Adversarial Attack Method for Single-Target Hard-Label Community Detection Based on Graph Neural Networks

Abstract

This application relates to an adversarial attack method for single-target hard-labeled community detection based on graph neural networks. It designs a generalizable community detection proxy model based on graph neural networks, addressing the problem of lacking feedback attack effects from the target model in practice. A hierarchical priority graph search strategy is proposed, fully utilizing graph structure properties to hierarchically divide the search space of the perturbation graph and assign priorities. The search starts within the community where the target node is located, then moves to other communities outside the target community, and finally to the initial perturbation graph of the entire graph, significantly reducing the search perturbation space and improving search efficiency. An efficient gradient calculation method for queries is also proposed, which, while ensuring a high attack success rate, minimizes the number of edges in the perturbation graph and the number of visits to the target model, making the attack method more realistic and less detectable.

Description

Technical Field

[0001] This application relates to the field of adversarial attack technology for community detection, and more specifically, to a single-target hard-label adversarial attack method for community detection based on graph neural networks. Background Technology

[0002] Community detection is one of the most widely studied topics in graph research. Its goal is to discover groups of nodes in a graph where intra-group connections are denser than inter-group connections. It has been widely applied in many practical applications, such as functional module identification in protein-protein interaction networks, discovery of scientific disciplines in co-author networks, and detection of fraudulent organizations in user transaction networks. However, with the rapid development of community detection methods, there has been a growing awareness of the excessive mining of personal privacy. Against this backdrop, some work has begun to explore techniques that allow the hiding of individuals, communities, or reduce the overall performance of community detection methods; these techniques are primarily based on heuristic or genetic methods.

[0003] In recent years, deep graph learning models have achieved outstanding performance in many graph learning tasks. However, some studies have also noted that deep graph models are vulnerable to attacks in tasks such as node / graph classification. Inspired by these findings, adversarial attacks have been extended to the community detection problem, targeting the modification of a target node's original label to hide its true identity. A well-developed attack scheme could benefit many real-world applications, such as personal privacy protection and understanding fraud evasion patterns.

[0004] Unlike adversarial attacks targeting node / graph classification, the gradients or binary responses of the target classifier are unavailable, and the lack of feedback from the target model is the first challenge. For example, in social networking companies like Facebook or Twitter, community detection methods are used as backend methods for other purposes such as advertising, which prevents direct interaction between the target model and individuals.

[0005] Most existing community detection attack methods aim to reduce the overall performance of community detection methods, failing to address the actual privacy protection needs of individuals and groups within social networks. Users on social networks may not care about performance degradation, but rather whether community detection methods can potentially uncover their community identities and spy on their privacy. When generating corresponding adversarial attack perturbation graphs with the goal of hiding the true community identities of target nodes, determining the perturbation edge combinations is an NP-hard problem. Furthermore, as the number of nodes in a social network increases, the search space of the perturbation graph grows exponentially. Maintaining a high attack success rate while improving attack efficiency and minimizing the number of edges in the graph presents a significant challenge. Summary of the Invention

[0006] To overcome at least one deficiency in the prior art, this application provides a single-target hard-label community detection adversarial attack method based on graph neural networks.

[0007] Firstly, a single-target hard-label community detection adversarial attack method based on graph neural networks is provided, including:

[0008] Construct a community detection proxy model; the community detection proxy module is used to divide the community graph structure into multiple communities.

[0009] Identify the target problem of counter-perturbation against the target node;

[0010] Based on the community detection proxy model, a hierarchical priority search strategy is adopted to determine the perturbation edges, and the initial perturbation matrix is ​​determined based on the perturbation edges. The hierarchical priority search strategy includes searching for perturbation edges in the community where the target node is located, searching for perturbation edges between the community where the target node is located and other communities, and searching for perturbation edges globally.

[0011] Based on the initial perturbation matrix, the gradient calculation method is used to solve the target problem, and the optimal perturbation matrix is ​​obtained after multiple iterations.

[0012] The perturbation map is obtained based on the optimal perturbation matrix.

[0013] In one embodiment, constructing a community detection proxy model includes:

[0014] The community detection proxy model is trained in an unsupervised manner using a loss function, resulting in the trained community detection proxy model. The loss function is:

[0015]

[0016] Among them, L u Here, K is the number of communities, Tr(·) is the rank of the matrix, and C is the community partitioning matrix. T Let C be the transpose of C, and A be the adjacency matrix of the community graph structure. This is element-wise division of a matrix, where D is the degree matrix. The balance coefficient is N, where N is the number of nodes in the community graph structure, and I is... K Let K×K be the identity matrix, ||·|| F Let be the F-norm of the matrix.

[0017] In one embodiment, the community detection model utilizes a graph convolutional network to build the model's network architecture for community segmentation. The specific process is as follows:

[0018] The adjacency matrix of the community graph structure is normalized to obtain the normalized adjacency matrix, using the following formula:

[0019]

[0020] in, Let D be the normalized adjacency matrix, and I be the degree matrix. N Let A be an N×N identity matrix, where N is the number of nodes in the community graph structure, and A is the adjacency matrix of the community graph structure.

[0021] The node feature matrix is ​​determined based on the normalized adjacency matrix, using the following formula:

[0022]

[0023] Among them, H l Let X be the node feature matrix, δ(·) be the activation function, X be the node attribute value matrix, and W be the node feature matrix. 0 Let W be the first weight matrix. 1 This is the second weight matrix;

[0024] The community partitioning matrix is ​​determined based on the node feature matrix using the following formula:

[0025] C = softmax(δ(H) l W c1 W c2 )

[0026] Where C is the community partitioning matrix, W c1 W is the third weight matrix. c2 This is the fourth weight matrix.

[0027] In one embodiment, the target problem is:

[0028]

[0029] subject to γ <b,Λ(A,h(A,Θ))<τ

[0030] Where, Θ * Let Θ be the optimal perturbation matrix, T(Θ) be the perturbation matrix, γ be the attack perturbation rate, b be the perturbation budget, Λ be the similarity calculation for two graphs, A be the adjacency matrix of the community graph structure, h(·) be the perturbation function for generating the perturbation graph, and τ be the similarity budget.

[0031] Attack perturbation rate γ:

[0032] γ=‖AA′‖0 / N(N-1)

[0033] Where, ||·||0 is the L0 norm of the matrix, N is the number of nodes in the community graph structure, and A′ is the perturbation graph;

[0034] Element A′ in perturbation graph A′ i,j :

[0035]

[0036] Among them, A′ i,j Let A be the element in the i-th row and j-th column of the perturbation graph A′. i,j Let be the element in the i-th row and j-th column of the adjacency matrix A in the community graph structure. Θ represents the element in the i-th row and j-th column of the inverse matrix of adjacency matrix A in the community graph structure; i,j Let be the element in the i-th row and j-th column of the perturbation matrix Θ;

[0037] Objective function T(Θ):

[0038]

[0039] Where clip(·) is the clipping function. Let be the perturbation matrix on the classification boundary, and ||·||1 be the L1 norm of the matrix;

[0040] Perturbation matrix on classification boundary

[0041]

[0042] Where, Θ norm Let d(Θ) be the normalized perturbation matrix of the perturbation matrix Θ, and d(Θ) be the perturbation matrix along Θ. norm Optimal step size in direction:

[0043]

[0044] Where λ is along Θ norm Step size in direction, v t For the target node, y t For target node v t The original tag.

[0045] In one embodiment, based on the community detection proxy model, a hierarchical priority search strategy is used to determine perturbation edges, and an initial perturbation matrix is ​​determined based on the perturbation edges, including:

[0046] Step S31: Search for perturbation edges within the community where the target node is located, update the community graph structure, and input the updated community graph structure into the community detection proxy model. If the label value of the target node output by the community detection proxy model is different from the original label value of the target node, the search is successful, and the initial perturbation matrix is ​​determined based on the perturbation edges; otherwise, proceed to step S32.

[0047] Step S32: Search for perturbation edges between the community where the target node is located and other communities, update the community graph structure, and input the updated community graph structure into the community detection proxy model. If the label value of the target node output by the community detection proxy model is different from the original label value of the target node, the search is successful, and the initial perturbation matrix is ​​determined according to the perturbation edges; otherwise, proceed to step S33.

[0048] Step S33: Search for perturbation edges globally, update the community graph structure, and input the updated community graph structure into the community detection proxy model. If the label value of the target node output by the community detection proxy model is different from the original label value of the target node, the search is successful, and the initial perturbation matrix is ​​determined based on the perturbation edges; otherwise, the target node attack fails.

[0049] In one embodiment, based on the initial perturbation matrix, a gradient calculation method is used to solve the objective problem, and after multiple iterations, the optimal perturbation matrix is ​​obtained, including:

[0050] The current disturbance direction is determined to be Θ. old Proceeding forward in the current perturbation direction with increments of μu, we obtain a new perturbation direction Θ. new Θ new =Θ old +μu q , where u q The vector is a normalized direction vector randomly sampled from a Gaussian distribution, μ is a step size constant, q∈1,2,3...Q, and Q is the number of normalized direction vectors; the current perturbation direction Θ is... old The objective function value is T(Θ) old ), new perturbation direction Θ new The objective function value is T(Θ) old +μu q );

[0051] For each u q Calculate u q Gradient sign in direction: sign(T(Θ) old +μu q )-T(Θ old )):

[0052]

[0053] Among them, A * It is in Θ new In the direction of T(Θ) old The perturbation diagram corresponding to the equal values, A * =h(A,d) * Θ new h(·) is the perturbation function for generating the perturbation graph, A is the adjacency matrix of the community graph structure, and yt d represents the original label of the target node. * For Θ new The isotropic step size in the direction; f(A) * The input is A. * The labels output by the model at that time;

[0054] The following formula is used to determine d. * :

[0055] ||clip(d * Θ new -0.5)‖1=T(Θ old )

[0056] Where, ||·||1 is the L1 norm of the matrix, and clip(·) is the clipping function;

[0057] According to all u q Gradient sign in the direction, calculate T(Θ) old Estimated gradient of )

[0058]

[0059] Based on the estimated gradient Determine the perturbation matrix for the next iteration:

[0060]

[0061] Where, Θ t+1 Let Θ be the perturbation matrix for the (t+1)th iteration. t Let η be the perturbation matrix for the t-th iteration. t Let be the learning rate in the t-th iteration;

[0062] After M iterations, the perturbation matrix Θ of the Mth iteration is obtained. m That is, the optimal perturbation matrix;

[0063] For the first iteration, the current perturbation direction Θ old Let Θ0 be the normalized perturbation matrix of the initial perturbation matrix; for the t-th iteration, t>1, the current perturbation direction Θ0 is... old Let Θ be the perturbation matrix for the (t-1)th iteration. t-1 .

[0064] Secondly, a single-target hard-label community detection adversarial attack device based on graph neural networks is provided, comprising:

[0065] The model building module is used to build the community detection proxy model; the community detection proxy module is used to divide the community graph structure into multiple communities.

[0066] The target problem determination module is used to determine the target problem for the adversarial perturbation against the target node;

[0067] The initial perturbation matrix determination module is used to determine perturbation edges based on the community detection proxy model using a hierarchical priority search strategy, and to determine the initial perturbation matrix based on the perturbation edges. The hierarchical priority search strategy includes searching for perturbation edges in the community where the target node is located, searching for perturbation edges between the community where the target node is located and other communities, and searching for perturbation edges globally.

[0068] The target problem solving module is used to solve the target problem based on the initial perturbation matrix using the gradient calculation method, and obtains the optimal perturbation matrix through multiple iterations.

[0069] The perturbation map determination module is used to obtain the perturbation map based on the optimal perturbation matrix.

[0070] In one embodiment, the model building module is also used for:

[0071] The community detection proxy model is trained in an unsupervised manner using a loss function, resulting in the trained community detection proxy model. The loss function is:

[0072]

[0073] Among them, L u Here, K is the number of communities, Tr(·) is the rank of the matrix, and C is the community partitioning matrix. T Let C be the transpose of C, and A be the adjacency matrix of the community graph structure. This is element-wise division of a matrix, where D is the degree matrix. The balance coefficient is N, where N is the number of nodes in the community graph structure, and I is... K Let K×K be the identity matrix, ||·|| F Let be the F-norm of the matrix.

[0074] In one embodiment, the target problem is:

[0075]

[0076] subject to γ <b,Λ(A,h(A,Θ))<τ

[0077] Where, Θ * Let Θ be the optimal perturbation matrix, T(Θ) be the perturbation matrix, γ be the attack perturbation rate, b be the perturbation budget, Λ be the similarity calculation for two graphs, A be the adjacency matrix of the community graph structure, h(·) be the perturbation function for generating the perturbation graph, and τ be the similarity budget.

[0078] Attack perturbation rate γ:

[0079] γ=‖AA′‖0 / N(N-1)

[0080] Where, ||·||0 is the L0 norm of the matrix, N is the number of nodes in the community graph structure, and A′ is the perturbation graph;

[0081] Element A′ in perturbation graph A′ i,j :

[0082]

[0083] Among them, A′ i,j Let A be the element in the i-th row and j-th column of the perturbation graph A′. i,j Let be the element in the i-th row and j-th column of the adjacency matrix A in the community graph structure. Θ represents the element in the i-th row and j-th column of the inverse matrix of adjacency matrix A in the community graph structure; i,j Let be the element in the i-th row and j-th column of the perturbation matrix Θ;

[0084] Objective function T(Θ):

[0085]

[0086] Where clip(·) is the clipping function. Let be the perturbation matrix on the classification boundary, and ||·||1 be the L1 norm of the matrix;

[0087] Perturbation matrix on classification boundary

[0088]

[0089] Where, Θ norm Let d(Θ) be the normalized perturbation matrix of the perturbation matrix Θ, and d(Θ) be the perturbation matrix along Θ. norm Optimal step size in direction:

[0090]

[0091] Where λ is along Θ norm Step size in direction, v t For the target node, y t For target node v t The original tag.

[0092] In one embodiment, the target problem solving module is used for:

[0093] The current disturbance direction is determined to be Θ. old Proceeding forward in the current perturbation direction with increments of μu, we obtain a new perturbation direction Θ. new Θ new =Θ old +μuq , where u q The vector is a normalized direction vector randomly sampled from a Gaussian distribution, μ is a step size constant, q∈1,2,3...Q, and Q is the number of normalized direction vectors; the current perturbation direction Θ is... old The objective function value is T(Θ) old ), new perturbation direction Θ new The objective function value is T(Θ) old +μu q );

[0094] For each u q Calculate u q Gradient sign in direction: sign(T(Θ) old +μu q )-T(Θ old )):

[0095]

[0096] Among them, A * It is in Θ new In the direction of T(Θ) old The perturbation diagram corresponding to the equal values, A * =h(A,d) * Θ new h(·) is the perturbation function for generating the perturbation graph, A is the adjacency matrix of the community graph structure, and y t d represents the original label of the target node. * For Θ new The isotropic step size in the direction; f(A) * The input is A. * The labels output by the model at that time;

[0097] The following formula is used to determine d. * :

[0098] ||clip(d * Θ new -0.5)‖1=T(Θ old )

[0099] Where, ||·||1 is the L1 norm of the matrix, and clip(·) is the clipping function;

[0100] According to all u q Gradient sign in the direction, calculate T(Θ) old Estimated gradient of )

[0101]

[0102] Based on the estimated gradient Determine the perturbation matrix for the next iteration:

[0103]

[0104] Where, Θ t+1 Let Θ be the perturbation matrix for the (t+1)th iteration. t Let η be the perturbation matrix for the t-th iteration. t Let be the learning rate in the t-th iteration;

[0105] After M iterations, the perturbation matrix Θ of the Mth iteration is obtained. M That is, the optimal perturbation matrix;

[0106] For the first iteration, the current perturbation direction Θ old Let Θ0 be the normalized perturbation matrix of the initial perturbation matrix; for the t-th iteration, t>1, the current perturbation direction Θ0 is... old Let Θ be the perturbation matrix for the (t-1)th iteration. t-1 .

[0107] Compared with the prior art, this application has the following beneficial effects:

[0108] 1. This application designs a generalizable community detection proxy model based on graph neural networks, which solves the problem of no feedback attack effect from the target model in practice; the community detection proxy model can be deployed and implemented locally, realistically simulating community detection methods, and also lays the foundation for subsequent experimental verification and analysis of attack performance.

[0109] 2. This application proposes a hierarchical priority graph search strategy, which makes full use of the graph structure attributes to divide the search space of the perturbation graph into hierarchical levels and set priorities. Starting from the community where the target node is located, the search proceeds to other communities outside the community, and finally to the initial perturbation graph of the entire graph. This greatly reduces the search perturbation space and improves the search perturbation efficiency.

[0110] 3. This application proposes an efficient gradient calculation method for queries, which can minimize the number of perturbation edges in the graph and the number of visits to the target model while ensuring a high attack success rate, making the attack method more realistic and less likely to be detected. Attached Figure Description

[0111] This application can be better understood by referring to the description given below in conjunction with the accompanying drawings, which, together with the detailed description below, are incorporated in and form part of this specification. In the drawings:

[0112] Figure 1 A schematic diagram of community testing is shown;

[0113] Figure 2A flowchart illustrating an adversarial attack method for single-target hard-label community detection based on graph neural networks according to an embodiment of this application is shown.

[0114] Figure 3 A structural block diagram of a single-target hard-label community detection adversarial attack device based on a graph neural network according to an embodiment of this application is shown;

[0115] Figure 4 The following diagrams show the SR comparison between the proposed method and existing methods on different datasets: (a) shows the SR comparison between the proposed method and existing methods on the DBLP-medium dataset; (b) shows the SR comparison between the proposed method and existing methods on the Finance-medium dataset; (c) shows the SR comparison between the proposed method and existing methods on the DBLP-large dataset; and (d) shows the SR comparison between the proposed method and existing methods on the Finance-large dataset.

[0116] Figure 5 The AP comparison charts of the proposed method and existing methods on different datasets are shown, where (a) is the AP comparison chart of the proposed method and existing methods on the DBLP-medium dataset, (b) is the AP comparison chart of the proposed method and existing methods on the Finance-medium dataset, (c) is the AP comparison chart of the proposed method and existing methods on the DBLP-large dataset, and (d) is the AP comparison chart of the proposed method and existing methods on the Finance-large dataset.

[0117] Figure 6 The attack performance graphs of the method of this application on different datasets are shown, where (a) is the attack performance graph of the method of this application on the DBLP-medium dataset, (b) is the attack performance graph of the method of this application on the Finance-medium dataset, (c) is the attack performance graph of the method of this application on the DBLP-large dataset, and (d) is the attack performance graph of the method of this application on the Finance-large dataset. Detailed Implementation

[0118] Exemplary embodiments of the present application will be described below with reference to the accompanying drawings. For clarity and brevity, not all features of the actual embodiments are described in the specification. However, it should be understood that many embodiment-specific decisions can be made in the development of any such actual embodiment to achieve the developer’s specific objectives, and these decisions may vary as the embodiments differ.

[0119] It should also be noted that, in order to avoid obscuring this application with unnecessary details, only the device structure closely related to the solution according to this application is shown in the accompanying drawings, while other details that are not closely related to this application are omitted.

[0120] It should be understood that this application is not limited to the described embodiments by virtue of the following description with reference to the accompanying drawings. In this document, embodiments may be combined with each other, features may be substituted or borrowed between different embodiments, and one or more features may be omitted in one embodiment, where feasible.

[0121] Figure 1 The diagram illustrates community detection, where (a) shows the original community graph structure and (b) shows the graph structure after community partitioning. The community structure is represented by a graph structure, and the real-world entities are represented by a set of nodes V, where V = {v1, v2, v3, ..., v...}. N For example, authors in a co-author network and users in a user transaction network use an N×N adjacency matrix A to describe the connections between nodes in a node set V. The elements A in the adjacency matrix A... i,j ∈{0,1} represents node V i and V j Does an undirected edge exist between them, for example, linking two authors' co-authored papers or connecting two users' transactions? Let X = {X1, X2, X3, ... X} N} represents the attribute value of a node in V, where It is a d-dimensional vector. The community detection problem aims to partition a graph G = (V, A, X) into K disjoint subgraphs Gi. i =(V i A i ,X i ), i = 1, 2, ..., K, where And when i≠j, This application uses a formula for generating non-overlapping communities.

[0122] Single-target hard-label community detection adversarial attacks refer to attacks where the attacker does not know the target GNN model and can only obtain the predicted label by querying the target model. The aim is to change the original label of the target node to hide the true community identity of the target node. This has many applications in the real world, such as protecting personal privacy in social networks and uncovering the spoofing patterns of malicious users.

[0123] This application provides a single-target hard-label community detection attack method based on graph neural networks, extending adversarial attacks to the community detection problem. By designing a proxy community detection model based on graph neural networks to simulate real-world community detection methods and provide attack feedback, the attack aims to hide the true identity of the target node by changing its original label. The attack problem is formulated as an optimization problem, with the goal of minimizing the number of edges to be perturbed in the graph while maintaining a high attack success rate. A hierarchical priority search strategy and a query-efficient gradient calculation method are designed to reduce the number of queries to the target model and optimize the perturbed graph structure.

[0124] Figure 2 A flowchart illustrating an adversarial attack method for single-target hard-label community detection based on a graph neural network according to an embodiment of this application is shown. The method includes:

[0125] Step S1: Construct a community detection proxy model; the community detection proxy module is used to divide the community graph structure into multiple communities;

[0126] Step S2: Determine the target problem of the adversarial perturbation against the target node;

[0127] Step S3: Based on the community detection proxy model, a hierarchical priority search strategy is adopted to determine the perturbation edges, and the initial perturbation matrix is ​​determined according to the perturbation edges. The hierarchical priority search strategy includes searching for perturbation edges in the community where the target node is located, searching for perturbation edges between the community where the target node is located and other communities, and searching for perturbation edges in the global scope.

[0128] Step S4: Based on the initial perturbation matrix, the gradient calculation method is used to solve the target problem, and after multiple iterations, the optimal perturbation matrix is ​​obtained.

[0129] Step S5: Obtain the perturbation map based on the optimal perturbation matrix.

[0130] In this embodiment, a generalizable community detection proxy model based on graph neural networks is designed, which solves the problem of lacking feedback attack effects from the target model in practice. The community detection proxy model can be deployed and implemented locally, realistically simulating community detection methods, and also laying the foundation for subsequent experimental verification and analysis of attack performance. The hierarchical priority graph search strategy is adopted, which greatly reduces the search perturbation space and improves the search perturbation efficiency. The gradient calculation method ensures a high attack success rate while minimizing the number of perturbation edges in the graph and the number of visits to the target model, making the attack method more realistic and less likely to be detected.

[0131] In one embodiment, step S1, constructing the community detection proxy model, may include:

[0132] The community detection proxy model is trained in an unsupervised manner using a loss function, resulting in the trained community detection proxy model. The loss function is:

[0133]

[0134] Among them, L u Here, K is the number of communities, Tr(·) is the rank of the matrix, and C is the community partitioning matrix. T Let C be the transpose of C, and A be the adjacency matrix of the community graph structure. This is element-wise division of a matrix, where D is the degree matrix. The balance coefficient is N, where N is the number of nodes in the community graph structure, and I is... K Let K×K be the identity matrix, ||·|| F Let be the F-norm of the matrix.

[0135] Here, by minimizing the loss function Lu, unsupervised community partitioning can be achieved according to the settings. The first term in the loss function minimizes the edges between communities after partitioning, which encourages the edges to be much smaller than the edges within a community. In the second term, |·| F The F-norm of a matrix is ​​used in... As a standardized cutting factor, it encourages balanced clustering.

[0136] Specifically, the community detection model uses Graph Convolutional Networks (GCNs) to build the model's network architecture to achieve community segmentation. The specific process is as follows:

[0137] The adjacency matrix of the community graph structure is normalized to obtain the normalized adjacency matrix, using the following formula:

[0138]

[0139] in, Let D be the normalized adjacency matrix, and I be the degree matrix. N Let A be an N×N identity matrix, where N is the number of nodes in the community graph structure, and A is the adjacency matrix of the community graph structure; D ii =∑ j (A+I N ) ij D ii Let be the element in the i-th row and i-th column of the degree matrix D.

[0140] The node feature matrix is ​​determined based on the normalized adjacency matrix. Here, node features are transformed on the graph structure through two-hop smoothing, using the following formula:

[0141]

[0142] Among them, H lLet X be the node feature matrix, δ(·) be the activation function, X be the node attribute value matrix, and W be the node feature matrix. 0 Let W be the first weight matrix. 1 This is the second weight matrix.

[0143] Based on the node feature matrix, a community partitioning matrix is ​​determined. Here, similar nodes are assigned to the same community using the following formula:

[0144] C = softmax(δ(H) l W c1 W c2 )

[0145] Where C is the community partitioning matrix, W c1 W is the third weight matrix. c2 This is the fourth weight matrix.

[0146] Here, W c1 The function is to linearly transform the node representation from v-dimensional space to r-dimensional space, and then introduce nonlinearity by binding it to an activation function, W. c2 The score is used to assign a score to each of the K communities; then the softmax function is applied to obtain the normalized distribution of each node across the K communities, which means that the sum of the K scores for each node is 1.

[0147] In one embodiment, the target problem is:

[0148]

[0149] subject to γ <b,Λ(A,h(A,Θ))<τ

[0150] Where, Θ * Let Θ be the optimal perturbation matrix, T(Θ) be the perturbation matrix, γ be the attack perturbation rate, b be the perturbation budget, constrain the number of perturbation edges, Λ be used to calculate the similarity between two graphs, and the log-likelihood ratio test statistic is performed based on the power-law distribution of the graphs to constrain the similarity between the two graphs before and after the attack, A be the adjacency matrix of the community graph structure, h(·) be the perturbation function for generating the perturbation graph, and τ be the similarity budget.

[0151] Here, the attacker can find the optimal perturbation matrix Θ by minimizing T(Θ). * The smaller the T(Θ) value, the fewer the perturbation edges.

[0152] Attack perturbation rate γ:

[0153] γ=‖AA′‖0 / N(N-1)

[0154] Where, ||·||0 is the L0 norm of the matrix, N is the number of nodes in the community graph structure, and A′ is the perturbation graph;

[0155] Element A′ in perturbation graph A′ i,j :

[0156]

[0157] Among them, A′ i,j Let A be the element in the i-th row and j-th column of the perturbation graph A′. i,j Let be the element in the i-th row and j-th column of the adjacency matrix A in the community graph structure. Θ represents the element in the i-th row and j-th column of the inverse matrix of adjacency matrix A in the community graph structure; i,j Let be the element in the i-th row and j-th column of the perturbation matrix Θ;

[0158] Here, Θ is relaxed to be a continuous variable. The binary term {0,1} in Θ is relaxed to be a continuous variable from 0 to 1, that is... This solution approximates the gradient of the objective function. Each relaxation element Θ... ij Both can be viewed as the probability of changes in the corresponding edge between two nodes. Specifically, if Θ ij If the value is greater than 0.5, disturb the edge state between node i and node j; otherwise, do not disturb.

[0159] Objective function T(Θ):

[0160]

[0161] Here, clip(·) is the clipping function, which clips (·) into the range [0,1]. Let be the perturbation matrix on the classification boundary, and ||·||1 be the L1 norm of the matrix;

[0162] Perturbation matrix on classification boundary

[0163]

[0164] Where, Θ norm Let Θ be the normalized perturbation matrix. It is a distance matrix that starts from A and ends at the classification boundary in the Θ direction, with a length of d(Θ) and basis vectors Θ. norm .

[0165] d(Θ) is along Θ norm Optimal step size in direction:

[0166]

[0167] Where λ is along Θ norm Step size in direction, v t For the target node, yt For target node v t The original tag.

[0168] Here, d(Θ) is used to measure the distance between the original target graph and the attack graph where the predicted labels of the target nodes have changed, Θ norm Is it to satisfy ||Θ norm The normalized perturbation matrix Θ of perturbation matrix ||2=1. d(Θ) measures the distance from the original graph to the classification boundary; that is, if moving d(Θ) from the original graph along the direction of Θ crosses the classification boundary in the direction of Θ, then the perturbation graph A′=(A,λΘ) is obtained. norm The target node v in ) t The predicted label has changed.

[0169] In one embodiment, a hierarchical priority search strategy is used to reduce the search space by leveraging graph structure properties, effectively identifying the initial perturbation matrix Θ0, and ensuring that the target nodes in the corresponding perturbation graph have the same orientation as y in the direction specified by Θ0. t Different prediction labels.

[0170] Edges in a graph structure can reflect the similarity between nodes. Nodes within the same community may have more edges, closer connections, and more similar attributes, but there are far fewer edges between different communities, and the connections between nodes in different communities are not close. This means that when changing the original community prediction label of a target node, the connection with the original community should be weakened, and the connection with other communities should be strengthened. The types of perturbation edges should be classified and a priority order should be designed.

[0171] Based on the above, in step S3, based on the community detection proxy model, a hierarchical priority search strategy is used to determine the perturbation edges, and the initial perturbation matrix is ​​determined according to the perturbation edges; this may include:

[0172] Step S31: Search for perturbation edges within the community where the target node is located, update the community graph structure, and input the updated community graph structure into the community detection proxy model. If the label value of the target node output by the community detection proxy model is different from the original label value of the target node, the search is successful, and the initial perturbation matrix is ​​determined based on the perturbation edges; otherwise, proceed to step S32.

[0173] In this step, perturbation edges are searched within the community of the target node. This search can be performed multiple times, for example, 800 times. Each search randomly selects a certain number of edges as perturbation edges. These selected perturbation edges are then removed from the graph structure to obtain an updated community graph structure. For an example, see [link to example]. Figure 1If, in a certain search, two perturbation edges are randomly determined to be the edge between node 2 and node 3 and the edge between node 2 and node 4, then these two perturbation edges do not exist in the updated community graph structure; then, the updated community graph structure is input into the community detection proxy model to obtain the predicted label value.

[0174] Here, the initial perturbation matrix Θ0 is determined based on the perturbation edges. Each element in the initial perturbation matrix corresponds to an edge in the graph structure. The element corresponding to the perturbation edge in the initial perturbation matrix has a value of 1, and the other elements have a value of 0.

[0175] Step S32: Search for perturbation edges between the community where the target node is located and other communities, update the community graph structure, and input the updated community graph structure into the community detection proxy model. If the label value of the target node output by the community detection proxy model is different from the original label value of the target node, the search is successful, and the initial perturbation matrix is ​​determined according to the perturbation edges; otherwise, proceed to step S33.

[0176] In this step, a certain number of edges are randomly selected as perturbation edges between the community where the target node is located and other communities in each search. For an example, see [link to example]. Figure 1 Search for perturbation edges between communities C1 and C2. Two perturbation edges are randomly determined to be the edge between node 3 and node 5 and the edge between node 1 and node 6 (there is no edge between them, so a virtual edge is added). Then, delete the edge between node 3 and node 5 and add the edge between node 1 and node 6 in the updated graph structure.

[0177] Step S33: Search for perturbation edges globally, update the community graph structure, and input the updated community graph structure into the community detection proxy model. If the label value of the target node output by the community detection proxy model is different from the original label value of the target node, the search is successful, and the initial perturbation matrix is ​​determined based on the perturbation edges; otherwise, the target node attack fails.

[0178] In the above embodiments, a hierarchical priority graph search strategy is proposed. This strategy makes full use of the graph structure attributes to hierarchically divide the search space of the perturbation graph and set priorities. It starts from the community where the target node is located, then moves to other communities outside the community, and finally to the initial perturbation graph of the entire graph. This greatly reduces the search perturbation space and improves the search perturbation efficiency.

[0179] In one embodiment, step S4, based on the initial perturbation matrix, uses a gradient calculation method to solve the target problem, and after multiple iterations, obtains the optimal perturbation matrix, which may include:

[0180] Step S41, determine the current disturbance direction as Θ old Proceeding forward in the current perturbation direction with increments of μu, we obtain a new perturbation direction Θ.new Θ new =Θ old +μu q , where u q The vector is a normalized direction vector randomly sampled from a Gaussian distribution, μ is a step size constant, q∈1,2,3...Q, and Q is the number of normalized direction vectors; the current perturbation direction Θ is... old The objective function value is T(Θ) old ), new perturbation direction Θ new The objective function value is T(Θ) old +μu q ).

[0181] Step S42, for each u q Calculate u q Gradient sign in direction: sign(T(Θ) old +μu q )-T(Θ old )):

[0182]

[0183] Among them, A * It is in Θ new In the direction of T(Θ) old The perturbation diagram corresponding to the equal values, A * =h(A,d) * Θ new h(·) is the perturbation function for generating the perturbation graph, A is the adjacency matrix of the community graph structure, and y t d represents the original label of the target node. * For Θ new The isotropic step size in the direction; f(A) * The input is A. * The labels output by the model at that time.

[0184] The following formula is used to determine d. * :

[0185] ||clip(d * Θ new -0.5)‖1=T(Θ old )

[0186] Where, ‖·‖1 is the L1 norm of the matrix, and clip(·) is the clipping function.

[0187] In this step, T(Θ) is calculated by querying an efficient gradient sign calculation method. oldThe gradient sign can be calculated by querying the target model only once, which saves some of the number of queries to the target model and improves the efficiency of querying and accessing the original model.

[0188] Step S43, based on all u q Gradient sign in the direction, calculate T(Θ) old Estimated gradient of )

[0189]

[0190] Based on the estimated gradient Determine the perturbation matrix for the next iteration:

[0191]

[0192] Where, Θ t+1 Let Θ be the perturbation matrix for the (t+1)th iteration. t Let η be the perturbation matrix for the t-th iteration. t Let be the learning rate in the t-th iteration;

[0193] Step S44: After M iterations, the perturbation matrix Θ of the Mth iteration is obtained. M That is, the optimal perturbation matrix;

[0194] In the above embodiment, for the first iteration, the current perturbation direction Θ old Let Θ0 be the normalized perturbation matrix of the initial perturbation matrix; for the t-th iteration, t>1, the current perturbation direction Θ0 is... old Let Θ be the perturbation matrix for the (t-1)th iteration. t-1 .

[0195] Here, after obtaining the optimal perturbation matrix, the adversarial graph A′=h(A,Θ) is... M ).

[0196] In the above embodiments, an efficient gradient calculation method for queries is proposed. While ensuring a high attack success rate, it can minimize the number of perturbation edges in the graph and the number of visits to the target model, making the attack method more realistic and less likely to be detected.

[0197] Employing the same inventive concept as the single-target hard-label community detection adversarial attack method based on graph neural networks, this embodiment also provides a corresponding single-target hard-label community detection adversarial attack device based on graph neural networks. Figure 3 A structural block diagram of a single-target hard-label community detection adversarial attack device based on a graph neural network according to an embodiment of this application is shown, including:

[0198] Model building module 31 is used to build a community detection proxy model; the community detection proxy module is used to divide the community graph structure into multiple communities;

[0199] The target problem determination module 32 is used to determine the target problem of the adversarial perturbation against the target node;

[0200] The initial perturbation matrix determination module 33 is used to determine perturbation edges based on the community detection agent model using a hierarchical priority search strategy, and to determine the initial perturbation matrix based on the perturbation edges; the hierarchical priority search strategy includes searching for perturbation edges in the community where the target node is located, searching for perturbation edges between the community where the target node is located and other communities, and searching for perturbation edges globally;

[0201] The target problem solving module 34 is used to solve the target problem based on the initial perturbation matrix using the gradient calculation method, and obtain the optimal perturbation matrix through multiple iterations.

[0202] The perturbation map determination module 35 is used to obtain the perturbation map based on the optimal perturbation matrix.

[0203] In this embodiment, a generalizable community detection proxy model based on graph neural networks is designed, which solves the problem of lacking feedback attack effects from the target model in practice. The community detection proxy model can be deployed and implemented locally, realistically simulating community detection methods, and also laying the foundation for subsequent experimental verification and analysis of attack performance. The hierarchical priority graph search strategy is adopted, which greatly reduces the search perturbation space and improves the search perturbation efficiency. The gradient calculation method ensures a high attack success rate while minimizing the number of perturbation edges in the graph and the number of visits to the target model, making the attack method more realistic and less likely to be detected.

[0204] The specific implementation functions of each module in the above embodiments are consistent with the specific implementation methods of the aforementioned method embodiments, and will not be described in detail here.

[0205] To further verify the effectiveness of the method and apparatus of this application, the community detection adversarial attack method provided in this application was applied to a public dataset for experimentation, and the performance of the adversarial attack method of this application was analyzed. Four real datasets were used in the experiment: DBLP-medium, Finance-medium, DBLP-large, and Finance-large.

[0206] DBLP is an integrated database system for English-language computer science literature, organized by author. Based on DBLP bibliographic data, two co-authorship graphs were constructed, with 5,304 and 20,814 authors respectively. The former was named DBLP-medium, and the latter DBLP-large. For each author, a 305-dimensional one-hot representation was used to encode their research keywords. Therefore, if two authors co-author a paper, through A... ij =1 and A ji The adjacency matrix A is constructed using the representation of 1. Finance is an anonymous user-to-user transaction dataset provided by Tencent, from which 5206 and 20121 users were selected to construct two transaction networks. The former is named Finance-medium, and the latter Finance-large. For each user, the dataset collected 7 features. If two users have one or more transaction records, they are identified through A. ij =1 and A ji The adjacency matrix A is constructed using the representation of 1.

[0207] This application provides a single-target hard-label community detection adversarial attack method based on graph neural networks (CD-HLBA method). For the attack model, four key metrics are used to evaluate the effectiveness of the attack:

[0208] (1) Success rate (SR), which is the proportion of successful adversarial maps out of all target maps.

[0209] (2) Average perturbation (AP), which is the average number of perturbation edges on the graph that are successfully resisted.

[0210] (3) Average number of queries (AQ), which is the average number of queries used throughout the attack (the number of times the target node label is queried).

[0211] (4) Average Time (AT), which is the average time taken for the entire attack. Even if the attack fails, this application will calculate the number of queries and attack time for all target graphs.

[0212] It is important to note that the higher the attack's SR, the lower its AP, AQ, and AT, and the better the attack performance.

[0213] Furthermore, since there are few hard-label adversarial attacks targeting single-target nodes in related research on community detection, most of them are aimed at reducing the overall performance of community detection methods or hiding multiple target nodes. In order to compare the effectiveness of the method from multiple aspects, this application compares it with other multi-target community detection methods and uses the following two metrics, M1 and M2, to evaluate the performance of the attack method.

[0214]

[0215] Where K>1, Gi is a community subgraph G1, G2...G of graph G divided into K communities. k C + For multi-objective node combinations, ∩ represents the intersection of two sets, and |·| represents the number of elements. To find the node data in the subgraph of the community with the most intersection data.

[0216] Molecules follow C + The number of communities in the distribution grows linearly, with a penalty C in the denominator. + The skewed distribution of members within the community structure. Intuitively, this metric M1(C) represents the skewed distribution of members within the community structure. + G) focuses on C + Members in G1, G2, G3…G k The distribution of C is such that the larger M1 is, the greater the distribution of C. + The more discrete the distribution, the better the attack performance, and M1(C + ,G)∈[0,1].

[0217]

[0218] Among them, only the presence of C is considered in the molecule. + The community of members, molecules with C + Members appearing simultaneously in the same community as non-C + The number of members grows linearly. The focus of this metric is C. + The degree of concealment within a crowd; the larger M2, the higher the C. + Members are scattered throughout a relatively large community, M2(C + (G)∈[0,1). This scheme aims to change the target node label, and the new predicted label is for communities with a large number of nodes. Therefore, the larger M2 is, the better the target node is concealed and the better the attack performance.

[0219] The adversarial attack method for single-target hard-label community detection based on graph neural networks (CD-HLBA method) proposed in this application is compared with existing methods such as RL-S2V attack and random attack, and the experimental results are shown in the figure. Figures 4-5 RL-S2V is an adversarial attack based on reinforcement learning that models the attack as a finite-view Markov decision process. In a random attack, the attacker first randomly and uniformly selects a perturbation rate, and then, given a target node, randomly perturbs a corresponding number of edges in the target graph.

[0220] in, Figure 4The following diagrams show the SR comparison between the proposed method and existing methods on different datasets: (a) shows the SR comparison between the proposed method and existing methods on the DBLP-medium dataset; (b) shows the SR comparison between the proposed method and existing methods on the Finance-medium dataset; (c) shows the SR comparison between the proposed method and existing methods on the DBLP-large dataset; and (d) shows the SR comparison between the proposed method and existing methods on the Finance-large dataset.

[0221] according to Figure 4 It can be seen that this application samples five different budgets in the range of 0.01 to 0.20 with a step size of 0.05. It can be observed that: (1) In most cases, the proposed attack is significantly better than other attacks. For example, when the budget b is less than 0.05, the random attack is almost ineffective on the four datasets, while the attack in this application achieves at least 40% SR; when the budget b = 0.15, the attack in this application achieves 42% SR on DBLP-medium, while the SR of RL-S2V is just over 20%. The results show that the optimization-based attack proposed in this application is more advantageous than other attack methods. (2) All methods have higher SR under larger budgets. This is because a larger budget allows the attacker to perturb more edges in the graph, and the success rate will increase accordingly.

[0222] Figure 5 The AP comparison charts of the proposed method and existing methods on different datasets are shown, where (a) is the AP comparison chart of the proposed method and existing methods on the DBLP-medium dataset, (b) is the AP comparison chart of the proposed method and existing methods on the Finance-medium dataset, (c) is the AP comparison chart of the proposed method and existing methods on the DBLP-large dataset, and (d) is the AP comparison chart of the proposed method and existing methods on the Finance-large dataset.

[0223] according to Figure 5It can be seen that (1) the attack in this application achieves a higher SR with a smaller AP, indicating that the attack in this application is significantly better than the random attack, even though the random attack under consideration is the strongest. For example, on the Finance-medium dataset, when b = 0.20, the SR of the attack in this application can reach 89.47%, and the AP corresponding to the adversarial graph is 7.33. However, the SR of the random attack under the same setting is only 39.48%. (2) AP increases with the increase of budget b. This is obvious and reasonable, because a larger budget means that more edges can be perturbed, and there is a greater probability of obtaining a successful adversarial graph. (3) The AP of attacking the four datasets is different. The reason is that the datasets have different average degrees. Specifically, DBLP is a dense graph, while Finance is not dense. This result shows that changing the predicted label of the target node in a dense graph requires more effort, and therefore requires perturbing more edges.

[0224] To evaluate the type of perturbation, the experiments also recorded the number of edges added and removed for each dataset during the attack. When b = 0.20, the average (added edges, removed edges) for DBLP-medium, Finance-medium, DBLP-large, and Finance-large were (3.47, 6.13), (7.51, 4.25), (5.13, 11.98), and (12.36, 8.14), respectively. Therefore, it can be seen that more edges should be removed for denser datasets (e.g., DBLP), and more edges should be added for sparser datasets (e.g., Finance).

[0225] In addition, the SR, AQ, and AT of the three attack methods under default settings on four datasets are recorded, as shown in Table 1. These three methods were set to have very similar query counts. It can be observed that the AT of RLS2V is significantly higher than that of the attack method in this application and the random attack. This is because the search space of RL-S2V is exponentially related to the number of nodes in the target graph. The random attack has the smallest AT because it does not require gradient computation. The attack method in this application has a similar AT to the random attack, although it does require gradient computation.

[0226] Table 1 shows the performance of SR, AQ, and AT(s) on the three datasets under default settings.

[0227]

[0228] Figure 6The attack performance graphs of the method of this application on different datasets are shown, where (a) is the attack performance graph of the method of this application on the DBLP-medium dataset, (b) is the attack performance graph of the method of this application on the Finance-medium dataset, (c) is the attack performance graph of the method of this application on the DBLP-large dataset, and (d) is the attack performance graph of the method of this application on the Finance-large dataset.

[0229] according to Figure 6 As shown in the DBLPmedium dataset, increasing the budget Δ from 2 to 20 improves attack performance (i.e., both M1 and M2 increase), indicating that a larger budget contributes to attack success. Another observation is that attack performance increases very rapidly when Δ ≤ 10, but stabilizes when Δ > 10, suggesting that the effect of Δ becomes less significant with further increases in budget.

[0230] In summary, experiments demonstrate that the method presented in this application outperforms other comparative methods in terms of attack success rate, budget expenditure, and time. The single-target hard-label community detection adversarial attack method based on graph neural networks provided in this application can hide the true community identity of target nodes while minimizing the number of perturbation edges in the graph.

[0231] The above descriptions are merely various embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A single-target hard-label community detection adversarial attack method based on graph neural networks, characterized in that, include: A community detection proxy model is constructed; the community detection proxy model is used to divide the community graph structure into multiple communities. Identify the target problem of counter-perturbation against the target node; Based on the community detection proxy model, a hierarchical priority search strategy is adopted to determine perturbation edges, and an initial perturbation matrix is ​​determined based on the perturbation edges; the hierarchical priority search strategy includes searching for perturbation edges in the community where the target node is located, searching for perturbation edges between the community where the target node is located and other communities, and searching for perturbation edges globally; Based on the initial perturbation matrix, the target problem is solved using the gradient calculation method, and the optimal perturbation matrix is ​​obtained through multiple iterations. Based on the optimal perturbation matrix, the perturbation diagram is obtained; The target problem is: b, in, This is the optimal perturbation matrix. Here is the perturbation matrix. Let be the objective function. Let b be the attack perturbation rate, and b be the perturbation budget. To calculate the similarity between two images, For the adjacency matrix of the community graph structure, The perturbation function for generating the perturbation map. Budgeting for similarity; Attack Disturbance Rate : in, For matrix Norm, where N is the number of nodes in the community graph structure. This is a perturbation diagram; Perturbation diagram elements in : in, Perturbation diagram The element in the i-th row and j-th column, Let be the element in the i-th row and j-th column of the adjacency matrix A in the community graph structure. Let be the element in the i-th row and j-th column of the inverse matrix of adjacency matrix A in the community graph structure; perturbation matrix The element in the i-th row and j-th column; objective function : Among them, clip For editing functions, The perturbation matrix on the classification boundary, Let L1 be the norm of the matrix; Perturbation matrix on classification boundary : in, perturbation matrix The normalized perturbation matrix, For along Optimal step size in direction: in, For along Step size in direction, For the target node, For the target node The original tag.

2. The method as described in claim 1, characterized in that, The construction of the community detection proxy model includes: The community detection proxy model is trained in an unsupervised manner using a loss function, resulting in the trained community detection proxy model. The loss function is: in, Let K be the loss function, and K be the number of communities set. To find the rank of the matrix, Divide the community into matrices. For the transpose of C, For the adjacency matrix of the community graph structure, For element-wise division of a matrix, For degree matrix, The balance coefficient is N, where N is the number of nodes in the community graph structure. for The identity matrix, Let be the F-norm of the matrix.

3. The method as described in claim 1, characterized in that, The community detection model utilizes a graph convolutional network to build the model's network architecture for community segmentation. The specific process is as follows: The adjacency matrix of the community graph structure is normalized to obtain the normalized adjacency matrix, using the following formula: in, The normalized adjacency matrix, For degree matrix, For N The identity matrix, where N is the number of nodes in the community graph structure. The adjacency matrix is ​​a community graph structure; The node feature matrix is ​​determined based on the normalized adjacency matrix using the following formula: in, The node feature matrix, For activation function, This is a matrix of node attribute values. This is the first weight matrix. This is the second weight matrix; Based on the node feature matrix, the community partitioning matrix is ​​determined using the following formula: in, Divide the community into matrices. This is the third weight matrix. This is the fourth weight matrix.

4. The method as described in claim 1, characterized in that, in, Based on the community detection proxy model, a hierarchical priority search strategy is used to determine perturbation edges, and an initial perturbation matrix is ​​determined based on the perturbation edges, including: Step S31: Search for perturbation edges within the community where the target node is located, update the community graph structure, and input the updated community graph structure into the community detection proxy model. If the label value of the target node output by the community detection proxy model is different from the original label value of the target node, the search is successful, and the initial perturbation matrix is ​​determined according to the perturbation edges; otherwise, proceed to step S32. Step S32: Search for perturbation edges between the community where the target node is located and other communities, update the community graph structure, and input the updated community graph structure into the community detection proxy model. If the label value of the target node output by the community detection proxy model is different from the original label value of the target node, the search is successful, and the initial perturbation matrix is ​​determined according to the perturbation edge; otherwise, proceed to step S33. Step S33: Search for perturbation edges globally, update the community graph structure, and input the updated community graph structure into the community detection proxy model. If the label value of the target node output by the community detection proxy model is different from the original label value of the target node, the search is successful, and the initial perturbation matrix is ​​determined according to the perturbation edges; otherwise, the target node attack fails.

5. The method as described in claim 1, characterized in that, in, Based on the initial perturbation matrix, the target problem is solved using a gradient calculation method, and after multiple iterations, the optimal perturbation matrix is ​​obtained, including: The current disturbance direction is determined as In the current disturbance direction The increment propagates forward, resulting in a new direction of disturbance. , ,in, Let be a normalized direction vector randomly sampled from a Gaussian distribution. The step size is a constant. , The number of normalized direction vectors; the current perturbation direction. The objective function value is New perturbation direction The objective function value is ; For each ,calculate Gradient sign in direction : in, Is Direction and The perturbation diagram corresponding to equal values. , The perturbation function for generating the perturbation map. For the adjacency matrix of the community graph structure, The original label of the target node. for The equal directional step size in the direction; For input The labels output by the model at that time; Determine using the following formula : in, Let clip be the L1 norm of the matrix. For editing functions; According to all Gradient sign in the direction, calculation Estimated gradient : Based on the estimated gradient Determine the perturbation matrix for the next iteration: in, Let be the perturbation matrix for the (t+1)th iteration. Let be the perturbation matrix for the t-th iteration. Let be the learning rate in the t-th iteration; After M iterations, the perturbation matrix of the Mth iteration is obtained. That is, the optimal perturbation matrix; For the first iteration, the current perturbation direction The initial perturbation matrix The normalized perturbation matrix; for the t-th iteration, Current disturbance direction The perturbation matrix for the (t-1)th iteration .

6. A single-target hard-label community detection adversarial attack device based on graph neural networks, characterized in that, include: The model building module is used to build community detection proxy models; The community detection agent module is used to divide the community graph structure into multiple communities; The target problem determination module is used to determine the target problem of the adversarial perturbation against the target node; The initial perturbation matrix determination module is used to determine perturbation edges based on the community detection agent model using a hierarchical priority search strategy, and to determine the initial perturbation matrix based on the perturbation edges; the hierarchical priority search strategy includes searching for perturbation edges in the community where the target node is located, searching for perturbation edges between the community where the target node is located and other communities, and searching for perturbation edges globally; The target problem solving module is used to solve the target problem based on the initial perturbation matrix using a gradient calculation method, and obtain the optimal perturbation matrix through multiple iterations. The perturbation map determination module is used to obtain the perturbation map based on the optimal perturbation matrix; The target problem is: b, in, This is the optimal perturbation matrix. Here is the perturbation matrix. Let be the objective function. Let b be the attack perturbation rate, and b be the perturbation budget. To calculate the similarity between two images, For the adjacency matrix of the community graph structure, The perturbation function for generating the perturbation map. Budgeting for similarity; Attack Disturbance Rate : in, For matrix Norm, where N is the number of nodes in the community graph structure. This is a perturbation diagram; Perturbation diagram elements in : in, Perturbation diagram The element in the i-th row and j-th column, Let be the element in the i-th row and j-th column of the adjacency matrix A in the community graph structure. Let be the element in the i-th row and j-th column of the inverse matrix of adjacency matrix A in the community graph structure; perturbation matrix The element in the i-th row and j-th column; objective function : Among them, clip For editing functions, The perturbation matrix on the classification boundary, Let L1 be the norm of the matrix; Perturbation matrix on classification boundary : in, perturbation matrix The normalized perturbation matrix, For along Optimal step size in direction: in, For along Step size in direction, For the target node, For the target node The original tag.

7. The apparatus as claimed in claim 6, characterized in that, The model building module is also used for: The community detection proxy model is trained in an unsupervised manner using a loss function, resulting in the trained community detection proxy model. The loss function is: in, Let K be the loss function, and K be the number of communities set. To find the rank of the matrix, Divide the community into matrices. For the transpose of C, For the adjacency matrix of the community graph structure, For element-wise division of a matrix, For degree matrix, The balance coefficient is N, where N is the number of nodes in the community graph structure. for The identity matrix, Let be the F-norm of the matrix.

8. The apparatus as claimed in claim 6, characterized in that, The target problem solving module is used for: The current disturbance direction is determined as In the current disturbance direction The increment propagates forward, resulting in a new direction of disturbance. , ,in, Let be a normalized direction vector randomly sampled from a Gaussian distribution. The step size is a constant. , The number of normalized direction vectors; the current perturbation direction. The objective function value is New perturbation direction The objective function value is ; For each ,calculate Gradient sign in direction : in, Is Direction and The perturbation diagram corresponding to equal values. , The perturbation function for generating the perturbation map. For the adjacency matrix of the community graph structure, The original label of the target node. for The equal directional step size in the direction; For input The labels output by the model at that time; Determine using the following formula : in, Let clip be the L1 norm of the matrix. For editing functions; According to all Gradient sign in the direction, calculation Estimated gradient : Based on the estimated gradient Determine the perturbation matrix for the next iteration: in, Let be the perturbation matrix for the (t+1)th iteration. Let be the perturbation matrix for the t-th iteration. Let be the learning rate in the t-th iteration; After M iterations, the perturbation matrix of the Mth iteration is obtained. That is, the optimal perturbation matrix; For the first iteration, the current perturbation direction The initial perturbation matrix The normalized perturbation matrix; for the t-th iteration, Current disturbance direction The perturbation matrix for the (t-1)th iteration .

Images