A method for determining a privacy budget

Abstract

Embodiments of the present application disclose a method for determining a privacy budget, the method comprising: obtaining a disturbed feature vector, and initializing node features based on the disturbed feature vector; constructing a graph dataset based on the node features, and encoding the graph dataset to obtain a graph embedding; decoding the graph embedding, reconstructing an adjacency matrix, and determining link prediction accuracy based on the adjacency matrix; determining attribute attack accuracy according to the graph embedding and sensitive attribute labels of partial objects; and performing result analysis on the link prediction accuracy and the attribute attack accuracy to obtain a privacy budget analysis result. The above method can directly obtain the privacy budget analysis result, and relevant personnel can intuitively understand the correlation between the link prediction accuracy and the attribute attack accuracy under each privacy budget value, and then can select a corresponding privacy budget value according to actual task use requirements.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of model training, and particularly relates to a method for determining a privacy budget. BACKGROUND

[0002] With the continuous development of AI, cloud computing and 5G technologies, the Internet of Everything has become a trend, and various applications have emerged to facilitate people's lives from different angles. In this era of the Internet of Everything, a large amount of data is generated every day, and there are complex relationships between data. Traditional text and image forms cannot clearly express the complex relationships between data. Network structure data composed of node and edge information can well represent this type of data, such as citation networks composed of paper citation relationships, traffic networks composed of urban road traffic, and social networks composed of social relationships between people. This network structure data set is called a graph structure data set.

[0003] Mining and analyzing graph structure data sets can obtain a large amount of potential valuable information, thereby serving people's lives to a greater extent. Taking the graph structure data in a social network as an example, large social platforms such as WeChat, Weibo, Second and Twitter have been continuously developing and expanding in recent years, and each platform contains hundreds of millions of objects. In addition to the information of the objects, there are also countless connections between the objects. Based on the personal information, personalized preferences and social relationships of the objects, i.e., the object social network data set, the platform can perform social behavior prediction, personalized recommendation and other operations. For example, objects with common interests on Weibo are more likely to become friends, and when one of them feels that a piece of information is interesting, the object will have a greater probability of sharing the information with the objects related to it.

[0004] Graph neural networks (GNNs) can achieve excellent performance in representing and analyzing graph structure data. Graph neural networks can be applied to social networks, epidemic prediction, recommendation systems, network security and natural language processing. In a graph neural network model, the input data is a graph structure (for example, the relationship between friends in a social network), and the model will use the structure information and node features of the graph data for training. For example, many GNN models will update the original node information by passing the information between neighbor nodes. Through the neighbor node message passing mechanism, the graph neural network can learn the vector representation of the node or the entire graph, which can be used as input in graph structure data analysis tasks. In a graph structure data set like a social network, a central organization is often needed to collect information in order to obtain graph structure information and node feature information.

[0005] Local Differential Privacy (LDP) achieves privacy protection in the process of collecting object information through strict mathematical proof. LDP is a privacy protection data collection technology that has attracted much attention and has aroused widespread concern in theory and application. Many companies have deployed LDP-based data collection algorithms in their systems, such as Apple iOS system, Google browser, and Windows system. Due to the good properties of LDP, LDP is widely used in various statistical and analytical tasks to alleviate privacy problems, such as federated learning and deep learning.

[0006] Generally speaking, differential privacy defines a privacy budget, where the larger the privacy budget, the better the data availability and the lower the privacy protection level; the smaller the privacy budget, the worse the data availability and the higher the privacy protection level. Protecting graph structure data using local differential privacy technology not only needs to ensure the security of the data, but also needs to improve the data availability as much as possible, i.e. the performance of the graph neural network model. Although the subsequent graph neural network model is considered to be immune to privacy attacks in theory under the protection of differential privacy technology, deploying DP in practical applications will encounter many difficulties:

[0007] 1. In the scenario of differentially private protected data, the selection of the parameter privacy budget will directly affect the size of the noise added to the data, thereby directly determining the data availability and security. How to select the differential privacy budget at the level of the features of the nodes of the graph neural network is a pending problem.

[0008] 2. The relationship between the selected differential privacy budget and the degree of privacy protection possessed by the graph neural network model in practice is not clear enough. SUMMARY

[0009] To solve or partially solve the above problems, the present application provides a method for determining a privacy budget.

[0010] The present application provides a method for determining a privacy budget, which comprises: obtaining a disturbed feature vector and initializing node features based on the disturbed feature vector; constructing a graph data set based on the node features and encoding the graph data set to obtain a graph embedding; decoding the graph embedding, reconstructing an adjacency matrix, and determining link prediction accuracy based on the adjacency matrix; determining attribute attack accuracy according to the graph embedding and the sensitive attribute label of part of the objects; and performing result analysis on the link prediction accuracy and the attribute attack accuracy to obtain a privacy budget analysis result.

[0011] In some examples, encoding the graph dataset to obtain a graph embedding comprises: inputting the graph dataset into an encoder, wherein the encoder comprises two graph convolution layers, each of which corresponds to a graph convolutional neural network, and a k-hop algorithm is arranged in a first layer graph convolutional neural network corresponding to a first graph convolution layer in the encoder; receiving a convolution result obtained by performing twice convolution encoding on the graph dataset by the encoder, and taking the convolution result as the graph embedding.

[0012] In some examples, decoding the graph embedding to reconstruct an adjacency matrix and determining a link prediction accuracy based on the adjacency matrix comprises: calculating an inner product of the graph embedding; obtaining the adjacency matrix based on minimizing a cross-entropy loss function and the inner product of the graph embedding; and determining the link prediction accuracy based on the adjacency matrix.

[0013] In some examples, determining an attribute attack accuracy according to the graph embedding and a sensitive attribute label of a partial object comprises: obtaining the sensitive attribute label of the partial object; determining a sensitive attribute of another object based on the graph embedding and the sensitive attribute label of the partial object; and determining the attribute attack accuracy based on the sensitive attribute of the other object.

[0014] In some examples, performing result analysis on the link prediction accuracy and the attribute attack accuracy to obtain a privacy budget analysis result comprises: determining a relationship between data availability and privacy for each privacy budget value based on the link prediction accuracy and the attribute attack accuracy; and taking the relationship between the data availability and the privacy for each privacy budget value as the privacy budget analysis result.

[0015] In some examples, after performing result analysis on the link prediction accuracy and the attribute attack accuracy to obtain a privacy budget analysis result, the method further comprises: selecting a privacy budget value based on the privacy budget analysis result and a requirement of a current task.

[0016] Compared with the prior art, the present application has the following beneficial effects:

[0017] The application provides a privacy budget determination method, which comprises the following steps: obtaining a disturbed feature vector, and initializing node features based on the disturbed feature vector; constructing a graph data set based on the node features, and encoding the graph data set to obtain a graph embedding; decoding the graph embedding, reconstructing an adjacency matrix, and determining link prediction accuracy based on the adjacency matrix; determining attribute attack accuracy according to the graph embedding and sensitive attribute labels of part of objects; and performing result analysis on the link prediction accuracy and the attribute attack accuracy to obtain a privacy budget analysis result. Through the above method, the privacy budget analysis result can be directly obtained, relevant personnel can intuitively understand the correlation between the link prediction accuracy and the attribute attack accuracy under each privacy budget value, and then the corresponding privacy budget value can be selected according to the actual task use requirement. The interference data determined based on the privacy budget value can meet the data security and usability of the model in the actual task, thereby improving the accuracy of the model in the actual task, and avoiding the problem that the selected differential privacy budget and the privacy protection degree possessed by the graph neural network model in the actual task are not sufficiently clear, resulting in poor model use effect in the actual task. BRIEF DESCRIPTION OF DRAWINGS

[0018] Figure 1 is a basic schematic diagram of a privacy budget determination method according to an embodiment of the application;

[0019] Figure 2 is a basic schematic diagram of a differential privacy budget optimization scheme at the node feature level of a graph neural network according to an embodiment of the application;

[0020] Figure 3 is a basic schematic diagram of attack effects of an AIA attack under different conditions according to an embodiment of the application;

[0021] Figure 4 is a basic schematic diagram of the relationship between practicality and privacy protection effect according to an embodiment of the application. DETAILED DESCRIPTION

[0022] The exemplary embodiments will be described in detail herein with reference to the attached drawings. The following description is with reference to the drawings, in which like numerals represent like elements, unless otherwise specified. The embodiments described in the following exemplary embodiments are not representative of all embodiments consistent with the present application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of the present application, as detailed in the appended claims.

[0023] The block diagrams shown in the drawings are merely functional entities, and do not necessarily correspond to physically independent entities. That is, these functional entities can be implemented in the form of software, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0024] The flowcharts shown in the drawings are merely exemplary illustrations, and do not necessarily include all contents and operations / steps, nor are they necessarily executed in the order described. For example, some operations / steps can be further decomposed, and some operations / steps can be combined or partially combined, so the actual execution order can be changed according to actual conditions.

[0025] It should also be noted that "multiple" as mentioned in the present application refers to two or more. The association relationship of "and / or" describes the associated objects, which means that there can be three relationships, for example, A and / or B can represent the three cases of A alone, A and B together, and B alone. The character " / " generally represents an "or" relationship between the associated objects before and after it.

[0026] Embodiment one

[0027] As Figure 1 shown, Figure 1 a method for determining a privacy budget is proposed for the present example, the method comprising:

[0028] S101, obtaining a disturbed feature vector, and initializing node features based on the disturbed feature vector;

[0029] S102, constructing a graph data set based on the node features, and encoding the graph data set to obtain a graph embedding;

[0030] S103, decoding the graph embedding, reconstructing an adjacency matrix, and determining link prediction accuracy based on the adjacency matrix;

[0031] S104, determining attribute attack accuracy according to the graph embedding and sensitive attribute labels of part of the objects;

[0032] S105, performing result analysis on the link prediction accuracy and the attribute attack accuracy to obtain a privacy budget analysis result.

[0033] In the following, the concept of privacy budget parameter ε is first introduced through the definition of differential privacy, and then the difficulties existing in the application of differential privacy to graph neural networks are introduced.

[0034] Definition 1.1 (Adjacent data set) Let data sets D and D' be adjacent, that is, |DΔD'| = 1, then D and D' are called adjacent data sets.

[0035] Definition 1.2 (Differential Privacy) Let M be a randomized algorithm, Range(M) be the possible output of M, and let ε be a privacy budget. M satisfies ε-differential privacy if for all neighboring datasets D and D' and all outputs O, Pr[M(D) = O] ≤ e

[0036] Pr[M(D') = O] ε

[0037] Generally speaking, the larger the privacy budget ε, the better the data availability and the lower the privacy protection level; the smaller the privacy budget ε, the worse the data availability and the higher the privacy protection level. Protecting graph structure data using local differential privacy technology not only needs to ensure the security of the data, but also needs to improve the performance of the graph neural network model as much as possible. Although the subsequent graph neural network model is considered to be theoretically immune to privacy attacks under the protection of differential privacy technology, there are many difficulties in deploying DP in practical applications:

[0038] In the scenario of protecting data with differential privacy, the selection of the parameter privacy budget ε will directly affect the size of the noise added to the data, thereby directly determining the availability and security of the data. How to select the differential privacy budget at the node feature level of the graph neural network is a pending problem;

[0039] The relationship between the selected differential privacy budget and the degree of privacy protection possessed by the graph neural network model in practice is not clear enough.

[0040] In step S101, a disturbed feature vector is obtained, and node features are initialized based on the disturbed feature vector. The disturbed feature vector is obtained by performing differential privacy operation on a private feature vector, for example, the server knows the topology information, and each object v has a private d-dimensional feature vector x v , where each dimension of the feature is located in the range [α, β]. When the server requests the feature vector, the object v uses a multi-dimensional LDP mechanism on x v to obtain the corresponding disturbed feature vector x′ v locally, and then returns it to the server.

[0041]

[0042] After receiving the disturbed data, the server will initialize the node features by calculating the above formula (1), where m is a parameter used to control the number of features to be disturbed. It can be mathematically proven that x′ v is an unbiased estimate of the corresponding private feature vector x v .

[0043] ​In some examples, encoding the graph dataset to obtain a graph embedding comprises: inputting the graph dataset into an encoder, wherein the encoder comprises two graph convolution layers, each of which corresponds to a graph convolution neural network, and a first graph convolution layer in the encoder is provided with a k-hop algorithm in a first layer graph convolution neural network corresponding to the first graph convolution layer; receiving a convolution result obtained after the graph dataset is twice convoluted by the encoder, and taking the convolution result as the graph embedding.

[0044] In the above, the GAE encoder is used to encode the graph data. In order to reduce the performance degradation caused by data perturbation, the first layer graph convolution neural network (GCN) in the GAE encoder is modified in this example. The K-hops operation is introduced in this layer, which helps to reduce the influence of noise. The calculation process in this layer can be represented as formula (2):

[0045] H (1) = σ(LX (K) W 0 ), (2)

[0046] where L and W 0 are the symmetric normalized graph Laplacian and the weight matrix, respectively, and X (K) is the result of K consecutive neighborhood linear aggregation, because each node propagates its message to K-hop neighbor nodes. For a single node v, the invention sets The neighborhood size of v is represented as This example calculates formula (2) for each node in parallel.

[0047]

[0048] It can be understood that the above encoder is a stack of two graph convolution layers, so the obtained graph embedding Z at least contains the first-order and second-order neighbor information of the nodes.

[0049] In some examples, decoding the graph embedding to reconstruct an adjacency matrix and determining link prediction accuracy based on the adjacency matrix comprises:

[0050] calculating the inner product of the graph embedding;

[0051] obtaining the adjacency matrix based on minimizing a cross-entropy loss function and the inner product of the graph embedding;

[0052] determining the link prediction accuracy based on the adjacency matrix.

[0053] Where, since the learned embedding Z preserves the graph topology and node attribute information, the graph information can be reconstructed with the help of Z and the attribute inference classifier can be trained. The decoder module computes the inner product of Z and reconstructs the adjacency matrix with a minimization cross-entropy loss function to perform link prediction, and then determines the link prediction accuracy.

[0054]

[0055] Where A ij and are the elements in A and , respectively.

[0056] In some examples, determining the attribute attack accuracy according to the graph embedding and the sensitive attribute label of the partial object includes:

[0057] Obtaining the sensitive attribute label of the partial object;

[0058] Determining the sensitive attribute of the other object based on the graph embedding and the sensitive attribute label of the partial object;

[0059] Determining the attribute attack accuracy based on the sensitive attribute of the other object.

[0060] It can be understood that, in order to infer the sensitive attribute of the object, we assume that the server can obtain the graph embedding Z and the sensitive attribute label of the partial object . This is a practical assumption because a small part of the objects do disclose their information on their personal profiles, while the other objects prefer to keep information such as gender and location secret. After the GAE training process is completed, the server will extract the learned embedding Z. Then, the server uses Z and to train the classifier to predict the sensitive attribute of the other object:

[0061]

[0062] Where Λ represents the attack classifier, is a random variable of the sensitive attribute of the i-th object, and and represent the possible values and the prediction results of the sensitive attribute of the i-th object, respectively. In order to make a better comparison, we trained three classifiers, namely: neural network (NN), random forest (RF), and support vector machine (SVM).

[0063] In some examples, performing result analysis on the link prediction accuracy and the attribute attack accuracy to obtain a privacy budget analysis result includes:

[0064] determine a link between data availability and privacy for each privacy budget value based on the link prediction accuracy and the attribute attack accuracy;

[0065] analyze the link between the data availability and the privacy for each privacy budget value as the privacy budget analysis result.

[0066] After these steps, the server will obtain the accuracy of the GAE model and the accuracy of the attribute inference under different privacy budget values. That is, based on the above steps, the link between data availability and privacy under each privacy budget value can be obtained, and then the corresponding privacy budget value can be selected according to the data availability and the privacy

[0067] In some examples, after the result analysis of the link prediction accuracy and the attribute attack accuracy to obtain the privacy budget analysis result, the method further comprises:

[0068] selecting a privacy budget value based on the privacy budget analysis result and the requirements of the current task.

[0069] Compared with pure abstract numerical values, the attack accuracy of the category attribute is more intuitive than the privacy budget. Therefore, based on the attribute attack accuracy and the accuracy of the link prediction, the server can select a suitable privacy budget value in subsequent tasks.

[0070] The method for determining the privacy budget provided in this example includes: obtaining a perturbed feature vector and initializing node features based on the perturbed feature vector; constructing a graph data set based on the node features and encoding the graph data set to obtain a graph embedding; decoding the graph embedding to reconstruct an adjacency matrix and determining a link prediction accuracy based on the adjacency matrix; determining an attribute attack accuracy according to the graph embedding and sensitive attribute labels of part of the objects; and performing result analysis on the link prediction accuracy and the attribute attack accuracy to obtain a privacy budget analysis result. Through the above method of this example, the privacy budget analysis result can be directly obtained, and relevant personnel can intuitively understand the correlation between the link prediction accuracy and the attribute attack accuracy under each privacy budget value. Furthermore, a corresponding privacy budget value can be selected according to the actual task use requirements, and the interference data determined based on the privacy budget value can meet the data security and availability of the model in the actual task, thereby improving the accuracy of the model in the actual task. The problem of poor model use effect in the actual task caused by the unclear link between the selected differential privacy budget and the privacy protection level of the graph neural network model in the related art is avoided.

[0071] Embodiment Two

[0072] In order to better understand the present application, a more specific example is provided in this example for illustration;

[0073] The present application proposes a privacy budget determination method, which is applied to a differential privacy budget optimization scheme at the node feature level of a graph neural network. The scheme is divided into three modules: data collection, model training, and result analysis. In the data collection stage, the present example assumes that the central server has the global topology structure and collects node features through LDP. In the model training stage, the present example needs to train two models: a graph auto-encoder model and an attribute inference attack model (AIA). The present example first trains a graph auto-encoder (GAE), and uses the accuracy of edge prediction task to measure the actual utility of the model. Then, the present example assumes that the server is an adversary, and can perform attribute inference attacks on the graph neural network model under different privacy budget values. In the result analysis stage, the present example uses experimental results to establish a relationship between the accuracy of the graph auto-encoder model, the accuracy of the attribute inference attack, and different privacy budget values. The architecture of the differential privacy budget optimization scheme at the node feature level of the graph neural network is as shown in Figure 2 .

[0074] 1. Data collection

[0075] The present example assumes that the server knows the topology information, and each object v has a private d-dimensional feature vector x v , where each dimension of the feature is located in the range [α, β]. When the server requests the feature vector, the object v uses a multi-dimensional LDP mechanism on x v to locally obtain the corresponding perturbed feature vector x′ v , and then returns it to the server.

[0076]

[0077] After receiving the perturbed data, the server will initialize the node features by calculating the above formula (1), where m is a parameter used to control the number of features to be disturbed. It can be mathematically proved that x′ v is an unbiased estimate of the corresponding private feature vector x v .

[0078] Model training

[0079] 2.1. GAE model training

[0080] Due to the concern of performance degradation caused by data perturbation, the first layer of graph convolutional network (GCN) in the GAE encoder is modified in this example, where a K-hops operation is introduced to help reduce the impact of noise. The calculation process in this layer can be represented as formula (2):

[0081] H (1) = σ(LX (K) W 0 ), (2)

[0082] where L and W 0 are the symmetric normalized graph Laplacian and weight matrix, respectively, and X (K) is the result of K-hop linear aggregation of neighborhood, as each node propagates its message to K-hop neighbor nodes. For a single node v, the neighborhood size is denoted as , and the example calculates formula (3) for each node in parallel.

[0083]

[0084] Note that the encoder is a stack of two graph convolutional layers, so the graph embedding Z obtained contains at least the first and second order neighbor information of the nodes. Since the learned embedding Z preserves the graph topology and node attribute information, the graph information can be reconstructed with the help of Z and the attribute inference classifier can be trained. The decoder module calculates the inner product of Z and reconstructs the adjacency matrix to perform link prediction by minimizing the cross-entropy loss function (3).

[0085]

[0086] where A ij and are the elements in A and , respectively.

[0087] 2.2 AIA model training

[0088] To infer the sensitive attributes of objects, we assume that the server can obtain the graph embedding Z and the sensitive attribute labels of a part of the objects . This is a practical assumption because a small part of the objects do disclose their information on their personal profiles, while other objects prefer to keep information such as gender and location secret. After the GAE training process is completed, the server will extract the learned embedding Z. Then, the server uses Z and to train the classifier to predict the sensitive attributes of other objects:

[0089] ​

[0090] where Λ denotes the attack classifier, is a random variable of the sensitive attribute of the i-th object, and and denote the possible values and the predicted results of the sensitive attribute of the i-th object, respectively. To make a better comparison, we trained three classifiers, namely, neural network (NN), random forest (RF), and support vector machine (SVM).

[0091] Result analysis

[0092] Although this example takes a certain specific attack method, the process of experimental evaluation is general, and therefore the relevant conclusions can be regarded as the lower limit of node feature privacy leakage or secure line in graph neural networks. This example learns graph representation through the GAE model, in which the encoder is a graph convolution network, and the decoder is to reconstruct the adjacency matrix by inner product multiplication. To evaluate the accuracy of graph reconstruction, this example uses edge prediction accuracy as a measure of data availability. In the case of evaluating attribute inference attacks, for the second dataset, this is a binary classification problem, so we directly use F1-score to balance recall and accuracy. F1-score is a measure that combines precision and recall into a single value. For the first dataset, we use Macro-F1-score, which directly averages the F1-scores of different classes.

[0093] Here is how to calculate F1-score:

[0094]

[0095] where P represents the attack accuracy, and R represents the attack recall. After calculating the attack effect and the accuracy of the GAE model, this example can intuitively obtain the relationship between data availability and privacy.

[0096] This example can be applied in multiple scenarios that require privacy protection. Take a third-party server collecting private data as an example. For a given structure of the graph G, the server can obtain an intuitive privacy budget through three steps.

[0097] First, the server collects perturbed node features under different privacy budget protections. After obtaining the node features, the server will calculate the unbiased estimate of the node features.

[0098] Second, the server trains the GAE model and minimizes the prediction error of the reconstructed adjacency relationship through formula (7).

[0099] Finally, the server extracts the graph embedding Z as input and trains the attack classifier.

[0100] After these steps, the server will obtain the accuracy of the GAE model and the accuracy of attribute inference under different privacy budget values.

[0101] Compared with pure abstract numerical values, the attack accuracy of categorical attributes is more intuitive than the privacy budget. Therefore, based on the attribute attack accuracy and the accuracy of link prediction, the server can select a suitable privacy budget value in subsequent tasks. The innovations of this example can be summarized as the following three points:

[0102] This example realizes the intuitive explanation of the differential privacy budget value at the node feature level of the graph neural network through the above method;

[0103] In order to give an intuitive explanation of the privacy budget value ε, this example uses attribute inference attacks and GAE models to give a specific experimental evaluation scheme, and introduces k-Prop operation in the first layer GCN of the GAE model, which achieves the effect of noise reduction;

[0104] The experimental results on multiple social group related graph structure datasets show that this example can provide an intuitive explanation of the differential privacy budget value at the node feature level of the graph neural network, thereby providing help for the selection of privacy budget values in practice.

[0105] Effects of this example

[0106] This example shows the experimental effect through the following method. The GAE model learns the graph representation through the autoencoder, where the encoder is the graph convolution network, and the decoder is to reconstruct the adjacency matrix through the inner product multiplication. In order to evaluate the accuracy of graph reconstruction, we take the edge prediction accuracy as the measure. When evaluating the attribute inference attack, for the second dataset, it is a binary classification problem, so we directly use F1-score to balance the recall rate and accuracy, and F1-score is a measure that combines precision and recall rate into a single value. For the first dataset, we use Macro-F1-score, which directly adds up the F1-scores of different categories and takes the average.

[0107] AIA attack effect

[0108] According to the experimental results of the AIA attack classifier, we can intuitively observe the server's sensitive attribute prediction ability under different privacy budget values. For the first dataset, such as Figure 3As shown in (a), when using a fully private method, the F1-score for graph embeddings is 0.22 for NNs, 0.217 for RFs, and 0.212 for SVM classifiers. The attack F1-score increases with the privacy budget. When ε is greater than 1, the F1-score clearly indicates the model's vulnerability to attribute inference attacks. In some cases, this vulnerability is close to that of methods without privacy protection. However, when providing acceptable practicality (e.g., ε = 0.5), the model exhibits a moderate level of vulnerability to attribute inference attacks.

[0109] On the other hand, such as Figure 3 As shown in (b), under the fully privacy-preserving method, the graph embeddings of the dataset show that the F1-scores for the NN, Rf, and SVM attack models are 0.507, 0.503, and 0.494, respectively. Similarly, the attack performance improves with increasing privacy budget. When ε is greater than 1, the attack score approaches the result using the non-privacy-preserving method, with 0.625 for NN, 0.635 for RF, and 0.631 for the SVM classifier. To strike a trade-off between privacy and practicality, we suggest that the privacy budget should also be close to 0.5, which provides acceptable practicality.

[0110] A trade-off between practicality and privacy protection

[0111] Based on the experimental results returned by the scheme model, this example can provide a reference for selecting privacy budget values ​​under different conditions. Figure 4 As shown in (a), for the first dataset, when the server's (hypothetical attacker's) prediction capability is required to be no more than 0.5, the accuracy of the edge prediction task can reach 0.84. In this case, the recommended privacy budget is ε = 1. And when the required prediction accuracy is no less than 0.8, the recommended privacy budget provided in this example is ε = 0.5. Similar results can be found for the second dataset. Figure 4 This was found in (b). Therefore, this example can be quite useful when facing different privacy protection and practical needs.

[0112] Summarize

[0113] The proposed scheme in this example provides an intuitive explanation of privacy budgets when performing localized differential privacy and training graph neural networks. To our knowledge, this is the first attempt to perform attribute inference attacks on localized private graph neural networks. Our experimental results also show that localized differential privacy models can provide strong privacy protection for adversaries only by moderately reducing the model's utility. Conversely, such models may be vulnerable to privacy attacks when providing competitive real-world utility. Therefore, we advocate selecting an appropriate ε value to balance practicality and privacy across different applications.

[0114] In several embodiments provided in the present application, it should be understood that the disclosed apparatus and method can be implemented in other manners. For example, the described apparatus embodiments are merely schematic. The division of units is merely logical function division. There can be another division manner in actual implementation. For example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed.

[0115] The units described as separated components can or can not be physically separated, and the components displayed as units can or can not be physical units, i.e., can be located in one place or can be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purposes of the embodiments of the present application.

[0116] In addition, each functional unit in the various embodiments of the present application can be integrated in one processing unit, or each unit can exist physically, or two or more units can be integrated in one unit. The integrated unit can be implemented in the form of hardware or in the form of software functional units.

[0117] If the integrated unit is implemented in the form of software functional units and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on such an understanding, the technical solutions of the present application essentially or the part that contributes to the prior art, or all or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods in the various embodiments of the present application. The foregoing storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disk, and various media that can store program codes.

[0118] The technical solutions provided by the embodiments of the present application are described in detail above. The principles and implementation manners of the embodiments of the present application are described by applying specific examples in the patent. The above description of the embodiments is only used to help understand the principles of the embodiments of the present application; the above description is merely a preferred embodiment of the present application, and is not used to limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application should be included in the protection scope of the present application.

Claims

1. A method for determining a privacy budget, characterized in that, The method comprises: obtaining a disturbed feature vector, and initializing node features based on the disturbed feature vector; constructing a graph dataset based on the node features, and encoding the graph dataset to obtain a graph embedding; decoding the graph embedding, reconstructing an adjacency matrix, and determining link prediction accuracy based on the adjacency matrix; determining attribute attack accuracy according to the graph embedding and sensitive attribute labels of part of the objects; performing result analysis on the link prediction accuracy and the attribute attack accuracy to obtain a privacy budget analysis result.

2. The method of claim 1, wherein, encoding the graph dataset to obtain a graph embedding comprises: inputting the graph dataset into an encoder, wherein the encoder comprises two graph convolution layers, each corresponding to a graph convolutional neural network, and a k-hop algorithm is set in the first layer graph convolutional neural network corresponding to the first graph convolution layer in the encoder; receiving a convolution result obtained by performing twice convolution encoding on the graph dataset by the encoder, and taking the convolution result as the graph embedding.

3. The method of claim 1, wherein, decoding the graph embedding, reconstructing an adjacency matrix, and determining link prediction accuracy based on the adjacency matrix comprises: calculating the inner product of the graph embedding; obtaining the adjacency matrix based on the inner product of the graph embedding and a minimum cross-entropy loss function; determining the link prediction accuracy based on the adjacency matrix.

4. The method of claim 1, wherein, determining attribute attack accuracy according to the graph embedding and sensitive attribute labels of part of the objects comprises: obtaining the sensitive attribute labels of part of the objects; determining sensitive attributes of other objects based on the graph embedding and the sensitive attribute labels of part of the objects; determining the attribute attack accuracy based on the sensitive attributes of other objects.

5. The method of claim 1, wherein, performing result analysis on the link prediction accuracy and the attribute attack accuracy to obtain a privacy budget analysis result comprises: determining the relationship between data availability and privacy of each privacy budget value based on the link prediction accuracy and the attribute attack accuracy; taking the relationship between the data availability and privacy of each privacy budget value as the privacy budget analysis result.

6. The method of claim 1, wherein, after performing result analysis on the link prediction accuracy and the attribute attack accuracy to obtain a privacy budget analysis result, the method further comprises: selecting a privacy budget value based on the privacy budget analysis result and the requirements of the current task.

Images