A graph neural network attack defense method and system based on interpreting subgraphs

Abstract

This invention belongs to the field of graph neural network analysis, specifically relating to a graph neural network attack defense method and system based on interpretive subgraphs. The method includes: using a counterfactual interpreter to obtain a first counterfactual interpretive subgraph of a target user node in a social network; performing a first injection attack to obtain a second counterfactual interpretive subgraph; inputting the second counterfactual interpretive subgraph into a graph neural network classification model to obtain a first-stage guided attack result; using a fact interpreter to obtain a first interpretive subgraph of the target user node in the social network; performing a second injection attack to obtain a second interpretive subgraph; inputting the second interpretive subgraph into a graph neural network classification model to obtain a second-stage guided attack result; when the attack is successful, optimizing the graph neural network classification model to obtain an optimized graph neural network classification model. This invention has good attack performance and can provide ideas and inspiration for designing more robust graph neural network models.

Description

Technical Field

[0001] This invention belongs to the field of graph neural network analysis, specifically relating to a graph neural network attack defense method and system based on interpreting subgraphs. Background Technology

[0002] With the arrival of the big data era, people are surrounded by massive amounts of data. Data that can be represented by continuous vectors, such as images seen by the eyes and sounds heard by the ears, is called Euclidean space data. However, there is also non-Euclidean space data that cannot be represented by continuous vectors: graph data. Graph data is widespread in real society. For example, in citation networks, papers are connected by citations, and different papers need to be categorized into their respective research areas; in chemistry, molecules are modeled as graphs, and their biological activities and pharmacological properties need to be accurately identified for drug discovery; in social networks, users are considered nodes, relationships between users are considered edges, and each user has unique characteristics such as gender, age, and interests. Platforms need to recommend suitable friends for each user or determine whether a user is malicious based on their behavior.

[0003] As an extension of traditional deep learning to graph data, graph neural networks (GNNs) inherit both the advantages and disadvantages of traditional deep neural networks. GNNs possess strong capabilities in learning graph representations and have achieved advanced results in downstream tasks such as node classification, graph classification, and connection prediction, thus permeating many scientific and technological fields. However, GNNs are easily deceived by adversarial attacks. Attackers can manipulate graph structures or node features during the training or testing phase to generate adversarial perturbations, easily fooling the GNN model.

[0004] This vulnerability of graph neural networks has drawn significant attention to their application in security-critical areas such as financial systems. For example, in banking credit systems, attackers can forge connections with high-credit customers to evade fraud detection models; in social networks, fake news creators can easily create fake followers to increase the chances of misinformation being recommended and spread. Therefore, there is an urgent need to research graph neural networks against attacks and their countermeasures. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention proposes a graph neural network attack defense method and system based on interpreting subgraphs. The method includes: performing a first-stage guided attack on target user nodes in a social network; if the first-stage guided attack is successful, then performing a second-stage attack defense to obtain an optimized graph neural network classification model; the second-stage attack defense process includes:

[0006] S21: Obtain all user nodes of the target category in the social network, input one user node from the social network and the target category into the fact interpreter, and obtain the first interpretation subgraph of the user node;

[0007] S22: Select the first-order neighbor user nodes of the first interpretation subgraph, generate adversarial nodes corresponding to the first-order neighbor user nodes, adjust the feature information of the adversarial nodes, and obtain the second interpretation subgraph.

[0008] S23: Input the second interpretation subgraph and the target user node into the graph neural network classification model to obtain the final classification result of the target user node;

[0009] S24: Determine whether the final classification result of the target user node is the same as the target classification. If they are the same, the attack is successful. Otherwise, the attack fails. Input the next user node in the social network and the target classification into the fact interpreter to obtain the first interpretation subgraph of the user node and return to step S22.

[0010] S25: When the attack is successful, optimize the graph neural network classification model to obtain the optimized graph neural network classification model.

[0011] Preferably, the first phase of the guided attack process includes:

[0012] S11: Select target user nodes from the social network, obtain the second-order adjacency matrix of the target user node and the feature matrix of its second-order neighbors, input the second-order adjacency matrix and the feature matrix into the counterfactual interpreter, and obtain the first counterfactual interpretation subgraph of the target user node;

[0013] S12: Generate adversarial nodes corresponding to user nodes in the first counterfactual interpretation subgraph, adjust the feature information of the adversarial nodes, and obtain the second counterfactual interpretation subgraph;

[0014] S13: Input the second counterfactual explanation subgraph into the graph neural network classification model to obtain the preliminary classification results of the target user node;

[0015] S14: Determine whether the preliminary classification result of the target user node is correct. If it is correct, the first-stage bootstrapping attack fails; otherwise, the first-stage bootstrapping attack succeeds.

[0016] Furthermore, the counterfactual interpreter is represented as:

[0017]

[0018] Among them, g cf - denotes a parameterized counterfactual interpreter, and σ denotes the first activation function. Let A be the degree matrix of the second-order neighbors of the target user node. vLet X represent the second-order adjacency matrix of the target user nodes. v Let W represent the feature matrix of the second-order neighbors of the target user node, W represent the parameter matrix already learned in the graph convolutional neural network model, and P represent the scrambling mask matrix that the counterfactual interpreter needs to learn.

[0019] Furthermore, the loss function of the counterfactual interpreter is:

[0020]

[0021] in, This represents the prediction loss function, where β represents the hyperparameter controlling the loss weights. This represents the distance loss function.

[0022] Furthermore, the feature information representation of the adversarial node corresponding to the user node in the first counterfactual explanation subgraph is adjusted as follows:

[0023]

[0024] Where, x i ' represents the adjusted feature vector of the i-th adversarial node, deg' target This represents the degree of the target user node in the graph after perturbation, deg. target This represents the degree of the target user node in the original graph, deg′ i This represents the degree of user node i in the graph after perturbation, deg. i x represents the degree of user node i in the original graph. i This represents the feature vector of the i-th adversarial node before adjustment.

[0025] Preferably, the graph neural network classification model is a graph convolutional neural network (GCN) model.

[0026] Preferably, the feature information of the adversarial node corresponding to the first-order neighbor user node is represented as follows:

[0027]

[0028] Where, x j ' represents the adjusted node feature vector, N represents the actual perturbation count required during bootstrapping, deg″ target This represents the degree of the target node in the graph after perturbation, deg. j x represents the degree of node j in the original graph. j X represents the node feature vector before adjustment. one-neibor This represents the set of all first-order neighbor nodes of the center node in the first interpretation subgraph.

[0029] A graph neural network attack defense system based on interpreting subgraphs includes: a first attack module, a second attack module, and a classification model optimization module;

[0030] The first attack module is used to perform a first-stage bootstrapping attack test on the classification model;

[0031] The second attack module is used to perform a second-stage bootstrapping attack test on the classification model;

[0032] The classification model optimization module is used to optimize the model based on the results of the second-stage bootstrapping attack test and output the optimized classification model.

[0033] The beneficial effects of this invention are as follows:

[0034] This invention combines relevant knowledge and technology in the field of graph neural network interpretability to propose a method for designing adversarial examples in graph structures to implement guided attacks. It uses counterfactual interpreters and factual explanations to misclassify target user nodes into other categories through graph injection attacks. This invention has good attack performance and can train more robust graph neural network models based on the adversarial examples of this invention, effectively improving the attack defense performance of graph neural networks. Attached Figure Description

[0035] Figure 1 This is a flowchart of the graph neural network attack defense method based on the interpretation subgraph in this invention. Detailed Implementation

[0036] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0037] This invention proposes a graph neural network attack defense method and system based on interpreting subgraphs, such as... Figure 1 As shown, the method includes the following: performing a first-stage guided attack on target user nodes in a social network; if the first-stage guided attack is successful, performing a second-stage attack defense to obtain an optimized graph neural network classification model; the process of a successful first-stage guided attack includes:

[0038] S11: Select target user nodes from the social network, obtain the second-order adjacency matrix of the target user node and the feature matrix of its second-order neighbors, input the second-order adjacency matrix and the feature matrix into the counterfactual interpreter, and obtain the first counterfactual interpretation subgraph of the target user node.

[0039] A social network is a network with social attributes composed of individuals in real life. Social networks represent various social relationships, and their nodes usually refer to individuals or organizations. The process involves obtaining the adjacency matrix A and feature matrix X of the social network; selecting a user node in the social network as the target user node, i.e., the attack node; the attack objective of this invention is to cause the target user node to be misclassified by the classification model into a pre-specified category.

[0040] The second-order adjacency matrix and the characteristic matrix are input into the counterfactual interpreter g. cf In the process, the first counterfactual interpretation subgraph of the target user node is obtained; the first counterfactual interpretation subgraph can be represented as G. cf-explain =(A cf-explain X cf-explain A cf-explain X is the adjacency matrix representing the subgraph structure information. cf_explain The feature matrix represents the feature information of the subgraph.

[0041] Preferably, the counterfactual interpreter used in this invention is represented as follows:

[0042]

[0043] Among them, g cf-exp This represents a parameterized counterfactual interpreter, where σ represents the first activation function. Let A be the degree matrix of the second-order neighbors of the target user node. v Let X represent the second-order adjacency matrix of the target user nodes. v Let W represent the feature matrix of the second-order neighbors of the target user node, W represent the parameter matrix already learned in the graph convolutional neural network model, and P represent the scrambling mask matrix that the counterfactual interpreter needs to learn.

[0044] The loss function L of the counterfactual interpreter is:

[0045]

[0046]

[0047]

[0048] in, This represents the prediction loss function, where β represents the hyperparameter controlling the loss weights. Let L represent the distance loss function, f(v) represent the classification result output by the neural network model after inputting node v into the original image, and L represent the distance loss function. NLL This represents the negative log-likelihood loss function. This represents a node v whose structural information has changed after being processed by the counterfactual interpreter. Indicates that the node The new classification result is output after inputting into the graph neural network model.

[0049] S12: Generate adversarial nodes corresponding to user nodes in the first counterfactual explanation subgraph, adjust the feature information of the adversarial nodes, and obtain the second counterfactual explanation subgraph.

[0050] The first injection attack is performed, specifically targeting the first counterfactual interpretation subgraph G. cf-explai For each user node in the graph, a fake adversarial node is designed; considering the feature information of each user node and its degree information in the original social network graph, the feature information of the adversarial node is adjusted, and thus the second counterfactual explanation subgraph G′ is obtained.

[0051] The feature information representation of the adversarial node corresponding to the user node in the first counterfactual explanation subgraph is adjusted as follows:

[0052]

[0053] Where, x i ' represents the adjusted feature vector of the i-th adversarial node, deg' target This represents the degree of the target user node in the graph after perturbation, deg. target This represents the degree of the target user node in the original graph, deg′ i This represents the degree of node i in the graph after the perturbation is added, deg i x represents the degree of node i in the original graph. i This represents the feature vector of the i-th adversarial node before adjustment (the feature vector of the i-th user node in the first counterfactual interpretation subgraph).

[0054] The second counterfactual explanation subgraph G′ can be represented as:

[0055]

[0056] Where V′ represents the set of nodes after injecting adversarial nodes, V represents the set of nodes in the original graph, E represents the set of edges in the original graph, and E′ represents the set of edges after injecting adversarial nodes and connecting them; A′ and X′ represent the adjacency matrix and feature matrix of the second counterfactual interpretation subgraph, respectively; v inj Denotes the set of adversarial nodes, e inj This represents the edge connecting the adversarial node and the target user node. This represents the vector concatenation operation.

[0057] S13: Input the second counterfactual explanation subgraph into the graph neural network classification model to obtain the preliminary classification results of the target user nodes.

[0058] Preferably, the graph neural network classification model uses the graph convolutional neural network (GCN) model, represented as:

[0059]

[0060] Where f(A, X; W) represents the GCN model parameterized by W. This represents the second activation function; express, I represents the identity matrix; Let X represent the node degree matrix of the input graph, X represent the feature vector matrix of the input graph, and W represent the parameter matrix that the GCN model needs to learn.

[0061] S14: Determine whether the preliminary classification result of the target user node is correct. If it is correct, the first-stage bootstrapping attack fails; otherwise, the first-stage bootstrapping attack succeeds.

[0062] The system determines whether the preliminary classification result of the target user node is the same as the original category. If they are the same, the classification is correct and the first-stage bootstrapping attack fails. If they are different, the target user node is misclassified into a category other than the original category and the first-stage bootstrapping attack succeeds. The original category is the classification result obtained by classifying the target user node using an unoptimized graph neural network classification model.

[0063] The success of the first-phase bootstrapping attack can be represented as follows:

[0064] f(A,X;W)≠f(A′,X′;W)

[0065] If the equation holds true, it means that the first phase of the guided attack was successful.

[0066] After the first phase of the attack is successfully initiated, the second phase of attack defense will proceed. The process of the second phase of attack defense includes:

[0067] S21: Obtain all user nodes of the target category in the social network, input one user node from the social network and the target category into the fact interpreter, and obtain the first interpretive subgraph of the user node.

[0068] Using a classification category of user nodes in a social network as the target classification L target Obtain all user nodes of the target category in the social network; input one user node from the social network and the target category into the fact interpreter g. exp In the process, the first interpretation subgraph G of the user node is obtained. explainPreferably, the fact explainer is the GNNExplainer model (the GNNExplainer model is described in detail in the existing literature Z. Ying, D. Bourgeois, J. You, M. Zitnik, and J. Leskovec. Gnnexplainer: Generating explanations for graph neural networks. In Advances in Neural Information Processing Systems, volume 32, 2019).

[0069] The first interpretation subgraph is represented as:

[0070]

[0071]

[0072] G explain =(A explain X explain )

[0073] in, The category is L target Let f(v) be the set of user nodes, and f(v) be the classification result obtained after user node v is input into the graph neural network model. This indicates all categories classified as L target The set of first interpretation subgraphs of nodes, G explain Let A represent the first explanatory subgraph obtained. explain Let X represent the adjacency matrix of the first interpretation subgraph. explain Let represent the feature matrix of the first interpretation subgraph.

[0074] S22: Select the first-order neighbor user nodes of the center node of the first interpretation subgraph, generate adversarial nodes corresponding to the first-order neighbor user nodes, adjust the feature information of the adversarial nodes, and obtain the second interpretation subgraph.

[0075] The second injection attack is performed as follows: First-order neighbor user nodes of the central node in the first interpretation subgraph are selected. Under the premise of satisfying the perturbation budget, adversarial nodes corresponding to the first-order neighbor user nodes are generated. The feature information of the adversarial nodes is adjusted to obtain the second interpretation subgraph. The adjustment process is represented as follows:

[0076]

[0077] Where, x j' represents the adjusted adversarial node feature vector corresponding to the j-th first-order neighbor user node, N represents the actual perturbation count required during bootstrapping, deg″ target This represents the degree of the target user node in the graph after perturbation, deg. j x represents the degree of user node j in the original graph. j Let X represent the feature vector of the j-th adversarial node before adjustment. one-neibo This represents the set of all first-order neighbor nodes of the center node in the first interpretation subgraph.

[0078] S23: Input the second interpretation subgraph and the target user node into the graph neural network classification model to obtain the final classification result of the target user node.

[0079] S24: Determine whether the final classification result of the target user node is the same as the target classification. If they are the same, the attack is successful; otherwise, the attack fails. Input the next user node in the social network and the target classification into the fact interpreter to obtain the first interpretation subgraph of the user node and return to step S22.

[0080] Determine whether the final classification result of the target user node matches the target classification L. target If they are the same, it indicates a classification error, and the second-stage guided attack is successful, meaning the target user node is misclassified by the classification model into a pre-specified category L. target If they are different, it indicates that the second-stage bootstrapping attack has failed. At this point, the next user node in the social network and target classification is input into the fact interpreter to obtain the first interpretation subgraph of the user node and return to step S22 to continue the second-stage bootstrapping attack.

[0081] The success of the second-stage guided attack can be expressed as follows:

[0082]

[0083] Where A″ represents the adjacency matrix after injecting adversarial user nodes, X″ represents the feature matrix after injecting adversarial user nodes, and v t The target node guiding the attack is represented by W, which represents the parameter matrix learned in the Graph Neural Network (GCN) model; Success tag =1 indicates that the second-stage guided attack was successful; otherwise, it indicates that the second-stage guided attack failed.

[0084] S25: When the attack is successful, optimize the graph neural network classification model to obtain the optimized graph neural network classification model.

[0085] Each successful attack optimizes the graph neural network classification model. After multiple optimizations, an optimized graph neural network classification model is obtained, which can be used to defend against the aforementioned guided attacks.

[0086] The present invention also provides a graph neural network attack defense system based on interpretive subgraphs, which can be used to execute the above-mentioned graph neural network attack defense method based on interpretive subgraphs, including: a first attack module, a second attack module, and a classification model optimization module;

[0087] The first attack module is used to perform a first-stage bootstrapping attack test on the classification model;

[0088] The second attack module is used to perform a second-stage bootstrapping attack test on the classification model;

[0089] The classification model optimization module is used to optimize the model based on the results of the second-stage bootstrapping attack test and output the optimized classification model.

[0090] The attack method of this invention causes the target user node to be misclassified by the model into a pre-specified category, resulting in a good attack effect. This reflects the design flaws of graph neural networks and provides ideas and inspiration for designing more robust graph neural network models, so as to achieve better attack defense for graph neural networks.

[0091] The above-described embodiments further illustrate the purpose, technical solution, and advantages of the present invention. It should be understood that the above-described embodiments are merely preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made to the present invention within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A graph neural network attack defense method based on interpreting subgraphs, characterized in that, include: A first-stage guided attack is performed on the target user node in the social network. If the first-stage guided attack is successful, a second-stage attack defense is performed to obtain an optimized graph neural network classification model. The second phase of the attack and defense process includes: S21: Obtain all user nodes of the target category in the social network, input one user node from the social network and the target category into the fact interpreter, and obtain the first interpretation subgraph of the user node; S22: Select the first-order neighbor user nodes of the center node of the first interpretation subgraph, generate adversarial nodes corresponding to the first-order neighbor user nodes, adjust the feature information of the adversarial nodes, and obtain the second interpretation subgraph; the adjusted feature information of the adversarial nodes is represented as follows: ； in, This represents the adjusted node feature vector. This represents the actual number of disturbances required during the boot process. This represents the degree of the target node in the graph after the perturbation is applied. This represents the degree of node j in the original graph. This represents the node feature vector before adjustment. This represents the set of all first-order neighbor nodes of the central node in the first interpretation subgraph. S23: Input the second interpretation subgraph and the target user node into the graph neural network classification model to obtain the final classification result of the target user node; S24: Determine whether the final classification result of the target user node is the same as the target classification. If they are the same, the attack is successful. Otherwise, the attack fails. Input the next user node in the social network and the target classification into the fact interpreter to obtain the first interpretation subgraph of the user node and return to step S22. S25: When the attack is successful, optimize the graph neural network classification model to obtain the optimized graph neural network classification model.

2. The graph neural network attack defense method based on interpreting subgraphs according to claim 1, characterized in that, The first phase of the attack guidance process includes: S11: Select target user nodes from the social network, obtain the second-order adjacency matrix of the target user node and the feature matrix of its second-order neighbors, input the second-order adjacency matrix and the feature matrix into the counterfactual interpreter, and obtain the first counterfactual interpretation subgraph of the target user node; S12: Generate adversarial nodes corresponding to user nodes in the first counterfactual interpretation subgraph, adjust the feature information of the adversarial nodes, and obtain the second counterfactual interpretation subgraph; S13: Input the second counterfactual explanation subgraph into the graph neural network classification model to obtain the preliminary classification results of the target user node; S14: Determine whether the preliminary classification result of the target user node is correct. If it is correct, the first-stage bootstrapping attack fails; otherwise, the first-stage bootstrapping attack succeeds.

3. The graph neural network attack defense method based on interpreting subgraphs according to claim 2, characterized in that, The counterfactual interpreter is represented as: ； in, This represents a parameterized counterfactual interpreter. This represents the first activation function. This represents the degree matrix of the second-order neighbors of the target user node. This represents the second-order adjacency matrix of the target user nodes. This represents the feature matrix of the second-order neighbors of the target user node. This represents the parameter matrix that has been learned in the graph convolutional neural network model. This represents the scrambling mask matrix that the counterfactual interpreter needs to learn.

4. The graph neural network attack defense method based on interpreting subgraphs according to claim 2, characterized in that, The loss function of the counterfactual interpreter is: ； in, Represents the prediction loss function. The hyperparameters representing the weights controlling the loss are... This represents the distance loss function.

5. A graph neural network attack defense method based on interpreting subgraphs according to claim 2, characterized in that, The feature information representation of the adversarial node corresponding to the user node in the first counterfactual explanation subgraph is adjusted as follows: ； in, This represents the adjusted feature vector of the i-th adversarial node. This represents the degree of the target user node in the graph after the perturbation is added. This represents the degree of the target user node in the original graph. This represents the degree of user node i in the graph after the perturbation is added. This represents the degree of user node i in the original graph. This represents the feature vector of the i-th adversarial node before adjustment.

6. The graph neural network attack defense method based on interpreting subgraphs according to claim 1, characterized in that, The graph neural network classification model is the graph convolutional neural network (GCN) model.

7. A graph neural network attack defense system based on interpretable subgraphs, the system being used to execute the graph neural network attack defense method based on interpretable subgraphs as described in any one of claims 1 to 6, characterized in that, include: The first attack module, the second attack module, and the classification model optimization module; The first attack module is used to perform a first-stage bootstrapping attack test on the classification model; The second attack module is used to perform a second-stage bootstrapping attack test on the classification model; The classification model optimization module is used to optimize the model based on the results of the second-stage bootstrapping attack test and output the optimized classification model.

Images