A node injection attack method and device based on target subgraph partitioning

Abstract

The present invention discloses a node injection attack method and device based on target subgraph partitioning. The method of the present invention includes taking a graph structure data set containing entity nodes as original graph data; dividing the original graph data into multiple subgraphs by a community detection algorithm, and selecting the most relevant target subgraph from the multiple subgraphs according to the position and local structure of the target entity node; generating features that match the injected entity node with the neighborhood features of the target entity node based on the attack on the target subgraph, and optimizing the features of the injected entity node; mapping the optimized injected entity node to the original graph data, and establishing a connection relationship with the entity node in the original graph data according to the neighborhood structure of the target entity node, so as to complete the adversarial attack on the graph neural network based on the connection relationship. The present invention solves the efficiency and concealment problems of the existing graph injection attack method when processing large-scale graph data, and the method has a higher attack success rate.

Description

Technical Field

[0001] The present invention relates to the field of adversarial attack technology, and in particular to a node injection attack method and device based on target subgraph partitioning. Background Art

[0002] Graph neural network (GNN) models have a strong ability to process complex relational data in many practical application scenarios and are widely used in social networks, recommendation systems, financial services and other fields. However, there are also urgent security issues in practice. Recent studies have shown that graph neural network models are vulnerable to adversarial attacks. Since GNNs use the relationship between graph structures and node features to achieve effective representation learning of nodes and graphs, attackers only need to add small perturbations to the graph to easily deceive the GNN model, which makes the graph neural network model algorithm applied to practical scenarios have obvious vulnerabilities, seriously affecting the reliability and security of practical application systems. It is known that in social networks, nodes usually represent users and edges represent social relationships between users. The feature data of nodes may include user interests, personal information, and interaction records. By analyzing this data, social network platforms can recommend friends, content or advertisements. However, attackers can manipulate the output of the recommendation system by injecting fake nodes with specific features, misleading the platform to push biased information to specific groups, and even influence public opinion under large-scale attacks. In the recommendation system, nodes can represent users and items, and edges represent the interaction between users and items, such as purchase history or ratings. The recommendation algorithm generates personalized recommendations for users by processing these feature data. Attackers can massively increase the exposure of specific products or content through fake user behaviors, causing recommendation algorithms to favor the promotion of this information, thereby misleading users' purchasing decisions or information acquisition. In the application scenarios of graph data in the financial field, such as credit risk assessment and fraud detection, nodes often represent individuals or institutions, and edges represent financial transactions or relationship networks. The characteristic data of each node may include income, transaction history, credit score, etc. Attackers may affect the risk assessment model by adding false transaction records or forged financial relationships, thereby misleading the system's judgment of loan or transaction risks and causing significant financial losses.

[0003] The research and analysis of these attack methods are of great significance in revealing the potential security issues of GNN models in practical applications. By simulating and analyzing adversarial attack behaviors, we can better understand the weak links of graph models, which provides a theoretical basis and empirical basis for the development of safer and more robust graph neural network models in the future, and helps to develop more targeted and defensive solutions to ensure the security and stability of GNN in a wide range of application scenarios. Existing adversarial attacks are mainly divided into two categories: graph modification attacks and graph injection attacks.

[0004] Graph modification attacks interfere with GNNs by directly modifying graph structures or node features. The NETTACK method proposed by Zügner et al. generates adversarial samples by iteratively modifying node features and edges, significantly reducing the classification performance of GNNs. The subsequent Metatack method further improves the attack effect through meta-gradient optimization, and can effectively destroy the model performance even without modifying the node weights. This type of method proves that even small perturbations can have a huge impact on the prediction accuracy of GNNs. HGAC proposes a heterogeneous edge rewriting strategy by studying the problem of unsupervised adversarial attacks on heterogeneous graph pre-training, using node clustering results as pseudo-labels to guide structural modifications. However, a key problem with graph modification attack methods is that they require direct manipulation of the graph structure, which is often unrealistic in practical applications. In many scenarios, attackers do not have access to modify the original graph, and these modifications are easily detected, which limits the applicability of this type of attack method.

[0005] To overcome the limitations of graph modification attacks, graph injection attacks have gradually become a hot topic of research. Graph injection attacks add a small number of malicious nodes and their associated edges to the graph without directly modifying the existing graph structure. This type of attack destroys the decision-making mechanism of GNN by introducing new nodes and edges while maintaining the integrity of the graph structure. The AFGSM method proposes an approximate gradient closure solution, which successfully achieves model interference by generating new node features and injecting them into the graph. NIPA adopts a reinforcement learning approach and uses Q learning to generate labels and edges of injected nodes, which improves the flexibility and adaptability of the attack. G2A2C avoids excessive assumptions about the victim model through a gradient-free injection method, making this method have strong model adaptability. GCIA uses graph contrastive learning (GCL) to enhance the generation of pseudo nodes in black-box graph injection attacks. The method includes a node encoder for aggregating neighborhood features to create low-dimensional embeddings; a reward predictor for mapping these embeddings to query results using a multi-layer perceptron (MLP); and a pseudo node generator for optimizing nodes to maximize the perturbation of target nodes in the embedding space. However, these existing graph injection attack methods still face obvious challenges when facing large-scale graph data. On the one hand, the complexity of large-scale graph data makes traditional injection methods consume a lot of computing resources and time; on the other hand, when generating injection node features, existing methods are difficult to effectively control the attack budget, which makes the features of the injection nodes easy to be exposed, reducing the concealment of the attack. Summary of the invention

[0006] The present invention aims to solve one of the technical problems in the related art at least to a certain extent.

[0007] To this end, in view of the limitations of existing graph injection attack methods in large-scale graph data, this paper proposes a node injection attack method TS-NIA based on target subgraph partitioning. The core idea is to use the community detection algorithm to divide the large-scale graph into smaller subgraphs, so as to carry out efficient attacks in the local range. By focusing on the local subgraph around the target node, TS-NIA can accurately attack the target node without modifying the global graph structure, reducing the processing overhead of large-scale graph data.

[0008] Another object of the present invention is to provide a node injection attack device based on target subgraph partitioning.

[0009] To achieve the above object, the present invention proposes a node injection attack method based on target subgraph partitioning, comprising:

[0010] The graph structure dataset containing entity nodes is used as the original graph data;

[0011] Divide the original graph data into multiple subgraphs by a community detection algorithm, and select the most relevant target subgraph from the multiple subgraphs according to the location and local structure of the attack target entity node;

[0012] Generate features of the injected entity node that match features of the target entity node's neighborhood based on the attack on the target subgraph, and optimize the features of the injected entity node;

[0013] The optimized injected entity nodes are mapped to the original graph data, and a connection relationship with the entity nodes in the original graph data is established according to the neighborhood structure of the target entity nodes, so as to complete the adversarial attack on the graph neural network based on the connection relationship.

[0014] The node injection attack method based on target subgraph partitioning of the embodiment of the present invention may also have the following additional technical features:

[0015] In one embodiment of the present invention, the original graph data is represented as ,in, represents the adjacency matrix, Represents the feature matrix; the original graph data is divided into multiple subgraphs through the community detection algorithm, including:

[0016] Using community detection algorithm to Divide into multiple subgraphs or communities to obtain multiple community sets , each community consists of several entity nodes; identify the entity nodes that contain the target Community ,Community Contains all entity nodes connected to the target entity node, for Entity nodes in the original graph are identified In Jump neighbors and build the target subgraph ; Target subgraph The node set is , the edge set is Contains all edges between entity nodes in the target subgraph.

[0017] In one embodiment of the present invention, generating a feature that matches the neighborhood feature of the injected entity node with the target entity node based on the attack on the target subgraph includes:

[0018] For each injected entity node , identification First-order neighbors in the target subgraph , and calculate the mean of the neighbor features and standard deviation , the specific formula is as follows:

[0019]

[0020]

[0021] Calculate the weight of neighbor features through the softmax function , and weight the neighbor features:

[0022]

[0023]

[0024] in, Is a node Features, nodes , Indicates that it is a node The normalized weights of features in neighbor nodes, represents the obtained weighted average eigenvalue, Representation Node Features;

[0025] Perform nonlinear transformation on the weighted features to generate new feature vectors:

[0026] .

[0027] In one embodiment of the present invention, the method further comprises:

[0028] According to the mean and standard deviation of the neighbor features, the generated feature vector is scaled and adjusted to finally generate the feature vector injected into the entity node :

[0029] .

[0030] In one embodiment of the present invention, the characteristics of the injected entity node are optimized, including:

[0031] Define the loss function , combined with the classification loss of the target entity node and regularization loss , the loss function formula is:

[0032]

[0033] Optimize the features of the injected entity nodes through the gradient descent method and update the feature vector , to minimize the loss function:

[0034] .

[0035] In one embodiment of the present invention, the optimized injected entity node is mapped to the original graph data, and a connection relationship with the entity node in the original graph data is established according to the neighborhood structure of the attack target entity node, including:

[0036] Map the optimized injected entity nodes from the subgraph back to the original graph using the index mapping function :

[0037]

[0038] in, Representative subgraph The index set indicates the number of nodes in the subgraph; Represents the original image A collection of indices in , representing the node numbers in the original graph;

[0039] Update the adjacency matrix of the original graph , connect the injected nodes with the entity nodes in the original graph:

[0040]

[0041] in, It means adding the connection information of the new node to the original graph. After completing the mapping and connection of the injected entity nodes, the final perturbation graph is obtained.

[0042] To achieve the above object, the present invention, on the other hand, proposes a node injection attack device based on target subgraph partitioning, comprising:

[0043] The original graph data acquisition module is used to take the graph structure data set containing entity nodes as the original graph data;

[0044] A subgraph partitioning and selection module is used to partition the original graph data into multiple subgraphs through a community detection algorithm, and select the most relevant target subgraph from the multiple subgraphs according to the location and local structure of the attack target entity node;

[0045] A node feature generation optimization module, used for generating features that match the neighborhood features of the injected entity node and the target entity node based on the attack on the target subgraph, and optimizing the features of the injected entity node;

[0046] The entity node mapping module is used to map the optimized injected entity nodes to the original graph data, and establish a connection relationship with the entity nodes in the original graph data according to the neighborhood structure of the target entity nodes, so as to complete the adversarial attack on the graph neural network based on the connection relationship.

[0047] The node injection attack method and device based on target subgraph partitioning of the embodiment of the present invention can perform efficient attacks in a local range. It is possible to accurately attack the target node without modifying the global graph structure, reducing the processing overhead of large-scale graph data. At the same time, the generated injected node features are highly similar to the legitimate node features, ensuring that the injected node can be seamlessly integrated into the graph structure, thereby improving the concealment of the attack. With this method, the attack is not only more difficult to detect, but also can achieve significant damage to the performance of the GNN with fewer injected nodes.

[0048] Additional aspects and advantages of the present invention will be given in part in the following description and in part will be obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] The above and / or additional aspects and advantages of the present invention will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0050] Figure 1 is a flow chart of a node injection attack method based on target subgraph partitioning according to an embodiment of the present invention;

[0051] Figure 2 It is a structural diagram of a node injection attack device based on target subgraph partitioning according to an embodiment of the present invention. DETAILED DESCRIPTION

[0052] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features in the embodiments can be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0053] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0054] The following describes a node injection attack method and device based on target subgraph partitioning according to an embodiment of the present invention with reference to the accompanying drawings.

[0055] This paper focuses on conducting effective and imperceptible adversarial attacks on graph data of different scales. A node injection attack method based on target subgraph partitioning is proposed. This method (TS-NIA) selects the subgraph with the highest correlation with the target node for attack by performing community detection or relevant subgraph partitioning on the graph, and generates injected node features that are highly similar to the real node features, thereby maximizing the impact on the graph neural network (GNN) without destroying the graph structure. This scheme ensures a high degree of consistency between the injected node and the target node neighborhood through feature generation and feature optimization modules, thereby enhancing the concealment of the attack.

[0056] Figure 1 FIG. 1 is a flow chart of a node injection attack method based on target subgraph partitioning according to an embodiment of the present invention. Figure 1 As shown, the method includes:

[0057] S1, takes the graph structure dataset containing entity nodes as the original graph data.

[0058] The embodiment of the present invention receives input graph data, including graph nodes, edges and feature information of the nodes, and uses entity data as graph structure data. The entity nodes in the graph can be users, papers, items, institutions, etc.

[0059] Specifically, for various original graph datasets publicly available on the Internet, graph structure datasets of certain papers are selected as the original graph data in the present invention, wherein the original graph data includes the adjacency matrix and feature matrix of the original graph, which are expressed as , represents the adjacency matrix of the original graph, Represents the feature matrix of the original graph.

[0060] It should be noted that the method of obtaining the original graph data in the present invention is not limited to the public graph structure data set, and some unpublished graph structure data sets can also be used as the source of obtaining the original graph data of the present invention.

[0061] S2, divides the original graph data into multiple subgraphs through the community detection algorithm, and selects the most relevant target subgraph from multiple subgraphs according to the location and local structure of the target entity node.

[0062] The original graph is divided into multiple subgraphs through the community detection algorithm. The division of each subgraph is based on the connectivity and similarity of the nodes in the graph, with the aim of reducing the processing complexity of large-scale graphs.

[0063] According to the location and local structure of the target node, the most relevant subgraph is selected to ensure that the attack is concentrated on the area that has the greatest impact on the target node.

[0064] Specifically, the Louvain algorithm is used for community detection. The Louvain algorithm is a modularity maximization algorithm that can divide a graph into multiple communities with high internal connections. It iteratively divides nodes into communities to maximize modularity. , modularity is defined as follows:

[0065]

[0066] in, represents the total number of edges in the network, represents an element in the adjacency matrix of the graph if and There is an edge between = 1 if the value is set to true, otherwise 0. , indicating a node and nodes The degree between; Representation Node The community where you live, Representation Node The community where you are located, when the node and nodes When they belong to the same community, ;otherwise .

[0067] Furthermore, the Louvain algorithm is used to transform the graph Divide into multiple subgraphs or communities to obtain multiple community sets , each community consists of several nodes, and the nodes in the community are closely connected. Identify the nodes that contain the target node Community , which contains all nodes connected to the target node. This step ensures that the attack can focus on the local area where the target node is located. , identify the nodes in the original graph In Hop neighbor (default =2), build a subgraph The node set of the subgraph is , express The k-order neighbor node set and edge set are Contains all edges between nodes in the subgraph.

[0068] This step ensures that the attack is focused on the target node and its related local structure through community detection and k-hop neighbor identification, which simplifies the processing complexity of large-scale graphs.

[0069] S3, based on the attack on the target subgraph, generates features of the injected entity node that match the features of the target entity node’s neighborhood, and optimizes the features of the injected entity node.

[0070] It can be understood that the present invention generates features that match the neighborhood features of the target node for the injection node through feature generation; and further adjusts these features through feature optimization to enhance the imperceptibility of the attack.

[0071] Select the number of nodes to inject , connect the injected malicious node to the target node and its nearest neighbors. The adjacency matrix of the extended subgraph , to include the connections between the injected nodes and the original nodes. The expanded adjacency matrix is ​​represented as follows:

[0072]

[0073] in, Represents the connection relationship between the injected node and the original,subgraph nodes, yes The transpose of represents the connection from the injected node to the original subgraph node. Indicates the connection relationship between injection nodes.

[0074] To ensure that the features of the injected nodes are similar to the legitimate nodes, the features of the injected nodes are generated by the following steps:

[0075] Calculate the mean and standard deviation of neighbor features: For each target node , first identify its first-order neighbors in the subgraph , and calculate the mean of the neighbor features and standard deviation , the specific formula is as follows:

[0076]

[0077]

[0078] Feature weight allocation: Calculate the weight of neighbor features through the softmax function , and weight the neighbor features:

[0079]

[0080]

[0081] in, Is a node Features, nodes , Indicates that it is a node The normalized weights of features in neighbor nodes, represents the obtained weighted average eigenvalue, Representation Node characteristics.

[0082] Nonlinear transformation: Perform nonlinear transformation on weighted features to generate new feature vectors:

[0083]

[0084] Furthermore, the generated features are scaled according to the mean and standard deviation of the neighbor features so that their distribution matches the legitimate node features, and finally the feature vector of the injected node is generated. :

[0085]

[0086] This feature generation process ensures that the features of the injected nodes are consistent with the feature distribution of the legitimate nodes in the graph, thereby improving the concealment of the attack.

[0087] In order to further enhance the attack effect, the loss function is defined , combined with the classification loss of the target node and regularization loss , where the regularization term ensures that the features of the injected nodes are similar to those of the legitimate nodes. The loss function formula is:

[0088]

[0089] in, A hyperparameter used to adjust the weight of classification loss and regularization loss. , you can control the influence of regularization loss on the total loss.

[0090] Furthermore, the features of the injected nodes are optimized by gradient descent method, and the feature vector is updated. , to minimize the loss function:

[0091]

[0092] in, is the learning rate, t is the number of iterations, and multiple iterations are performed to ensure that the features of the injected nodes can effectively interfere with the classification of the target nodes. : Loss function Injection Node This indicates how to adjust the loss function based on its current value. , so that the loss function minimize.

[0093] S4, maps the optimized injected entity nodes to the original graph data, and establishes a connection relationship with the entity nodes in the original graph data according to the neighborhood structure of the target entity nodes, so as to complete the adversarial attack on the graph neural network based on the connection relationship.

[0094] Specifically, the present invention maps the generated injected nodes back to the original graph, and establishes connections with existing nodes according to the neighborhood structure of the attack target, ensuring that the injected nodes cause minimal damage to the graph. The adversarial attack on the graph neural network is completed, and the classification of the target node or the decision of other tasks is affected by the injected node, and the attack result is output.

[0095] This embodiment maps the optimized injected nodes from the subgraph back to the original graph using the index mapping function :

[0096]

[0097] in, Representative subgraph The index collection represents the node number in the subgraph. Represents the original image The set of indices in represents the node numbers in the original graph. This mapping process ensures that the position of the injected node in the original graph is consistent with its relative position in the subgraph.

[0098] This embodiment updates the adjacency matrix of the original graph , connect the injected nodes with nodes in the original graph:

[0099]

[0100] Indicates adding the connection information of the new node to the original graph. This step completes the mapping and connection of the injected nodes to obtain the final perturbation graph.

[0101] Furthermore, the experimental results of the present invention are as follows:

[0102] The dataset is shown in Table 1:

[0103] Table 1

[0104]

[0105] Cora dataset (citation network):

[0106] This dataset consists of machine learning papers and is a popular dataset for graph deep learning in recent years. This dataset has 2708 sample points, each of which is a scientific paper. All sample points are divided into 8 categories, which are:

[0107] 1) Case-based; 2) Genetic algorithm; 3) Neural network; 4) Probabilistic method; 5) Reinforcement learning; 6) Rule learning; 7) Theory;

[0108] Each paper is represented by a 1433-dimensional word vector, so each sample point has 1433 features. Each element of the word vector corresponds to a word, and the element has only two values: 0 or 1. 0 means that the word corresponding to the element is not in the paper, and 1 means that it is in the paper. All words come from a dictionary with 1433 words.

[0109] CiteSeer dataset (citation network):

[0110] The papers are divided into six categories: Agents, AI (artificial intelligence), DB (database), IR (information retrieval), ML (machine language) and HCI. A total of 3,312 papers are included, recording the citation or citation information between papers. After removing stop words and words that appear less than 10 times in the document, 3,703 unique words are obtained.

[0111] PubMed dataset (citation network):

[0112] Includes 19717 scientific publications on diabetes from Pubmed database, divided into three categories:

[0113] Diabetes Melitus, Experimental

[0114] Diabetes Mellitus Type 1

[0115] Diabetes Mellitus Type 2

[0116] The citation network consists of 44,338 links. Each publication in the dataset is described by a TF / IDF weighted word vector from a dictionary of 500 unique words.

[0117] ogbn-map (paper) dataset:

[0118] The ogbn-map dataset is a heterogeneous network consisting of a subset of the Microsoft Academic Graph (MAG). It contains four types of entities - papers (736,389 nodes), authors (1,134,649 nodes), institutions (8,740 nodes), and research fields (59,965 nodes) - and four types of directed relationships connecting two types of entities: authors "belong to" institutions, authors "write" papers, papers "cite" papers, and papers "belong to a research field". Each paper is associated with a 128-dimensional word2vec feature vector, while all other types of entities have no input node features.

[0119] In the present invention, we focus on paper node types to construct a homogeneous subgraph.

[0120] Ogbn-products dataset:

[0121] Represents the Amazon product co-purchasing network. A node represents a product sold on Amazon, and an edge between two products indicates that these products are purchased together. The node features are generated by extracting bag-of-words features from product descriptions and then performing principal component analysis to reduce the dimensionality to 100.

[0122] The present invention conducts a comprehensive experimental verification of the TS-NIA method, and analyzes and compares the experimental results under different attack scenarios. The experimental results are taken from the average of five experiments to ensure their authenticity and effectiveness. Table 2 is a comparison of the misclassification rate experiments.

[0123] Table 2

[0124]

[0125] The experimental results shown in Table 2 show that TS-NIA performs well on various datasets, especially on the Cora and Citeseer datasets. With two nodes injected (k=2), the misclassification rates of TS-NIA on the Cora and Citeseer datasets reach 53.34% and 72.54%, respectively, which is significantly better than other comparison methods including GCIA-10. Although the misclassification rate of TS-NIA in the Pubmed dataset is 76.92%, slightly lower than that of GCIA-10, it still ranks second on this dataset, fully demonstrating its robustness and effectiveness in various scenarios.

[0126] Although GCIA-10 has shown excellent performance on the Pubmed dataset, its main drawback is its reliance on multiple queries, which leads to bottlenecks when applied to large-scale graphs. GCIA-10 needs to optimize the features of the injected nodes through repeated queries, which not only increases the attack time, but also may lead to inefficiency and latency issues when processing large-scale graphs. Therefore, the complexity and high query requirements of GCIA-10 have limitations when processing real-time large-scale graph data.

[0127] In contrast, TS-NIA achieves efficient attack performance without a large number of queries through a more targeted subgraph partitioning strategy and an effective feature generation module, and is particularly applicable in large-scale graph data processing. This makes TS-NIA more practical and efficient in large-scale graph scenarios.

[0128] Table 3 shows the experimental comparison of misclassification rate / memory usage (GB) on large-scale graphs.

[0129] Table 3

[0130]

[0131] In the scalability experiments on large-scale datasets, TS-NIA achieved misclassification rates of 42.65% and 29.86% on the ogbn-mag (paper) (nodes: 736,389; edges: 5,416,271) and ogbn-products (nodes: 2,449,029; edges: 61,859,140) datasets, respectively. In contrast, the comparison algorithms failed to successfully conduct any attacks under the same experimental conditions. TS-NIA also demonstrated high efficiency in the use of memory resources, with average memory usage of 5GB and 8GB on the ogbn-mag (paper) and ogbn-products datasets, respectively. By strategically partitioning the original graph into subgraphs, TS-NIA effectively reduced computational complexity and optimized memory allocation. This result further demonstrates the superior performance of the technology of the present invention on large-scale graph data.

[0132] Compared with the existing technologies, TS-NIA has significant advantages in many aspects. First, by partitioning the target subgraph, TS-NIA effectively reduces the complexity of processing large-scale graph data, making the method still efficient on large-scale data sets. Secondly, the introduction of the feature generation and optimization module ensures that the features of the injected nodes are similar to those of the legitimate nodes, greatly improving the concealment of the attack and reducing the risk of the attack being detected. Finally, TS-NIA can still significantly damage the performance of GNN when the number of injected nodes is small, which makes the method more cost-effective and flexible in practical applications.

[0133] In general, the node injection attack device based on target subgraph partitioning designed by the present invention solves the efficiency and concealment problems of existing graph injection attack methods when processing large-scale graph data by combining community detection and feature optimization technology. Compared with existing graph modification and graph injection attack methods, TS-NIA not only has a higher attack success rate, but also has better scalability and concealment. It is suitable for a variety of attack scenarios that require high concealment and accuracy, and has broad application prospects.

[0134] According to the node injection attack method based on target subgraph partitioning of the embodiment of the present invention, by performing targeted subgraph partitioning on the original graph, the complexity can be effectively reduced and the attack can be concentrated on the key areas of the graph, thereby improving the effectiveness of the attack. The device demonstrates good memory management capabilities on large-scale graph data sets, effectively reduces the consumption of computing resources through subgraph partitioning technology, has efficient scalability, and is suitable for adversarial attacks on large-scale graphs.

[0135] In order to implement the above embodiment, Figure 2 As shown, this embodiment also provides a node injection attack device 10 based on target subgraph partitioning, including:

[0136] The original graph data acquisition module 100 is used to use the graph structure data set containing entity nodes as the original graph data;

[0137] A subgraph partitioning and selecting module 200 is used to partition the original graph data into multiple subgraphs by using a community detection algorithm, and select the most relevant target subgraph from the multiple subgraphs according to the location and local structure of the attack target entity node;

[0138] A node feature generation optimization module 300, for generating features that match the neighborhood features of the injected entity node and the target entity node based on the attack on the target subgraph, and optimizing the features of the injected entity node;

[0139] The entity node mapping module 400 is used to map the optimized injected entity nodes to the original graph data, and establish a connection relationship with the entity nodes in the original graph data according to the neighborhood structure of the target entity nodes, so as to complete the adversarial attack on the graph neural network based on the connection relationship.

[0140] Furthermore, the original graph data is represented as ,in, represents the adjacency matrix, represents a feature matrix; the subgraph partitioning and selecting module 200 is also used for:

[0141] Using community detection algorithm to Divide into multiple subgraphs or communities to obtain multiple community sets , each community consists of several entity nodes; identify the entity nodes that contain the target Community ,Community Contains all entity nodes connected to the target entity node, for Entity nodes in the original graph are identified In Jump neighbors and build the target subgraph ; Target subgraph The node set is , the edge set is Contains all edges between entity nodes in the target subgraph.

[0142] Furthermore, the node feature generation optimization module 300 is also used for:

[0143] For each injected entity node , identification First-order neighbors in the target subgraph , and calculate the mean of the neighbor features and standard deviation , the specific formula is as follows:

[0144]

[0145]

[0146] Calculate the weight of neighbor features through the softmax function , and weight the neighbor features:

[0147]

[0148]

[0149] in, Is a node Features, nodes , Indicates that it is a node The normalized weights of features in neighbor nodes, represents the obtained weighted average eigenvalue, Representation Node Features;

[0150] Perform nonlinear transformation on the weighted features to generate new feature vectors:

[0151] .

[0152] Furthermore, it also includes:

[0153] According to the mean and standard deviation of the neighbor features, the generated feature vector is scaled and adjusted to finally generate the feature vector injected into the entity node :

[0154] .

[0155] According to the node injection attack device based on target subgraph partitioning of the embodiment of the present invention, by performing targeted subgraph partitioning on the original graph, the complexity can be effectively reduced and the attack can be concentrated on the key areas of the graph, thereby improving the effectiveness of the attack. The device demonstrates good memory management capabilities on large-scale graph datasets, effectively reduces the consumption of computing resources through subgraph partitioning technology, has efficient scalability, and is suitable for adversarial attacks on large-scale graphs.

[0156] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0157] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of the present invention, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

Claims

1. A node injection attack method based on target subgraph partitioning, characterized in that: include: The graph structure dataset containing entity nodes is used as the original graph data; Divide the original graph data into multiple subgraphs by a community detection algorithm, and select the most relevant target subgraph from the multiple subgraphs according to the location and local structure of the attack target entity node; Generate features of the injected entity node that match features of the neighborhood of the target entity node based on the attack on the target subgraph, and optimize the features of the injected entity node to achieve the attack on the target node; Mapping the optimized injected entity nodes to the original graph data, and establishing a connection relationship with the entity nodes in the original graph data according to the neighborhood structure of the target entity nodes, so as to complete the adversarial attack on the graph neural network based on the connection relationship; Generate features that match the injected entity node and the target entity node neighborhood features based on the attack on the target subgraph, including: For each injected entity node , identification First-order neighbors in the target subgraph , and calculate the mean of the neighbor features and standard deviation , the specific formula is as follows: Calculate the weight of neighbor features through the softmax function , and weight the neighbor features: in, Is a node Features, nodes , Indicates that it is a node The normalized weights of features in neighbor nodes, represents the obtained weighted average eigenvalue, Representation Node Features; Perform nonlinear transformation on the weighted features to generate new feature vectors: The method further comprises: According to the mean and standard deviation of the neighbor features, the generated feature vector is scaled and adjusted to finally generate the feature vector injected into the entity node : 。 2. The method according to claim 1, characterized in that The original graph data is represented as ,in, represents the adjacency matrix, represents the feature matrix; The original graph data is divided into multiple subgraphs by using a community detection algorithm, including: Using community detection algorithm to Divide into multiple subgraphs or communities to obtain multiple community sets , each community consists of several entity nodes; identify the entity nodes that contain the target Community ,Community Contains all entity nodes connected to the target entity node, for Entity nodes in the original graph are identified In Jump neighbors and build the target subgraph ; Target subgraph The node set is , the edge set is Contains all edges between entity nodes in the target subgraph.

3. The method according to claim 1, characterized in that Optimize the features of injected entity nodes, including: Defining the loss function , combined with the classification loss of the target entity node and regularization loss , the loss function formula is: Optimize the features of the injected entity nodes through the gradient descent method and update the feature vector , to minimize the loss function: in, is the learning rate, is the number of iterations, is the loss function Injection Node gradient.

4. The method according to claim 3, characterized in that Map the optimized injected entity nodes to the original graph data, and establish a connection relationship with the entity nodes in the original graph data based on the neighborhood structure of the target entity nodes, including: Map the optimized injected entity nodes from the subgraph back to the original graph using the index mapping function : in, Representative subgraph The index set in the subgraph indicates the node number in the subgraph; Represents the original image A collection of indices in , representing the node numbers in the original graph; Update the adjacency matrix of the original graph , connect the injected nodes with the entity nodes in the original graph: in, It means adding the connection information of the new node to the original graph. After completing the mapping and connection of the injected entity nodes, the final perturbation graph is obtained.

5. A node injection attack device based on target subgraph partitioning, characterized in that: include: The original graph data acquisition module is used to take the graph structure data set containing entity nodes as the original graph data; A subgraph partitioning and selection module is used to partition the original graph data into multiple subgraphs through a community detection algorithm, and select the most relevant target subgraph from the multiple subgraphs according to the location and local structure of the attack target entity node; A node feature generation optimization module, used for generating features that match the neighborhood features of the injected entity node and the target entity node based on the attack on the target subgraph, and optimizing the features of the injected entity node; An entity node mapping module is used to map the optimized injected entity nodes to the original graph data, and establish a connection relationship with the entity nodes in the original graph data according to the neighborhood structure of the target entity nodes, so as to complete the adversarial attack on the graph neural network based on the connection relationship; The node feature generation optimization module is also used for: For each injected entity node , identification First-order neighbors in the target subgraph , and calculate the mean of the neighbor features and standard deviation , the specific formula is as follows: Calculate the weight of neighbor features through the softmax function , and weight the neighbor features: in, Is a node Features, nodes , Indicates that it is a node The normalized weights of features in neighbor nodes, represents the obtained weighted average eigenvalue, Representation Node Features; Perform nonlinear transformation on the weighted features to generate new feature vectors: Also includes: According to the mean and standard deviation of the neighbor features, the generated feature vector is scaled and adjusted to finally generate the feature vector injected into the entity node : 。 6. The device according to claim 5, characterized in that The original graph data is represented as ,in, represents the adjacency matrix, represents a feature matrix; the subgraph partitioning and selecting module is also used for: Using community detection algorithm to Divide into multiple subgraphs or communities to obtain multiple community sets , each community consists of several entity nodes; identify the entity nodes that contain the target Community ,Community Contains all entity nodes connected to the target entity node, for Entity nodes in the original graph are identified In Jump neighbors and build the target subgraph ; Target subgraph The node set is , the edge set is Contains all edges between entity nodes in the target subgraph.

Images