Social network injection attack method based on large language model

Abstract

The present disclosure provides a social network injection attack method based on a large language model. Steps S1-S6: Step S1, modeling the objects and object relationships in the social network using a graph data structure; Step S2, selecting an example node; Step S3, selecting a victim node and a category, and selecting a target category according to the category with the highest average score in the most vulnerable node; Step S4, original text generation; Step S5, structure optimization; Step S6: Steps S3-S5 are repeated, iteration is performed, the expected number of inserted nodes is reached, and the graph after the insertion of the nodes is returned as the graph after the attack. The scheme of the present application constructs a more effective attack method, so that during the construction of the social network, the user who has a large number of attention behaviors in a short time can be alerted, and the user similar to the false user portrait obtained by the attack algorithm is paid more attention.

Description

Technical Field

[0001] This disclosure relates to the field of artificial intelligence, and more specifically, to a method for social network injection attacks based on large language models. Background Technology

[0002] In the field of data science today, graph data, as a complex data structure, plays a crucial role in multiple domains by capturing the relationships between entities in its unique form. Unlike traditional structured data, such as tables or images, graph data depicts a more dynamic and complex network of relationships through sets of nodes and edges. This data structure is particularly suitable for describing interactions in social networks, the link structure of the Internet, and protein-molecule interactions in scientific research. Because it can reflect complex relationships and interdependencies, graph data plays a vital role in advancing research and applications in fields such as bioinformatics, cybersecurity, and recommender systems.

[0003] With the expanding applications of graph data, graph neural network (Graph Neural Network) technology has emerged, aiming to capture complex patterns in graphs through deep learning methods. Graph Neural Networks inherit the powerful capabilities of traditional neural networks while introducing specialized mechanisms for processing graph-structured data, such as capturing relationships between nodes through adjacency matrices. This innovative approach enables Graph Neural Networks to excel in tasks such as node classification, graph classification, and link prediction. In practical applications, Graph Neural Networks have proven their immense potential in multiple fields. For example, in bioinformatics, Graph Neural Networks can be used to predict protein-protein interactions, helping scientists understand disease mechanisms and develop new drugs. In cybersecurity, Graph Neural Networks can identify abnormal patterns in networks, effectively preventing attacks against them. Furthermore, Graph Neural Networks have found applications in recommendation systems, recommending more personalized and relevant content to users by analyzing relationships and interaction patterns between them.

[0004] Among numerous application scenarios, graph neural networks (Graph Neural Networks) have garnered significant attention for their application in social network analysis. In social networks, nodes represent users, and edges represent the relationships between users. For example, in the microblogging network, the follow-and-follow relationships between users can be represented by the edges of a graph. Graph Neural Networks can leverage user features and interactions to perform tasks such as user attribute prediction and user relationship prediction, providing support for subsequent tasks such as social network analysis, member profiling, and personalized user recommendations. Despite their excellent performance in social network analysis, graph neural networks are particularly vulnerable to graph adversarial attacks.

[0005] Among these attacks, graph injection attacks are considered one of the most realistic. In social networks, attackers can inject fake users and generate fake user interactions with target users to influence the model's classification of target nodes. Studying graph injection attacks on social networks can provide a deeper understanding of social networks and offer insights into designing better robust graph neural networks.

[0006] Currently, graph injection attacks on social networks like Weibo only focus on node representations; the injected content is still node representations rather than the original text. This limitation leads to the following constraints in real-world scenarios: 1) Lack of interpretability: Existing graph injection attack methods primarily focus on minor changes in graph structure and node representations, rather than the original text content of the nodes. This results in nodes generated by the attack lacking understandable semantic information, making the attack behavior difficult to interpret and reducing the realism and persuasiveness of the attack. 2) Inapplicability to real-world scenarios: In real-world scenarios such as social networks and citation networks, attackers often manipulate by injecting new nodes with original text, rather than directly manipulating the embedding space. Current attack methods, lacking consideration for original text processing, are difficult to apply directly to these scenarios, limiting their practical application scope and effectiveness. 3) Easily detectable by defenders: Node representations generated by embedding-based attack methods may not match the representation methods of normal nodes, especially when defenders use different text embedding techniques. This mismatch makes the injected nodes easier to identify and detect, increasing the detectability of the attack.

[0007] To address the aforementioned challenges, designing an interpretable social network attack algorithm capable of directly manipulating original text is crucial. This requires new attack methods to not only consider graph structure manipulation but also to deeply understand and generate text content with actual semantics, thereby enhancing the realism and undetectability of the attack. Simultaneously, this method should be adaptable to various text processing techniques, ensuring a high degree of consistency between the generated text and the natural language text within the target domain, thus minimizing the likelihood of detection by defense systems while maintaining the attack's effectiveness. Considering these requirements, graph injection attacks based on large language models have emerged as a promising research direction. By leveraging the powerful text generation capabilities of large language models, more sophisticated and reliable attack strategies can be designed. These strategies can generate original text consistent with the style and content of existing nodes in the target graph. This not only enhances the interpretability and practical applicability of the attack but also improves its stealth by generating diverse and indistinguishable text, providing new ideas and tools for solving the challenges faced by graph injection attacks.

[0008] This invention aims to solve the problem of social network graph injection attacks in the context of large language models. It addresses the issues of poor interpretability and ease of detection by defenders in past social network injection attacks. Summary of the Invention

[0009] The purpose of this disclosure is to provide a method for social network injection attacks based on a large language model.

[0010] In general, a social network injection attack method based on a large language model is provided, including steps S1-S6:

[0011] Step S1: Model the objects and relationships in the social network using a graph data structure;

[0012] Step S2, select the example node;

[0013] Step S3: Select the victim node and category, and select the target category based on the category with the highest average score among the most vulnerable nodes;

[0014] Step S4, Original text generation;

[0015] Step S5, structural optimization;

[0016] Step S6: Repeat steps S3 to S5 to iterate until the expected number of inserted nodes is reached, and return the graph after the nodes have been inserted as the graph after the attack.

[0017] The method of modeling using graph data structures involves representing the social network as a graph G, generating new social user objects using large-scale modeling techniques, generating prompts based on the content of the existing social network and the selected targets, and providing these prompts to the large-scale model for user profile generation. The generated objects are nodes in the graph structure G, and the relationships between these objects are edges in the graph structure G. Each node object has node features and node labels, denoted as X and Y respectively. A new node V is defined as the generated node with node feature X, and A' is defined as the edge connecting the generated new node and nodes in the original graph. The number of inserted nodes is denoted as n. v .

[0018] The process of selecting example nodes is as follows: A three-layer graph convolutional neural network is set as the surrogate model, where the structure of a single-layer graph convolutional neural network is: Z = ReLU(AXW), where ReLU is the activation function and W is the parameter to be learned. Then, the three-layer graph convolutional neural network is represented as:

[0019] Z=A(AReLU(AReLU(AXW1)W2)W3;

[0020] The proxy model is trained on the target graph using the Adam optimizer with a learning rate of 0.01, a dropout rate of 0.5, and a cross-entropy loss function. The proxy model outputs Z for nodes belonging to class i. Nodes with Z(i) > 0.99 are retained. Nodes with a degree higher than the average in the example node set are then filtered out. Finally, nodes whose text length is within ±2 standard deviations of the average character length are retained in the example node set to obtain the example node set.

[0021] The method for selecting victim nodes and categories is as follows: Victim nodes and categories are selected through multiple iterations. In each iteration, a vulnerability score is calculated for each node: Let p be the confidence score output by the surrogate model, d be the degree of the node, and d be the node's classification into class c before the first iteration. If the node is still classified into class c by the surrogate model in the current iteration, then p is the confidence score of the surrogate model for its classification, and d is the vulnerability score. Therefore, the vulnerability score is: Otherwise, the node scores 0.

[0022] The method for selecting the target category based on the category with the highest average score among the most vulnerable nodes is as follows: Let the number of injected nodes in each round be n. In the current iteration round, denoted as round t, the target category is selected based on the category with the highest average score among the first n_t = n*γ most vulnerable nodes, where γ≥1 is a hyperparameter. The n_t nodes with the highest score in the target category are selected as the victim node set.

[0023] The original text generation method is as follows: extract the text of the example node and the victim node set as positive and negative samples, and add them to the prompt words; provide the prompt words to the large language model to generate text that is similar to the example node but does not belong to the target category;

[0024] After the original text generation step, the corresponding social network user attributes and user profiles are generated, inserted into the graph, and a new graph G' is obtained.

[0025] The structure optimization method is as follows: calculate the gradient of the loss function of the proxy model with respect to each edge in the current graph structure, select the edge with the largest gradient for flipping, that is, add the edge if it does not exist, and remove the edge if it already exists.

[0026] After the edge flip is completed, the attack effect will be evaluated. If it is found that the predicted loss of the target node is increased by flipping the edge, that is, the attack objective is achieved, then the edge optimization is retained; otherwise, if the optimization does not achieve the expected attack effect, the function will fall back to the previous state or try to flip other edges.

[0027] This invention addresses the problem of high node degrees in graphs after typical attacks, which can generate fake users with fixed characteristics. In terms of building the security of social networks, by constructing a more effective attack method, it enables the social network construction process to increase vigilance for users who engage in a large number of attention behaviors in a short period of time, and to increase attention to users who are similar to the fake user profiles obtained by the attack algorithm, which is beneficial to the subsequent design of robust graph neural networks. Attached Figure Description

[0028] The above and other objects and features of this disclosure will become clearer from the following description taken in conjunction with the accompanying drawings.

[0029] Figure 1 This is a flowchart illustrating a method for social network injection attacks based on a large language model according to an embodiment of the present disclosure; Detailed Implementation

[0030] The following detailed embodiments are provided to aid the reader in gaining a comprehensive understanding of the methods, apparatus, and / or systems described herein. However, various changes, modifications, and equivalents of the methods, apparatus, and / or systems described herein will become apparent upon understanding this disclosure. For example, the order of operations described herein is merely illustrative and is not limited to those orders set forth herein, but may be changed as will become clear upon understanding this disclosure, except for operations that must occur in a specific order. Furthermore, for clarity and conciseness, descriptions of features known in the art may be omitted.

[0031] The features described herein may be implemented in different forms and should not be construed as limited to the examples described herein. Rather, the examples described herein are provided only to illustrate some of the many feasible ways of implementing the methods, apparatus, and / or systems described herein, which will become clear upon understanding the disclosure of this application.

[0032] As used herein, the term “and / or” includes any one of the associated listed items and any combination of any two or more.

[0033] Although terms such as “first,” “second,” and “third” may be used herein to describe various components, assemblies, regions, layers, or parts, these components, assemblies, regions, layers, or parts should not be limited by these terms. Rather, these terms are used only to distinguish one component, assembly, region, layer, or part from another. Thus, without departing from the teaching of the examples described herein, the first component, first assembly, first region, first layer, or first part referred to as the first component, first assembly, first region, first layer, or first part may also be referred to as the second component, second assembly, second region, second layer, or second part.

[0034] In the specification, when an element (such as a layer, region, or substrate) is described as being "on" another element, "connected to," or "bonded to" another element, the element may be directly "on" another element, directly "connected to," or "bonded to" the other element, or one or more other elements may be present in between. Conversely, when an element is described as being "directly on" another element, "directly connected to," or "directly bonded to" another element, no other elements may be present in between.

[0035] The terminology used herein is for the purpose of describing various examples only and is not intended to limit disclosure. Unless the context clearly indicates otherwise, the singular form is intended to include the plural form as well. The terms “comprising,” “including,” and “having” indicate the presence of the described features, quantities, operations, components, elements, and / or combinations thereof, but do not preclude the presence or addition of one or more other features, quantities, operations, components, elements, and / or combinations thereof.

[0036] Unless otherwise defined, all terms used herein (including technical and scientific terms) shall have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure pertains upon understanding this disclosure. Unless expressly defined herein, terms (such as those defined in a general dictionary) shall be interpreted as having a meaning consistent with their meaning in the context of the relevant field and in this disclosure, and shall not be interpreted in an idealized or overly formalistic manner.

[0037] Furthermore, in the description of the examples, detailed descriptions of well-known related structures or functions will be omitted when it is believed that such detailed descriptions would lead to a vague interpretation of this disclosure.

[0038] Figure 1 This is a schematic diagram illustrating a social network injection attack system based on a large language model according to an embodiment of the present disclosure.

[0039] like Figure 1 As shown, this technology includes steps S1-S6.

[0040] Step S1: Model the objects and relationships in the social network using a graph data structure, represented as graph G. When generating new social user objects, a large model technique is used. Taking the generation of Weibo users using a large language model as an example for injection attack material on the Weibo social network, the content generated by the large model is the user profile of the user, including their gender, place of residence, interests, personal introduction, etc. Using a large model for social network user generation ensures the interpretability of the social user profile. In terms of text generation, the large model can generate logically consistent and fluent user content based on prompt words. Specifically, prompt words are generated based on the existing social network content and the selected target to be attacked, and provided to the large model for user profile generation. The specific addition method is shown in step S4. Here, objects are nodes in G, and the relationships between the objects are edges in the graph structure G. Node objects are accompanied by node features and node labels, denoted as X and Y, respectively. This invention considers graph injection attacks, i.e., generating a new node V with node feature X, and also including generating edges between the new node and the original graph nodes, denoted as A'. Let n be the number of inserted nodes. v .

[0041] Step S2: Select example nodes. A three-layer graph convolutional neural network is set as the surrogate model. The structure of a single-layer graph convolutional neural network is: Z = ReLU(AXW), where ReLU is the activation function and W is the parameter to be learned. The three-layer graph convolutional neural network can be represented as: Z = A(AReLU(AReLU(AXW1)W2)W3). The surrogate model is trained on the graph to be attacked. During training, the Adam optimizer is used, with a learning rate of 0.01, a dropout rate of 0.5, and a cross-entropy loss function. Nodes correctly classified by the surrogate model in the training set and with a confidence score greater than 0.99 are added to the example node set. Specifically, if the surrogate model outputs Z for nodes belonging to class i, nodes with Z(i) > 0.99 are retained. Then, nodes with a degree higher than the average in the example node set are filtered out. Finally, nodes in the example node set whose text length is within ±2 standard deviations of the average character length are retained. After these three steps, the example node set V1 is obtained.

[0042] Step S3.1, Victim Node and Category Selection. Victim nodes and categories are selected through multiple iterations. In each iteration, a vulnerability score is calculated for each node. Specifically, let p be the confidence score output by the surrogate model, and d be the degree of the node. Before the first iteration, the surrogate model classifies the node into class c. If the node is still classified into class c by the surrogate model in the current iteration, then the confidence score of the surrogate model's classification is denoted as p, and the vulnerability score is: (If the node is classified by the proxy model as having the same predicted category as the unmodified graph); otherwise, the node scores 0.

[0043] Step S3.2, let n be the number of nodes injected in each round. In the current iteration round, denoted as round t, this invention selects the target category based on the category with the highest average score among the most vulnerable nodes in the first n_t = n*γ, where γ≥1 is a hyperparameter. The n_t nodes with the highest score in the target category are selected as the victim node set, denoted as V2.

[0044] Step S4, Original Text Generation. Extract the text from example nodes and victim node sets V1 and V2 as positive and negative samples, adding them to the prompt words. Provide these prompts to the large language model to generate text similar to the example nodes but not belonging to the target category. The example nodes are sampled in step S2, with a sampling count of 2. The requirement of "similar to example nodes but not belonging to the target category" is added to the prompt words as input to the large model, thus obtaining an output that meets the requirements. Here, the prompt words are: unique in content but similar in writing styles to the examples given. Each generated piece should reflect the tone and style of the provided examples, yet diverge in themes and topics to create a mix that's distinct from...<target_label_name> .

[0045] As the example shows, this invention requires that the generated content be "unique in content but similar in writing styles to the examples given. Each generated piece should reflect the academic tone and style of the provided examples, yet diverge in themes and topics to create a mix that's distinct from..."<target_label_name> Specifically, the generated user profile text style is similar to the selected example set, ensuring consistency with existing topics in the social network; simultaneously, in terms of content details, it is obfuscated for downstream tasks, ensuring that the surviving content differs from the target category, thus achieving the objective of attack.<target_label_name> This refers to the target category selected in step S3.2.

[0046] After the original text generation step, the corresponding social network user attributes and user profiles are generated, inserted into the graph, and a new graph G' is obtained.

[0047] Step S5, Structure Optimization. Randomly connect the newly inserted node to the original graph nodes with edges, then use an adaptive structure optimization algorithm to fine-tune the structure, obtaining the fine-tuned algorithm G_t. The adaptive structure optimization algorithm can be Metatack.

[0048] Specifically, the gradient of the surrogate model's loss function (which can use cross-entropy loss) with respect to each edge in the current graph structure is calculated. The edge with the largest gradient is then flipped; that is, if the edge did not originally exist, it is added, and if it already exists, it is removed. The purpose of this process is to maximize the impact on the model's prediction loss by adjusting the graph structure, especially by adding or removing edges, thereby finding the optimal graph structure that causes the model to make prediction errors. After the flipping is completed, the attack effect is evaluated. If it is found that flipping the edge increases the prediction loss of the target node, i.e., the attack objective is achieved, then the edge optimization is retained. Otherwise, if the optimization does not achieve the expected attack effect, the function may revert to the previous state or try flipping other edges.

[0049] Step S6: Repeat steps S3.1 to S5. Let the number of iterations be T, then the process is repeated T times until the expected number of inserted nodes is reached. Return the graph G_T after the insertion of nodes is completed, as the graph after the attack.

[0050] The attacked graph contains both the original social network and newly injected fake users. This process ensures the interpretability and inattentionality of the generated users through a large model; that is, the content of the newly generated users will not significantly deviate from the user content contained in the original social network. The graph neural network's classification of test nodes in the new graph is affected by the injected fake users, leading to a decline in classification accuracy and achieving the attack objective. For example, when the downstream classification task is the gender of users in the social network, this method generates specific user profiles to guide the graph neural network to classify male users in the original social network as female users, causing a decrease in the graph neural network's classification accuracy on this task. Specifically, this algorithm can generate fake users with typical female user characteristics in the social network and establish attention relationships (i.e., edges) with the male users to be attacked in the original network, thereby misleading the graph neural network's gender classification of the users to be attacked. Similarly, when the downstream classification task focuses on other classification tasks such as user residence location and user interests, this attack algorithm can also generate deceptive fake user profiles based on the content of the downstream task and connect them with the nodes to be attacked in the original graph, thereby reducing the graph neural network's classification accuracy for them. By studying the characteristics of the attacked graph and the injected fake users, this invention will help inspire subsequent robust graph neural network design and related technologies for fake user identification. Specifically, the attacked graph often has a high node degree, especially the attacked object; fake users are characterized by: many outgoing edges, few incoming edges, and significantly more social behavior than average in a short period of time. Fake users have low sustained activity, and their overall user profile is too distinct, retaining stereotypes related to downstream tasks. These findings will be beneficial to the design of subsequent robust graph neural networks. For example, robust graph neural networks can increase vigilance for users who exhibit a large number of attention behaviors in a short period of time, and increase attention to users whose profiles are similar to those of fake users obtained by the attack algorithm.

[0051] While some embodiments of this disclosure have been shown and described, those skilled in the art will understand that modifications may be made to these embodiments without departing from the principles and spirit of this disclosure, which are defined by the claims and their equivalents.

Claims

1. A social network injection attack method based on a large language model, characterized in that, Including steps S1-S6: Step S1: Model the objects and relationships in the social network using a graph data structure; Step S2, select the example node; Step S3: Select the victim node and category, and select the target category based on the category with the highest average score among the most vulnerable nodes; Step S4, Original text generation; Step S5, structural optimization; Step S6: Repeat steps S3 to S5 to iterate until the expected number of inserted nodes is reached, and return the graph after the nodes have been inserted as the graph after the attack. The process of selecting example nodes is as follows: A three-layer graph convolutional neural network is set as the surrogate model, wherein the structure of the single-layer graph convolutional neural network is: , For activation function, Given the parameters to be learned, the three-layer graph convolutional neural network can be represented as follows: ； The proxy model is trained on the target graph using the Adam optimizer with a learning rate of 0.01, a dropout rate of 0.5, and a cross-entropy loss function. The proxy model is set to... The final output of the class node ,reserve The nodes are then filtered out, and nodes with a degree higher than the average in the example node set are removed. Finally, nodes whose text length is within plus or minus 2 standard deviations of the average character length in the example node set are retained to obtain the example node set. The original text generation method is as follows: extract the text of the example node and the victim node set as positive and negative samples, and add them to the prompt words; provide the prompt words to the large language model to generate text that is similar to the example node but does not belong to the target category; After the original text generation step, the corresponding social network user attributes and user profiles are generated, inserted into the graph, and a new graph G' is obtained; The structural optimization method is as follows: calculate the gradient of the loss function of the surrogate model with respect to each edge in the current graph structure, and select the edge with the largest gradient for flipping. That is, if the edge does not exist, add it; if the edge already exists, remove it. After the edge flip is completed, the attack effect will be evaluated. If it is found that the predicted loss of the target node is increased by flipping the edge, that is, the attack objective is achieved, then the edge optimization is retained; otherwise, if the optimization does not achieve the expected attack effect, the function will fall back to the previous state or try to flip other edges.

2. The social network injection attack method based on a large language model as described in claim 1, characterized in that, The method of modeling using graph data structures involves representing the social network as a graph G, generating new social user objects using large-scale modeling techniques, generating prompts based on the content of the existing social network and the selected targets, and providing these prompts to the large-scale model for user profile generation. The generated objects are nodes in the graph structure G, and the relationships between these objects are edges in the graph structure G. Each node object has node features and node labels, denoted as X and Y respectively. A new node V is defined as the generated node with node feature X, and A' is defined as the edge connecting the generated new node and nodes in the original graph. The number of inserted nodes is denoted as . ; 。 3. The social network injection attack method based on a large language model as described in claim 2, characterized in that, The method for selecting victim nodes and categories is as follows: Victim nodes and categories are selected through multiple iterations. In each iteration, a vulnerability score is calculated for each node. Let c represent the proxy model's classification of nodes before the first iteration. The initial classification, i.e., the surrogate model's view of nodes On the unattacked map, it is divided into the first... For a user, if a node is still classified as category c by the proxy model in the current iteration round, meaning the proxy model classifies the node as c on the attacked graph in the current iteration round, then the confidence of the proxy model in its classification is denoted as p, and the vulnerability score is: Otherwise, the node scores 0.

4. The social network injection attack method based on a large language model as described in claim 3, characterized in that, The method for selecting the target category based on the category with the highest average score among the most vulnerable nodes is as follows: Let n be the number of nodes injected in each round, and in the current iteration round, denoted as round t, based on the previous... The target category is selected from the category with the highest average score among the most vulnerable nodes. It is a hyperparameter that scores the highest in the target category. The node was selected as the victim node set.

Images