Defence method, device, medium and equipment based on graph longitudinal federation model
Patent Information
- Application Number
- CN202311140704.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2023-09-05
- Publication Date
- 2026-09-22
- Estimated Expiration
- 2043-09-05
AI Technical Summary
[0021]根据本申请实施例的一个方面，提供了一种计算机程序产品或计算机程序，该计算机程序产品或计算机程序包括计算机指令，该计算机指令存储在计算机可读存储介质中。计算机设备的处理器从计算机可读存储介质读取该计算机指令，处理器执行该计算机指令，使得该计算机设备执行上述实施例中提供的基于图纵向联邦模型的防御方法。
Smart Images
Figure CN117395024B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of computer technology, and more specifically, to a defense method, apparatus, medium, and device based on a graph vertical federation model. Background Technology
[0002] Graph data is abundant in real life; social networks, financial networks, and other data structures can all be represented as graph structures. Graph neural networks (GNNs) have powerful modeling capabilities for graph data and are therefore widely used in downstream tasks such as node classification, community detection, and graph classification. In practical applications, the node features and neighborhood information of high-quality graph data are often separated among different data holders, posing a challenge to training high-quality GNN models. Graph vertical federation models can solve the challenge of data isolation. They require different data holders to exchange node representations only with the server, which only returns gradients and classification results, thus jointly training the model. This approach can train high-quality GNN models while protecting data privacy. However, graph vertical federation models are vulnerable to adversarial attacks. Traditional graph vertical federation models cannot access global information due to privacy protection restrictions, affecting their defense effectiveness. Therefore, improving the robustness of graph vertical federation models and ensuring their defense against adversarial attacks has become an urgent technical problem to be solved. Summary of the Invention
[0003] The embodiments of this application provide a defense method, apparatus, medium and device based on a graph vertical federation model, which can at least to some extent improve the robustness of the graph vertical federation model and ensure its defense effect against adversarial attacks.
[0004] Other features and advantages of this application will become apparent from the following detailed description, or may be learned in part from practice of this application.
[0005] According to one aspect of the embodiments of this application, a defense method based on a graph vertical federation model is provided, which is applied to a central server. The central server is configured with a global model in the graph vertical federation model, and the central server is communicatively connected with local servers corresponding to multiple participants. Each local server is configured with a local model in the graph vertical federation model.
[0006] The method includes:
[0007] Based on the received prediction request for the target node, a target node embedding upload instruction for the target node is sent to the local server corresponding to each participant, so that each local server, according to the target node embedding upload instruction, calls the local model to generate and feed back the target node embedding corresponding to the target node.
[0008] Obtain a pre-configured historical node embedding library, which includes several historical node embedding groups consisting of node embeddings generated by all local servers for the same historical node.
[0009] Query the historical node embedding library and select the historical node embedding group with the highest total similarity to the target node embeddings sent by other participants besides malicious participants as the target historical node embedding group.
[0010] Replace the target node embedding sent by the malicious party in the target historical node embedding group with the historical node embedding sent by the malicious party.
[0011] Based on the target node embedding replaced by the malicious participant and the target node embedding sent by the other participants, the global model is invoked to make a prediction so that the global model outputs a prediction result corresponding to the target node.
[0012] According to one aspect of the embodiments of this application, a defense device based on a graph vertical federation model is provided, which is applied to a central server. The central server is configured with a global model in the graph vertical federation model, and the central server is communicatively connected to local servers corresponding to multiple participants. Each local server is configured with a local model in the graph vertical federation model.
[0013] The device includes:
[0014] The sending module is used to send a target node embedding upload instruction for the target node to the local server corresponding to each participant according to the received prediction request for the target node, so that each local server calls the local model to generate and feed back the target node embedding corresponding to the target node according to the target node embedding upload instruction.
[0015] The acquisition module is used to acquire a pre-configured historical node embedding library, which includes several historical node embedding groups composed of node embeddings generated by all local servers for the same historical node.
[0016] The query module is used to query the historical node embedding library and select the historical node embedding group with the highest total similarity to the target node embeddings sent by other participants (excluding malicious participants) as the target historical node embedding group.
[0017] The replacement module is used to replace the target node embedding sent by the malicious party with the historical node embedding sent by the malicious party in the target historical node embedding group.
[0018] The processing module is used to call the global model to make predictions based on the target node embedding replaced by the malicious participant and the target node embeddings sent by the other participants, so that the global model outputs a prediction result corresponding to the target node.
[0019] According to one aspect of the embodiments of this application, a computer-readable medium is provided having a computer program stored thereon, which, when executed by a processor, implements the defense method based on the graph vertical federation model as described in the above embodiments.
[0020] According to one aspect of the embodiments of this application, an electronic device is provided, including: one or more processors; and a storage device for storing one or more programs, which, when executed by the one or more processors, cause the one or more processors to implement the defense method based on the graph vertical federation model as described in the above embodiments.
[0021] According to one aspect of the embodiments of this application, a computer program product or computer program is provided, the computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and executes the computer instructions, causing the computer device to perform the defense method based on the graph vertical federation model provided in the above embodiments.
[0022] In some embodiments of this application, the technical solutions involve sending a target node embedding upload instruction to the local servers of each participating party based on a received prediction request for the target node. Each local server then uses its corresponding local model to generate and return a target node embedding corresponding to the target node. Based on the received target node embedding, a historical node embedding library is queried. The historical node embedding group with the highest total similarity to target node embeddings sent by other participating parties (excluding malicious parties) is selected as the target historical node embedding group. The historical node embedding sent by the malicious party is then used to replace the target node embedding sent by that malicious party within the target historical node embedding group. Based on the target node embedding replaced by the malicious party and the target node embeddings sent by other participating parties, a global model is invoked for prediction, resulting in the global model outputting a prediction result corresponding to the target node. Therefore, replacing the malicious party's target node embedding with the historical node embedding from the group with the highest total similarity reduces the impact of malicious parties on the prediction results, improves the robustness of the graph vertical federation model, and ensures its defense against adversarial attacks.
[0023] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description
[0024] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application. It is obvious that the drawings described below are merely some embodiments of this application, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort. In the drawings:
[0025] Figure 1 A flowchart illustrating a defense method based on a graph vertical federation model according to an embodiment of this application is shown.
[0026] Figure 2 A block diagram of a defense device based on a graph vertical federation model according to an embodiment of this application is shown;
[0027] Figure 3 A schematic diagram of the structure of a computer system suitable for implementing the electronic device of the present application is shown. Detailed Implementation
[0028] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided to make this application more comprehensive and complete, and to fully convey the concept of the exemplary embodiments to those skilled in the art.
[0029] Furthermore, the described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. Numerous specific details are provided in the following description to give a thorough understanding of embodiments of this application. However, those skilled in the art will recognize that the technical solutions of this application can be practiced without one or more of the specific details, or other methods, components, apparatuses, steps, etc., can be employed. In other instances, well-known methods, apparatuses, implementations, or operations are not shown or described in detail to avoid obscuring various aspects of this application.
[0030] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities can be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.
[0031] The flowcharts shown in the accompanying drawings are merely illustrative and do not necessarily include all content and operations / steps, nor do they necessarily have to be performed in the described order. For example, some operations / steps can be broken down, while others can be combined or partially combined; therefore, the actual execution order may change depending on the specific circumstances.
[0032] Figure 1 A flowchart illustrating a defense method based on a graph vertical federation model according to an embodiment of this application is shown. This method can be applied to a central server configured with a global model in the graph vertical federation model. The central server communicates with local servers corresponding to multiple participating parties, and each local server is configured with a local model in the graph vertical federation model. Each local model can generate node embeddings for a node and upload them to the central server. The central server then calls the global model to perform predictions based on all the received node embeddings for that node and outputs the corresponding prediction results.
[0033] In a practical application scenario, the central server can be located in a bank, configured with the global model from a graph-based federated model. Each supermarket / store has its own local server, each with its own local model. Each local server can store information about each user (e.g., user ID, deposits, purchase frequency, user relationships, etc.). It should be understood that the information stored for the same user on different local servers may be the same or different. When prediction is needed, the local server can treat each user as a node. Based on the user's information, it generates a node embedding corresponding to that node by calling the corresponding local model and uploads it to the central server. The central server, based on the received node embedding, calls the global model to generate a prediction result for that node, which can be the user's credit rating. Participants can then download the corresponding user's credit rating from the central server for their use.
[0034] like Figure 1 As shown, this defense method based on the graph vertical federation model includes at least steps S110 to S150, which are described in detail below:
[0035] In step S110, based on the received prediction request for the target node, a target node embedding upload instruction for the target node is sent to the local server corresponding to each participant, so that each local server calls the local model to generate and feed back the target node embedding corresponding to the target node according to the target node embedding upload instruction.
[0036] In this embodiment, when there is a prediction requirement, the administrator can generate a prediction request for the target node through their own terminal device and send it to the central server. For example, the administrator can communicate with the central server through a desktop computer. The administrator can determine the target node to be predicted in the desktop computer, generate the corresponding prediction request, and send it to the central server.
[0037] Upon receiving the prediction request, the central server can send a target node embedding upload instruction to the local servers of each participating party. Each local server, upon receiving the instruction, can retrieve the relevant information about the target node stored on its local server, call its local model to generate the corresponding target node embedding, and then send the embedding back to the central server.
[0038] In one embodiment, the prediction request for the target node may also be initiated by a participant and sent to the central server, without any special limitation.
[0039] In step S120, a pre-configured historical node embedding library is obtained. The historical node embedding library includes several historical node embedding groups composed of node embeddings generated by all local servers for the same historical node.
[0040] In this embodiment, the central server can obtain a pre-configured historical node embedding library from its own storage space. This historical node embedding library contains several historical node embedding groups composed of node embeddings generated by all local servers for the same historical node.
[0041] In one embodiment of this application, before obtaining the pre-configured historical node embedding library, the method further includes:
[0042] Send a historical node embedding upload instruction for all historical nodes to the local servers corresponding to each participant, so that each local server can call the local model to generate and upload the historical node embedding corresponding to each historical node according to the historical node embedding upload instruction.
[0043] The historical node embeddings sent by each local server for the same historical node are grouped into a historical node embedding group to obtain a historical node embedding library and store it.
[0044] In this embodiment, after the graph vertical federated model (including the global model and local models) is trained, the central server can send a historical node embedding upload instruction to the local servers corresponding to each participant for all historical nodes. After receiving the historical node embedding upload instruction, each local server calls its local model to generate and upload the historical node embedding corresponding to each historical node. The central server can then integrate all the received historical node embeddings, grouping historical node embeddings corresponding to the same historical node into a historical node embedding group. Several historical node embedding groups constitute a historical node embedding library.
[0045] In one embodiment, during the training of the graph vertical federation model, participant i uses a local graph neural network f i (A i ,X i ;θ i (i.e., local model) obtains the embedding of node j. The data is then uploaded to the central server S. The central server S aggregates the node embeddings of each participant to obtain the global embedding of node j. The central server S uses a global classifier f0 (i.e., a global model) to analyze the global embedding h. j The predicted label of node j is obtained by classification. The central server S calculates the cross-entropy between the predicted label and the true label, and performs backpropagation to update θ0 and θ. i This is to complete the training of the graph vertical federation model.
[0046] Continue to refer to Figure 1 In step S130, the historical node embedding library is queried, and the historical node embedding group with the highest total similarity to the target node embeddings sent by other participants (excluding malicious participants) is taken as the target historical node embedding group.
[0047] In this context, malicious actors can be predetermined. It should be understood that due to parameter settings deviations in the local model or if a particular actor suffers an adversarial attack, the node embeddings output by its local model may contribute less to subsequent correct classification. Therefore, those skilled in the art can identify malicious actors from all actors based on the contribution of the node embeddings generated by the local models of each actor.
[0048] In one embodiment of this application, querying the historical node embedding library and selecting the historical node embedding group with the highest total similarity to target node embeddings sent by parties other than malicious parties as the target historical node embedding group includes:
[0049] The target node embeddings sent by all parties other than malicious parties are matched one by one with the historical node embeddings sent by the same party in each historical node embedding group to determine the similarity between the two.
[0050] For each historical node embedding group, the similarity scores of all other participants are summed to obtain the total similarity score for each historical node embedding group.
[0051] The historical node embedding group with the highest total similarity is taken as the target historical node embedding group.
[0052] In this embodiment, the central server can match the target node embeddings sent by participants other than malicious participants one by one with the historical node embeddings sent by the same participant in each historical node embedding group, thereby determining the similarity between the two. In one example, the cosine similarity between the target node embedding and the historical node embeddings can be calculated as the similarity between them. Thus, the similarity between the target node embedding sent by a normal participant and each historical node embedding previously sent by that normal participant can be obtained. It should be understood that a higher similarity indicates a higher degree of overlap between the relevant information of the target node and historical nodes stored in the normal participant's local server.
[0053] Next, the central server sums the similarities of all normal participants within each historical node embedding group to obtain the total similarity for each historical node embedding group. The historical node embedding group with the highest total similarity is then selected as the target historical node embedding group. It should be understood that the relevant information of the historical nodes corresponding to this target historical node embedding group should have the highest similarity to the relevant information of the target node.
[0054] In step S140, the historical node embedding sent by the malicious party in the target historical node embedding group is replaced with the target node embedding sent by the malicious party.
[0055] In this embodiment, after determining the target historical node embedding group, since the information of its corresponding historical node has the highest similarity to the information of the target node to be predicted, it should be understood that, since the historical node embedding library is established after the graph vertical federated model is trained (i.e., before the attack), the historical node embeddings uploaded by each participant at this time can guarantee a certain degree of accuracy and can thus serve as a reference for subsequent use in the training of the graph vertical federated model. Therefore, the historical node embedding previously sent by the malicious participant in the target historical node embedding group can be used to replace the target node embedding currently sent by the malicious participant, thereby reducing the adverse impact of the malicious participant on the subsequent prediction results.
[0056] In step S150, based on the target node embedding replaced by the malicious participant and the target node embedding sent by the other participants, the global model is invoked to make a prediction so that the global model outputs a prediction result corresponding to the target node.
[0057] In this embodiment, after replacing the target node embedding uploaded by the malicious participant, the central server can predict the target node by calling the global model based on the target node embedding replaced by the malicious participant and the target node embedding sent by the normal participant, so that the global model outputs the corresponding prediction result.
[0058] based on Figure 1 In the illustrated embodiment, based on the received prediction request for the target node, a target node embedding upload instruction is sent to the local servers corresponding to each participant. This instructs each local server to call its corresponding local model to generate and return the target node embedding corresponding to the target node. Based on the received target node embedding, the historical node embedding library is queried. The historical node embedding group with the highest total similarity to target node embeddings sent by participants other than malicious participants is selected as the target historical node embedding group. The historical node embedding sent by the malicious participant is then used to replace the target node embedding sent by that malicious participant within the target historical node embedding group. Based on the replaced target node embedding by the malicious participant and the target node embeddings sent by other participants, the global model is invoked for prediction, resulting in the global model outputting a prediction result corresponding to the target node. Therefore, replacing the malicious participant's target node embedding with the historical node embedding from the group with the highest total similarity reduces the impact of malicious participants on the prediction results, improves the robustness of the graph vertical federation model, and ensures its defense against adversarial attacks.
[0059] In one embodiment of this application, the method further includes:
[0060] Send a test node embedding upload instruction for the test node to the local server corresponding to each participant, so that each local server, according to the test node embedding upload instruction, calls the local model to generate and return the test node embedding corresponding to the test node;
[0061] Based on the test node embeddings received from each of the local servers and a pre-determined value function, the contribution of each participant to the test node is calculated according to the Shapley value.
[0062] Malicious participants are identified from all participants based on their contribution to the test node.
[0063] In this embodiment, to identify malicious participants from all participants, those skilled in the art can pre-configure a verification dataset, which includes the node ID of at least one test node and its corresponding node label. The central server can send a test node embedding upload instruction to the local servers corresponding to each participant. Upon receiving the test node embedding upload instruction, each local server can generate the corresponding test node embedding by calling a local model based on the relevant information of the test node, and then send the test node embedding back to the central server.
[0064] The central server can calculate the contribution of each participant to the correct classification of a test node based on the received test node embeddings and a pre-determined value function, according to the Shapley value. It should be understood that a higher contribution indicates a higher level of credibility for the test node embedding generated by that participant. Therefore, the central server can identify malicious participants from all participants based on their respective contributions. For example, it can identify the participant with the lowest contribution as a malicious participant, or the participant with the lowest contribution and a contribution below a predetermined threshold as a malicious participant, and so on. This ensures the accuracy of the malicious participant identification results.
[0065] In one embodiment, the contribution of each participant to the test node is determined according to the following formula:
[0066]
[0067] The calculation of this contribution is based on the Shapley value in cooperative game theory, where the value function F... v (S)=I(f0(Agg(S),θ0)=y v I is the indicator function, f0(θ0) is the server-side classifier (i.e., the global model), and Agg is the server-side aggregation protocol. For participant i, the test node embedding for test node v is sent, y v It is the label of the test node v.
[0068] In one embodiment of this application, the number of test nodes is at least two. Then, based on the contribution of each participant to the test node, malicious participants are identified from all the participants, including:
[0069] Based on the contribution of each participant to each test node, determine the total contribution of each participant to all test nodes;
[0070] The participant with the lowest total contribution will be identified as a malicious participant.
[0071] Therefore, by conducting multiple rounds of testing at multiple test nodes, errors in identification results caused by a single test can be avoided, ensuring the accuracy of the identification results for malicious participants.
[0072] The following describes an apparatus embodiment of this application, which can be used to execute the defense method based on a graph vertical federation model in the above embodiments of this application. For details not disclosed in the apparatus embodiments of this application, please refer to the embodiments of the defense method based on a graph vertical federation model described above.
[0073] Figure 2 A block diagram of a defense device based on a graph vertical federation model according to an embodiment of this application is shown.
[0074] Reference Figure 2 As shown, a defense device based on a graph vertical federation model according to an embodiment of this application is applied to a central server, which is configured with a global model in the graph vertical federation model. The central server is communicatively connected to local servers corresponding to multiple participants, and each local server is configured with a local model in the graph vertical federation model.
[0075] The device includes:
[0076] The sending module is used to send a target node embedding upload instruction for the target node to the local server corresponding to each participant according to the received prediction request for the target node, so that each local server calls the local model to generate and feed back the target node embedding corresponding to the target node according to the target node embedding upload instruction.
[0077] The acquisition module is used to acquire a pre-configured historical node embedding library, which includes several historical node embedding groups composed of node embeddings generated by all local servers for the same historical node.
[0078] The query module is used to query the historical node embedding library and select the historical node embedding group with the highest total similarity to the target node embeddings sent by other participants (excluding malicious participants) as the target historical node embedding group.
[0079] The replacement module is used to replace the target node embedding sent by the malicious party with the historical node embedding sent by the malicious party in the target historical node embedding group.
[0080] The processing module is used to call the global model to make predictions based on the target node embedding replaced by the malicious participant and the target node embeddings sent by the other participants, so that the global model outputs a prediction result corresponding to the target node.
[0081] In one embodiment of this application, the processing module is further configured to:
[0082] Send a test node embedding upload instruction for the test node to the local server corresponding to each participant, so that each local server, according to the test node embedding upload instruction, calls the local model to generate and return the test node embedding corresponding to the test node;
[0083] Based on the test node embeddings received from each of the local servers and a pre-determined value function, the contribution of each participant to the test node is calculated according to the Shapley value.
[0084] Malicious participants are identified from all participants based on their contribution to the test node.
[0085] In one embodiment of this application, the contribution of each participant to the test node is determined according to the following formula:
[0086]
[0087] Wherein, the value function F v (S)=I(f0(Agg(S),θ0)=y v I is the indicator function, f0(θ0) is the server-side classifier (i.e., the global model), and Agg is the server-side aggregation protocol. For participant i, the test node embedding for test node v is sent, y v It is the label of the test node v.
[0088] In one embodiment of this application, if the number of test nodes is at least two, then malicious participants are identified from all participants based on the contribution of each participant to the test node, including:
[0089] Based on the contribution of each participant to each test node, determine the total contribution of each participant to all test nodes;
[0090] The participant with the lowest total contribution will be identified as a malicious participant.
[0091] In one embodiment of this application, before obtaining the pre-configured historical node embedding library, the obtaining module is further configured to:
[0092] Send a historical node embedding upload instruction for all historical nodes to the local servers corresponding to each participant, so that each local server can call the local model to generate and upload the historical node embedding corresponding to each historical node according to the historical node embedding upload instruction.
[0093] The historical node embeddings sent by each local server for the same historical node are grouped into a historical node embedding group to obtain a historical node embedding library and store it.
[0094] In one embodiment of this application, the query module is used for:
[0095] The target node embeddings sent by all parties other than malicious parties are matched one by one with the historical node embeddings sent by the same party in each historical node embedding group to determine the similarity between the two.
[0096] For each historical node embedding group, the similarity scores of all other participants are summed to obtain the total similarity score for each historical node embedding group.
[0097] The historical node embedding group with the highest total similarity is taken as the target historical node embedding group.
[0098] Figure 3 A schematic diagram of the structure of a computer system suitable for implementing the electronic device of the present application is shown.
[0099] It should be noted that, Figure 3 The computer system of the electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.
[0100] like Figure 3 As shown, the computer system includes a Central Processing Unit (CPU) 301, which can perform various appropriate actions and processes based on programs stored in Read-Only Memory (ROM) 302 or programs loaded from storage portion 308 into Random Access Memory (RAM) 303, such as performing the methods described in the above embodiments. The RAM 303 also stores various programs and data required for system operation. The CPU 301, ROM 302, and RAM 303 are interconnected via a bus 304. An Input / Output (I / O) interface 305 is also connected to the bus 304.
[0101] The following components are connected to I / O interface 305: an input section 306 including a keyboard, mouse, etc.; an output section 307 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 308 including a hard disk, etc.; and a communication section 309 including a network interface card such as a LAN (Local Area Network) card, modem, etc. The communication section 309 performs communication processing via a network such as the Internet. A drive 310 is also connected to I / O interface 305 as needed. Removable media 311, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., are installed on drive 310 as needed so that computer programs read from them can be installed into storage section 308 as needed.
[0102] Specifically, according to embodiments of this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program including a computer program for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 309, and / or installed from removable medium 311. When the computer program is executed by central processing unit (CPU) 301, it performs various functions defined in the system of this application.
[0103] It should be noted that the computer-readable medium shown in the embodiments of this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), flash memory, optical fiber, portable compact disc read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying a computer-readable computer program. The transmitted data signal can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The computer-readable signal medium can also be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The computer program contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to wireless, wired, etc., or any suitable combination thereof.
[0104] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. Each block in a flowchart or block diagram may represent a module, segment, or portion of code, which contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.
[0105] The units described in the embodiments of this application can be implemented in software or hardware, and the described units can also be located in a processor. The names of these units do not necessarily limit the specific unit itself.
[0106] In another aspect, this application also provides a computer-readable medium, which may be included in the electronic device described in the above embodiments; or it may exist independently and not assembled into the electronic device. The computer-readable medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to perform the methods described in the above embodiments.
[0107] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to the embodiments of this application, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.
[0108] Through the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, touch terminal, or network device, etc.) to execute the method according to the embodiments of this application.
[0109] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the embodiments disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein.
[0110] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.
Claims
1. A defense method based on a graph vertical federation model, characterized in that, The model is applied to a central server, which is configured with a global model in a graph vertical federation model. The central server communicates with local servers corresponding to multiple participants, and each local server is configured with a local model in the graph vertical federation model. The method includes: Based on the received prediction request for the target node, a target node embedding upload instruction for the target node is sent to the local server corresponding to each participant, so that each local server, according to the target node embedding upload instruction, calls the local model to generate and feed back the target node embedding corresponding to the target node. Obtain a pre-configured historical node embedding library, which includes several historical node embedding groups consisting of node embeddings generated by all local servers for the same historical node. Query the historical node embedding library and select the historical node embedding group with the highest total similarity to the target node embeddings sent by other participants besides malicious participants as the target historical node embedding group. Replace the target node embedding sent by the malicious party in the target historical node embedding group with the historical node embedding sent by the malicious party. Based on the target node embedding replaced by the malicious participant and the target node embedding sent by the other participants, the global model is invoked to make a prediction so that the global model outputs a prediction result corresponding to the target node.
2. The method according to claim 1, characterized in that, The method further includes: Send a test node embedding upload instruction for the test node to the local server corresponding to each participant, so that each local server, according to the test node embedding upload instruction, calls the local model to generate and return the test node embedding corresponding to the test node; Based on the test node embeddings received from each of the local servers and a pre-determined value function, the contribution of each participant to the test node is calculated according to the Shapley value. Malicious participants are identified from all participants based on their contribution to the test node.
3. The method according to claim 2, characterized in that, The contribution of each participant to the test node is determined according to the following formula: Wherein, the value function F v (S)=I(f0(Agg(S),θ0)=y v I is the indicator function, f0(θ0) is the server-side classifier (i.e., the global model), and Agg is the server-side aggregation protocol. For participant i, the test node embedding for test node v is sent, y v It is the label of the test node V.
4. The method according to claim 2, characterized in that, If the number of test nodes is at least two, then based on the contribution of each participant to the test node, malicious participants are identified from all participants, including: Based on the contribution of each participant to each test node, determine the total contribution of each participant to all test nodes; The participant with the lowest total contribution will be identified as a malicious participant.
5. The method according to any one of claims 1-4, characterized in that, Before obtaining the pre-configured historical node embedding library, the method further includes: Send a historical node embedding upload instruction for all historical nodes to the local servers corresponding to each participant, so that each local server can call the local model to generate and upload the historical node embedding corresponding to each historical node according to the historical node embedding upload instruction. The historical node embeddings sent by each local server for the same historical node are grouped into a historical node embedding group to obtain a historical node embedding library and store it.
6. The method according to any one of claims 1-4, characterized in that, The historical node embedding library is queried, and the historical node embedding group with the highest total similarity to the target node embeddings sent by other participants (excluding malicious participants) is selected as the target historical node embedding group, including: The target node embeddings sent by all parties other than malicious parties are matched one by one with the historical node embeddings sent by the same party in each historical node embedding group to determine the similarity between the two. For each historical node embedding group, the similarity scores of all other participants are summed to obtain the total similarity score for each historical node embedding group. The historical node embedding group with the highest total similarity is taken as the target historical node embedding group.
7. A defense device based on a graph vertical federation model, characterized in that, The model is applied to a central server, which is configured with a global model in a graph vertical federation model. The central server communicates with local servers corresponding to multiple participants, and each local server is configured with a local model in the graph vertical federation model. The device includes: The sending module is used to send a target node embedding upload instruction for the target node to the local server corresponding to each participant according to the received prediction request for the target node, so that each local server calls the local model to generate and feed back the target node embedding corresponding to the target node according to the target node embedding upload instruction. The acquisition module is used to acquire a pre-configured historical node embedding library, which includes several historical node embedding groups composed of node embeddings generated by all local servers for the same historical node. The query module is used to query the historical node embedding library and select the historical node embedding group with the highest total similarity to the target node embeddings sent by other participants (excluding malicious participants) as the target historical node embedding group. The replacement module is used to replace the target node embedding sent by the malicious party with the historical node embedding sent by the malicious party in the target historical node embedding group. The processing module is used to call the global model to make predictions based on the target node embedding replaced by the malicious participant and the target node embeddings sent by the other participants, so that the global model outputs a prediction result corresponding to the target node.
8. The apparatus according to claim 7, characterized in that, The processing module is also used for: Send a test node embedding upload instruction for the test node to the local server corresponding to each participant, so that each local server, according to the test node embedding upload instruction, calls the local model to generate and return the test node embedding corresponding to the test node; Based on the test node embeddings received from each of the local servers and a pre-determined value function, the contribution of each participant to the test node is calculated according to the Shapley value. Malicious participants are identified from all participants based on their contribution to the test node.
9. A computer-readable medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the defense method based on the graph vertical federation model as described in any one of claims 1 to 6.
10. An electronic device, characterized in that, include: One or more processors; A storage device for storing one or more programs, which, when executed by one or more processors, cause the one or more processors to implement the defense method based on a graph vertical federation model as described in any one of claims 1 to 6.