Label Adversarial Attack Method for Citation Network Graph Based on Genetic Algorithm

Abstract

The present invention discloses a citation network graph label adversarial attack method based on a genetic algorithm. In the graph G constructed by the citation network, a subgraph is extracted as the training subgraph, the nodes therein form the training set, and the remaining nodes form the test set. The graph label adversarial attack scheme is represented as an individual in the genetic algorithm, and after evolution, the optimal graph label adversarial attack scheme is selected. During the evolution process, the fitness of the individual is calculated based on the difference in the prediction accuracy of the test nodes before and after the attack. The present invention realizes the optimized search for the citation network graph label attack countermeasure based on the genetic algorithm, thereby improving the quality of the generated graph label attack countermeasure samples.

Description

Technical Field

[0001] The present invention belongs to the technical field of citation network graph label adversarial attacks. More specifically, it relates to a method for citation network graph label adversarial attacks based on a genetic algorithm. Background Art

[0002] With the continuous increase in the number of academic papers, the citation network formed by academic papers and their references is becoming a large-scale complex network. This citation network is a graph structure data with citation documents as nodes and citation relationships between documents as edges. Due to the large scale of the citation network, assigning scientific papers in the citation network to the correct topics plays an important role in literature retrieval and paper recommendation.

[0003] Graph neural networks are very proficient in dealing with tasks related to citation network graph structure data. However, when faced with malicious modification of the labels of citation network document nodes, the incorrect label information contained in the modified label noise can spread along the entire citation network graph and affect a relatively large proportion of nodes, resulting in incorrect predictions by the graph neural network model. Currently, there are not many studies on citation network graph label adversarial attacks. For example, the attack model LafAK based on label flipping proposed by Zhang M et al. for node classification tasks. This model is based on the approximate closed form of GNN and the continuous substitution of non-differentiable objectives, and effectively generates attacks through a gradient-based optimizer. However, this attack method limits the label categories after node label flipping to only the two most numerous label categories in the graph, with a limited perturbation space, resulting in a relatively limited application scenario for the attack method. Wu Yiteng et al. proposed a label flipping adversarial attack on graph neural networks using a gradient attack method based on three basic assumptions such as the contradictory data hypothesis, parameter difference hypothesis, and same distribution hypothesis. However, due to the discreteness of the labels, there is a certain error in finding a suitable perturbation method for label attacks through gradients. Summary of the Invention

[0004] The purpose of the present invention is to overcome the deficiencies of the prior art and provide a method for citation network graph label adversarial attacks based on a genetic algorithm. The graph label adversarial attack scheme is represented as an individual in the genetic algorithm, and a suitable citation network graph label attack and countermeasure scheme is obtained by searching the solution space through the genetic algorithm, improving the quality of graph label attack and countermeasure samples.

[0005] To achieve the above-mentioned invention purpose, the method for citation network graph label adversarial attacks based on a genetic algorithm of the present invention includes the following steps:

[0006] S1: For the graph G constructed from the citation network, denote the number of all label categories of the document nodes contained therein as C + 1, and the label categories are (0, 1, 2,..., C); extract a subgraph in the graph G as the training subgraph G train, the nodes among them form a training node set, and the remaining nodes in graph G form a test node set;

[0007] S3: Extract the features of each node in graph G according to the input requirements of the graph neural network classification model to be subjected to graph label adversarial attack to obtain the feature matrix of graph G. At the same time, obtain the adjacency matrix of graph G, and combine the labels of the training nodes in the training set as training samples to train the graph neural network classification model. Then, use the trained graph neural network classification model to predict each test node in the test set, and obtain the predicted label category for each test node in the test set;

[0008] S3: Calculate the number M of nodes for label flipping in graph G according to the preset perturbation ratio δ, and use (α m , β m ) to represent the label flipping scheme of the m-th node. α m represents the original serial number of the m-th node for label flipping, and β m represents the label category after the label flipping of node α m to form the graph label adversarial attack individuals [(α1,β1),(α2,β2),…,(α M , β M )] in the genetic algorithm;

[0009] S4: Initialize the graph label adversarial sample population, and the initialization method for each individual is as follows: Randomly select M nodes from the training set, perform label flipping on them, and form an individual with the serial numbers of these M nodes and the label categories after label flipping;

[0010] S5: Modify graph G according to the graph label adversarial attack scheme corresponding to the individual to obtain graph G′, obtain the feature matrix and adjacency matrix of graph G′, and combine the labels of the training nodes in the training set after label flipping attack as training samples to retrain the graph neural network classification model. Then, use the retrained graph neural network classification model to predict each test node in the test set, and obtain the predicted label category for each test node in the test set; Then, calculate the fitness value of this individual using the following formula:

[0011]

[0012] Among them, N test represents the number of test nodes in the test set, Y i represents the true label category of the i-th test node, P i represents the label category predicted by the graph neural network classification model for the i-th test node before the attack, P iy' represents the label category predicted by the graph neural network classification model for the i-th test node after attacking using the graph label adversarial attack scheme corresponding to the current individual. I() represents the binary function, which is 1 when the condition holds and 0 when the condition does not hold;

[0013] S6: Select several individuals from the population as parent individuals for evolution according to the fitness value;

[0014] S7: Perform crossover operations on the parent individuals selected in step S6 with the crossover probability P c to generate new individuals. After the crossover operation, it is necessary to determine whether there are two label flipping schemes for the same node in the individual. If so, randomly select a node from the nodes not included in the individual in graph G and generate its label flipping scheme to replace one of the two label translation schemes for the same node. If not, do nothing;

[0015] S8: Mutate the individuals after the crossover operation with the mutation probability P v to generate new individuals, and mutate the label category after flipping the node label during the mutation operation;

[0016] S9: Determine whether the iteration end condition is reached. If not, return to step S5. If so, enter step S10;

[0017] S10: Select the graph label adversarial attack scheme corresponding to the individual with the largest fitness value in the current population as the final graph label adversarial attack scheme.

[0018] The citation network graph label adversarial attack method based on genetic algorithm in the present invention extracts a subgraph as the training subgraph in the graph G constructed by the citation network, forms the training set with the nodes therein, and forms the test set with the remaining nodes. The graph label adversarial attack scheme is represented as an individual in the genetic algorithm, and the optimal graph label adversarial attack scheme is selected after evolution. The fitness of the individual during the evolution process is calculated according to the difference in the prediction accuracy of the test nodes before and after the attack.

[0019] The present invention realizes the optimized search for the citation network graph label attack countermeasure scheme based on genetic algorithm, thereby improving the quality of the generated graph label attack countermeasure samples. Description of the Drawings

[0020] Figure 1 is the flowchart of the specific implementation manner of the citation network graph label adversarial attack method based on genetic algorithm in the present invention;

[0021] Figure 2 is the example diagram of the individual evolution process in this embodiment. Specific Embodiment

[0022] The following describes the specific embodiments of the present invention in conjunction with the accompanying drawings, so that those skilled in the art can better understand the present invention. It should be particularly noted that in the following description, when the detailed description of known functions and designs may dilute the main content of the present invention, these descriptions will be omitted here.

[0023] Embodiment

[0024] Figure 1 is a flowchart of the specific implementation of the citation network graph label adversarial attack method based on the genetic algorithm of the present invention. As Figure 1 shown, the specific steps of the citation network graph label adversarial attack method based on the genetic algorithm of the present invention include:

[0025] S101: Citation network partitioning:

[0026] For the graph G constructed by the citation network, denote the number of all label categories of the literature nodes contained therein as C + 1, and the label categories are (0, 1, 2,..., C). According to the node label categories, all node label information of the graph G can be described as a node vector (t1, t2,..., t N ), t n represents the label category of the node, t n ∈(0, 1, 2,..., C), n = 1, 2,..., N, where N represents the number of literatures in the citation network, that is, the number of nodes in the graph G. Extract a subgraph from the graph G as the training subgraph G train , and form the training set with the nodes therein, and the remaining nodes in the graph G form the test set.

[0027] In practical applications, in order to improve the training effect of the graph neural network classification model trained by the subsequent training set, the best node label categories in the extracted training subgraph G train should include all label categories, the number of nodes in each label category is greater than the preset threshold, and these nodes belong to the connected component.

[0028] S102: Obtain the model prediction result before the attack:

[0029] Extract the features of each node in the graph G according to the input requirements of the graph neural network classification model to be subjected to the graph label adversarial attack to obtain the feature matrix of the graph G, and at the same time obtain the adjacency matrix of the graph G, and combine the labels of the training nodes in the training set as training samples to train the graph neural network classification model, and then use the trained graph neural network classification model to predict each test node in the test set to obtain the predicted label category of each test node in the test set.

[0030] In order to make the prediction accuracy of the pre - attack model more accurate, in this embodiment, when training the graph neural network classification model with the training set, the training set is divided into a training subset and a validation subset. The graph neural network classification model is trained several times with the training subset, and then the validation subset is used to verify the graph neural network classification model completed in each training and the prediction accuracy is statistically obtained, and the graph neural network classification model with the optimal prediction accuracy is selected to predict the test set.

[0031] S103: Determine the graph label adversarial attack encoding method:

[0032] According to the preset perturbation ratio δ, calculate the number of nodes M for label flipping in graph G. Encode the genes in the genetic algorithm into the form of a binary tuple (α m , β m ), that is, use (α m , β m ) to represent the label flipping scheme of the m - th node. α m represents the original serial number of the m - th node for label flipping, and β m represents the label category after the node α m is flipped, forming the graph label adversarial attack individuals in the genetic algorithm: [(α1, β1), (α2, β2), …, (α M , β M )]. Obviously, in the present invention, each graph label adversarial attack individual is a possibility of label attack and represents an attack scheme of label attack.

[0033] S104: Initialize the graph label adversarial sample population:

[0034] Initialize the graph label adversarial sample population. The initialization method for each individual is as follows: Randomly select M nodes from the training set, flip their labels, and form an individual with the serial numbers of these M nodes and the label categories after label flipping.

[0035] S105: Calculate the individual fitness value:

[0036] The fitness function is the basis for evaluating the fitness of each individual in the genetic algorithm. Usually, individuals with higher fitness will be retained for the next generation of genetic operations. In the present invention, label flipping belongs to poisoning attacks in graph adversarial attacks, and for this, a method for calculating the individual fitness value is proposed:

[0037] Modify the graph \(G\) according to the graph label adversarial attack scheme corresponding to the individual to obtain the graph \(G'\). Based on the feature matrix and adjacency matrix of \(G'\), and combined with the labels of the training nodes in the training set after label flipping attack as training samples, retrain the graph neural network classification model. Then, use the retrained graph neural network classification model to predict each test node in the test set, and obtain the predicted label category for each test node in the test set. Then, calculate the fitness value of this individual using the following formula:

[0038]

[0039] where \(N\) test represents the number of test nodes in the test set, \(Y\) i represents the true label category of the \(i\)-th test node, \(P\) i represents the label category predicted by the graph neural network classification model for the \(i\)-th test node before the attack, \(P\) i ' represents the label category predicted by the graph neural network classification model for the \(i\)-th test node after the attack using the graph label adversarial attack scheme corresponding to the current individual. \(I()\) represents the binary function, which is 1 when the condition holds and 0 when the condition does not hold.

[0040] It can be seen that when the value is larger, it means that the graph label adversarial attack scheme corresponding to the individual has a greater adverse impact on the graph neural network classification model, and the attack effect is more successful. That is to say, the larger the fitness value, the better the individual.

[0041] S106: Individual selection:

[0042] Select several individuals from the population as parent individuals for evolution according to the fitness value.

[0043] Selection is an embodiment of the survival of the fittest mechanism. According to the evolutionary law of nature, individuals with higher fitness have greater chances of survival and reproduction than those with lower fitness. In this embodiment, the common selection method - roulette wheel selection method is used. In this method, the selection probability of each individual is proportional to its fitness value, and the larger the fitness value, the greater the selection probability.

[0044] S107: Individual crossover:

[0045] Cross the parent individuals selected in step S106 according to the crossover probability \(P\) cPerform crossover operation to generate new individuals. In the present invention, since each individual contains the label flipping scheme of nodes, after the crossover operation, there may be two label flipping schemes of the same node in the individual, and conflicts will occur at this time. Therefore, after the crossover operation, it is necessary to determine whether there are two label flipping schemes of the same node in the individual. If so, randomly select a node from the nodes not included in the individual in graph G and generate its label flipping scheme to replace one of the two label translation schemes of the same node. If not, no operation is performed.

[0046] Adopting the crossover operation can recombine the individual genes, so as to continuously generate individuals with better adaptability and avoid the limitation of the search space of the genetic algorithm. The main factor affecting the crossover operation is the crossover probability. Ordinary genetic algorithms set the crossover probability as a fixed value, which limits the optimization efficiency of the genetic algorithm. The crossover probability P c is too large. Although the search intensity of the algorithm will be further increased, the overall efficiency of the algorithm will be affected. The crossover probability P c is too small. The probability of recombination of individual genes is small, and the search performance is greatly reduced. To overcome the above problems, in this embodiment, an adaptive crossover probability is adopted, and the crossover probability is continuously adjusted according to the fitness values of individuals in the population. For the individuals with the maximum and minimum fitness, instead of zero crossover operation or complete crossover operation, a crossover operation with a specific probability is performed, which can effectively improve the role of the crossover operation in maintaining the diversity of individuals in the algorithm. The specific calculation formula of the crossover probability P c is as follows:

[0047]

[0048] Among them, f c represents the larger value of the fitness values of the two parent individuals before the crossover operation, f max , f min respectively represent the maximum and minimum fitness values in the population before the crossover operation. k1, k2, and k3 are preset constants between 0 and 1, and k2 > k3.

[0049] S108: Individual mutation:

[0050] Mutate the individuals after the crossover operation according to the mutation probability P v to generate new individuals, and mutate the label category after the node label is flipped during the mutation operation.

[0051] The mutation operation, like the crossover operation, is also an essential part of the genetic algorithm. Among the new individuals formed after the crossover operation, there is a certain probability that gene mutation will occur, so as to ensure the diversity of individual genes in the population. The mutation probability P vThis has a great impact on this step. If the mutation probability is very high, then the entire search process degenerates into a random search process. Therefore, a more prudent approach is to take a relatively large probability at the beginning of the evolution process and gradually reduce it to near 0 as the search process progresses. Therefore, in this embodiment, an adaptive mutation probability is used to perform the mutation operation, which not only conforms to the actual problem but also has high adaptability. The mutation probability P v The specific calculation formula is as follows:

[0052]

[0053] where k4, k5, and k6 are preset constants between 0 and 1, and k5 > k6.

[0054] As the number of iterations increases, the fitness values of the individuals in the population become higher and closer, and f max -f c becomes smaller and smaller, so the mutation probability becomes smaller and smaller.

[0055] Figure 2 is an example diagram of the individual evolution process in this embodiment. As Figure 2 shown, the individuals in the nth generation form individuals after changing the labels of 4 nodes through label flipping, and new individuals are generated after selection, crossover, and mutation.

[0056] S109: Determine whether the iteration end condition is reached. If not, return to step S105. If so, enter step S110.

[0057] There are generally two iteration end conditions. One is to reach the preset maximum number of iterations, and the other is that the fitness value of the optimal individual in the population converges. In practical applications, it can be selected according to the situation.

[0058] S110: Screen the graph label adversarial attack scheme:

[0059] Select the graph label adversarial attack scheme corresponding to the individual with the largest fitness value in the current population as the final graph label adversarial attack scheme.

[0060] To better illustrate the technical effects of the present invention, specific examples are used to experimentally verify the present invention. The two publicly available real-world graph datasets used in this embodiment are: Cora dataset and Citeseer dataset. Among them, the Cora dataset is a citation network composed of 2,708 machine learning papers, divided into 7 different categories. Each paper is represented as a node in the network, and the citation relationship between papers represents the interconnected edges between nodes. The dimension of the word vector of each machine learning paper is 1,433. Therefore, each node in the network has 1,433 features. The Citeseer dataset, like the Cora dataset, belongs to a citation network. In contrast, it has one less category, with a total of six categories: Agents, AI (Artificial Intelligence), DB (Database), IR (Information Retrieval), ML (Machine Language), and HCI. This dataset contains a total of 3,327 publications, and the number of citation relationships (i.e., edges in the network) is 4,732. The word vectors in each publication are represented in two forms: 0 / 1. 0 means the word does not appear in the publication paper, and 1 means the word appears in the paper. In this embodiment, all node features and 20 labeled nodes for each class are used as the training set, another 500 nodes are used as the validation set, and 1,000 nodes are used as the test set.

[0061] In this embodiment, 3 existing citation graph label adversarial attack methods are selected as comparison methods, including: Random Perturbation Attack (Rnd), Degree-based Attack (Deg), and the method in the literature "Zhang M, Hu L, Shi C, et al. Adversarial label-flipping attack and defense for graph neural networks[C] / / 2020 IEEE International Conference on Data Mining (ICDM). IEEE, 2020: 791-800." (abbreviated as LafAK). The model prediction accuracies of the present invention and the 3 comparison methods under different label flipping ratios are statistically analyzed. Table 1 is the statistical table of the model prediction accuracies of the present invention and the 3 comparison methods under different label flipping ratios in this embodiment.

[0062]

[0063] Table 1

[0064] As shown in Table 1, the present invention is significantly superior to the random perturbation attack (Rnd) in terms of perturbation indicators. The impact of the Rnd attack method on GCN is relatively limited; especially for a 5% perturbation, the prediction accuracy of the random attack does not decrease significantly. On the contrary, the attack effect of the present invention is significantly better. Moreover, as the number of perturbations increases, the attack effect of the present invention becomes better and better, indicating that the genetic algorithm finds the most effective flipping operation in the search space, greatly reducing the performance. The present invention has better performance than other label flipping attacks (Deg, LafAk). After analysis, the main reasons are as follows: (1) Deg only identifies influential nodes based on degrees; (2) LafAK mainly targets binary classification attacks, and label flipping is limited to binary classification attacks, and the perturbation space for multi-label attacks is limited. However, the present invention has no limitation on the number of categories, and more feature information of the citation network can be considered through the genetic algorithm, making the obtained graph label adversarial attack scheme more effective.

[0065] Although the above description of the illustrative specific embodiments of the present invention is provided for the understanding of those skilled in the art of the present technology, it should be clear that the present invention is not limited to the scope of the specific embodiments. For those of ordinary skill in the art of the present technology, as long as various changes are within the spirit and scope of the present invention defined and determined by the appended claims, these changes are obvious, and all inventions and creations using the concept of the present invention are within the scope of protection.

Claims

1. A citation network graph label adversarial attack method based on genetic algorithm, characterized in that Including the following steps: S1: For the graph G constructed for the citation network, denote the number of all label categories of the literature nodes contained therein as C + 1, and the label categories are (0, 1, 2, …, C); extract a subgraph from the graph G as the training subgraph G train , and form the training node set from the nodes therein, and the remaining nodes in the graph G form the test node set; S3: Extract the features of each node in graph G according to the input requirements of the graph neural network classification model to be subjected to graph label adversarial attack to obtain the feature matrix of graph G. At the same time, obtain the adjacency matrix of graph G, and combine the labels of the training nodes in the training set as training samples to train the graph neural network classification model. Then, use the trained graph neural network classification model to predict each test node in the test set, and obtain the predicted label category for each test node in the test set; S3: Calculate the number of nodes M with label flipping in graph G according to the preset perturbation ratio δ, and use (α m , β m ) to represent the label flipping scheme of the m-th node. α m represents the original serial number of the m-th node with label flipping, and β m represents the label category after the label flipping of node α m , thus forming the graph label adversarial attack individuals [(α1, β1), (α2, β2), …, (α M , β M )] in the genetic algorithm; S4: Initialize the graph label adversarial sample population. The initialization method for each individual is as follows: Randomly select M nodes from the training set, flip their labels, and form an individual with the serial numbers of these M nodes and the label categories after label flipping; S5: Modify graph G according to the graph label adversarial attack scheme corresponding to the individual to obtain graph G'. Obtain the feature matrix and adjacency matrix of graph G', and combine the labels of the training nodes in the training set after label flipping attack as training samples to retrain the graph neural network classification model. Then, use the retrained graph neural network classification model to predict each test node in the test set, and obtain the predicted label category for each test node in the test set; Then, calculate the fitness value of this individual using the following formula: Among them, N test represents the number of test nodes in the test set, Y i represents the true label category of the i-th test node, P i represents the label category predicted by the graph neural network classification model for the i-th test node before the attack, P i ' represents the label category predicted by the graph neural network classification model for the i-th test node after the attack using the graph label adversarial attack scheme corresponding to the current individual. I() represents a binary function, which is 1 when the condition holds and 0 when the condition does not hold; S6: Select several individuals from the population as parent individuals for evolution according to the fitness value; S7: Perform crossover operation on the parent individuals selected in step S6 according to the crossover probability P c to generate new individuals. After the crossover operation, it is necessary to determine whether there are two label flipping schemes for the same node in the individual. If so, randomly select a node from the nodes not included in the individual in graph G and generate its label flipping scheme to replace one of the two label translation schemes for the same node. If not, no operation is performed; S8: Mutate the individuals after the crossover operation according to the mutation probability P v to generate new individuals. During the mutation operation, mutate the label category after the node label is flipped; S9: Determine whether the iteration end condition is reached. If not, return to step S5. If so, enter step S10; S10: Select the graph label adversarial attack scheme corresponding to the individual with the largest fitness value in the current population as the final graph label adversarial attack scheme.

2. The citation network graph label adversarial attack method according to claim 1, wherein The training sub-graph G extracted in the step S1 train wherein the node label categories include all label categories, the number of nodes in each label category is greater than a preset threshold, and the nodes in the training sub-graph G train belong to a connected component.

3. The citation network graph label adversarial attack method according to claim 1, wherein In step S2, when training the graph neural network classification model using the training set, divide the training set into a training subset and a validation subset. Use the training subset to train the graph neural network classification model several times, and then use the validation subset to validate the graph neural network classification model completed in each training and statistically obtain the prediction accuracy rate. Select the graph neural network classification model with the optimal prediction accuracy rate to predict the test set.

4. The citation network diagram label adversarial attack method according to claim 1, characterized in that In step S6, the roulette wheel selection method is used when extracting individual optimization.

5. The citation network graph label adversarial attack method according to claim 1, wherein The crossover probability P in the step S7 c is calculated by the following formula: Among them, f c represents the larger value of the fitness values of the two parent individuals before the crossover operation, f max , f min respectively represent the maximum and minimum fitness values in the current population, and k1, k2, k3 are preset constants between 0 and 1, and k2 > k3.

6. The citation network graph label adversarial attack method according to claim 1, characterized in that The mutation probability P in the step S8 v is calculated by the following formula: Among them, f c represents the larger value of the fitness values of the two parent individuals before the crossover operation, f max , f min respectively represent the maximum and minimum fitness values in the current population. k4, k5, and k6 are preset constants between 0 and 1, and k5 > k6.

Images