconstruction process is completed, the reconstructed embedding matrix is ​​further normalized and smoothed.

5. The method according to claim 4, characterized in that, Step S2 includes adding random noise to the updated embedding vector based on a differential privacy mechanism to ensure that the semantic reconstruction process of the affected nodes satisfies privacy constraints; specifically, firstly, based on the node influence obtained in step S1... A differentiated privacy budget is allocated to each affected node using an exponential decay approach: ， in Based on privacy budget, The attenuation coefficient; Then, the corresponding noise standard deviation is calculated based on the privacy budget of each node: ， in For embedding query functions Sensitivity; Based on the noise scale, a Gaussian noise vector is generated for each affected node and added to the reconstructed embedding vector to form a perturbed embedding matrix. This matrix maintains model usability while ensuring the overall system satisfies... - Differential privacy requirements, and provide inspectable inputs for the verification of privacy parameters in zero-knowledge proofs.

6. The method according to claim 1, characterized in that, Step S3 includes constructing a graph state commitment to ensure that the subsequent zero-knowledge proof verification process is based on consistent and tamper-proof graph data; specifically, it includes: the adjacency matrix of the graph data processed in step S1. With node feature matrix Expand in row-major order and concatenate into a uniform serialized vector: ， in This represents a vector concatenation operation; Serialized vector Input to the cryptographically secure hash function to calculate the digest value: ， This serves as an immutable commitment to the graph state; the summary is collision-resistant and antigenic, preventing unauthorized modification of the graph structure or features. To enhance credibility, the digest value is combined with a timestamp and digitally signed using the system private key to form a commitment record with proof of integrity and origin. During the verification phase, the verifier confirms that the deletion operation was performed on a graph state consistent with the baseline graph state processed in step S1 by re-serializing the graph data and calculating its digest and comparing it with the commitment digest.

7. The method according to claim 6, characterized in that, Step S3 includes encoding the node deletion, embedding reconstruction, and differential privacy noise addition processes into a zero-knowledge proof verifiable arithmetic circuit, and generating a publicly verifiable proof based on a general proof system. First, basic constraints, including addition gates, multiplication gates, and Boolean constraints, are constructed using arithmetic circuit language to ensure that the node deletion flag is satisfied: ， in, Let i be the "deletion flag" for the i-th node. Secondly, the circuit integrates three types of core verification constraints: First, it verifies the correct execution of the deletion operation on the adjacency matrix through matrix update relations, ensuring that the target node and its associated edges are removed; second, it verifies the consistency between the updated embedding vector and the output of the reconstruction function through embedding error constraints, ensuring that the constraint error is satisfied. ； Third, the differential privacy noise meets the system's privacy requirements by constraining the noise amplitude and statistical properties, including verifying that the norm of the noise vector does not exceed a preset range. Furthermore, the zero-mean and variance consistency of noise is verified by using the error bounds of the sample mean and variance of the embedding dimension. This ensures that the noise generation process meets the requirements. -Differential privacy constraints; Finally, using the original graph data, intermediate states, and noise parameters as private inputs, and the graph state commitments and system parameters as public inputs, zero-knowledge proofs are generated using Groth16 or PLONK proof systems. This allows the verifier to confirm the correctness, integrity, and privacy compliance of the entire forgetting process without accessing sensitive data.

Images