Attribute reasoning method of federal map neural network and application thereof

Abstract

The invention discloses an attribute reasoning method of a federal map neural network and application thereof. The method comprises the following steps: generating local node embedding at an inference end, and obtaining an inference end local embedding gradient corresponding to the local node embedding; based on the inference end local embedding gradient, generating a target user embedding gradient, updating the target user embedding gradient, and obtaining local node embedding of the target user; obtaining a shadow map data set, marking the shadow map data set with a preset target reasoning attribute, and training a shadow classification model and an attribute classifier based on the shadow map data set; on the basis of the shadow classification model, obtaining a feature vector corresponding to embedding of a local node of the target user; and based on the updated attribute classifier, obtaining the probability distribution of the local graph data of the target user about the prediction attribute. According to the method, the possibility of leakage of the privacy data of the user can be accurately measured, and theoretical support is provided for development of a privacy protection method.

Description

Technical Field

[0001] The present invention belongs to the technical field of data privacy reasoning, and specifically relates to an attribute reasoning method of a federated graph neural network and its application. Background Art

[0002] In recent years, Federated Graph Neural Networks (FedGNNs) have achieved remarkable success in representation learning of graph data. It enables collaborative training of graph neural network (GNN) models between multiple participants without sharing their original graph data, thus solving the data silo problem faced by centralized GNNs in data-sensitive scenarios.

[0003] Graph data carries a lot of personal attribute privacy, which can easily lead to privacy leakage during sharing, analysis, and application, and faces potential threats. Although FedGNNs can protect user data privacy to a certain extent, it still faces many privacy and security issues.

[0004] Since the vulnerability of FedGNNs in the face of reasoning attacks has not been deeply explored in the existing technology, there is an urgent need for an attribute reasoning method of federated graph neural networks to verify the security performance of federated graph neural networks.

[0005] Therefore, in response to the above technical problems, it is necessary to provide an improved attribute reasoning strategy for use in the federated graph neural network environment.

[0006] The information disclosed in this background technology section is only intended to enhance the understanding of the overall background of the invention and should not be regarded as an acknowledgment or any form of suggestion that the information constitutes the prior art already known to a person skilled in the art. Summary of the invention

[0007] The purpose of the present invention is to provide an attribute reasoning method of a federated graph neural network and its application, which can provide an effective attribute reasoning method that can detect the defense capability of the federated graph neural network against attribute reasoning and its own security performance.

[0008] In order to achieve the above object, a technical solution provided by a specific embodiment of the present invention is as follows:

[0009] In a first aspect, the present invention provides an attribute reasoning method of a federated graph neural network, which includes:

[0010] Based on the initial model, generate a local node embedding at the inference end, and obtain the inference end local embedding gradient corresponding to the local node embedding based on forward propagation;

[0011] Based on the local embedding gradient of the inference end, generate a target user embedding gradient, recursively update the target user embedding gradient, and obtain the local node embedding of the target user based on the updated target user embedding gradient;

[0012] Acquire a shadow map dataset based on the local node embedding of the target user, label the shadow map dataset with a preset target inference attribute, and train a shadow classification model and an attribute classifier based on the labeled shadow map dataset;

[0013] Taking the local node embedding of the target user as input, based on the shadow classification model, obtain the feature vector corresponding to the local node embedding of the target user; taking the feature vector and the target inference attribute as input, obtain the probability distribution of the target user's local map data about the predicted attribute based on the updated attribute classifier.

[0014] In one or more embodiments of the present invention, generating a target user embedding gradient based on the local embedding gradient includes:

[0015] Generate a random noise vector with the same number of rows or columns as the local embedded gradient and obtain a noise gradient vector corresponding to the random noise vector;

[0016] The local embedding gradient and the noise gradient vector are concatenated row by row or column by column to generate the target user embedding gradient.

[0017] In one or more embodiments of the present invention, recursively updating the target user embedding gradient includes:

[0018] Obtaining an aggregated global model and a global embedding gradient corresponding to the global model;

[0019] Embed the target user into a discriminator preset by gradient input, and update the parameters of the discriminator based on minimizing the first loss function;

[0020] Based on minimizing the second loss function, updating the parameters of the generator for generating local node embeddings and random noise vectors;

[0021] Based on the updated generator, the target user embedding gradient is generated.

[0022] In one or more embodiments of the present invention, the local node embedding formula for obtaining the target user based on the updated target user embedding gradient is:

[0023]

[0024] Among them, W (l) is the local model gradient weight of the target user, H CEmbed the local node of the target user.

[0025] In one or more embodiments of the present invention, the training of the shadow classification model and the attribute classifier based on the labeled shadow map dataset includes:

[0026] Training a shadow classification model based on the shadow map dataset and / or the inference-end local map dataset, and obtaining node embedding of the shadow model;

[0027] Based on minimizing a third loss function, updating parameters of the shadow classification model;

[0028] Based on the updated shadow classification model, a preset test data set is classified, and a plurality of categories and probability values ​​corresponding to each category are output;

[0029] Aggregating the probability values ​​corresponding to each of the categories into a feature vector, and generating a training data set for an attribute classifier based on the feature vector;

[0030] The attribute classifier is trained based on the training data set of the attribute classifier.

[0031] In one or more embodiments of the present invention, aggregating the probability values ​​corresponding to each of the categories into a feature vector includes:

[0032] Based on a preset activation function, the probability values ​​corresponding to the categories are converted into posterior output probabilities, and the sum of the posterior output probabilities corresponding to the categories is 1;

[0033] Calculate the posterior output probability values ​​p1, p2, ..., p k Element-wise difference between them, and the difference results are Concatenate into feature vectors

[0034] In one or more embodiments of the present invention, the first loss function, the second loss function, and the third loss function are respectively:

[0035]

[0036] Where N represents the dimension of the embedding vector or gradient, φ is the discriminator model parameter, represents the output of the discriminator model, is the global embedding gradient, K is the number of clients participating in the federated training, is the local embedding gradient on the inference side, z fake is a random noise vector, θ is the generator model parameter, is the local embedding gradient on the non-inference side, Embed gradient for target users; LD is the first loss function, L GRN is the second loss function, L D ' is the third loss function; Embed gradients for shading models.

[0037] In a second aspect, the present invention provides an attribute reasoning system of a federated graph neural network, comprising:

[0038] A generation module, configured to generate a local node embedding at the inference end based on the initial model, and obtain a local embedding gradient at the inference end corresponding to the local node embedding based on forward propagation;

[0039] An updating module, configured to generate a target user embedding gradient based on the inference end local embedding gradient, recursively update the target user embedding gradient, and obtain a local node embedding of the target user based on the updated target user embedding gradient;

[0040] A training module, used for acquiring a shadow map dataset based on the local node embedding of the target user, marking the shadow map dataset with a preset target inference attribute, and training a shadow classification model and an attribute classifier based on the marked shadow map dataset;

[0041] The inference module is used to take the local node embedding of the target user as input, and based on the shadow classification model, obtain the feature vector corresponding to the local node embedding of the target user; take the feature vector and the target inference attribute as input, and obtain the probability distribution of the target user's local map data about the predicted attribute based on the updated attribute classifier.

[0042] In a third aspect, the present invention provides a security detection method for a federated graph neural network, which applies the attribute reasoning method of the federated graph neural network, and includes:

[0043] Based on the attribute reasoning method of the federated graph neural network, attribute reasoning is performed on the target user in the federated graph neural network;

[0044] Acquire attribute information of the target user's local map data;

[0045] If the accuracy of attribute reasoning of the Bangtu neural network is greater than a preset safety threshold, the target user is in a risky state;

[0046] If the accuracy of the attribute reasoning of the Bangtu neural network is less than or equal to a preset safety threshold, the target user is in a safe state.

[0047] In a fourth aspect, the present invention provides a security detection system for a federated graph neural network, comprising:

[0048] An application module, used to perform attribute reasoning on a target user in a federated graph neural network based on the attribute reasoning method of the federated graph neural network;

[0049] An acquisition module, used to acquire attribute information of the target user's local map data;

[0050] A first judgment module is used to judge that the target user is in a risky state when the accuracy of the attribute reasoning of the Bangtu neural network is greater than a preset safety threshold;

[0051] The second judgment module is used to judge that the target user is in a safe state when the accuracy of the attribute reasoning of the Bangtu neural network is less than or equal to a preset safety threshold.

[0052] Compared with the prior art, the attribute reasoning method of the federated graph neural network provided by the present invention obtains the probability distribution of the local graph data of the target user by recursively updating the local node embedding of the user and combining the trained shadow model and attribute classifier. The target local data can be inferred for the federated graph neural network, and the possibility of leakage of user privacy data can be accurately measured, providing theoretical support for the development of privacy protection methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0054] Figure 1 It is a schematic diagram of a federated graph neural network framework in one embodiment of the present invention;

[0055] Figure 2 It is a flowchart of an attribute reasoning method of a federated graph neural network in one embodiment of the present invention;

[0056] Figure 3 It is a structural block diagram of an attribute reasoning system of a federated graph neural network in one embodiment of the present invention;

[0057] Figure 4 It is a structural block diagram of an electronic device in one embodiment of the present invention.

[0058] Figure 5 It is a schematic flow chart of a security detection method of a federated graph neural network in one embodiment of the present invention;

[0059] Figure 6 It is a structural block diagram of a security detection system of a federated graph neural network in one embodiment of the present invention. DETAILED DESCRIPTION

[0060] The specific implementation modes of the present invention are described in detail below in conjunction with the accompanying drawings, but it should be understood that the protection scope of the present invention is not limited by the specific implementation modes.

[0061] Unless explicitly stated otherwise, throughout the specification and claims, the term “comprise” or variations such as “include” or “comprising”, etc., will be understood to include the stated elements or components but not to exclude other elements or components.

[0062] In order to facilitate understanding of the technical solutions of the present application, the technical terms that may appear in the present invention are first explained in detail below.

[0063] Forward propagation: Also known as the forward propagation algorithm, it is a training method for neural network models. The input data passes through each layer of the neural network, and the weights and biases of each layer perform linear transformations on the input data, and then perform nonlinear transformations through the activation function to finally obtain the output of the model. The purpose of forward propagation is to calculate the predicted value of the model.

[0064] Federated Graph Neural Networks: Federated Graph Neural Networks combine the advantages of federated learning and graph neural network models, and can learn and reason on distributed graph data while protecting data privacy.

[0065] Please refer to Figure 2 As shown, it is a flow chart of the attribute reasoning method of the federated graph neural network in one embodiment of the present invention. The attribute reasoning method of the federated graph neural network specifically includes the following steps:

[0066] S201: Generate a local node embedding at the inference end based on the initial model, and obtain the inference end local embedding gradient corresponding to the local node embedding based on forward propagation;

[0067] like Figure 1 FIG. 1 is a schematic diagram of a federated graph neural network framework in one embodiment of the present invention. In the FedGNNs framework, each client has its own graph dataset D (i) :=(g (i) ,Y (i) ), where g (i) =(V (i) ,E (i) ), V (i) Represents the set of nodes in the graph, E (i) represents the edge set, Represents the graph data and the corresponding node and edge feature sets, Y (i)A collection of labels representing graph data. Each client has a GNN model to learn graph representations and make predictions. FedGNNs enables multiple clients to collaborate through a server to improve their respective GNN models without necessarily revealing the client's local graph dataset. For each node ν on the client i ∈V (i) , neighborhood aggregation is the same as traditional GNN. In FedGNNs with node classification as downstream task, client C uses the local GNN model to learn local node embedding and transfers the trained local model gradient after completing l rounds of local training. and node embedding gradients Upload to the central server. The server aggregates the gradients received from the clients and aggregates the global model and the global node embedding gradient Finally, the client uses the received global gradient to update the local GNN classification model until the model converges.

[0068] As mentioned above, the federated graph neural network can enable multiple clients to collaborate through a server to improve their respective graph neural network models. In federated learning, only the global model gradient and global embedding gradient generated by server fitting are shared among participants without exposing the participants' local privacy data. However, it is precisely because of the sharing of the above information that users may be disguised as attackers of client nodes participating in model aggregation, and their privacy information may be obtained based on reasoning based on the shared global gradient. The present invention focuses on federated graph neural networks and provides a more accurate attribute reasoning method. The ability of the corresponding detected federated graph neural network to resist attribute reasoning attacks can be judged based on comparing the feature reasoning results of the target user's local graph data with the actual features.

[0069] It is understandable that in order to obtain the global model and global embedding gradient sent by the server, the attacker needs to be one of the clients participating in the federated learning. Therefore, the initial model is the initial GNN model corresponding to each client in the federated graph neural network. Further, the initial GNN model is used to complete the local graph data training to obtain a d-dimensional local node embedding H m , and obtain the local embedding gradient through forward propagation Used to participate in federal training.

[0070] S202: generating a target user embedding gradient based on the local embedding gradient of the inference end, recursively updating the target user embedding gradient, and acquiring a local node embedding of the target user based on the updated target user embedding gradient;

[0071] In an exemplary embodiment, based on the local embedding gradient, a target user embedding gradient is generated, including: generating a random noise vector with the same number of rows or columns as the local embedding gradient and obtaining a noise gradient vector corresponding to the random noise vector; concatenating the local embedding gradient with the noise gradient vector by row or column to generate the target user embedding gradient.

[0072] It should be noted that in order to achieve the generation of target user embedding gradients, a generator for generating local node embeddings and random noise vectors is set on the inference end, as well as a discriminator for evaluating the gap between the generated embedding gradient estimate and the true global embedding gradient, so as to make the generated node embedding of the generator closer to the global embedding.

[0073] For example, a multilayer perceptron can be provided on the inference end. A multilayer perceptron (MLP) is an artificial neural network with a forward structure. In addition to the input and output layers, it can have multiple hidden layers in the middle. The layers of the multilayer perceptron are fully connected. The bottom layer of the multilayer perceptron is the input layer, the middle layer is the hidden layer, and the last layer is the output layer. In one embodiment of the present invention, the GRN (Generative Regression Neutral Network) in the above-mentioned perceptron is composed of a generator and a discriminator.

[0074] Furthermore, the inference end uses the above generator to generate a (K-1)×d-dimensional random noise vector z fake and the corresponding noise gradient vector θ is the model parameter of the generator. Then, the inference end will With d dimension The link becomes a K×d-dimensional target user embedding gradient As the input of the discriminator, it promotes the generator to use the information from the real data to obtain the target user embedding gradient that is closer to the real one. That is, the generator model can be expressed as

[0075]

[0076] It can be understood that if the generated noise gradient vector With local embedding gradient The number of rows is the same, then they can also be concatenated into The present invention can apply the above two splicing methods or change the position of the splicing objects based on the above two splicing methods, which is not limited in the embodiments.

[0077] Furthermore, in an exemplary embodiment of the present invention, the target user embedding gradient is recursively updated, specifically including: obtaining an aggregated global model and a global embedding gradient corresponding to the global model; inputting the target user embedding gradient into a preset discriminator, and updating the parameters of the discriminator based on minimizing the first loss function; updating the parameters of the generator based on minimizing the second loss function; and generating the target user embedding gradient based on the updated generator.

[0078] It should be noted that the inference end obtains the global embedding gradient by querying the server and the aggregated global model The goal of obtaining the target user embedding gradient can be transformed into a regression problem. That is, the discriminator minimizes the loss function L D To adjust its own parameters and feed the results back to the generator, the local node embedding on the inference side generated by the generator is closer to the global embedding.

[0079] It is understandable that the server usually uses the mean method to fit the local embedding of each client into the global embedding, that is:

[0080]

[0081] Due to global embedding The inference side can infer the embedding features of other clients (especially the target user) by generating an approximate global embedding and subtracting the known part (such as the local embedding of the inference side). The inference side minimizes L GRN To optimize the generator parameter θ, the generated noise gradient As close as possible to the actual node embedding gradient of the target user. After obtaining the embedding gradient of the target model, the attacker can obtain the local node embedding H of the target user through the layer-by-layer back-propagation mechanism of GNN. C .

[0082] It should also be noted that the first loss function and the second loss function are respectively:

[0083]

[0084] Where N represents the dimension of the embedding vector or gradient, φ is the discriminator model parameter, represents the output of the discriminator model, is the global embedding gradient, K is the number of clients participating in the federated training, is the local embedding gradient on the inference side, z fake is a random noise vector, θ is the generator model parameter, is the local embedding gradient on the non-inference side, Embed gradient for target users; L D is the first loss function, L GRN is the second loss function.

[0085] Based on the application of the above loss function, the optimization of the generator parameter θ can be expressed as follows:

[0086]

[0087] Where η is the learning rate. After repeatedly adjusting θ and z fake , so that the generator finally generates the true local embedding gradient closest to the target user

[0088]

[0089] After obtaining the embedding gradient of the target model, the inference end can obtain the local node embedding H of the target user through the layer-by-layer back-propagation mechanism of GNN. C .

[0090]

[0091] Among them, W (l) The local model gradient weight of the target user can be obtained from the local gradient of the target user.

[0092] It should be noted that the embodiment of the present invention does not limit the method for obtaining the local gradient of the target user. In a specific embodiment, the method for obtaining the local gradient of the target user in federated learning can be transferred to this solution, that is, the local gradient of the target user is obtained by the differential analysis method. In another exemplary embodiment, based on the generator and discriminator configured at the inference end, the embedding gradient of the aforementioned target user can be replaced with the model gradient, and the same recursive update method can be used to obtain it.

[0093] S203: acquiring a shadow map dataset based on the local node embedding of the target user, marking the shadow map dataset with a preset target inference attribute, and training a shadow classification model and an attribute classifier based on the marked shadow map dataset;

[0094] It should be noted that the shadow graph dataset refers to a graph dataset obtained from a public dataset and / or a local dataset based on the query of the target user's local node embedding features, which has the same or similar distribution as the target graph data. Training the shadow classification model based on the shadow graph dataset can better simulate the node embedding output by the target user.

[0095] In particular, a single shadow model usually outputs a single result in the subsequent reasoning stage. In order to understand the target user's reaction to different structural data and features, thereby improving the accuracy of inference of the target user's graph attributes, the above shadow dataset and the local dataset on the inference end can be divided into multiple training datasets, and a shadow model is trained based on each training dataset.

[0096] For example, by embedding H C The query of the characteristics (including but not limited to mean, variance, etc.) of the target graph data is performed to obtain an auxiliary dataset D with the same or similar distribution as the target graph data from the public dataset. aux Shadow map dataset G as attacker S , mark the attributes that the inference end wants to infer in the local map dataset and shadow map dataset. The inference end is based on G S Divide multiple subsets of the same size to train x (x ≥ 1) shadow models Each shadow model Shadow map From its local dataset G m or G S Random sampling in .

[0097] It should also be noted that the target inference attribute is the graph attribute that the inference end expects to obtain in the target user's local graph data, which may include but is not limited to: number of nodes, variables, image category, etc. The embodiment of the present invention does not limit the selection of the inference attribute.

[0098] In an exemplary embodiment of the present invention, a shadow classification model and an attribute classifier are trained based on a labeled shadow map dataset, including: training a shadow classification model based on the shadow map dataset and / or an inference-end local map dataset to obtain node embeddings of the shadow model; updating the parameters of the shadow classification model based on minimizing a third loss function; classifying a preset test dataset based on the updated shadow classification model, and outputting a plurality of categories and probability values ​​corresponding to each of the categories; aggregating the probability values ​​corresponding to each of the categories into a feature vector, and generating a training dataset for an attribute classifier based on the feature vector; and training an attribute classifier based on the training dataset of the attribute classifier.

[0099] The above-mentioned third loss function is used to directly compare the node embedding obtained by the shadow classification model for the shadow map dataset and / or the local dataset on the inference end and the target node embedding obtained. As the loss function becomes smaller, the gap between the two becomes smaller, thereby achieving the purpose of optimizing the shadow classification model parameters.

[0100] In an exemplary embodiment, the third loss function may be:

[0101]

[0102] Among them, L D ' is the third loss function; Embedding gradients for shadow models, represents the output of the discriminator model, N represents the dimension of the embedding vector or gradient, and φ is the discriminator model parameter.

[0103] Further, the probability values ​​corresponding to each of the categories are aggregated into a feature vector, including: based on a preset activation function, the probability values ​​corresponding to each of the categories are converted into posterior output probabilities, and the sum of the posterior output probabilities corresponding to each category is 1; calculating the posterior output probability values ​​p1, p2, ..., p k Element-wise difference between them, and the difference results are Concatenate into feature vectors

[0104] For example, in a specific embodiment, the inference end expects to infer the number of nodes in a target user's local map data set. The shadow classification model output result vector shows that the probability that there are 100 nodes in the data set is 60%, the probability that there are 60 nodes in the data set is 50%, and the probability that there are 30 nodes in the data set is 90%. It can be understood that the sum of the probabilities of each item in the above output result has exceeded 100%, so it needs to be processed so that the probability values ​​corresponding to each of the categories are converted into posterior output probabilities. That is, the sum of the posterior output probabilities corresponding to each category is 1. Corresponding to the above specific embodiment, after conversion, it should be shown that there is a 30% probability that there are 100 nodes in the data set, a 25% probability that there are 60 nodes in the data set, and a 45% probability that there are 30 nodes in the data set.

[0105] It should be noted that the activation function refers to the function running on the neurons of the artificial neural network, which is responsible for mapping the input of the neurons to the output, and is intended to help the network learn complex operations in the data. If the activation function is not used, each layer of output is a linear function of the upper layer input, and no matter how many layers the neural network has, the output is a linear combination of the input. The use of the activation function can introduce nonlinear factors to the neurons, so that the neural network can arbitrarily approximate any nonlinear function, making the deep neural network expression ability more powerful, so that the neural network can be applied to numerous nonlinear models. In an embodiment of the present invention, the softmax function is preferably used as the activation function to convert the probability values ​​corresponding to each of the categories into posterior output probabilities.

[0106] It should also be noted that the k posterior output probabilities p1, p2, ..., p of each node v are k , calculate the element-wise difference p between all posterior probability values diff The formula is:

[0107]

[0108] Get the p of each node diff After that, the inference end will set all p diff Concatenate into feature vectors Each shadow classification model training dataset with its target attributes annotated in advance, including the number of nodes, number of edges, etc., and the concatenated feature vector Together they serve as the training data set for the attribute classifier P

[0109] In an exemplary embodiment, after the training data set of the attribute classifier is generated, the inference end trains the attribute classifier on the training data set. In the embodiment of the present invention, there is no restriction on the type of prediction layer model of the attribute classifier. Since the random forest model can provide a higher prediction accuracy when processing complex data and high-dimensional data, it is preferred that the random forest (RF) is used as the prediction layer model in this embodiment.

[0110] An attribute classifier usually consists of a feature extractor E and multiple parallel prediction layers M. P Composition, each M P Responsible for predicting an attribute, the goal is to optimize the parameter λ of the attribute classifier by minimizing the cross entropy loss function so that it can infer the attribute of interest to the inference end in the graph data. The optimization problem can be expressed as:

[0111]

[0112] Where F is the set of attributes that the attacker is interested in, such as the number of nodes, the number of edges, the node density, etc., f is the attribute in F, and for each attribute f∈F there is a corresponding prediction layer M P ,and Then it represents the cross entropy loss, and the feature extractor E is responsible for extracting the embedded features in the training dataset of the input attribute classifier. Here all attribute pairs E share the same parameters, and M P Using different parameters, it can handle the uniqueness of each attribute and ensure that each attribute is optimized in a targeted manner. Through this supervised learning method, the attribute classifier can learn the feature vector The relationship between the target user and the attribute labels is used to identify the specific attributes in the local graph of the target user during the inference phase.

[0113] S204: Taking the local node embedding of the target user as input, based on the shadow classification model, obtain the feature vector corresponding to the local node embedding of the target user; taking the feature vector and the target inference attribute as input, obtain the probability distribution of the target user's local map data about the predicted attribute based on the updated attribute classifier.

[0114] Based on the previous steps of this solution, the inference end has trained the attribute classifier using the embedding and attribute labels. In the inference phase, the inference end uses the local embedding of the target user as input to the attribute classifier. The input features can be the statistical features of the target node embedding (such as mean, variance, etc.) or the structural features of the relationship between nodes.

[0115] In addition, since the inference end has learned the behavior of the target user's local model through the shadow classification model and other means during the training phase, the inference end can use the forward propagation of the shadow classification model and the corresponding activation function layer to obtain the posterior output of the target user's local embedding, and use the same aggregation method as the attribute classifier training phase to calculate the aggregated posterior probability of the target user. Target user local embed H C The statistical characteristics (variance, mean, etc.), structural characteristics and optimized classifier parameters λ are input into the trained attribute classifier P, M P The attacker can then obtain the target graph G by reasoning based on the input features. C Probability distribution of the predicted attributes:

[0116]

[0117] In order to further illustrate the attribute reasoning method provided by the present invention and its reasoning effect in the federated graph neural network, a set of experimental data is provided again for verification.

[0118] The following experiments are performed on a Xeon(R)W-2133CPU device equipped with 256GB RAM and NVIDIAGeForce RTX 2080Ti processor. All algorithms are implemented based on the PyTorch framework. The number of iterations of federated training is set to 50, and the learning rate of the generator model and the GNN model is set to 0.01. This paper sets up 5 clients to participate in FedGNNs training, one of which is an inference client, or a client directly controlled by the inference client.

[0119] This paper selects three public datasets with different complexities in terms of the number of classes, edges, and nodes to verify the performance of the method, including Cora, Citeseer, and Pubmed. They are widely used in the literature for graph learning. The entire graph dataset is evenly distributed to 5 clients, each client has a part of the entire graph dataset as a local dataset to generate training and test data for PIAFGNN, and the client's local graph data is divided into 80% training dataset and 20% test dataset. In the same experiment, this paper considers two different privacy graph attributes as the attacker's target, namely the number of nodes and the number of edges, which are irrelevant to the main classification task of the model.

[0120] In order to fairly compare the inference accuracy under different settings, the experiments ensure that the training data of all inference ends are the same. This paper uses Random Forest (RF) as the training algorithm for the attribute classifier and uses MaxPool as the embedding aggregation method for GNN in the pooling layer. At the same time, as a reference, this paper selects the attribute reasoning attack method for centralized GNNs and the random guessing method for binary classification tasks as baselines.

[0121] Table 1 Reasoning accuracy of different local models and different data sets in this invention

[0122]

[0123] As can be seen from the above table, the present invention has achieved excellent reasoning performance under different settings, and even achieved reasoning accuracy close to that of centralized methods on FedGNNs based on GCN, with a correct prediction rate of 79.40% in inferring the number of attributes of target graph nodes. In addition, even on a complex GNN model such as GraphSage, the attack accuracy of PIAFGNN can reach more than 65% on graph datasets with complex structures and loose connections such as Pubemd and CiteSeer, which is much higher than the attack accuracy of the random guessing baseline. This shows that the present invention can implement high-precision attribute reasoning on different local model structures and different datasets.

[0124] Please refer to Figure 5 The figure is a flow chart of a security detection method of a federated graph neural network in one embodiment of the present invention. The attribute reasoning method of the federated graph neural network specifically includes the following steps:

[0125] S501: Based on the attribute reasoning method of the federated graph neural network, perform attribute reasoning on the target user in the federated graph neural network; S502: Obtain attribute information of the local map data of the target user; S503: If the accuracy of the attribute reasoning of the federated graph neural network is greater than the preset safety threshold, the target user is in a risky state; S504: If the accuracy of the attribute reasoning of the federated graph neural network is less than or equal to the preset safety threshold, the target user is in a safe state.

[0126] Please refer to Figure 3 As shown, based on the same inventive concept as the aforementioned attribute reasoning method of the federated graph neural network, an embodiment of the present invention provides an attribute reasoning system 300 of a federated graph neural network, which includes: a generation module 301, an update module 302, a training module 303 and a reasoning module 304.

[0127] Specifically, the generation module 301 is used to generate a local node embedding at the inference end based on the initial model, and obtain the inference end local embedding gradient corresponding to the local node embedding based on forward propagation; the update module 302 is used to generate a target user embedding gradient based on the inference end local embedding gradient, recursively update the target user embedding gradient, and obtain the target user's local node embedding based on the updated target user embedding gradient; the training module 303 is used to obtain a shadow map dataset based on the target user's local node embedding, and mark the shadow map dataset with a preset target inference attribute, and train a shadow classification model and an attribute classifier based on the marked shadow map dataset; the inference module 304 is used to take the target user's local node embedding as input, and obtain the feature vector corresponding to the target user's local node embedding based on the shadow classification model; and take the feature vector and the target inference attribute as input, and obtain the probability distribution of the target user's local map data about the predicted attribute based on the updated attribute classifier.

[0128] Please refer to Figure 6 As shown, based on the same inventive concept as the attribute reasoning method of the aforementioned federated graph neural network, an embodiment of the present invention provides a security detection system 600 of a federated graph neural network, which includes: an application module 601, an acquisition module 602, a first judgment module 603 and a second judgment module 604.

[0129] Specifically, the application module 601 is used to perform attribute reasoning on the target user in the federated graph neural network based on the attribute reasoning method of the federated graph neural network; the acquisition module 602 is used to obtain the attribute information of the local map data of the target user; the first judgment module 603 is used to judge that the target user is in a risky state when the accuracy of the attribute reasoning of the federated graph neural network is greater than a preset safety threshold; the second judgment module 604 is used to judge that the target user is in a safe state when the accuracy of the attribute reasoning of the federated graph neural network is less than or equal to the preset safety threshold.

[0130] Please refer to Figure 4 As shown, an embodiment of the present invention further provides an electronic device 400, which includes at least one processor 401, a memory 402 (e.g., a non-volatile memory), a memory 403, and a communication interface 404, and the at least one processor 401, the memory 402, the memory 403, and the communication interface 404 are connected together via a bus 405. At least one processor 401 is used to call at least one program instruction stored or encoded in the memory 402, so that at least one processor 401 performs various operations and functions of the attribute reasoning method of the federated graph neural network described in various embodiments of this specification.

[0131] In an embodiment of the present specification, the electronic device 400 may include, but is not limited to, a personal computer, a server computer, a workstation, a desktop computer, a laptop computer, a notebook computer, a mobile electronic device, a smart phone, a tablet computer, a cellular phone, a personal digital assistant (PDA), a handheld device, a messaging device, a wearable electronic device, a consumer electronic device, and the like.

[0132] An embodiment of the present invention also provides a computer-readable medium, which carries computer execution instructions. When the computer execution instructions are executed by a processor, they can be used to implement various operations and functions of the attribute reasoning method of the federated graph neural network described in the various embodiments of this specification.

[0133] The computer-readable medium in the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device.

[0134] In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, device, or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0135] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0136] The present invention is described with reference to flowcharts and / or block diagrams of methods, apparatuses, systems, and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as a combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the process in the flowchart. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0137] The foregoing description of specific exemplary embodiments of the present invention is for the purpose of illustration and demonstration. These descriptions are not intended to limit the present invention to the precise form disclosed, and it is clear that many changes and variations can be made based on the above teachings. The purpose of selecting and describing the exemplary embodiments is to explain the specific principles of the present invention and its practical application, so that those skilled in the art can realize and utilize various different exemplary embodiments of the present invention and various different selections and changes. The scope of the present invention is intended to be limited by the claims and their equivalents.

Claims

1. A method for attribute reasoning of a federated graph neural network, characterized in that: include: Based on the initial model, generate a local node embedding at the inference end, and obtain the inference end local embedding gradient corresponding to the local node embedding based on forward propagation; Based on the local embedding gradient of the inference end, generate a target user embedding gradient, recursively update the target user embedding gradient, and obtain the local node embedding of the target user based on the updated target user embedding gradient; Acquire a shadow map dataset based on the local node embedding of the target user, label the shadow map dataset with a preset target inference attribute, and train a shadow classification model and an attribute classifier based on the labeled shadow map dataset; Taking the local node embedding of the target user as input, based on the shadow classification model, obtain the feature vector corresponding to the local node embedding of the target user; taking the feature vector and the target inference attribute as input, obtain the probability distribution of the target user's local map data about the predicted attribute based on the updated attribute classifier.

2. The attribute reasoning method of the federated graph neural network according to claim 1 is characterized in that: The generating a target user embedding gradient based on the local embedding gradient includes: Generate a random noise vector with the same number of rows or columns as the local embedded gradient and obtain a noise gradient vector corresponding to the random noise vector; The local embedding gradient and the noise gradient vector are concatenated row by row or column by column to generate the target user embedding gradient.

3. The attribute reasoning method of the federated graph neural network according to claim 2 is characterized in that: The recursive updating of the target user embedding gradient includes: Obtaining an aggregated global model and a global embedding gradient corresponding to the global model; Embed the target user into a discriminator preset by gradient input, and update the parameters of the discriminator based on minimizing a first loss function; Based on minimizing the second loss function, updating the parameters of the generator for generating local node embeddings and random noise vectors; Based on the updated generator, the target user embedding gradient is generated.

4. The attribute reasoning method of the federated graph neural network according to claim 3 is characterized in that: The local node embedding formula for obtaining the target user based on the updated target user embedding gradient is: Among them, W (l) is the local model gradient weight of the target user, H C Embed the local node of the target user.

5. The attribute reasoning method of the federated graph neural network according to claim 3 is characterized in that: The shadow classification model and the attribute classifier are trained based on the labeled shadow map dataset, including: Training a shadow classification model based on the shadow map dataset and / or the inference-end local map dataset, and obtaining node embedding of the shadow classification model; Based on minimizing a third loss function, updating parameters of the shadow classification model; Based on the updated shadow classification model, a preset test data set is classified, and a plurality of categories and probability values ​​corresponding to each category are output; Aggregating the probability values ​​corresponding to each of the categories into a feature vector, and generating a training data set for an attribute classifier based on the feature vector; The attribute classifier is trained based on the training data set of the attribute classifier.

6. The attribute reasoning method of the federated graph neural network according to claim 5 is characterized in that: The aggregating the probability values ​​corresponding to the categories into a feature vector includes: Based on a preset activation function, the probability values ​​corresponding to the categories are converted into posterior output probabilities, and the sum of the posterior output probabilities corresponding to the categories is 1; Calculate the posterior output probability values ​​p1, p2, ..., p k Element-wise difference between them, and the difference results are Concatenate into feature vectors 7. The attribute reasoning method of the federated graph neural network according to claim 5 is characterized in that: The first loss function, the second loss function, and the third loss function are respectively: Where N represents the dimension of the embedding vector or gradient, φ is the discriminator model parameter, represents the output of the discriminator model, is the global embedding gradient, K is the number of clients participating in the federated training, is the local embedding gradient on the inference side, z fake is a random noise vector, θ is the generator model parameter, is the local embedding gradient on the non-inference side, Embed gradient for target users; L D is the first loss function, L GRN is the second loss function, L D ' is the third loss function; Embed gradients for shading models.

8. A federated graph neural network attribute reasoning system, characterized in that: include: A generation module, configured to generate a local node embedding at the inference end based on the initial model, and obtain a local embedding gradient at the inference end corresponding to the local node embedding based on forward propagation; An updating module, configured to generate a target user embedding gradient based on the local embedding gradient of the inference end, recursively update the target user embedding gradient, and obtain a local node embedding of the target user based on the updated target user embedding gradient; A training module, used for acquiring a shadow map dataset based on the local node embedding of the target user, marking the shadow map dataset with a preset target inference attribute, and training a shadow classification model and an attribute classifier based on the marked shadow map dataset; An inference module is used to obtain a feature vector corresponding to the local node embedding of the target user based on the shadow classification model, taking the local node embedding of the target user as input; and obtaining the probability distribution of the target user's local map data about the predicted attribute based on the updated attribute classifier, taking the feature vector and the target inference attribute as input.

9. A security detection method for a federated graph neural network, using the attribute reasoning method of a federated graph neural network as described in any one of claims 1 to 7, characterized in that: include: Based on the attribute reasoning method of the federated graph neural network, attribute reasoning is performed on the target user in the federated graph neural network; Acquire attribute information of the target user's local map data; If the accuracy of attribute reasoning of the Bangtu neural network is greater than a preset safety threshold, the target user is in a risky state; If the accuracy of the attribute reasoning of the Bangtu neural network is less than or equal to a preset safety threshold, the target user is in a safe state.

10. A security detection system for a federated graph neural network, characterized in that: include: An application module, used to perform attribute reasoning on a target user in a federated graph neural network based on the attribute reasoning method of the federated graph neural network; An acquisition module, used to acquire attribute information of the target user's local map data; A first judgment module is used to judge that the target user is in a risky state when the accuracy of the attribute reasoning of the Bangtu neural network is greater than a preset safety threshold; The second judgment module is used to judge that the target user is in a safe state when the accuracy of the attribute reasoning of the Bangtu neural network is less than or equal to a preset safety threshold.

Images