A graph attention network inference method and system with privacy protection

Abstract

The application discloses a graph attention network reasoning method and system with privacy protection, which is applied to a graph attention network and has three cloud servers. The steps include the following: S101: obtaining graph data of an encrypted data holder and a graph attention network model trained by a model holder, and sending the graph data and the model to the three cloud servers; S102: making the three cloud servers obtain secret shares of feature vectors of real neighbors of each node through a secure feature update protocol; S103: performing secure calculation of a nonlinear function by using the secret shares; S104: performing secure calculation of a normalized attention coefficient by using degrees of each node in a secret sharing form, and performing graph attention network reasoning with privacy protection. The scheme can solve the technical problem that it is difficult to protect the privacy of graph data and a trained model while completing graph attention network reasoning service in the prior art.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of information security, and particularly relates to a graph attention network reasoning method and system with privacy protection. BACKGROUND

[0002] Graph data can model some complex structures in real-world scenarios, such as social networks and knowledge graphs. Since graph data lacks a fixed arrangement and order, convolutional neural networks designed to extract image features cannot be used to analyze graph data. Graph attention networks are a kind of graph neural networks specially designed for processing graph data. Graph attention networks introduce an attention mechanism to calculate the weights of adjacent nodes, and then update the state of the center node using these weights. In particular, it does not need to know the structure of the entire graph during the training phase, only the adjacent nodes of each node. Graph attention networks provide a new method for solving complex problems involving graph data. This makes it widely used in many real-world applications, such as recommendation systems, text classification, and computer vision, etc.

[0003] With the wide application of cloud computing, neural network inference services for resource-constrained users are increasingly becoming a basic service for cloud service providers. Users first upload private data to the cloud, and then the cloud performs neural network inference services and returns the results to the user. Unfortunately, directly deploying graph neural network inference services in the cloud can cause serious privacy problems for private graph data and valuable trained models. On the one hand, private graph data is full of important sensitive information. For example, in a knowledge graph, the features of each node represent the properties of each entity, and the edges between nodes represent the relationships between entities. On the other hand, graph data and trained graph neural network models are valuable assets to their owners. Revealing either of them can easily harm the interests of their owners. How to protect the privacy of graph data and trained models while completing graph attention network inference services has become a problem to be solved. SUMMARY

[0004] In order to solve the technical problem that it is difficult to protect the privacy of graph data and trained models while completing graph attention network inference services in the prior art, the application provides a graph attention network reasoning method and system with privacy protection.

[0005] First aspect

[0006] The application provides a graph attention network reasoning method with privacy protection, applied to a graph attention network, comprising three cloud servers, characterized in that,

[0007] S101: Obtain the graph data of an encrypted data holder and the trained graph attention network model of a model holder, and send them to the three cloud servers;

[0008] S102: Obtain, by a secure feature update protocol, a secret share of a feature vector of each real neighbor of the node by the three cloud servers;

[0009] S103: Perform secure computation of a nonlinear function by using the secret share;

[0010] S104: Perform secure computation of a normalized attention coefficient by using a degree of each node in a secret sharing form, and perform privacy-preserving graph attention network inference.

[0011] The second aspect

[0012] The application provides a privacy-preserving graph attention network inference system, which is applied to performing the privacy-preserving graph attention network inference method in the first aspect and comprises the following steps of:

[0013] An acquisition module is configured to acquire graph data of an encrypted data holder and a graph attention network model trained by a model holder, and send the graph data and the graph attention network model to the three cloud servers;

[0014] A secure feature update protocol module is configured to obtain, by a secure feature update protocol, a secret share of a feature vector of each real neighbor of the node by the three cloud servers;

[0015] A nonlinear function module is configured to perform secure computation of a nonlinear function by using the secret share;

[0016] A privacy-preserving graph attention network inference module is configured to perform secure computation of a normalized attention coefficient by using a degree of each node in a secret sharing form, and perform privacy-preserving graph attention network inference.

[0017] Compared with the prior art, the application has at least the following beneficial technical effects:

[0018] In the application, a resource-restricted user can encrypt and distribute private graph data to three independent cloud servers, the three cloud servers perform secure interaction, execute a privacy-preserving inference scheme of a graph attention network, obtain an inference result, and return the inference result to the user. The resource-restricted user and the model holder only need to send the private graph data and the trained model to the three cloud servers once, which liberates the online participation of the user and the model holder. The method designs a privacy-preserving algorithm for an inference stage of the graph attention network, which can provide a privacy-preserving inference service of the graph attention network for the resource-restricted user and guarantee the privacy of the private graph data and the trained model. BRIEF DESCRIPTION OF DRAWINGS

[0019] The above-mentioned characteristics, technical features, advantages and implementation ways of the present application will be further described in a clear and easy-to-understand manner in combination with the preferred embodiments and the accompanying drawings.

[0020] Figure 1 is a flow diagram of a graph attention network reasoning method with privacy protection provided by the present application;

[0021] Figure 2 is a structural diagram of a graph attention network reasoning system with privacy protection provided by the present application;

[0022] Figure 3 is a model diagram of a graph attention network reasoning system with privacy protection provided by the present application. DETAILED DESCRIPTION

[0023] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the specific embodiments of the present application will be described below with reference to the accompanying drawings. Obviously, the accompanying drawings in the following description only represent some embodiments of the present application, and for those skilled in the art, other drawings can be obtained from these drawings without creative labor, and other embodiments can also be obtained.

[0024] In order to make the drawing simple, only the parts related to the invention are shown in each drawing, which does not represent the actual structure of the product. In addition, in order to make the drawing simple and easy to understand, in some drawings, only one of the components with the same structure or function is shown, or only one of them is marked. In this paper, "one" not only means "only one", but also means "more than one".

[0025] It should be further understood that the term "and / or" used in the specification and the appended claims of the present application means any combination of one or more of the associated listed items and all possible combinations, and includes these combinations.

[0026] In this paper, it should be noted that unless otherwise specified and limited, the terms "mounting", "connection", "connection" should be understood in a broad sense, for example, it can be fixed connection, or detachable connection, or integral connection. It can be mechanical connection or electrical connection. It can be directly connected or indirectly connected through an intermediate medium. It can be the communication inside two elements. For those skilled in the art, the specific meaning of the above terms in the present application can be understood according to the specific circumstances.

[0027] In addition, in the description of the present application, the terms "first", "second" and the like are only used to distinguish the description, and cannot be understood as indicating or implying relative importance.

[0028] Embodiment 1

[0029] In one embodiment, referring to the flowchart of the graph attention network inference method with privacy protection provided by the present application shown in the accompanying drawings of the specification, Figure 1 , the structure diagram of the graph attention network inference system with privacy protection provided by the present application is shown in the accompanying drawings of the specification. Figure 2 , the structure diagram of the graph attention network inference system with privacy protection provided by the present application is shown in the accompanying drawings of the specification.

[0030] The graph attention network inference method with privacy protection provided by the present application is applied to a graph attention network and includes three cloud servers.

[0031] The graph attention network inference method with privacy protection provided by the present application includes:

[0032] S101: Obtain the graph data of an encrypted data holder and a graph attention network model trained by a model holder, and send them to the three cloud servers.

[0033] The data holder is a resource-restricted user.

[0034] Optionally, the graph data includes digital information and structural information, the digital information includes a feature vector of each node and a feature matrix composed of feature vectors of all the nodes, and the structural information includes edges between the nodes, degrees of the nodes, and neighbor identities of the nodes, and the edges between the nodes, the degrees of the nodes, and the neighbor identities of the nodes are set in an adjacency matrix of a graph.

[0035] Optionally, the S101 specifically includes:

[0036] S1011: The data holder divides the feature matrix into first arithmetic secret shares by using a replicated secret sharing technology, the data holder encrypts the adjacency matrix with self-connection and divides the adjacency matrix into second arithmetic secret shares, the data holder encrypts the degrees of each node and divides them into third arithmetic secret shares, and the model holder encrypts the graph attention network model by using the replicated secret sharing technology and divides it into fourth arithmetic secret shares;

[0037] S1012: Obtain the first arithmetic secret shares and send them to the corresponding cloud servers in the three cloud servers;

[0038] S1013: Obtain the second arithmetic secret shares and send them to the corresponding cloud servers in the three cloud servers;

[0039] S1014: Obtain the third arithmetic secret share, and send the third arithmetic secret share to the corresponding cloud server in the three cloud servers;

[0040] S1015: Obtain the fourth arithmetic secret share, and send the fourth arithmetic secret share to the corresponding cloud server in the three cloud servers.

[0041] For example: the numerical information of the graph data is the feature vector of each node v i The feature vector of each node v i The feature vectors of all nodes can form a feature matrix F 0 The data holder divides the feature matrix into arithmetic secret shares This is the first arithmetic secret share, and sends these secret shares to the corresponding cloud server. The structural information of the graph data includes edges, node degrees and node neighbor identities. The adjacency matrix A of the graph contains these structural information. Since in the graph attention network, the first-order neighbor set i of the node v includes the node v i itself, the data holder needs to encrypt the adjacency matrix with self-connection using the replicated secret sharing technology, and then obtain its arithmetic secret share This is the second arithmetic secret share, and is sent to the corresponding cloud server. In order to calculate the normalized attention coefficient securely, the data holder also needs to encrypt the degree d i of each node (i∈[1,n]) and its secret share, which is the third arithmetic secret share, and is sent to the corresponding cloud server. The model holder also encrypts the graph attention network model (W 1，2 , m 1，2 ) using the replicated secret sharing technology and its secret share, which is the fourth arithmetic secret share, and is sent to the corresponding cloud server.

[0042] S102: Obtain the arithmetic secret share of the feature vector of the real neighbor of each node through the secure feature update protocol.

[0043] Optionally, the S102 specifically includes:

[0044] S1021: Obtain the fifth arithmetic secret share through the secure feature update protocol by using the adjacency matrix and the most significant bit of the node.

[0045] Optionally, the S1021 specifically includes:

[0046] ​S10211: judging whether the target node is a neighbor of the node, and updating the feature vector of a non-neighbor node to a zero vector;

[0047] S10212: obtaining a Boolean secret share through a secure extraction protocol of the most significant bit;

[0048] S10213: converting the Boolean secret share into the fifth arithmetic secret share through a secure B2A protocol.

[0049] S1022: completing feature updating through the fifth arithmetic secret share and the arithmetic secret share of the feature vector of the node.

[0050] The secure feature updating technique is used to make three cloud servers obtain secret shares of the feature vector of the real neighbor of each node without exposing the identity of the neighbor of the node. With the aid of a self-connected adjacency matrix and the most significant bit (MSB), the feature vector of each node is securely updated. In the self-connected adjacency matrix, if a ij > 0, the node v j is a neighbor of the node v i ; if a ij ≤ 0, the node v j is not a neighbor of the node v i , and the feature vector of the node v j is updated to a zero vector. Since the most significant bit can represent the positive and negative relationship, the comparison operation is converted into the extraction operation of the most significant bit. In the self-connected adjacency matrix, the inequality a ij -1 ≥ 0 is equivalent to a ij > 0, and the inequality a ij -1 < 0 is equivalent to a ij ≤ 0, so the MSB of a ij -1 can be extracted to realize the comparison operation. The secure extraction protocol of the most significant bit outputs the Boolean secret share of the MSB. Since the moduli are different, the Boolean secret share cannot be directly multiplied by the arithmetic secret share, and the secure B2A protocol is further used to convert the Boolean secret share into the arithmetic secret share. The secure B2A protocol can convert a k-bit secret value x from the Boolean sharing into the arithmetic sharing. Specifically, refer to the attached drawings Figure 3, a model schematic diagram of the graph attention network reasoning method with privacy protection provided by the application is shown. The system model contains three entities: a data holder (i.e. a resource-limited user), a model holder and three cloud servers. Due to limited computing resources, the data holder hopes to use the cloud server to obtain the reasoning result of the private graph data. The data holder uses the replicated secret sharing technology to divide the private graph data into three pairs of secret shares, and sends them to the three cloud servers respectively. The model holder spends a lot of resources to train a graph attention network model for some specific applications, in order to protect the privacy of the model, the model holder also sends the encrypted model to the three cloud servers in the same way. The three cloud servers supported by independent cloud service providers can provide privacy protection graph attention network reasoning services, and none of the cloud servers will get the plaintext form of the private graph data and the graph attention network model. The system architecture liberates the online participation of the data holder and the model holder. Cloud servers P1 and P2 first get a random boolean secret share through three pseudo-random functions Cloud servers P2 and P3 also get a random boolean share in the same way Then the three cloud servers calculate k-1 times of independent full adders Then they get In the semi-honest adversary model, this step can be optimized as: P2 takes the boolean secret share of (-x2-x3) as input, and they calculate a parallel prefix adder to get In any case, x1 can finally be obtained by P1 and P3, and the final arithmetic secret share is represented as Finally, multiplying the arithmetic secret share with the arithmetic secret share of the feature vector of the corresponding node v j can complete the feature update.

[0051] S102 can be completed by algorithm:

[0052] for j=1→n do

[0053] Each party locally calculates

[0054] Each party gets

[0055] Each party gets

[0056] Each party locally calculates

[0057] Each party gets

[0058] Copying secret sharing involves sharing the secret value. The key is to divide the key into three random secret shares, x1, x2, and x3, using addition to encrypt a k-bit secret value x, satisfying x1 + x2 + x3 ≡ x (mod 2). k Each secret share is evenly distributed in the ring. The three secret shares, given the random values ​​on the cloud server P, are then divided into three pairs: {(x1, x2), (x2, x3), (x3, x1)}. t Each pair of secret shares holds the t-th pair (t∈{1, 2, 3}). For ease of representation, we denote these three pairs of secret shares as triples (x1, x2, x3). This sharing method is represented as... In a replicated secret share, any two of the three parties can recover the secret value x, indicating that a replicated secret share can tolerate corruption by at most one party. To reveal a shared secret value x, party P... t Need to send x t Give to participant P t+1 (P 3+1 That is, P1). In this way, each participant can recover the secret value x through local addition. This reconstruction process is represented as...

[0059] Given two secret values ​​x and y and their respective secret shares, some basic operations between the three parties in the secret sharing domain are as follows. Addition or subtraction between the two shared values ​​can be computed locally by each participant. Addition or subtraction of a shared value and a public value c can also be calculated locally. The multiplication of a shared value and a public value c can be computed locally by each party.

[0060] Multiplication between two shared values It requires interactive computation by three parties. Specifically, each party P... t First, generate a related random number locally using a pseudo-random function. The condition r1 + r2 + r3 = 0 is satisfied. The purpose of the associated random number is to randomize the secret share of the multiplication result. Then P1 calculates and sends z1 = x1y1 + x1y2 + x2y1 + r1 to P3, P2 calculates and sends z2 = x2y2 + x2y3 + x3y2 + r2 to P1, and P3 calculates and sends z3 = x3y3 + x3y1 + x1y3 + r3 to P2. This completes the secure multiplication of two shared values.

[0061] It is worth noting that when k=1, in the ring Perform a copy secret share. At this point, we represent the Boolean secret share of the secret value x as... In the Boolean secret sharing, the exclusive or operation Instead of the addition operation, the and operation (A) replaces the multiplication operation.

[0062] S103: using the secret share, performing secure calculation of a nonlinear function.

[0063] Optionally, the S103 specifically includes:

[0064] S1031: the nonlinear function LeakyReLU and the nonlinear function ELU obtain the Boolean secret share and the fifth arithmetic secret share, and the three cloud servers perform local calculation to output a secure multiplication structure;

[0065] S1032: the nonlinear function Softmax obtains a secure exponential operation result, and the three cloud servers perform local addition on the arithmetic share of the secure exponential operation result to reconstruct the addition result, and divide the share of the secure exponential operation result by the reconstructed result to obtain a target secure exponential operation result.

[0066] Optionally, the nonlinear function LeakyReLU adopts the formula:

[0067]

[0068] The nonlinear function ELU adopts the formula:

[0069]

[0070] The nonlinear function Softmax adopts the formula:

[0071] z = Softmax (x) ;

[0072]

[0073] Wherein, s is the slope of negative input, s = 0.2, a is a parameter, a = 1, and C is the number of classification labels.

[0074] Specifically, there are three nonlinear functions (LeakyReLU, ELU, and Softmax) in the inference of the graph attention network, and corresponding secure calculation protocols are designed for the three nonlinear functions based on the replicated secret sharing technology.

[0075] Both LeakyReLU and ELU are piecewise functions, requiring comparison operations. Therefore, the comparison operations are transformed into secure MSB extraction operations. Then, a secure B2A protocol is invoked to convert the Boolean secret share of the MSB into an arithmetic secret share. Finally, secure multiplication and secure exponentiation operations are performed to securely compute these two nonlinear functions. Note that during GAT inference, the input to the nonlinear function ELU is a vector; therefore, the designed protocol needs to perform secure computation on each element of the vector.

[0076] The Softmax function normalizes a vector by first performing a security exponentiation on each element of the input vector. Then, each cloud server performs local addition on the arithmetic share of these exponentiation results and reconstructs the addition result (i.e., the denominator in the expression). Finally, each cloud server divides the security exponentiation share of each element in the first step by the reconstructed result, thus completing the security calculation of the Softmax function.

[0077] The algorithm used in S103 is described as follows:

[0078] Safe LeakyReLU(x):

[0079] All parties obtained the secure MSB extraction protocol.

[0080] All parties obtained the secure B2A extraction protocol.

[0081] Local calculation for each party

[0082] All parties output through safe multiplication

[0083] Safety ELU(x):

[0084] for i=1→L′do

[0085] All parties obtained the secure MSB extraction protocol.

[0086] All parties obtained the secure B2A extraction protocol.

[0087] Local calculation for each party

[0088] All parties obtained the security index through calculation.

[0089] Local calculation for each party

[0090] All parties output through safe multiplication

[0091] Secure Softmax(x):

[0092]

[0093]

[0094] S104: performing privacy-preserving graph attention network inference by using the degree of each node in the form of secret sharing to securely compute the normalized attention coefficients.

[0095] Optionally, the S104 specifically comprises:

[0096] S1041: using the shared degree of the node to compute the number of non-neighbor nodes;

[0097] S1042: using the zero vector to compute the attention coefficient of the non-neighbor node, and performing a secure exponential operation to compute the exponential result share of the attention coefficient;

[0098] S1043: summing the exponential results of the attention coefficients of all the nodes, and subtracting the product of the number of non-neighbor nodes and the exponential result share to obtain the sum result;

[0099] S1044: reconstructing the sum result, and dividing the exponential result share of the attention coefficient of each node by the sum result.

[0100] Optionally, since the feature vector of the non-neighbor node is updated to a zero vector, the attention coefficient of the non-neighbor node is the same.

[0101] Specifically, because the secure feature update protocol updates the feature vectors of all nodes instead of only accessing the feature vectors of neighbor nodes, the features of those updated non-neighbor nodes will still affect the secure computation of the normalized attention coefficients. To solve this problem, the degree of each node in the form of secret sharing is used to securely compute the normalized attention coefficients. Since the feature vectors of those non-neighbor nodes are updated to zero vectors in the secure feature update protocol, the attention coefficients of these non-neighbor nodes are the same. Specifically, first, the degree of each node v iThe number of non-neighbor nodes of each node is calculated according to the sharing degree of the node. Then the attention coefficient of the non-neighbor nodes of the node is calculated using the zero vector, and the security index operation is performed to calculate the exponential result share of the attention coefficient. Next, the exponential results of the attention coefficients of all nodes are summed, and the product of the results of the first two steps is subtracted to eliminate the influence of the non-neighbor nodes. Finally, the sum is reconstructed, and the exponential result share of the attention coefficient of each node is divided by the sum. This completes the secure calculation of the normalized attention coefficient. Further, a privacy protection reasoning scheme of the graph attention network is proposed, so that three independent cloud servers can provide privacy protection reasoning services of the graph attention network for resource-constrained users, and the privacy of the private graph data and the trained model is guaranteed.

[0102] The algorithm of S104 is described as follows:

[0103]

[0104]

[0105] In the present application, the resource-constrained user can encrypt and distribute his private graph data to three independent cloud servers, and the three cloud servers perform secure interaction to execute the privacy protection reasoning scheme of the graph attention network, obtain the inference result, and return it to the user. The resource-constrained user and the model holder only need to send their private graph data and trained model to the three cloud servers once, which liberates the online participation of the user and the model holder. The method designs a privacy protection algorithm for the inference stage of the graph attention network, which can provide privacy protection reasoning services of the graph attention network for resource-constrained users, while guaranteeing the privacy of the private graph data and the trained model.

[0106] Embodiment 2

[0107] In one embodiment, the present application provides a graph attention network reasoning system 30 with privacy protection, comprising an acquisition module 301 for acquiring the graph data of an encrypted data holder and the trained graph attention network model of a model holder, and sending them to the three cloud servers; a secure feature update protocol module 302 for enabling the three cloud servers to obtain secret shares of the feature vectors of the real neighbors of each node through a secure feature update protocol; a nonlinear function module 303 for performing secure calculation of a nonlinear function using the secret shares; and a privacy protection graph attention network reasoning module 304 for performing secure calculation of normalized attention coefficients using the degree of each node in the form of secret sharing, and performing privacy protection graph attention network reasoning.

[0108] The graph attention network reasoning system with privacy protection provided by the present application can realize the steps and effects of the graph attention network reasoning method with privacy protection in the above embodiment 1, and the present application will not be described again to avoid repetition.

[0109] Compared with the prior art, the present application has at least the following beneficial technical effects:

[0110] In the present application, the resource-constrained user can encrypt and distribute its private graph data to three independent cloud servers, the three cloud servers interact securely, execute the privacy protection reasoning scheme of the graph attention network, obtain the inference result, and return it to the user. The resource-constrained user and the model holder only need to send their private graph data and trained models to the three cloud servers once, which liberates the online participation of the user and the model holder. The method designs a privacy protection algorithm for the reasoning phase of the graph attention network, which can provide privacy protection reasoning service for the resource-constrained user, while ensuring the privacy of the private graph data and the trained model.

[0111] The technical features of the above embodiments can be combined arbitrarily, and to make the description concise, not all possible combinations of the technical features in the above embodiments are described, however, as long as the combination of the technical features does not exist contradictory, it should be considered as the scope of the present application.

[0112] The above embodiments only express several implementation manners of the present application, and the description is more specific and detailed, but it should not be understood as a limitation on the scope of the patent. It should be pointed out that for ordinary skilled in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are all within the protection scope of the present application. Therefore, the protection scope of the present application patent should be subject to the appended claims.

Claims

1. A graph attention network inference method with privacy protection, applied to a graph attention network, comprising three cloud servers, characterized in that, S101: obtaining the graph data of an encrypted data holder and a graph attention network model trained by a model holder, and sending them to the three cloud servers; S102: making the three cloud servers obtain arithmetic secret shares of feature vectors of each node real neighbor through a secure feature update protocol; S102 specifically includes: S1021: obtaining a fifth arithmetic secret share through the secure feature update protocol by using the adjacency matrix of the node and the most significant bit; S1021 specifically includes: S10211: judging whether the target node is a neighbor of the node, and updating the feature vector of the non-neighbor node to a zero vector; S10212: obtaining a Boolean secret share through a secure extraction protocol of the most significant bit; S10213: converting the Boolean secret share into the fifth arithmetic secret share through a secure B2A protocol; S1022: completing feature update through the fifth arithmetic secret share and the arithmetic secret share of the feature vector of the node; S103: performing secure calculation of a nonlinear function by using the arithmetic secret share; S103 specifically includes: S1031: the nonlinear function LeakyReLU and the nonlinear function ELU obtain the Boolean secret share and the fifth arithmetic secret share, and the three cloud servers perform local calculation to output a secure multiplication structure; S1032: the nonlinear function Softmax obtains a secure exponential operation result, and the three cloud servers perform local addition on the arithmetic share of the secure exponential operation result to reconstruct an addition result, and divide the share of the secure exponential operation result by the reconstructed result to obtain a target secure exponential operation result; The nonlinear function LeakyReLU adopts the formula: ； The nonlinear function ELU adopts the formula: ； The nonlinear function Softmax adopts the formula: ； ， where s is the slope of the negative input, s = 0.2, is a parameter, = 1, C is the number of classification labels; S104: performing secure calculation of a normalized attention coefficient by using the degree of each node in the form of secret sharing, and performing privacy protection graph attention network inference; S104 specifically includes: S1041: calculating the number of non-neighbor nodes using the shared degree of the node; S1042: calculating the attention coefficient of the non-neighbor node using the zero vector, and performing a secure exponential operation to calculate the exponential result share of the attention coefficient; S1043: summing the exponential results of the attention coefficients of all nodes, and subtracting the product of the number of non-neighbor nodes and the exponential result share to obtain a summation result; S1044: reconstructing the summation result, and dividing the exponential result share of the attention coefficient of each node by the summation result.

2. The graph attention network inference method of claim 1, wherein, The graph data includes digital information and structural information, the digital information includes a feature vector of each node and a feature matrix composed of feature vectors of all nodes, and the structural information includes edges between the nodes, degrees of the nodes, and neighbor identities of the nodes, and the edges between the nodes, the degrees of the nodes, and the neighbor identities of the nodes are arranged in an adjacency matrix of the graph.

3. The graph attention network inference method according to claim 2, characterized in that, The S101 specifically includes: S1011: The data holder divides the feature matrix into first arithmetic secret shares by using a replicated secret sharing technology, the data holder encrypts the adjacency matrix with self-connection and divides the adjacency matrix into second arithmetic secret shares, the data holder encrypts the degree of each node and divides the degree into third arithmetic secret shares, the model holder encrypts a graph attention network model by using a replicated secret sharing technology and divides the graph attention network model into fourth arithmetic secret shares; S1012: The first arithmetic secret shares are obtained, and the first arithmetic secret shares are sent to the corresponding cloud server in the three cloud servers; S1013: The second arithmetic secret shares are obtained, and the second arithmetic secret shares are sent to the corresponding cloud server in the three cloud servers; S1014: The third arithmetic secret shares are obtained, and the third arithmetic secret shares are sent to the corresponding cloud server in the three cloud servers; S1015: The fourth arithmetic secret shares are obtained, and the fourth arithmetic secret shares are sent to the corresponding cloud server in the three cloud servers.

4. The graph attention network inference method of claim 1, wherein, Since the feature vector of the non-neighbor node is updated to a zero vector, the attention coefficients of the non-neighbor node are the same.

5. A graph attention network inference system with privacy protection, applied to the graph attention network inference method with privacy protection in any one of claims 1 to 4, characterized in that, It includes: An acquisition module is configured to acquire encrypted data holder graph data and model holder trained graph attention network model and send to the three cloud servers; A secure feature update protocol module is configured to enable the three cloud servers to obtain secret shares of feature vectors of real neighbors of each node through a secure feature update protocol; A nonlinear function module is configured to perform secure calculation of a nonlinear function by using the secret shares; A privacy protection graph attention network inference module is configured to complete secure calculation of a normalized attention coefficient by using the degree of each node in the form of secret sharing and perform privacy protection graph attention network inference.

Images