A privacy leakage detection method for federated graph neural networks

Abstract

This invention relates to a privacy leakage detection method for federated graph neural networks, comprising the steps of: acquiring target information of training set members and non-training set members of each subsystem when passing through the subgraph federated model; acquiring feature vectors based on the target information; inputting test data from the feature vectors into a trained encoder to obtain test accuracy, wherein the trained encoder is trained using the training data from the feature vectors, and the proportion of training set members and non-training set members in the training data is equal; and determining the degree of privacy leakage of training set members based on the test accuracy. This method can evaluate and analyze the privacy leakage of the subgraph federated model itself, and compare and analyze the privacy leakage of different parameters of the deep neural network in the subgraph federated model, thereby assisting model owners in optimizing the model and reducing privacy leakage of training members, filling the gap in privacy leakage detection technology under subgraph federated learning models.

Description

Technical Field

[0001] This invention belongs to the fields of machine learning and privacy security technology, specifically relating to a privacy leakage detection method using a federated graph neural network. Background Technology

[0002] Graphs are an ubiquitous and important form of data representation in the real world. However, due to their non-Euclidean nature, analyzing graph data is computationally extremely difficult. Recently, neural networks have been extended to graph data, resulting in graph neural networks (GNNs). Due to their superior performance, GNNs have found numerous applications, such as healthcare systems and recommendation systems. Meanwhile, as graphs grow larger, it becomes apparent that their subgraphs are stored across multiple local systems. To train a GNN model that more accurately reflects real-world distributions, data from multiple sources is needed. However, given the immense value of data, data sharing is impractical. Against this backdrop, many enterprises and laboratories utilize federated learning to address the data sharing problem. As a distributed learning paradigm, federated learning allows local systems to fully utilize data from other systems and obtain a centralized model. Therefore, subgraph federated learning models have developed rapidly in recent years. As neural networks have further developed, it has been discovered that they often remember information from the training data during model training. This is undesirable because graph data, such as chemical networks and social networks, is considered confidential. Data owners often spend significant resources collecting this data, or the data itself contains sensitive information, such as social relationships. Therefore, if a federated subsystem, after participating in subgraph federated learning, still leads to data privacy breaches, the harm it causes in today's data-driven information age is self-evident.

[0003] Most existing privacy leakage detection techniques for training members are implemented on non-graph data in federated learning or on centralized graph data. For example, existing research 1 analyzed the privacy leakage of graph neural networks under centralized conditions, finding that it is related to the properties of the dataset itself, such as the number of nodes and edges, as well as model overfitting and the type of graph neural network, thus providing a good assessment of the degree of privacy leakage in centralized graph neural networks. Similarly, existing research 2 analyzed the privacy leakage of non-graph data under federated learning, finding that it is related to the number of malicious clients and specific nodes. Both of these technical solutions have achieved good experimental results in their respective application contexts.

[0004] However, both of the above techniques have limitations in addressing privacy breaches. One ignores graph data, which limits its application in real-world situations because relationships in the real world are often represented by graph data, and further loss values ​​and gradient information are not considered. The other fails to consider the large scale of graph data, requiring federated learning methods to fully utilize the characteristics of data from each local system. Evaluating privacy breaches only under centralized systems is not applicable to evaluating privacy breaches in federated learning processes. Therefore, neither of the existing techniques can adequately assess the privacy breaches of training members in subgraph federated learning scenarios. Summary of the Invention

[0005] To address the aforementioned problems in the existing technology, this invention provides a privacy leakage detection method based on federated graph neural networks. The technical problem to be solved by this invention is achieved through the following technical solution:

[0006] This invention provides a privacy leakage detection method for federated graph neural networks, comprising the following steps:

[0007] Obtain the target information of each subsystem's training set members and non-training set members as they pass through the subgraph federated model;

[0008] Obtain the feature vector based on the target information;

[0009] The test data in the feature vector is input into the trained encoder to obtain the test accuracy. The trained encoder is obtained by training the encoder using the training data in the feature vector. The proportion of the training set members and the non-training set members in the training data is the same.

[0010] The degree of privacy leakage of the training set members is determined based on the test accuracy.

[0011] In one embodiment of the present invention, the target information includes one or more of the following: loss value, posterior probability, and gradient.

[0012] In one embodiment of the present invention, when the target information includes a loss value, a posterior probability, and a gradient, obtaining a feature vector based on the target information includes:

[0013] The gradient is then dimensionality reduced to obtain the dimensionality-reduced gradient information.

[0014] The dimensionality-reduced gradient information is concatenated with the loss value and the posterior probability to form the feature vector.

[0015] In one embodiment of the present invention, the gradient is dimensionality reduced to obtain dimensionality-reduced gradient information, including:

[0016] The gradient is input into a fully connected neural network for dimensionality reduction to obtain the dimensionality-reduced gradient information.

[0017] In one embodiment of the present invention, the fully connected neural network has 2-3 layers and an output dimension of 1×32 or 1×64.

[0018] In one embodiment of the present invention, 50% of the data in the feature vector is used as the test data, and 50% of the data in the feature vector is used as the training data.

[0019] In one embodiment of the invention, the encoder includes a binary classification fully connected neural network.

[0020] In one embodiment of the present invention, the number of layers in the binary classification fully connected neural network is 2-3.

[0021] In one embodiment of the present invention, the test accuracy range is 0.5-1.

[0022] In one embodiment of the present invention, determining the degree of privacy leakage of the training set members based on the test accuracy includes:

[0023] The degree of privacy breach increases with the increase of test precision.

[0024] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0025] The privacy leakage detection method of this invention obtains feature vectors by acquiring target information of training set members and non-training set members of a subgraph federated model, trains an encoder, and then uses the trained encoder to test test data to obtain test accuracy for judging the degree of privacy leakage. It can evaluate and analyze the privacy leakage of the subgraph federated model itself, and compare and analyze the privacy leakage of different parameters of the deep neural network of the subgraph federated model, thereby assisting the model owner to optimize the model and reduce the privacy leakage of training members, filling the gap in privacy leakage detection technology under the subgraph federated learning model. Attached Figure Description

[0026] Figure 1 A schematic flowchart illustrating a privacy leakage detection method using a federated graph neural network, provided in an embodiment of the present invention;

[0027] Figure 2 This is a flowchart illustrating another privacy leakage detection method using a federated graph neural network provided in an embodiment of the present invention. Detailed Implementation

[0028] The present invention will be further described in detail below with reference to specific embodiments, but the implementation of the present invention is not limited thereto.

[0029] Example 1

[0030] To address the privacy leakage issue of training members in subgraph federated learning, this embodiment proposes a technique for evaluating the privacy risk of subgraph federated learning models. The aim is to quantify the extent to which the model's output information leaks relevant information from the training data. The strategy involves obtaining the model's output information to infer whether a certain data point is in the training set or not, and then measuring the privacy leakage risk of the model by evaluating the overall accuracy.

[0031] Please see Figure 1 and Figure 2 , Figure 1 This is a flowchart illustrating a privacy leakage detection method using a federated graph neural network, as provided in an embodiment of the present invention. Figure 2 This is a flowchart illustrating another privacy leakage detection method using a federated graph neural network provided in an embodiment of the present invention. The privacy leakage detection method includes the following steps:

[0032] S1. Obtain the target information of each subsystem's training set members and non-training set members when passing through the subgraph federated model.

[0033] Specifically, firstly, each subsystem of the subgraph federated model randomly selects members from the training set and members from the non-training set. The selected members from the training set and members from the non-training set account for more than 10% of the total data. The number of selected members from the training set and members from the non-training set can be the same or different; preferably, the number of selected members from the training set and members from the non-training set is the same.

[0034] Then, each subsystem processes the selected samples from both the training set members and non-training set members into the subgraph federated model that needs to be evaluated. This subgraph federated model is a pre-trained model. The subsystem then uploads the target information of each sample in the subgraph federated model to the central server, which then obtains the target information of the sample.

[0035] In one specific embodiment, the target information includes one or more of the following: loss value, posterior probability, and gradient. That is, the target information can be any one of the loss value, posterior probability, and gradient, or any combination of the loss value, posterior probability, and gradient. Here, the gradient refers to the gradient of the last layer in the subgraph federated model.

[0036] S2. Obtain the feature vector based on the target information.

[0037] Specifically, when the target information is a loss value or a posterior probability, the loss value or posterior probability is directly used as the feature vector. When the target information is both a loss value and a posterior probability, the loss value and the posterior probability are concatenated to obtain the feature vector. When the target information is a gradient, the gradient is dimensionality-reduced to obtain the dimensionality-reduced gradient information, which is then directly used as the feature vector. When the target information includes a gradient and consists of two or three of the following: a loss value, a posterior probability, and the gradient itself, the gradient is first dimensionality-reduced to obtain the dimensionality-reduced gradient information. Then, the dimensionality-reduced gradient information is concatenated with the loss value and the posterior probability to form the feature vector.

[0038] Specifically, the gradient is input into a fully connected neural network for dimensionality reduction to obtain the dimensionality-reduced gradient information. This fully connected neural network has 2-3 layers and an output dimension of 1×32 or 1×64.

[0039] In one specific embodiment, the fully connected neural network has three layers: an input layer, a hidden layer, and an output layer. The dimension of the input data is (the length of the flattened gradient of a single sample, 1), the dimension of the input layer is (the length of the flattened gradient of a single sample, 64), the dimension of the hidden layer is (64, 64), the activation function is ReLU, the dimension of the output layer is (64, 32), and the dimension of the output data is (32, 1).

[0040] In one specific embodiment, the central server flattens the gradient information of each sample and inputs it into the three-layer fully connected neural network for dimensionality reduction, obtaining the dimensionality-reduced gradient information. Then, the dimensionality-reduced gradient information is directly concatenated with the loss value and posterior probability to form a feature vector. The feature vector labels of the training set members are fixed at 1, and the feature vector labels of the non-training set members are fixed at 0.

[0041] It should be emphasized again that when there is no need to assess the privacy risks associated with gradient information, there is no need to use a neural network for processing gradients, and the remaining steps are consistent with the method steps in this embodiment.

[0042] S3. Input the test data in the feature vector into the trained encoder to obtain the test accuracy. The trained encoder is obtained by training the encoder using the training data in the feature vector. The feature vectors of the training set members and the feature vectors of the non-training set members in the training data have the same ratio.

[0043] In one specific embodiment, the ratio of test data to training data in the feature vectors can be set according to the actual situation. Preferably, 50% of all feature vectors are used as test data and 50% as training data. In this case, the encoder output is relatively objective. Furthermore, the test data must ensure that the proportion of feature vectors of training set members and feature vectors of non-training set members is the same, that is, the feature vectors of training set members and feature vectors of non-training set members each account for half.

[0044] Specifically, firstly, 50% of the feature vectors are used as training data input to the encoder, and the encoder is trained using the labeled feature vectors from step S2 to obtain a trained encoder. Then, the trained encoder is used to test the 50% of the feature vectors as test data, and the test accuracy is output.

[0045] In one specific embodiment, the encoder includes a fully connected binary classification neural network with 2-3 layers. For example, the fully connected binary classification neural network includes three layers: an input layer, a hidden layer, and an output layer. The input layer has a dimension of (32 + 1 + posterior probability length, 64), the hidden layer has a dimension of (64, 64), the activation function is ReLU, and the output layer has a dimension of (64, 2). The posterior probability is then obtained by passing the softmax function, with a dimension of (2, 1). When training this fully connected binary classification neural network, the cross-entropy function is used as the loss function.

[0046] S4. Determine the degree of privacy leakage of the training set members based on the test accuracy.

[0047] Specifically, the privacy leakage of training members is judged based on the test accuracy. The degree of privacy leakage increases with the increase of the test accuracy, that is, the higher the test accuracy, the more serious the privacy leakage. The test accuracy range is (0.5, 1). When it is higher than 0.75, it indicates that there is a lot of privacy leakage.

[0048] The privacy leakage detection method in this embodiment obtains feature vectors by acquiring target information of training set members and non-training set members of the subsystem when passing through the subgraph federated model, and trains the encoder. Then, the trained encoder is used to test the test data to obtain the test accuracy for judging the degree of privacy leakage. This method concretizes and digitizes the privacy leakage situation, enabling the evaluation and analysis of the privacy leakage situation of the subgraph federated model itself. Furthermore, it compares and analyzes the privacy leakage situation of different parameters of the deep neural network of the subgraph federated model, thereby assisting the model owner in optimizing the model and reducing the privacy leakage of training members. This method fills the gap in privacy leakage detection technology under the subgraph federated learning model.

[0049] Example 2

[0050] To verify the effectiveness of the method in Example 1, this example sets up experiments for the latest subgraph federated model, where the subtask of the subgraph federated model is node classification. The selected datasets are widely used datasets in graph data, specifically including Cora, Citeseer, Pubmeddiabetes, and Msacademic.

[0051] In the experiment, the models to be evaluated were Fedsage and Fedsage+. Each subsystem selected 40% of its total available data, with an equal number of training and non-training set members. The selected data was processed by a subgraph federated model. The subgraph federated model uploaded the loss value, posterior probability, and gradient of the last layer for each data point to the central server. The gradient was then dimensionality-reduced using a fully connected neural network. The dimensionality-reduced gradient information was concatenated with the loss value and posterior probability to obtain the encoder's input feature vector. The fully connected neural network used for gradient dimensionality reduction consisted of three layers: an input layer, a hidden layer, and an output layer. The gradient was flattened before entering the input layer. The input data dimension was (the flattened gradient length of a single sample, 1), the input layer dimension was (the flattened gradient length of a single sample, 64), the hidden layer dimension was (64, 64), the activation function was ReLU, the output layer dimension was (64, 32), and the output data dimension was (32, 1).

[0052] The encoder is then trained using the training data of the input feature vectors, and tested on the test data of the feature vectors using the trained encoder. The encoder employs a fully connected binary classification neural network, including an input layer, hidden layers, and an output layer. The input layer has a dimension of (32 + 1 + posterior probability length, 64), the hidden layer has a dimension of (64, 64), the activation function is ReLU, and the output layer has a dimension of (64, 2). The posterior probability of the binary classification fully connected neural network is then obtained by applying a softmax function, with a dimension of (2, 1). The cross-entropy function is used as the loss function when training the binary classification fully connected neural network.

[0053] The evaluation was conducted on four datasets, and the results are shown in Tables 1-4. In Table 1, posterior means that only the posterior probability is used as the feature vector, posterior + loss means that the posterior probability and the loss value are used as the feature vector, and posterior + loss + gradient means that the posterior probability, the loss value, and the gradient information of the last layer are used as the feature vector.

[0054] Table 1. Privacy breach assessment of Fedsage and Fedsage+ on the Cora dataset.

[0055]

[0056] Table 2. Privacy breach assessment of Fedsage and Fedsage+ on the Citeseer dataset.

[0057]

[0058] Table 3. Privacy breach assessment of Fedsage and Fedsage+ on the Pubmeddiabetes dataset.

[0059]

[0060] Table 4. Privacy breach assessment of Fedsage and Fedsage+ on the MSacademic dataset.

[0061]

[0062] As shown in Tables 1-4, the privacy leakage situation varies for different datasets and models. For example, the privacy risk of Pubmeddiabetes under the Fedsage model is 0.6501, which is close to 0.5, indicating a relatively minor privacy leakage. However, the privacy risk of the Fedsage+ model under Citeseer is 0.9789, indicating a very serious privacy leakage. Furthermore, within the same dataset, the more information output, the easier it is to expose the privacy of the training data. This is because, for all datasets, the privacy risk increases without exception from posterior to posterior + loss to posterior + loss + gradient, which aligns with common understanding and reality. However, it is worth noting that different datasets and models have different sensitivities to privacy leakage for the same type of output information. This embodiment can also quantify the differences in sensitivity by calculating the difference in test accuracy between different datasets and models, thus achieving data quantification of these differences.

[0063] In summary, the privacy leakage detection technology adopted in this embodiment can effectively assess the privacy status of existing subgraph federated learning models, filling a gap in this technical field. Furthermore, the method employed concretizes and digitizes privacy leakage scenarios, verifying the advanced nature of this embodiment. Simultaneously, it can assess the upper and lower bounds of the privacy risks of the training data used by the model for different output information. Comparative experiments were conducted for different parameters, allowing model owners to understand which parameters are most relevant to training data privacy, facilitating model evaluation and optimization, and ultimately achieving the goal of protecting training data privacy.

[0064] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such modifications and substitutions should be considered within the scope of protection of the present invention.

Claims

1. A privacy leakage detection method for federated graph neural networks, characterized in that, Including the following steps: Obtain the target information of each subsystem's training set members and non-training set members as they pass through the subgraph federated model; the target information includes one or more of the following: loss value, posterior probability, and gradient. The feature vector is obtained based on the target information; when the target information includes a loss value, a posterior probability, and a gradient, the feature vector is obtained based on the target information, including: reducing the dimension of the gradient to obtain the dimension-reduced gradient information; concatenating the dimension-reduced gradient information with the loss value and the posterior probability to form the feature vector. The test data in the feature vector is input into the trained encoder to obtain the test accuracy. The trained encoder is obtained by training the encoder using the training data in the feature vector. The proportion of training set members and non-training set members in the training data is the same. The encoder includes a fully connected neural network for binary classification. The degree of privacy leakage of the training set members is determined based on the test accuracy; wherein the degree of privacy leakage increases with the increase of the test accuracy; the test accuracy ranges from 0.5 to 1.

2. The privacy leakage detection method for federated graph neural networks according to claim 1, characterized in that, The gradient is dimensionality reduced to obtain the dimensionality-reduced gradient information, including: The gradient is input into a fully connected neural network for dimensionality reduction to obtain the dimensionality-reduced gradient information.

3. The privacy leakage detection method for federated graph neural networks according to claim 2, characterized in that, The fully connected neural network has 2-3 layers and an output dimension of 1×32 or 1×64.

4. The privacy leakage detection method for federated graph neural networks according to claim 1, characterized in that, 50% of the data in the feature vector is used as the test data, and 50% of the data in the feature vector is used as the training data.

5. The privacy leakage detection method for federated graph neural networks according to claim 1, characterized in that, The binary classification fully connected neural network has 2-3 layers.

Images